Overview

overview

4

Static

static

1

Endermanch...xe.vbs

windows10-1703-x64

4

Analysis

  • max time kernel
    43s
  • max time network
    21s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-07-2024 11:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [email protected]

  • Size

    4KB

  • MD5

    9baa43c9a4532c083249f5b7defe1ef5

  • SHA1

    e326266d5a8bcb838d1f317f7aa0e2375fac76e6

  • SHA256

    5d53352e2db1d4ce0786116b3bf7d6b5c21422cfec97a91b0744cc2f5e3678c4

  • SHA512

    e3fa9f84d34b8a35a5d6e11e618ab0f3339114649d1ec77a80f9063024288e0496e173321f9bd035c86001fd956731e533a1c1fcecd2a3ef26a794910a329c29

  • SSDEEP

    24:o+j+dXcUj2R9o8ZLJKFdQY7phc7Dcu6bC79bC764/q464/q464/q464/q464/q4B:QrGELQRJauKeLnw36m0qLHgROoVW/

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      2⤵
        PID:4780
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe"
        2⤵
          PID:4544
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe"
          2⤵
            PID:3520
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5104
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im explorer.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2320
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im chrome.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1840
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im discord.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4524
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im steam.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4476
        • C:\Windows\System32\SystemSettingsBroker.exe
          C:\Windows\System32\SystemSettingsBroker.exe -Embedding
          1⤵
            PID:3720
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
            1⤵
              PID:2080
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localservice -s SstpSvc
              1⤵
                PID:1964
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
                1⤵
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:512
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                1⤵
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:212
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s RasMan
                1⤵
                  PID:3408

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Windows\INF\netrasa.PNF
                  Filesize

                  22KB

                  MD5

                  80648b43d233468718d717d10187b68d

                  SHA1

                  a1736e8f0e408ce705722ce097d1adb24ebffc45

                  SHA256

                  8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

                  SHA512

                  eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

                  Download Submit

                • C:\Windows\INF\netsstpa.PNF
                  Filesize

                  6KB

                  MD5

                  01e21456e8000bab92907eec3b3aeea9

                  SHA1

                  39b34fe438352f7b095e24c89968fca48b8ce11c

                  SHA256

                  35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

                  SHA512

                  9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

                  Download Submit