Analysis
-
max time kernel
4294211s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
17-03-2022 01:47
Static task
static1
Behavioral task
behavioral1
Sample
6ff88bf2296b946843af01f573fcef8ddcb4f2784a331cd97badf518e8f9e680.ps1
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
6ff88bf2296b946843af01f573fcef8ddcb4f2784a331cd97badf518e8f9e680.ps1
Resource
win10v2004-en-20220113
General
-
Target
6ff88bf2296b946843af01f573fcef8ddcb4f2784a331cd97badf518e8f9e680.ps1
-
Size
4KB
-
MD5
2c0275283e4fbadda153bfc1749c3ef3
-
SHA1
bde10a92bff89b8ea0c3c72a81241774cbbe1541
-
SHA256
6ff88bf2296b946843af01f573fcef8ddcb4f2784a331cd97badf518e8f9e680
-
SHA512
ed4e27a46e6c54f214374e791bf346449280258462dc6fc3bfe22bf077bc22c71058721be5b75e27baaca156c341517dbc9d72e299245fdaf6cc119f3f652677
Malware Config
Extracted
vjw0rm
http://help-microsoft.dnslive.net:1166
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 4 1888 powershell.exe 5 1888 powershell.exe 6 1888 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
SecurityHealth.exeSecurityHealth.exepid process 1344 SecurityHealth.exe 1076 SecurityHealth.exe -
Loads dropped DLL 1 IoCs
Processes:
powershell.exepid process 1912 powershell.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
SecurityHealth.exeSecurityHealth.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run SecurityHealth.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\2DFKGSARR8 = "\"C:\\ProgramData\\Twitter\\log\\system\\SecurityHealth.exe\"" SecurityHealth.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run SecurityHealth.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\2DFKGSARR8 = "\"C:\\ProgramData\\Twitter\\log\\system\\SecurityHealth.exe\"" SecurityHealth.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1356 schtasks.exe 1104 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 1888 powershell.exe 1664 powershell.exe 1912 powershell.exe 1912 powershell.exe 1912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1888 powershell.exe Token: SeDebugPrivilege 1664 powershell.exe Token: SeDebugPrivilege 1912 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
powershell.exepowershell.exeSecurityHealth.exetaskeng.exeSecurityHealth.exedescription pid process target process PID 1888 wrote to memory of 1664 1888 powershell.exe powershell.exe PID 1888 wrote to memory of 1664 1888 powershell.exe powershell.exe PID 1888 wrote to memory of 1664 1888 powershell.exe powershell.exe PID 1888 wrote to memory of 1912 1888 powershell.exe powershell.exe PID 1888 wrote to memory of 1912 1888 powershell.exe powershell.exe PID 1888 wrote to memory of 1912 1888 powershell.exe powershell.exe PID 1912 wrote to memory of 1344 1912 powershell.exe SecurityHealth.exe PID 1912 wrote to memory of 1344 1912 powershell.exe SecurityHealth.exe PID 1912 wrote to memory of 1344 1912 powershell.exe SecurityHealth.exe PID 1912 wrote to memory of 1344 1912 powershell.exe SecurityHealth.exe PID 1344 wrote to memory of 1356 1344 SecurityHealth.exe schtasks.exe PID 1344 wrote to memory of 1356 1344 SecurityHealth.exe schtasks.exe PID 1344 wrote to memory of 1356 1344 SecurityHealth.exe schtasks.exe PID 1636 wrote to memory of 1076 1636 taskeng.exe SecurityHealth.exe PID 1636 wrote to memory of 1076 1636 taskeng.exe SecurityHealth.exe PID 1636 wrote to memory of 1076 1636 taskeng.exe SecurityHealth.exe PID 1636 wrote to memory of 1076 1636 taskeng.exe SecurityHealth.exe PID 1076 wrote to memory of 1104 1076 SecurityHealth.exe schtasks.exe PID 1076 wrote to memory of 1104 1076 SecurityHealth.exe schtasks.exe PID 1076 wrote to memory of 1104 1076 SecurityHealth.exe schtasks.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6ff88bf2296b946843af01f573fcef8ddcb4f2784a331cd97badf518e8f9e680.ps11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -WindowStyle hidden -ExecutionPolicy Unrestricted C:\Users\Public\Untitled.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -WindowStyle hidden -ExecutionPolicy Unrestricted C:\Users\Public\like.ps12⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Twitter\log\system\SecurityHealth.exe"C:\ProgramData\Twitter\log\system\SecurityHealth.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\ProgramData\Twitter\log\system\SecurityHealth.exe4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {0BEDED0F-3372-463F-82D3-0A40EA9E42FC} S-1-5-21-2199625441-3471261906-229485034-1000:DRLQIXCW\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Twitter\log\system\SecurityHealth.exeC:\ProgramData\Twitter\log\system\SecurityHealth.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\ProgramData\Twitter\log\system\SecurityHealth.exe3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Twitter\log\system\SecurityHealth.exeMD5
e8e4ea0f80c9ff49df07e9c1b119ba2a
SHA1612deab27c7c0fd1bf21a2afe807da2fdf4c42e0
SHA256062e98994d7579f0ec3c0f2932ee604c16fc98be0c771cb1498409e595ff1904
SHA512bf7cc10726af050986b7b8dca68c99228c75acf68798af958cb48bdb9d77af8d424330cbfbae72f385cf4ae1f4f54035f820d23934034b88af915f6f7683b23e
-
C:\ProgramData\Twitter\log\system\SecurityHealth.exeMD5
e8e4ea0f80c9ff49df07e9c1b119ba2a
SHA1612deab27c7c0fd1bf21a2afe807da2fdf4c42e0
SHA256062e98994d7579f0ec3c0f2932ee604c16fc98be0c771cb1498409e595ff1904
SHA512bf7cc10726af050986b7b8dca68c99228c75acf68798af958cb48bdb9d77af8d424330cbfbae72f385cf4ae1f4f54035f820d23934034b88af915f6f7683b23e
-
C:\ProgramData\Twitter\log\system\SecurityHealth.exeMD5
e8e4ea0f80c9ff49df07e9c1b119ba2a
SHA1612deab27c7c0fd1bf21a2afe807da2fdf4c42e0
SHA256062e98994d7579f0ec3c0f2932ee604c16fc98be0c771cb1498409e595ff1904
SHA512bf7cc10726af050986b7b8dca68c99228c75acf68798af958cb48bdb9d77af8d424330cbfbae72f385cf4ae1f4f54035f820d23934034b88af915f6f7683b23e
-
C:\ProgramData\Twitter\log\system\SecurityHealth.exe.manifestMD5
4fe2c92cbf50391693d4dac365d46553
SHA1029fd15fea25c2419e4ec1f7f1015ea87faaa92e
SHA256f56223f8841a2e832dae953f3801f5462070ed0c0f0526407ce77325c90e2c26
SHA512041426e3aeab004dd57e8cb9758ce249714fd5a1e45a5db374d76796a4b29c09faf0224921b7742634cb872be96b61b693041cbb17643cb4f64f0edb35514466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
65de4ef765e941c3a2cd0db4105dd614
SHA12e7efe7ca88f4a94d0f977e85e301b98e999e615
SHA2561e40ba273ba851ee694eeed3b0cf4c1eccd77e3b72feadd1a0c732108f08bc1d
SHA5127819313df8a687de5c53982294dbb4637016ca35b4c95303a22b3e2d176195195f60cb434d99edb47f760a2ffcc0e83e539351c6247b1b8385b23917d6b28298
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
05b2f4a71009d9e2b18130b09c3e274f
SHA1f11d148fc96edcbaae12b40a6a4daf4c8666ef8a
SHA256baae95f3f3c0deebc7174b8909b9cbcd790cebb2720390111f4e53aa952624f0
SHA51215431e7ab74718644bb090a3c2aa837e2c01b2d22bd218cb8a1e6bf9391d6181d879836588f5047c94f58d7cb2dfc36e7639770be3da65c95199753e7aa9ab00
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
1f21021395075552a216c2e645072bbc
SHA15a56a4d37d33fad81f243995c31447e4c4a5cfbe
SHA256908d57636237dd1cb16686961b4e9f50b24df9cc3897ad1786c56225f56b4adc
SHA512ba7ec96d39b5be07bbd805c303d699f84accf2128a1d301d2782400415f21d74b5c37c850f0927fcebdb1c43d9420d38a0f856c77eaebd71749d76db92fdcd53
-
C:\Users\Public\like.ps1MD5
041841f16c9cf05496948b5564ae662c
SHA154a21f53c32cb71104ed9b4333e0183de0ec16d5
SHA2562af975634c3b24ee2c60d3821f309369c1036599c26777aa20e722058d7cd36b
SHA512108c58bf4740766f304c197a214a793a06769c27a5390df81cdbf4fbdef94d4104c2cf832f00f9f07989c0a8a58fd46f4f85cac2172ff665ea2b0b9b5a75be25
-
\ProgramData\Twitter\log\system\SecurityHealth.exeMD5
e8e4ea0f80c9ff49df07e9c1b119ba2a
SHA1612deab27c7c0fd1bf21a2afe807da2fdf4c42e0
SHA256062e98994d7579f0ec3c0f2932ee604c16fc98be0c771cb1498409e595ff1904
SHA512bf7cc10726af050986b7b8dca68c99228c75acf68798af958cb48bdb9d77af8d424330cbfbae72f385cf4ae1f4f54035f820d23934034b88af915f6f7683b23e
-
memory/1076-89-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1344-81-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1664-68-0x00000000027A2000-0x00000000027A4000-memory.dmpFilesize
8KB
-
memory/1664-66-0x00000000027A0000-0x00000000027A2000-memory.dmpFilesize
8KB
-
memory/1664-64-0x000007FEF29B0000-0x000007FEF350D000-memory.dmpFilesize
11.4MB
-
memory/1664-69-0x00000000027A4000-0x00000000027A7000-memory.dmpFilesize
12KB
-
memory/1664-70-0x00000000027AB000-0x00000000027CA000-memory.dmpFilesize
124KB
-
memory/1664-65-0x000007FEF4E20000-0x000007FEF57BD000-memory.dmpFilesize
9.6MB
-
memory/1664-67-0x000007FEF4E20000-0x000007FEF57BD000-memory.dmpFilesize
9.6MB
-
memory/1888-54-0x000007FEFB561000-0x000007FEFB563000-memory.dmpFilesize
8KB
-
memory/1888-60-0x00000000026B2000-0x00000000026B4000-memory.dmpFilesize
8KB
-
memory/1888-59-0x000007FEF4E20000-0x000007FEF57BD000-memory.dmpFilesize
9.6MB
-
memory/1888-56-0x000007FEF4E20000-0x000007FEF57BD000-memory.dmpFilesize
9.6MB
-
memory/1888-58-0x00000000026B0000-0x00000000026B2000-memory.dmpFilesize
8KB
-
memory/1888-55-0x000007FEF29B0000-0x000007FEF350D000-memory.dmpFilesize
11.4MB
-
memory/1888-61-0x00000000026B4000-0x00000000026B7000-memory.dmpFilesize
12KB
-
memory/1888-57-0x00000000026BB000-0x00000000026DA000-memory.dmpFilesize
124KB
-
memory/1912-73-0x000007FEF29B0000-0x000007FEF350D000-memory.dmpFilesize
11.4MB
-
memory/1912-85-0x000007FEF4E20000-0x000007FEF57BD000-memory.dmpFilesize
9.6MB
-
memory/1912-84-0x00000000027CB000-0x00000000027EA000-memory.dmpFilesize
124KB
-
memory/1912-83-0x00000000027C4000-0x00000000027C7000-memory.dmpFilesize
12KB
-
memory/1912-78-0x000007FEF4E20000-0x000007FEF57BD000-memory.dmpFilesize
9.6MB
-
memory/1912-82-0x00000000027C0000-0x00000000027C2000-memory.dmpFilesize
8KB
-
memory/1912-74-0x000000001B740000-0x000000001BA3F000-memory.dmpFilesize
3.0MB