Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-03-2024 18:51
Static task
static1
Behavioral task
behavioral1
Sample
invoice.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
invoice.vbs
Resource
win10v2004-20240226-en
General
-
Target
invoice.vbs
-
Size
19KB
-
MD5
433febbbc8e5d0eeed7b3aaa9ad15558
-
SHA1
83905f45e2c6977f35e7db522052295d739fd667
-
SHA256
25b4135b1c971889bcf7b36da063ea24025e2a67e22b3dd84ebb8f556b75823e
-
SHA512
6cae2f6e7b86052af6f812e815128f67ce76f44e56b9bfdb5e4fa0ce2fba5610deb830334162b330e5e494bece380d1f7e053f6f89eac398d48fe49cbb3626ec
-
SSDEEP
384:vKNssJiGagRYwZSFFOECXCghDStXdTX2XXXiXs31TNWE/cJ1:vq9agRYwZSGECXCgM7rGHqc1IE/m
Malware Config
Extracted
wshrat
http://paulrdp02.duckdns.org:1604
Signatures
-
Blocklisted process makes network request 27 IoCs
flow pid Process 4 2936 wscript.exe 6 2936 wscript.exe 7 2936 wscript.exe 9 2936 wscript.exe 10 2936 wscript.exe 11 2936 wscript.exe 13 2936 wscript.exe 14 2936 wscript.exe 15 2936 wscript.exe 17 2936 wscript.exe 18 2936 wscript.exe 19 2936 wscript.exe 21 2936 wscript.exe 22 2936 wscript.exe 23 2936 wscript.exe 25 2936 wscript.exe 26 2936 wscript.exe 27 2936 wscript.exe 29 2936 wscript.exe 30 2936 wscript.exe 31 2936 wscript.exe 33 2936 wscript.exe 34 2936 wscript.exe 35 2936 wscript.exe 37 2936 wscript.exe 38 2936 wscript.exe 39 2936 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice.vbs WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice.vbs wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invoice = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice.vbs\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\invoice = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice.vbs\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invoice = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice.vbs\"" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\invoice = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice.vbs\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2936 2300 WScript.exe 28 PID 2300 wrote to memory of 2936 2300 WScript.exe 28 PID 2300 wrote to memory of 2936 2300 WScript.exe 28
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\invoice.vbs"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\invoice.vbs"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5433febbbc8e5d0eeed7b3aaa9ad15558
SHA183905f45e2c6977f35e7db522052295d739fd667
SHA25625b4135b1c971889bcf7b36da063ea24025e2a67e22b3dd84ebb8f556b75823e
SHA5126cae2f6e7b86052af6f812e815128f67ce76f44e56b9bfdb5e4fa0ce2fba5610deb830334162b330e5e494bece380d1f7e053f6f89eac398d48fe49cbb3626ec