Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 11:12
Static task
static1
Behavioral task
behavioral1
Sample
Eurovisioner.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Eurovisioner.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
General
-
Target
Eurovisioner.exe
-
Size
548KB
-
MD5
e90feee8c6994f0cd73a792ea886693c
-
SHA1
e0c070b38f16693aacc47a0c11e5a0036191b1db
-
SHA256
a31748dd0aa6f53cbfa189bef070a2304e385ef18c0bab5672e039c4a12c41f7
-
SHA512
07158b7462c3ca51f0ce5737cab77ea93144105f40117341a6e79624c5ac7492365a85ce724724de9ff845367ebf1b44e061a19410b860699ce349676b0ba707
-
SSDEEP
6144:h1onKQNqlcuBZB478o/iDx5ux04TcMR5C33BlqS0gGD3WNfX5Slhv2:TozEBTyH/wzuO4TvC33vWgGDGxSl92
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.escolaprofissionaltomar.com - Port:
587 - Username:
[email protected] - Password:
*Acnbc232430# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL 64 IoCs
pid Process 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe 2188 Eurovisioner.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 57 drive.google.com 58 drive.google.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 75 api.ipify.org 76 api.ipify.org -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tvungen.ini Eurovisioner.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1196 Eurovisioner.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2188 Eurovisioner.exe 1196 Eurovisioner.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2188 set thread context of 1196 2188 Eurovisioner.exe 647 -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\opvaskene.ini Eurovisioner.exe File opened for modification C:\Program Files (x86)\Common Files\Lymphoidocyte.ini Eurovisioner.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\lejerets.Arb Eurovisioner.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1196 Eurovisioner.exe 1196 Eurovisioner.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2188 Eurovisioner.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1196 Eurovisioner.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 3364 2188 Eurovisioner.exe 93 PID 2188 wrote to memory of 3364 2188 Eurovisioner.exe 93 PID 2188 wrote to memory of 3364 2188 Eurovisioner.exe 93 PID 2188 wrote to memory of 3032 2188 Eurovisioner.exe 95 PID 2188 wrote to memory of 3032 2188 Eurovisioner.exe 95 PID 2188 wrote to memory of 3032 2188 Eurovisioner.exe 95 PID 2188 wrote to memory of 1128 2188 Eurovisioner.exe 97 PID 2188 wrote to memory of 1128 2188 Eurovisioner.exe 97 PID 2188 wrote to memory of 1128 2188 Eurovisioner.exe 97 PID 2188 wrote to memory of 1480 2188 Eurovisioner.exe 99 PID 2188 wrote to memory of 1480 2188 Eurovisioner.exe 99 PID 2188 wrote to memory of 1480 2188 Eurovisioner.exe 99 PID 2188 wrote to memory of 2656 2188 Eurovisioner.exe 101 PID 2188 wrote to memory of 2656 2188 Eurovisioner.exe 101 PID 2188 wrote to memory of 2656 2188 Eurovisioner.exe 101 PID 2188 wrote to memory of 636 2188 Eurovisioner.exe 103 PID 2188 wrote to memory of 636 2188 Eurovisioner.exe 103 PID 2188 wrote to memory of 636 2188 Eurovisioner.exe 103 PID 2188 wrote to memory of 3732 2188 Eurovisioner.exe 105 PID 2188 wrote to memory of 3732 2188 Eurovisioner.exe 105 PID 2188 wrote to memory of 3732 2188 Eurovisioner.exe 105 PID 2188 wrote to memory of 3940 2188 Eurovisioner.exe 107 PID 2188 wrote to memory of 3940 2188 Eurovisioner.exe 107 PID 2188 wrote to memory of 3940 2188 Eurovisioner.exe 107 PID 2188 wrote to memory of 4976 2188 Eurovisioner.exe 109 PID 2188 wrote to memory of 4976 2188 Eurovisioner.exe 109 PID 2188 wrote to memory of 4976 2188 Eurovisioner.exe 109 PID 2188 wrote to memory of 3396 2188 Eurovisioner.exe 112 PID 2188 wrote to memory of 3396 2188 Eurovisioner.exe 112 PID 2188 wrote to memory of 3396 2188 Eurovisioner.exe 112 PID 2188 wrote to memory of 1464 2188 Eurovisioner.exe 114 PID 2188 wrote to memory of 1464 2188 Eurovisioner.exe 114 PID 2188 wrote to memory of 1464 2188 Eurovisioner.exe 114 PID 2188 wrote to memory of 4528 2188 Eurovisioner.exe 116 PID 2188 wrote to memory of 4528 2188 Eurovisioner.exe 116 PID 2188 wrote to memory of 4528 2188 Eurovisioner.exe 116 PID 2188 wrote to memory of 2160 2188 Eurovisioner.exe 118 PID 2188 wrote to memory of 2160 2188 Eurovisioner.exe 118 PID 2188 wrote to memory of 2160 2188 Eurovisioner.exe 118 PID 2188 wrote to memory of 4636 2188 Eurovisioner.exe 120 PID 2188 wrote to memory of 4636 2188 Eurovisioner.exe 120 PID 2188 wrote to memory of 4636 2188 Eurovisioner.exe 120 PID 2188 wrote to memory of 5036 2188 Eurovisioner.exe 122 PID 2188 wrote to memory of 5036 2188 Eurovisioner.exe 122 PID 2188 wrote to memory of 5036 2188 Eurovisioner.exe 122 PID 2188 wrote to memory of 4564 2188 Eurovisioner.exe 124 PID 2188 wrote to memory of 4564 2188 Eurovisioner.exe 124 PID 2188 wrote to memory of 4564 2188 Eurovisioner.exe 124 PID 2188 wrote to memory of 4488 2188 Eurovisioner.exe 126 PID 2188 wrote to memory of 4488 2188 Eurovisioner.exe 126 PID 2188 wrote to memory of 4488 2188 Eurovisioner.exe 126 PID 2188 wrote to memory of 4992 2188 Eurovisioner.exe 128 PID 2188 wrote to memory of 4992 2188 Eurovisioner.exe 128 PID 2188 wrote to memory of 4992 2188 Eurovisioner.exe 128 PID 2188 wrote to memory of 1184 2188 Eurovisioner.exe 130 PID 2188 wrote to memory of 1184 2188 Eurovisioner.exe 130 PID 2188 wrote to memory of 1184 2188 Eurovisioner.exe 130 PID 2188 wrote to memory of 2008 2188 Eurovisioner.exe 132 PID 2188 wrote to memory of 2008 2188 Eurovisioner.exe 132 PID 2188 wrote to memory of 2008 2188 Eurovisioner.exe 132 PID 2188 wrote to memory of 3360 2188 Eurovisioner.exe 134 PID 2188 wrote to memory of 3360 2188 Eurovisioner.exe 134 PID 2188 wrote to memory of 3360 2188 Eurovisioner.exe 134 PID 2188 wrote to memory of 3412 2188 Eurovisioner.exe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eurovisioner.exe"C:\Users\Admin\AppData\Local\Temp\Eurovisioner.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:3364
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:3032
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1128
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1480
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2656
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:636
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3732
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3940
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"2⤵PID:4976
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"2⤵PID:3396
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1464
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:4528
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:2160
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4636
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:5036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:4564
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:4488
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:4992
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1184
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2008
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3360
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:3412
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:5020
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3184
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3504
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:3380
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:1980
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:4312
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:3912
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:4948
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:3420
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:5036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:3060
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:908
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:1892
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1540
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:4596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1152
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4728
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:3516
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:5092
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:3304
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:4316
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:2072
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:5048
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:1348
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4332
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2688
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:3172
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:908
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3796
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3952
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4520
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:3584
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:2284
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2488
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4976
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2828
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2856
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1988
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:5036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:848
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:4364
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:5080
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3356
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:4656
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1372
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:3220
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3964
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:4728
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2892
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"2⤵PID:3136
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2176
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"2⤵PID:1132
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"2⤵PID:1800
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:1888
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"2⤵PID:4376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:3300
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:3724
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4992
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"2⤵PID:4472
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2008
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:1420
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:3044
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2320
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:3508
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2084
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:4064
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:3640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:5012
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:3748
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4324
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"2⤵PID:1280
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:4972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3652
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2024
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3272
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2216
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1508
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:636
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:1568
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:3444
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:4392
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:4296
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:4996
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:4108
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:4332
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:4880
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2056
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4352
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2172
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4004
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:2924
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:3232
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3504
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:116
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4404
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:5092
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:396
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2244
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:4840
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:4128
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:5088
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:4880
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:1524
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2132
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:940
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:432
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:4792
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:5056
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:4016
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:4356
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1912
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:620
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3516
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3940
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:3624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2828
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:4108
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"2⤵PID:4324
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:2072
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2876
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4804
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4952
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:400
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3796
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:852
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1128
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1876
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:2924
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:736
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2320
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:116
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4340
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2428
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4256
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2160
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4676
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2600
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3936
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:4780
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:3724
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3124
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:744
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:552
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:1040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:3412
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1152
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:1248
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2868
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:3436
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1948
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:1704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:5036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:3660
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:5088
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:1984
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:3784
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4352
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:744
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3112
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4836
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1152
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1248
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:4520
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2488
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1616
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:912
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:1948
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:1240
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:3144
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:4916
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:5088
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1984
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:3784
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2056
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:3900
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3360
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:852
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1892
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4420
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:636
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:3504
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3396
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4856
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"2⤵PID:1616
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:912
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:964
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:424
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3144
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:4916
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:5088
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:4276
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"2⤵PID:3732
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3900
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:3360
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:4792
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:1972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1876
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4660
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3700
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2276
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:4932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4264
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:5084
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4600
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2164
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3128
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1888
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3084
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:940
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2084
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2536
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1476
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3188
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3584
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1064
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2840
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4264
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:5084
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:3640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\Eurovisioner.exe"C:\Users\Admin\AppData\Local\Temp\Eurovisioner.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD53f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA256fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
SHA5120a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
-
Filesize
6KB
MD5b5a1f9dc73e2944a388a61411bdd8c70
SHA1dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA256288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
SHA512b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
-
Filesize
37B
MD5e13e9d5b2397a5759ca52f5facbe9bb4
SHA1718daa072689802474818abe65e8329be26ed638
SHA256314ad250724df3c35e626250465fa0f268fc5f029777b73fc34b873c20b9e0f6
SHA5125febc52acd109e21112bd37a7091c1adab1b6dceb42f1c56567c15b0aae2704b9cef92c605f52ad98fd229ad19ec17d581c850cb7f76389e9002cf02ff3152fe