5a9b347e38b129cdc4fb31e15c01381c60bc4d9c29f3129a78a6f03648e2273c

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
11-03-2022 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

infected.vbs
Size

110KB
MD5

8dc859faaae724496048e07a5110180b
SHA1

58b589269f78f36bd25eae913984c2e904d9e359
SHA256

5a9b347e38b129cdc4fb31e15c01381c60bc4d9c29f3129a78a6f03648e2273c
SHA512

c612ad3d9b4f8917e4406fa2edf7e5a24e66da3e09c960f823fcb2fa48a87634442be78f67211af80c7cb703015d6a5db12a8b0b8480c2d2b003b921f721b800

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

4228 svchost.exe

pid	process
4228	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\svchost.exe	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

448 4228 WerFault.exe svchost.exe

pid	pid_target	process	target process
448	4228	WerFault.exe	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 4268 wrote to memory of 4228	4268	WScript.exe	svchost.exe
PID 4268 wrote to memory of 4228	4268	WScript.exe	svchost.exe
PID 4268 wrote to memory of 4228	4268	WScript.exe	svchost.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\infected.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4268

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Executes dropped EXE
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 228
3⤵
- Program crash
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4228 -ip 4228
1⤵
PID:2384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit