ec91954a19d06385bd4f5c9dec376f6a404accf89091f133c5f5064cde2635d5

Resubmissions

01/02/2023, 23:44

230201-3q4s2sdd64 8

01/02/2023, 23:23

230201-3dk56sdc45 8

01/02/2023, 22:30

230201-2eybfseg3x 10

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/02/2023, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mmercado-ve73580jov.vbs
Size

171KB
MD5

f3bf7594bf80e589cc9f79a1b606c21c
SHA1

12b58b7a2a6b92a3795d990c42ba32458042a20f
SHA256

801bf25da88afd12245112510da0bbc2f3f40dd8431b5330b6ebd325c8d110f3
SHA512

60b253506b66fcfe4cf52aca6469694a580cc70b1dab3863d326026b1108daca69bf7fa65fe9d6335c4a9593ee1473588e43b365ba21f160fe0a392452b904f0
SSDEEP

3072:RckLC3Zum3JcLwyADu7wztcX19WbJ9LCNq8I+zzb/M8njsrw7Ayr8oHNghP:RcAC3Zf3uLPANCNh/b5j3HqhP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1232	WScript.exe
5	1232	WScript.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1692	msiexec.exe
Token: SeRestorePrivilege	516	msiexec.exe
Token: SeTakeOwnershipPrivilege	516	msiexec.exe
Token: SeSecurityPrivilege	516	msiexec.exe
Token: SeCreateTokenPrivilege	1692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1692	msiexec.exe
Token: SeLockMemoryPrivilege	1692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1692	msiexec.exe
Token: SeMachineAccountPrivilege	1692	msiexec.exe
Token: SeTcbPrivilege	1692	msiexec.exe
Token: SeSecurityPrivilege	1692	msiexec.exe
Token: SeTakeOwnershipPrivilege	1692	msiexec.exe
Token: SeLoadDriverPrivilege	1692	msiexec.exe
Token: SeSystemProfilePrivilege	1692	msiexec.exe
Token: SeSystemtimePrivilege	1692	msiexec.exe
Token: SeProfSingleProcessPrivilege	1692	msiexec.exe
Token: SeIncBasePriorityPrivilege	1692	msiexec.exe
Token: SeCreatePagefilePrivilege	1692	msiexec.exe
Token: SeCreatePermanentPrivilege	1692	msiexec.exe
Token: SeBackupPrivilege	1692	msiexec.exe
Token: SeRestorePrivilege	1692	msiexec.exe
Token: SeShutdownPrivilege	1692	msiexec.exe
Token: SeDebugPrivilege	1692	msiexec.exe
Token: SeAuditPrivilege	1692	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1692	msiexec.exe
Token: SeChangeNotifyPrivilege	1692	msiexec.exe
Token: SeRemoteShutdownPrivilege	1692	msiexec.exe
Token: SeUndockPrivilege	1692	msiexec.exe
Token: SeSyncAgentPrivilege	1692	msiexec.exe
Token: SeEnableDelegationPrivilege	1692	msiexec.exe
Token: SeManageVolumePrivilege	1692	msiexec.exe
Token: SeImpersonatePrivilege	1692	msiexec.exe
Token: SeCreateGlobalPrivilege	1692	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1692	1232	WScript.exe	28
PID 1232 wrote to memory of 1692	1232	WScript.exe	28
PID 1232 wrote to memory of 1692	1232	WScript.exe	28
PID 1232 wrote to memory of 1692	1232	WScript.exe	28
PID 1232 wrote to memory of 1692	1232	WScript.exe	28

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mmercado-ve73580jov.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\System32\msiexec.exe
  msiexec /i C:\programData\1GSW3WFQ72X.bin /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\programData\1GSW3WFQ72X.bin

Filesize
1KB

MD5
20b3d400e73176c0b308f130bafd0158

SHA1
4cb36f52f1d602a21f06c3414147687e1fd910ff

SHA256
96c411bf0fccd24c6dc3064a1be1c8349e494e6669c9309a0d7ca9f2dd6f377c

SHA512
d13476b4cd3128a85666acdffa9c5a5b044c0edfdcef102647661a4ea621ce33416ac40fec2c74578b7bc59ce3d666f4ea7d96b71f393185eeab7ab9c0de0b61

Download Submit
memory/1692-55-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download