Analysis
-
max time kernel
269s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
28/03/2023, 17:32
General
-
Target
Archive.688306047.vbs
-
Size
8KB
-
MD5
dfd1724a4e51522d244d96dd58dcd721
-
SHA1
c8affb1a38d2bebaaf5c91aec4c23f2337533fe8
-
SHA256
1111e97e61ee666ad9df5a3fe14b37eeb02355c557c2998eb220bc165c0f6f1d
-
SHA512
f086dd7609b6bca84ce4db9d547eca9b554bb8582b9004eca0797bf4f50a81414c73d10d59e752cc44db723c13ace1e8e600bcc9bb43d48a62e0e419ea121101
-
SSDEEP
96:ehSF2h2qFlO5E8WDxSAC9H0pmJdy0xjK8rq9yZ9z0tsCNNM:dFIt3XcH0pSHrq9yZ9z/CNNM
Malware Config
Signatures
-
Detects Grandoreiro payload 4 IoCs
-
Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
-
Blocklisted process makes network request 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Archive.688306047.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\02EoVNPx\HostFx.exe"C:\02EoVNPx\HostFx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5b5485d229f8078575d639fb903b4fca7
SHA16a67a6bb694df592819d398a645504b2c7a2221c
SHA2569625e775e955281732270b7a0fc468bef83b468be85e82e0659973aefa369782
SHA5125d54f343b986d33c3e7de1450d8b6386bac66a9aeb8a77b0a81652cf2592e8f85847185d6e09e8c486a224bf21eb195308be1f489bbac615bf99d5fc760d85f8
-
Filesize
2.2MB
MD5b5485d229f8078575d639fb903b4fca7
SHA16a67a6bb694df592819d398a645504b2c7a2221c
SHA2569625e775e955281732270b7a0fc468bef83b468be85e82e0659973aefa369782
SHA5125d54f343b986d33c3e7de1450d8b6386bac66a9aeb8a77b0a81652cf2592e8f85847185d6e09e8c486a224bf21eb195308be1f489bbac615bf99d5fc760d85f8
-
Filesize
2.2MB
MD5b5485d229f8078575d639fb903b4fca7
SHA16a67a6bb694df592819d398a645504b2c7a2221c
SHA2569625e775e955281732270b7a0fc468bef83b468be85e82e0659973aefa369782
SHA5125d54f343b986d33c3e7de1450d8b6386bac66a9aeb8a77b0a81652cf2592e8f85847185d6e09e8c486a224bf21eb195308be1f489bbac615bf99d5fc760d85f8
-
Filesize
22.6MB
MD5cac9d2558d122149ae7d96a77477ca31
SHA1e1e8728d08ccb215a8234d88e0ffd725822f8a53
SHA256042cb2a7d5494ff63ac5dac24acfb6a7b453546a897bb5c54f4f985b0da1b491
SHA5129498aa32d33cade7f2e7f3383498b66b4986c722473d9ac56f539f3d1ad1c0e3433ef4a04d99e169d07e39831a42ff160173fce66fb015d121e17712d50b509a
-
Filesize
1.2MB
MD54003e34416ebd25e4c115d49dc15e1a7
SHA1faf95ec65cde5bd833ce610bb8523363310ec4ad
SHA256c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
SHA51288f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84
-
Filesize
13.0MB
MD587c7411e05ff159a3707869adc9d5c01
SHA1d147cfdc5d2ea979aa757423a0a22577c45acbe1
SHA256207d66dae08ca39065019355802604768b213ed2817e78bea128f136784af6a7
SHA512a5a22ed12fa2ea7d343fa38e527fab8735924e350dd138b72e2bec4417825b8bab52e6814ced320f67030fa3a0b88afd7a50ac1714476f40d9ec54c33acae922
-
Filesize
26.5MB
MD536d9e993ab9121c0046aadf30b82820e
SHA15440c5045f86fa5d97d91c0e787cddbfb8042725
SHA256e33ac90c9d52ac62087d1bb984996804d176c8dbdee38aaa01f9dbb87de8d35c
SHA512a29796223bac3d42b4b8baf0f467d88d2d31449d2cab56d1fd3d96bdf749be0ab79dfc1bd8b4cee37b5eb89dfce1da495ea85eb2c32acbb49dcbaeb83b36e152
-
Filesize
1.2MB
MD54003e34416ebd25e4c115d49dc15e1a7
SHA1faf95ec65cde5bd833ce610bb8523363310ec4ad
SHA256c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
SHA51288f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84
-
Filesize
13.0MB
MD587c7411e05ff159a3707869adc9d5c01
SHA1d147cfdc5d2ea979aa757423a0a22577c45acbe1
SHA256207d66dae08ca39065019355802604768b213ed2817e78bea128f136784af6a7
SHA512a5a22ed12fa2ea7d343fa38e527fab8735924e350dd138b72e2bec4417825b8bab52e6814ced320f67030fa3a0b88afd7a50ac1714476f40d9ec54c33acae922
-
Filesize
26.5MB
MD536d9e993ab9121c0046aadf30b82820e
SHA15440c5045f86fa5d97d91c0e787cddbfb8042725
SHA256e33ac90c9d52ac62087d1bb984996804d176c8dbdee38aaa01f9dbb87de8d35c
SHA512a29796223bac3d42b4b8baf0f467d88d2d31449d2cab56d1fd3d96bdf749be0ab79dfc1bd8b4cee37b5eb89dfce1da495ea85eb2c32acbb49dcbaeb83b36e152
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
26.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
26.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB