Overview
overview
10Static
static
1078769e4085...7e.zip
windows7_x64
178769e4085...7e.zip
windows10-2004_x64
malware-an...er.pdf
windows7_x64
1malware-an...er.pdf
windows10-2004_x64
1malware-an...is.pdf
windows7_x64
1malware-an...is.pdf
windows10-2004_x64
1malware-an...ypt.py
linux_amd64
malware-an...ypt.py
linux_armhf
malware-an...ypt.py
linux_mips
malware-an...ypt.py
linux_mipsel
malware-an...ons.py
windows7_x64
3malware-an...ons.py
windows10-2004_x64
3malware-an...is.pdf
windows7_x64
1malware-an...is.pdf
windows10-2004_x64
malware-an...tt.ps1
windows7_x64
10malware-an...tt.ps1
windows10-2004_x64
8malware-an...tt.vbs
windows7_x64
malware-an...tt.vbs
windows10-2004_x64
7malware-an...er.ps1
windows7_x64
1malware-an...er.ps1
windows10-2004_x64
malware-an...od.ps1
windows7_x64
malware-an...od.ps1
windows10-2004_x64
10malware-an...44.exe
windows7_x64
10malware-an...44.exe
windows10-2004_x64
malware-an...55.dll
windows7_x64
1malware-an...55.dll
windows10-2004_x64
malware-an...xes.py
linux_amd64
malware-an...xes.py
linux_armhf
malware-an...xes.py
linux_mips
malware-an...xes.py
linux_mipsel
malware-an...dra.py
windows7_x64
malware-an...dra.py
windows10-2004_x64
3Analysis
-
max time kernel
142s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:11
Static task
static1
Behavioral task
behavioral1
Sample
78769e4085312f21cc67e77bfdd136f9a30d34e2d2a5d8870f2ebbeb7c3a8f7e.zip
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
78769e4085312f21cc67e77bfdd136f9a30d34e2d2a5d8870f2ebbeb7c3a8f7e.zip
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
malware-analysis-writeups-master/agent-tesla-loader/agentTeslaLoader.pdf
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
malware-analysis-writeups-master/agent-tesla-loader/agentTeslaLoader.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
malware-analysis-writeups-master/ava-maria-rat/AvaMariaAnalysis.pdf
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
malware-analysis-writeups-master/ava-maria-rat/AvaMariaAnalysis.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral8
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral9
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral10
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral11
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerCatchBeacons.py
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerCatchBeacons.py
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
malware-analysis-writeups-master/bashar-bachir-chain/bashar-bachir-analysis.pdf
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
malware-analysis-writeups-master/bashar-bachir-chain/bashar-bachir-analysis.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.ps1
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.vbs
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.vbs
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/downloader.ps1
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/downloader.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod.ps1
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli444.exe
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli444.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli555.dll
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli555.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral27
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral28
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral29
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral30
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral31
Sample
malware-analysis-writeups-master/razy-variant/razyVariantDecryptStackStrings_ghidra.py
Resource
win7-20220414-en
Behavioral task
behavioral32
Sample
malware-analysis-writeups-master/razy-variant/razyVariantDecryptStackStrings_ghidra.py
Resource
win10v2004-20220414-en
General
-
Target
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.vbs
-
Size
190B
-
MD5
4d89cc370d80dcd3917b871eccdde4fb
-
SHA1
797297f55fea4f9929aa15ac4ae66b6686a1f4f1
-
SHA256
7b8c218ab9bbae5df94689e4abc735067b4a3034f854809c8e0b62f751bd0759
-
SHA512
2283448d134b6fdae12b05be13e69c303544830343fa5640f6cbe03d75734aa96d9a2338877121a7605d4d6525523990c41104ee1a21e085703c694911579cf5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 716 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 716 powershell.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WScript.exedescription pid process target process PID 3268 wrote to memory of 716 3268 WScript.exe powershell.exe PID 3268 wrote to memory of 716 3268 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\malware-analysis-writeups-master\bashar-bachir-chain\files\avastt.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windo 1 -noexit -exec bypass -file "C:\Users\Public\Nod.ps1"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken