1494601d2a69cddc7c76336c026080a422892711438a532447b7e22eaa30cde4

Analysis

max time kernel
104s
max time network
187s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1494601d2a69cddc7c76336c026080a422892711438a532447b7e22eaa30cde4.vbs
Size

534B
MD5

76da5805a167c985041e3e4153f88939
SHA1

8c8e6732979e8da3bede00917d7c2022f0160ce4
SHA256

1494601d2a69cddc7c76336c026080a422892711438a532447b7e22eaa30cde4
SHA512

3a4b94c5d3f14fecbe360a5b9506bc25110ada3049834ab7dcb0c1fef83731d61e5d05e763623caa56319b053f79114a306fbba575ab106fc13bb939d42de7a1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.97dn.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\97dn.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376864207"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000079a4c6c203f0923d8a818478c8835285fbd60520a8ab2a049939b80fb324176d000000000e8000000002000020000000154ea0b91de024ae79bd9b77067783d4186bdaa75ade7cabfdd3eef763e67a129000000090a8f0cfd64d66dd85ab4cb891b7c6af6a05497344b6119a404d58a2d8ea829b17b827e3c85655d3e94441cfc7ece40eeda1f46c03eb40ac2c0fa49342126e4b6b4df744342395ea3a9e9fcf53218bbc5cf422786268577ffa4f01495c28369dccac985823564c38b7e0638b0ba989f9c5a9e2a2d056ce9a607233915991c68e6969afaf85b523954f38349abfdba43740000000ea63ca7cd1d70ab6fd2652f568965f9fb677e5bb421abe6018059326347b9aa70da102804f08ef9c284d65ab7217f7a63e9e3a2de724d297c854086693c105c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.97dn.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000008761b8796a818ffa67a51a1c99ec86fbb040e1a8fc62733f78e11adfedd8d7fe000000000e80000000020000200000000c5e67b95228b016a1b6f8108ffef2ee9db69bec79fc44493460e20152d471d9200000001fd78d572673f89f3d41bef0b5ed8b79240dd994e305e8bf96f71a381e5f4f3a400000006ef3e8a313dabf1242e5e8aaeb50da8b7e4d59b531b751927556e63c9ef6559eac1e8261bd400279b47a70b6acdebe3a1be7835de787a7723409c0552cecce03	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC4E0E81-7348-11ED-AE55-6A950B37D0A0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b036a7bc5507d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\97dn.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\97dn.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
900	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
900	iexplore.exe
900	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
900	iexplore.exe
900	iexplore.exe
728	IEXPLORE.EXE
728	IEXPLORE.EXE
900	iexplore.exe
900	iexplore.exe
756	IEXPLORE.EXE
756	IEXPLORE.EXE
728	IEXPLORE.EXE
964	IEXPLORE.EXE
964	IEXPLORE.EXE
728	IEXPLORE.EXE
964	IEXPLORE.EXE
964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 900	1276	WScript.exe	28
PID 1276 wrote to memory of 900	1276	WScript.exe	28
PID 1276 wrote to memory of 900	1276	WScript.exe	28
PID 900 wrote to memory of 728	900	iexplore.exe	30
PID 900 wrote to memory of 728	900	iexplore.exe	30
PID 900 wrote to memory of 728	900	iexplore.exe	30
PID 900 wrote to memory of 728	900	iexplore.exe	30
PID 1276 wrote to memory of 592	1276	WScript.exe	32
PID 1276 wrote to memory of 592	1276	WScript.exe	32
PID 1276 wrote to memory of 592	1276	WScript.exe	32
PID 900 wrote to memory of 756	900	iexplore.exe	33
PID 900 wrote to memory of 756	900	iexplore.exe	33
PID 900 wrote to memory of 756	900	iexplore.exe	33
PID 900 wrote to memory of 756	900	iexplore.exe	33
PID 900 wrote to memory of 964	900	iexplore.exe	34
PID 900 wrote to memory of 964	900	iexplore.exe	34
PID 900 wrote to memory of 964	900	iexplore.exe	34
PID 900 wrote to memory of 964	900	iexplore.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1494601d2a69cddc7c76336c026080a422892711438a532447b7e22eaa30cde4.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.97dn.com/?tc
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:728
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275460 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:756
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:537605 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:964
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.97wg.com/?tc
  2⤵
  PID:592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc57b72e40ee94d7cbb706d8f591d88e

SHA1
3ea74e887ade903236aefc6d9ec40eb7e4cb8445

SHA256
37a647839ed6387c6dc2e847349f498c3a0b35fa46363f90dad63f1dfb751405

SHA512
a58a04a434a36b4aff597ed7df7eff4eee9f28363383d3e2abb865f02148a56beb620f9a6713926fa738e9f4b3831abecabfd7d50c779738eb8e9c3568beed15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef248d4ff1a930de9ae63528a4609f98

SHA1
e15f2f497908263aa886e14a497d003f92de00a2

SHA256
67212d390949f9cb1e4ae77de9cf8f56df48509e547b756a2318265a835bea75

SHA512
48dcfde52f0278f1c737d19c4ded25fae92665208b7267cd4c8e6d1a740a71fc9b0c97201d4833ae3e9c481cb2a6155eb9850bbf1f1373a9fb33822bf871197e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\09XVLMMT.txt

Filesize
208B

MD5
251db52f73611aa66bbbb7f642b4d257

SHA1
94096f243b1df4acb7dafccce75290047e51c247

SHA256
6eba44fd5d1fd46ab570ad404b3d4fd319b55e9525c088b04e3437c9edd74ec5

SHA512
952647be6f17025937f50e0ef54f97aeb88fad19ca5867be71bc26a670b88e048da4f320e44c8f35e85e3f79a41e4231de4773bce0259a4c96db2a800b2ec21d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BRBSLX9C.txt

Filesize
208B

MD5
11461aa56fc7f82b7cb52b53afcddf3d

SHA1
beba6b9bbdb408fa27d2d7f1a787e294fd3aa348

SHA256
c053974ec1b6ff97d97db5a372860d9eca58893afb11aca701250f2e036cbec7

SHA512
41378cacfdd2c260c3cf9542f4b0df13aa4a7e6a54b840bf14ffc4bdb616d2be3c281b0e67ceac66b16d685524888c9f4a08be7122a4f0e0b7cb17beab5038d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RKB70JZA.txt

Filesize
208B

MD5
11461aa56fc7f82b7cb52b53afcddf3d

SHA1
beba6b9bbdb408fa27d2d7f1a787e294fd3aa348

SHA256
c053974ec1b6ff97d97db5a372860d9eca58893afb11aca701250f2e036cbec7

SHA512
41378cacfdd2c260c3cf9542f4b0df13aa4a7e6a54b840bf14ffc4bdb616d2be3c281b0e67ceac66b16d685524888c9f4a08be7122a4f0e0b7cb17beab5038d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S9JY949R.txt

Filesize
111B

MD5
a4aa3e378541d03bf2b1d35991b503bb

SHA1
7e9233b6a1ba556b01b49b9c368126a5a8e4cf14

SHA256
644806842f2018fbd6859ff82be5e59f834cf526d12a86c356e2b78920b12d2f

SHA512
9d33f08553b0a9ddaee6ab919340608fd31ca7e936bc2122243b45a2cf4a8f72132b8b4ca17522c8691a2d2cf8785f42f6ddfdd5ce48526d65b781dbae0f7f83

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VKNZO735.txt

Filesize
533B

MD5
6de56339b8d1208820ba2863771fdded

SHA1
02e16a34579e2a28c05479cd49846570254d39a0

SHA256
d5737873fdaca47a4d295dff797502b396cdbcc38996747ab9d740e04413e962

SHA512
3be2d737fc27efd65473a542e9c2b710de451cb6bdb63b0555da392a6a9ac182c3a06350f7b9fe20ec8798e7e43899b9d022a2718f9fc2fe06276e8f0514525a

Download Submit
memory/1276-54-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download