Analysis
- max time kernel
436s - max time network
1165s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 13:34
General
- Target Windows Driver Foundation.vbs
- Size 984B
- Sample240409-qvlrtabe9s
- SHA256 2c5907389d374ed9efb86194a7f0f954349c93a7bc67b99c3d6b59bfc0d8296c
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://files.catbox.moe/fvl5hy.jpg
Signatures
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
rrrrrrrr.ps1
__PSScriptPolicyTest_a4wdlrum.ygy.ps1
memory/3592-1-0x0000020ED0D20000-0x0000020ED0D42000-memory.dmp
memory/3592-11-0x00007FF841160000-0x00007FF841C21000-memory.dmp
memory/3592-12-0x0000020ECEB30000-0x0000020ECEB40000-memory.dmp
memory/3592-13-0x0000020ECEB30000-0x0000020ECEB40000-memory.dmp
memory/3592-17-0x00007FF841160000-0x00007FF841C21000-memory.dmp