81c4dfd64db4238dab1ca85953cdcdcb83400aa94bf333ee6bec6f2c44fea034

Resubmissions

09-12-2022 21:30

01-12-2022 01:33

max time kernel
206s
max time network
106s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 01:33

Target

BF.vbs
Size

178B
MD5

e97169d9a3f1ee48f357f745e4160aea
SHA1

4806088e1b797895329851b0a6fe0928e74f8d9c
SHA256

d838a0f1bedce3f68099bcf37f3ae293c1ef441aa46173e67d5108b1ba41fd41
SHA512

634f98139e2b6082aad5898324e167fbe161b75a2c8ae145d8bd335706ea9d81449441a556b8fe2853079b590f0abcf0d0a0f04c9b69a7469e2dbdac0cc99322

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1496 powershell.exe
1496 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1496 powershell.exe

pid	process
1496	powershell.exe
1496	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1496	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1892 wrote to memory of 1496	1892	WScript.exe	powershell.exe
PID 1892 wrote to memory of 1496	1892	WScript.exe	powershell.exe
PID 1892 wrote to memory of 1496	1892	WScript.exe	powershell.exe
PID 1892 wrote to memory of 1496	1892	WScript.exe	powershell.exe
PID 1496 wrote to memory of 396	1496	powershell.exe	rundll32.exe
PID 1496 wrote to memory of 396	1496	powershell.exe	rundll32.exe
PID 1496 wrote to memory of 396	1496	powershell.exe	rundll32.exe
PID 1496 wrote to memory of 396	1496	powershell.exe	rundll32.exe
PID 1496 wrote to memory of 396	1496	powershell.exe	rundll32.exe
PID 1496 wrote to memory of 396	1496	powershell.exe	rundll32.exe
PID 1496 wrote to memory of 396	1496	powershell.exe	rundll32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BF.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\dispensedMutual.txt DrawThemeIcon
3⤵
PID:396

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/396-59-0x0000000000000000-mapping.dmp

Download
memory/1496-55-0x0000000000000000-mapping.dmp

Download
memory/1496-56-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1496-57-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Filesize
5.7MB

Download
memory/1496-58-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Filesize
5.7MB

Download
memory/1496-61-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Filesize
5.7MB

Download
memory/1892-54-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download