f6c5d0064568344d3c56561bcc3e6b843a1bba496a4c372f451fe5831d3cce8f

Resubmissions

09-12-2022 21:30

01-12-2022 16:56

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 16:56

Target

teased/expletives.vbs
Size

180B
MD5

2cd1f8dc755fe95803f559eb2fafd426
SHA1

0f10bdd9fee72736f9edacb687164d6f48a410be
SHA256

4f20d3df38ca5be59c5e550ee96ddc3e2331ec497872c335e1f3b071bf96ea15
SHA512

8d1cbd47d51afd56633708d3b872f924b78c28f5d074fa9a9340b4d487dc3d624b37d9651c09586bca3fc8f24169490e14f910a0731eeeb1e647710ec52cbe93

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1720 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1720 powershell.exe

pid	process
1720	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1720	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1404 wrote to memory of 1720	1404	WScript.exe	powershell.exe
PID 1404 wrote to memory of 1720	1404	WScript.exe	powershell.exe
PID 1404 wrote to memory of 1720	1404	WScript.exe	powershell.exe
PID 1404 wrote to memory of 1720	1404	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\teased\expletives.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass teased\\vehemently.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1404-54-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download
memory/1720-55-0x0000000000000000-mapping.dmp

Download
memory/1720-56-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1720-57-0x0000000073AA0000-0x000000007404B000-memory.dmp

Filesize
5.7MB

Download
memory/1720-58-0x0000000073AA0000-0x000000007404B000-memory.dmp

Filesize
5.7MB

Download