Overview

overview

8

Static

static

df6093cc83...ec.vbs

windows7-x64

8

df6093cc83...ec.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    142s
  • max time network
    170s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2022, 17:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    df6093cc8395612fbbd4363266ff5c78ce332367b4230866380f722296a9cdec.vbs

  • Size

    4KB

  • MD5

    21dea128e711313098d82c5c5be4f0e0

  • SHA1

    396275c129f66afa3f17a7b71a4ef6c20e9b2d7a

  • SHA256

    df6093cc8395612fbbd4363266ff5c78ce332367b4230866380f722296a9cdec

  • SHA512

    51773370565ca927e0416287bbac87774aa93781c2c0556b3b7ef128fa09365d6d62a24c2da276c1693ce0ab0679850a9b46488b23fea24a29532d45b34a7bfe

  • SSDEEP

    96:ffJwI7iv7wAbiPtb5UQG4OmDp/otZRvxDEAfExD9TQuDGm59QyPv+J/PEmZeAeiB:fBx7ivcAbAwJcV/otZMAcxDXDjT/P2Jr

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 62 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df6093cc8395612fbbd4363266ff5c78ce332367b4230866380f722296a9cdec.vbs"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stoP SHAredAccESS
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stoP SHAredAccESS
        3⤵
          PID:1468
      • C:\Windows\regedit.exe
        "C:\Windows\regedit.exe" /S sYSINFO.Reg
        2⤵
        • Runs .reg file with regedit
        PID:564
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" .\
        2⤵
          PID:524
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C dAtE 7/14/2009
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1452
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c dAte 11/21/2022
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1724
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Windows\System32\PRNcfg.VBs"
          2⤵
          • Blocklisted process makes network request
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:980
          • C:\Windows\System32\net.exe
            "C:\Windows\System32\net.exe" STOp SHArEdAcCEsS
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:648
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 STOp SHArEdAcCEsS
              4⤵
                PID:1680
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s sySinFo.REG
              3⤵
              • Runs .reg file with regedit
              PID:1800
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c daTe 11/11/2022
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1700
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c DAte 11/21/2022
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:780
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:1296

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Windows\System32\PRNcfg.VBs
                Filesize

                4KB

                MD5

                fb7624667540dfa7277a4aba6df8e121

                SHA1

                b128c529d35fa22181f60998f299391969db40fa

                SHA256

                57fe15a48c10354f2aba5f30ace709ba25a9ea39496d865af97328d69123dee4

                SHA512

                d89cf11a31423e067b8b71cf66145b4ff14454cb5c5d7a5d1713f6d555cc903248f7a38b49fe8245edafb484ab2bbbca087e4f0da800f4607340b43a690fe99b

                Download Submit

              • C:\Windows\system32\sYSINFO.Reg
                Filesize

                497B

                MD5

                1fca1f6483e39feb3f2769ec9680b151

                SHA1

                1294b13e913928624aa8b341fae933eb73a771b8

                SHA256

                6fac50eeb6342a2071d3fd8cca4b44a1db170063d157e7e54e8c995e70a7a31f

                SHA512

                4eb0ff47b918dac8af538f5beca9e4f574f10685f96d41a0a5ac4c818ec5bbd5168139e140f8a50e3bd82ea5ca5410863d0d06ea4d4ce44e6e8c71e34114d817

                Download Submit

              • C:\Windows\system32\sySinFo.REG
                Filesize

                497B

                MD5

                66b824b2500c1c09c29565874cf06f74

                SHA1

                c33fb5fb0c6c6e199f0cd60b3650e72f9e79318b

                SHA256

                96a4e5301dee4708d27440a01ff2efd37a4198df5d6fd4e20fe04be34cc67096

                SHA512

                83d75f751099a51fddd1f65a57264b6731b6487135658f777edbb142237b1d4c39a55e00081ddc474ceb076195fcc45f95beb09aeab318cafef8d6d8c6f7e585

                Download Submit

              • memory/1296-63-0x00000000039C0000-0x00000000039D0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1984-54-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

                Filesize

                8KB

                Download