Analysis
-
max time kernel
157s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2024 18:53
Static task
static1
Behavioral task
behavioral1
Sample
invoice.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
invoice.vbs
Resource
win10v2004-20240226-en
General
-
Target
invoice.vbs
-
Size
19KB
-
MD5
433febbbc8e5d0eeed7b3aaa9ad15558
-
SHA1
83905f45e2c6977f35e7db522052295d739fd667
-
SHA256
25b4135b1c971889bcf7b36da063ea24025e2a67e22b3dd84ebb8f556b75823e
-
SHA512
6cae2f6e7b86052af6f812e815128f67ce76f44e56b9bfdb5e4fa0ce2fba5610deb830334162b330e5e494bece380d1f7e053f6f89eac398d48fe49cbb3626ec
-
SSDEEP
384:vKNssJiGagRYwZSFFOECXCghDStXdTX2XXXiXs31TNWE/cJ1:vq9agRYwZSGECXCgM7rGHqc1IE/m
Malware Config
Extracted
wshrat
http://paulrdp02.duckdns.org:1604
Signatures
-
Blocklisted process makes network request 27 IoCs
flow pid Process 11 748 wscript.exe 40 748 wscript.exe 43 748 wscript.exe 48 748 wscript.exe 61 748 wscript.exe 63 748 wscript.exe 76 748 wscript.exe 77 748 wscript.exe 78 748 wscript.exe 79 748 wscript.exe 80 748 wscript.exe 84 748 wscript.exe 87 748 wscript.exe 88 748 wscript.exe 91 748 wscript.exe 92 748 wscript.exe 93 748 wscript.exe 94 748 wscript.exe 95 748 wscript.exe 96 748 wscript.exe 97 748 wscript.exe 98 748 wscript.exe 102 748 wscript.exe 103 748 wscript.exe 107 748 wscript.exe 109 748 wscript.exe 110 748 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice.vbs WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice.vbs wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invoice = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice.vbs\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invoice = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice.vbs\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invoice = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice.vbs\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invoice = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice.vbs\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 924 wrote to memory of 748 924 WScript.exe 86 PID 924 wrote to memory of 748 924 WScript.exe 86
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\invoice.vbs"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\invoice.vbs"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5433febbbc8e5d0eeed7b3aaa9ad15558
SHA183905f45e2c6977f35e7db522052295d739fd667
SHA25625b4135b1c971889bcf7b36da063ea24025e2a67e22b3dd84ebb8f556b75823e
SHA5126cae2f6e7b86052af6f812e815128f67ce76f44e56b9bfdb5e4fa0ce2fba5610deb830334162b330e5e494bece380d1f7e053f6f89eac398d48fe49cbb3626ec