c7728da75004903710287196fe7b46281fcc671420ebbac44388605e1d9892be

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FACTURA08798696.vbe
Size 646KB
Sample240624-seflzayapc
SHA256 411d7a0d9d268daa710bbd8af48825e3227be7ed743c50c68afc05b71a940e83
MD5 877d62bb0a3ca04372a89f1fd63aa517
SHA1 abb9619743f94df8ee35bcb29e08a33f49acc91a
SHA512 072e1b5ebf6aa76ee374d94b5d9f066c3f2c922808a646768234bf8cae9c62b55a82fa4e18ab860f7ffb5b31a625619991feaa3a82bc8fc7a3712b38cbbcf7ae
SSDEEP 12288:NuXAeUMRwhbVmNmN7wNL4NBN3rNrx9V0NnNcN/v3gRN6fyNMNIN3NLojSAfp+J1/:T4Rwhb79SyV7R1AIJTaud62Q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4152	x.exe

Loads dropped DLL 64 IoCs

pid	Process
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe
4152	x.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4152	x.exe
4456	x.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4152 set thread context of 4456	4152	x.exe	630

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\gokke\empacket.bru	x.exe
File opened for modification	C:\Windows\resources\Informationssgningers.par	x.exe
File opened for modification	C:\Windows\Fonts\sanitetstjenesten.par	x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4152	x.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4152	3404	WScript.exe	80
PID 3404 wrote to memory of 4152	3404	WScript.exe	80
PID 3404 wrote to memory of 4152	3404	WScript.exe	80
PID 4152 wrote to memory of 3552	4152	x.exe	81
PID 4152 wrote to memory of 3552	4152	x.exe	81
PID 4152 wrote to memory of 3552	4152	x.exe	81
PID 4152 wrote to memory of 3928	4152	x.exe	83
PID 4152 wrote to memory of 3928	4152	x.exe	83
PID 4152 wrote to memory of 3928	4152	x.exe	83
PID 4152 wrote to memory of 4524	4152	x.exe	85
PID 4152 wrote to memory of 4524	4152	x.exe	85
PID 4152 wrote to memory of 4524	4152	x.exe	85
PID 4152 wrote to memory of 2792	4152	x.exe	87
PID 4152 wrote to memory of 2792	4152	x.exe	87
PID 4152 wrote to memory of 2792	4152	x.exe	87
PID 4152 wrote to memory of 3016	4152	x.exe	89
PID 4152 wrote to memory of 3016	4152	x.exe	89
PID 4152 wrote to memory of 3016	4152	x.exe	89
PID 4152 wrote to memory of 1028	4152	x.exe	91
PID 4152 wrote to memory of 1028	4152	x.exe	91
PID 4152 wrote to memory of 1028	4152	x.exe	91
PID 4152 wrote to memory of 628	4152	x.exe	93
PID 4152 wrote to memory of 628	4152	x.exe	93
PID 4152 wrote to memory of 628	4152	x.exe	93
PID 4152 wrote to memory of 2032	4152	x.exe	95
PID 4152 wrote to memory of 2032	4152	x.exe	95
PID 4152 wrote to memory of 2032	4152	x.exe	95
PID 4152 wrote to memory of 3420	4152	x.exe	97
PID 4152 wrote to memory of 3420	4152	x.exe	97
PID 4152 wrote to memory of 3420	4152	x.exe	97
PID 4152 wrote to memory of 3252	4152	x.exe	99
PID 4152 wrote to memory of 3252	4152	x.exe	99
PID 4152 wrote to memory of 3252	4152	x.exe	99
PID 4152 wrote to memory of 3204	4152	x.exe	101
PID 4152 wrote to memory of 3204	4152	x.exe	101
PID 4152 wrote to memory of 3204	4152	x.exe	101
PID 4152 wrote to memory of 3808	4152	x.exe	103
PID 4152 wrote to memory of 3808	4152	x.exe	103
PID 4152 wrote to memory of 3808	4152	x.exe	103
PID 4152 wrote to memory of 3748	4152	x.exe	105
PID 4152 wrote to memory of 3748	4152	x.exe	105
PID 4152 wrote to memory of 3748	4152	x.exe	105
PID 4152 wrote to memory of 4060	4152	x.exe	107
PID 4152 wrote to memory of 4060	4152	x.exe	107
PID 4152 wrote to memory of 4060	4152	x.exe	107
PID 4152 wrote to memory of 4124	4152	x.exe	109
PID 4152 wrote to memory of 4124	4152	x.exe	109
PID 4152 wrote to memory of 4124	4152	x.exe	109
PID 4152 wrote to memory of 5008	4152	x.exe	111
PID 4152 wrote to memory of 5008	4152	x.exe	111
PID 4152 wrote to memory of 5008	4152	x.exe	111
PID 4152 wrote to memory of 4284	4152	x.exe	113
PID 4152 wrote to memory of 4284	4152	x.exe	113
PID 4152 wrote to memory of 4284	4152	x.exe	113
PID 4152 wrote to memory of 1124	4152	x.exe	115
PID 4152 wrote to memory of 1124	4152	x.exe	115
PID 4152 wrote to memory of 1124	4152	x.exe	115
PID 4152 wrote to memory of 4320	4152	x.exe	117
PID 4152 wrote to memory of 4320	4152	x.exe	117
PID 4152 wrote to memory of 4320	4152	x.exe	117
PID 4152 wrote to memory of 3228	4152	x.exe	119
PID 4152 wrote to memory of 3228	4152	x.exe	119
PID 4152 wrote to memory of 3228	4152	x.exe	119
PID 4152 wrote to memory of 536	4152	x.exe	121

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FACTURA08798696.vbe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x53^38"
    3⤵
    PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:4524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x75^38"
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4E^38"
    3⤵
    PID:3252
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x51^38"
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x71^38"
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x48^38"
    3⤵
    PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x51^38"
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:224
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x50^38"
    3⤵
    PID:684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:4836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x79^38"
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x56^38"
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x48^38"
    3⤵
    PID:3544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:1132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:64
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1184
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1E^38"
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x6D^38"
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x63^38"
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x74^38"
    3⤵
    PID:372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x68^38"
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x63^38"
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x6A^38"
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x70^38"
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:32
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x53^38"
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x47^38"
    3⤵
    PID:4780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:448
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x67^38"
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:1840
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x63^38"
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0B^38"
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:4352
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:64
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:4408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:5056
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x10^38"
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:3812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x56^38"
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x50^38"
    3⤵
    PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:448
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x79^38"
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4D^38"
    3⤵
    PID:4384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:5052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1F^38"
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:4324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x50^38"
    3⤵
    PID:3872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:3672
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x79^38"
    3⤵
    PID:224
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x47^38"
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:3372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:224
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x53^38"
    3⤵
    PID:4524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x65^38"
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x47^38"
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x71^38"
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x48^38"
    3⤵
    PID:940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x51^38"
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x76^38"
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x67^38"
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:32
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:4708
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4CC9.tmp\System.dll
Size 12KB
SHA256 1624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1
MD5 6c38da8922cc37b4bbb77de4a63ad843
SHA1 4e0533fd11df8bddbd543ed58df7b6060d9f4631
SHA512 ad0be3d7e57da9c304e9b9cac5341b6c76b157456ab44f5579d6c38c830a31c9c3e1e9a875b8f465243c607ea2ede6b0bb77237f17a70a4d4c78606e036c3430
SSDEEP 192:wA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:QR7SrtTv53tdtTgwF4SQbGPX36g9Mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4CC9.tmp\nsExec.dll
Size 7KB
SHA256 99fc8f647bfff3655dcd4ec577d79ec4102fb3a68b567282ba0b51e0b5262802
MD5 052099395689171cf64bf4a868e6a9be
SHA1 9581e80b223226eee5f726f38b3e966fdc5bbfad
SHA512 f45e38314e10129d3cceaefa918b25a432c67db8bf73f110a6957ca7f5cc96db749601fed550e0357bf67c84de2721d9692b8785c295fc7a1537b42c68b461a9
SSDEEP 96:rVl/7KOuFlKHMpXGu8FX6eT3sQk1u2QmIGjbAQvL7hDAbUlV:rVl+hSs2u85TTHkZQmbbLL7hDMo
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 469KB
SHA256 ddaf4a30fd1d9a4c74f1ae8842a6b0bb2053d9cfdcbcf9b7ad8122561658518a
MD5 9698e5ebed702eb7a5045811c60a3bc9
SHA1 07f394eaa3d0cfdf0933093775062cce0792129b
SHA512 a7f4acc934de58d4f3e203ef764c834ca41afe741ae5f596ed337225886d14052488d8428e34f8a5e28343cc9cbf5114c44c9f089f9675ba8fbb48171cd52a5e
SSDEEP 12288:kS43lfvP6AygOp6e49xcnBgxMemepP5x44:r4Zviv2p1xD3RXd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4456-706-0x0000000000810000-0x0000000001A64000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads