Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 09:18
Static task
static1
Behavioral task
behavioral1
Sample
INFORMAC.vbs
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
INFORMAC.vbs
Resource
win10v2004-20230220-en
General
-
Target
INFORMAC.vbs
-
Size
4.7MB
-
MD5
7682d10c7d8f06b663b1d0f16067adf4
-
SHA1
408ba3988f038083f382b89a0fb0889a6ccf0658
-
SHA256
0d49ed0ef687b35e0f3a806dc9f20dd9cef84ea06a197319ee8c4a1b5a04aad4
-
SHA512
8119e6a7fb71fde2b2ebbcd143ad08ea3fb53b8a3cce767cf487d685ec88673ed20bbfad5b8449ab7370e9a5f7043ba060c42abb126bb51da28d416f335faead
-
SSDEEP
49152:3HSMXYsIodMO+PJUL7TtMO8UF1hppr71baDhxSw35Aac2HMGwnQzpfGWP:m
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
yacd61c618add255ee0ac0ee56940.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ yacd61c618add255ee0ac0ee56940.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
yacd61c618add255ee0ac0ee56940.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion yacd61c618add255ee0ac0ee56940.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion yacd61c618add255ee0ac0ee56940.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 1 IoCs
Processes:
yacd61c618add255ee0ac0ee56940.exepid process 3332 yacd61c618add255ee0ac0ee56940.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\yacd61c618add255ee0ac0ee56940.exe themida C:\Users\Admin\AppData\Local\Temp\yacd61c618add255ee0ac0ee56940.exe themida behavioral2/memory/3332-138-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-139-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-140-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-141-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-142-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-143-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-144-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-145-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-146-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-150-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-151-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-152-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-153-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-154-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-155-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-156-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-157-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-158-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-159-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-160-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-161-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-162-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-163-0x0000000000E80000-0x00000000016C9000-memory.dmp themida behavioral2/memory/3332-164-0x0000000000E80000-0x00000000016C9000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
yacd61c618add255ee0ac0ee56940.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows\CurrentVersion\Run yacd61c618add255ee0ac0ee56940.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GXOWIS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\EGDE.exe\"" yacd61c618add255ee0ac0ee56940.exe -
Processes:
yacd61c618add255ee0ac0ee56940.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA yacd61c618add255ee0ac0ee56940.exe -
AutoIT Executable 22 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3332-140-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-141-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-142-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-143-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-144-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-145-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-146-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-150-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-151-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-152-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-153-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-154-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-155-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-156-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-157-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-158-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-159-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-160-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-161-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-162-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-163-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe behavioral2/memory/3332-164-0x0000000000E80000-0x00000000016C9000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
yacd61c618add255ee0ac0ee56940.exepid process 3332 yacd61c618add255ee0ac0ee56940.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
Processes:
yacd61c618add255ee0ac0ee56940.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2 yacd61c618add255ee0ac0ee56940.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
yacd61c618add255ee0ac0ee56940.exepid process 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe 3332 yacd61c618add255ee0ac0ee56940.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
yacd61c618add255ee0ac0ee56940.exepid process 3332 yacd61c618add255ee0ac0ee56940.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WScript.exeyacd61c618add255ee0ac0ee56940.exedescription pid process target process PID 640 wrote to memory of 3740 640 WScript.exe certutil.exe PID 640 wrote to memory of 3740 640 WScript.exe certutil.exe PID 640 wrote to memory of 3332 640 WScript.exe yacd61c618add255ee0ac0ee56940.exe PID 640 wrote to memory of 3332 640 WScript.exe yacd61c618add255ee0ac0ee56940.exe PID 640 wrote to memory of 3332 640 WScript.exe yacd61c618add255ee0ac0ee56940.exe PID 3332 wrote to memory of 4440 3332 yacd61c618add255ee0ac0ee56940.exe WSCript.exe PID 3332 wrote to memory of 4440 3332 yacd61c618add255ee0ac0ee56940.exe WSCript.exe PID 3332 wrote to memory of 4440 3332 yacd61c618add255ee0ac0ee56940.exe WSCript.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INFORMAC.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\certutil.exe"C:\Windows\System32\certutil.exe" -decode C:\Users\Admin\AppData\Local\Temp\Sb32e6a52a22741d15c746c4261 C:\Users\Admin\AppData\Local\Temp\yacd61c618add255ee0ac0ee56940.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\yacd61c618add255ee0ac0ee56940.exe"C:\Users\Admin\AppData\Local\Temp\yacd61c618add255ee0ac0ee56940.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\GXOWIS.vbs3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GXOWIS.vbsFilesize
878B
MD53d99251020982702f00048a7f1166865
SHA1e5ead989881790467c96a092e93b014c4afa6811
SHA2564c5675319ec4ac23afda439fa1eb9883b8573d53d567ba1d1c343cd5502fd005
SHA51213fcc886709d3d3f2f2b93e54f45ffff98d6fdf899a7ef5d86e4e110e8db00271a36e658497716a9162f302c6a88620d0aed3f2fa655d1c4b40055695293f04a
-
C:\Users\Admin\AppData\Local\Temp\Sb32e6a52a22741d15c746c4261Filesize
4.7MB
MD58102c205028e4898c08bdfc4b9c0b352
SHA13bc5e9064f978924e2eacfa14440a825c80388ef
SHA256a42e3a28241c1cf88249dc997a5d3e9c28e5fbc91ebf59b058e029534162c846
SHA512841f5baa6e1eaeaddff817266853161cfb9dafe77c8242b25fc8f8109ba2ca28667c561759f3a0c40f1945befd2668e2b93aefcfc4ab8c094124f6e619b58d1f
-
C:\Users\Admin\AppData\Local\Temp\yacd61c618add255ee0ac0ee56940.exeFilesize
3.5MB
MD583a302a7711d3e65a1e4c58b4b023399
SHA1d31bdb7dc1dc10f4085cfb1bf193c6c319037a35
SHA256a89b834a1644e35ed3c9bd3cf3c9fa81929aeb3d7e47c5ac8f50b4cdf02eaf63
SHA512ff96d153f623e0beda3ba5ca1feb3dcacbf03a1de686dc48231d8e4d2907e7384974e1bfe09e2a2e1f970322e63d913e220499380e9b8dfd5897d066577caa7a
-
C:\Users\Admin\AppData\Local\Temp\yacd61c618add255ee0ac0ee56940.exeFilesize
3.5MB
MD583a302a7711d3e65a1e4c58b4b023399
SHA1d31bdb7dc1dc10f4085cfb1bf193c6c319037a35
SHA256a89b834a1644e35ed3c9bd3cf3c9fa81929aeb3d7e47c5ac8f50b4cdf02eaf63
SHA512ff96d153f623e0beda3ba5ca1feb3dcacbf03a1de686dc48231d8e4d2907e7384974e1bfe09e2a2e1f970322e63d913e220499380e9b8dfd5897d066577caa7a
-
memory/3332-151-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-152-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-141-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-142-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-143-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-144-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-145-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-146-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-139-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-150-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-138-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-140-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-153-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-154-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-155-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-156-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-157-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-158-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-159-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-160-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-161-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-162-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-163-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB
-
memory/3332-164-0x0000000000E80000-0x00000000016C9000-memory.dmpFilesize
8.3MB