Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5

Overview

General Information

Sample URL: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5
Analysis ID: 1428438
Infos:

Detection

Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Detected Remcos RAT
Malicious sample detected (through community Yara rule)
Sigma detected: Remcos
System process connects to network (likely due to code injection or exploit)
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Blob-based file download detected
Creates autostart registry keys with suspicious names
Potential malicious VBS script found (suspicious strings)
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows Shell Script Host drops VBS files
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Script Initiated Connection
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses reg.exe to modify the Windows registry
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://geoplugin.net/json.gp URL Reputation: Label: phishing
Yara detected Remcos RAT
Source: Yara match File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2490459455.0000000000638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: unknown HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49854 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49886 version: TLS 1.2
Source: unknown HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.16:49898 version: TLS 1.2
Source: unknown HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.16:49899 version: TLS 1.2

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 148.72.177.212 443
Uses dynamic DNS services
Source: unknown DNS query: name: faststaynow.duckdns.org
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: unknown DNS traffic detected: queries for: adobe.tt.omtrdc.net
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49854 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49886 version: TLS 1.2
Source: unknown HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.16:49898 version: TLS 1.2
Source: unknown HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.16:49899 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2490459455.0000000000638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Blob-based file download detected
Source: C:\Users\user\Downloads\2023 Tax Organizer.zip File download: blob:https://acrobat.adobe.com/2b8c944b-39d2-4efa-8686-d2e1adb6d166
Potential malicious VBS script found (suspicious strings)
Source: C:\Windows\SysWOW64\wscript.exe Dropped file: EMPYA.ShellExecute APPDATA & "\VJQSJ.cmd", "", APPDATA, "", 0 Jump to dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Network Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74}
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: XML HTTP 6.0 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a0a-f192-11d4-a65f-0040963251e5}
Uses reg.exe to modify the Windows registry
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f
Yara signature match
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: classification engine Classification label: mal100.troj.expl.evad.win@28/101@44/273
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1848:120:WilError_03
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Mutant created: \Sessions\1\BaseNamedObjects\Rmc-DRFJJD
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe File created: C:\Users\user\AppData\Local\Temp\Memory.vbs
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'egui.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'avp.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'bdagent.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'egui.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'avp.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'bdagent.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'egui.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'avp.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'bdagent.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'egui.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'avp.exe'
Source: C:\Windows\SysWOW64\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'bdagent.exe'
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe File read: C:\Users\user\Desktop\desktop.ini
Source: C:\Windows\System32\rundll32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2012,i,12056640513929630974,10995804170337098686,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2012,i,12056640513929630974,10995804170337098686,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: unknown Process created: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: g2m.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: netapi32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: wsock32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: version.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: powrprof.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: secur32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: wininet.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: userenv.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: winmm.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: avicap32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: d3d9.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: msacm32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: msvfw32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: dwmapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: winmmbase.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: winmmbase.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: netutils.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: wldp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: samcli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: logoncli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: umpdc.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: k7rn7l32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: ntd3ll.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: winmm.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: wininet.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: netutils.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: ncrypt.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: ntasn1.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: mswsock.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: dnsapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: wldp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: profapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: winhttp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: winnsi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: propsys.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: edputil.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: policymanager.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: msvcp110_win.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: appresolver.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: slc.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: userenv.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: sppc.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Section loaded: windowscodecs.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32
Source: Window Recorder Window detected: More than 3 window changes detected

Persistence and Installation Behavior
barindex
Windows Shell Script Host drops VBS files
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\Start Menu\Programs\Startup\FDNUA.vbs
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\Start Menu\Programs\Startup\FDNUA.vbs

Boot Survival
barindex
Creates autostart registry keys with suspicious names
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *Chrome
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\Start Menu\Programs\Startup\FDNUA.vbs
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\Start Menu\Programs\Startup\WindowsServices-RDGVW.lnk
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\Start Menu\Programs\Startup\FDNUA.vbs
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\Start Menu\Programs\Startup\WindowsServices-RDGVW.lnk
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *Chrome
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *Chrome
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Window / User API: threadDelayed 9812
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe TID: 4800 Thread sleep count: 78 > 30
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe TID: 4800 Thread sleep time: -234000s >= -30000s
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe TID: 4800 Thread sleep count: 9812 > 30
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe TID: 4800 Thread sleep time: -29436000s >= -30000s

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 148.72.177.212 443
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\wscript.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\wscript.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2490459455.0000000000638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Detected Remcos RAT
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-DRFJJD
Yara detected Remcos RAT
Source: Yara match File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2490459455.0000000000638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.40.205.16
 unknown United States
20940 AKAMAI-ASN1EU false
151.101.1.138
 cdn-sharing.adobecc.map.fastly.net United States
54113 FASTLYUS false
23.209.188.7
 unknown United States
9498 BBIL-APBHARTIAirtelLtdIN false
52.202.204.11
 unknown United States
14618 AMAZON-AESUS false
46.183.222.118
 faststaynow.duckdns.org Latvia
52048 DATACLUBLV true
18.235.168.50
 unknown United States
14618 AMAZON-AESUS false
142.250.105.113
 unknown United States
15169 GOOGLEUS false
50.16.240.61
 unknown United States
14618 AMAZON-AESUS false
104.18.32.195
 unknown United States
13335 CLOUDFLARENETUS false
172.64.155.61
 unknown United States
13335 CLOUDFLARENETUS false
3.161.193.61
 dd20fzx9mj46f.cloudfront.net United States
16509 AMAZON-02US false
63.140.39.130
 adobe.com.ssl.d1.sc.omtrdc.net United States
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
148.72.177.212
 textbin.net United States
30083 AS-30083-GO-DADDY-COM-LLCUS true
104.18.32.77
 unknown United States
13335 CLOUDFLARENETUS false
13.226.100.23
 unknown United States
16509 AMAZON-02US false
44.198.86.118
 unknown United States
14618 AMAZON-AESUS false
23.22.254.206
 unknown United States
14618 AMAZON-AESUS false
96.7.225.33
 unknown United States
20940 AKAMAI-ASN1EU false
23.48.105.219
 unknown United States
20940 AKAMAI-ASN1EU false
142.250.105.94
 unknown United States
15169 GOOGLEUS false
13.226.100.103
 unknown United States
16509 AMAZON-02US false
23.11.229.233
 unknown United States
20940 AKAMAI-ASN1EU false
142.250.105.105
 www.google.com United States
15169 GOOGLEUS false
23.209.188.17
 unknown United States
9498 BBIL-APBHARTIAirtelLtdIN false
172.253.124.94
 unknown United States
15169 GOOGLEUS false
104.17.27.92
 widget.uservoice.com United States
13335 CLOUDFLARENETUS false
23.47.218.150
 unknown United States
16625 AKAMAI-ASUS false
64.233.185.101
 unknown United States
15169 GOOGLEUS false
63.140.39.9
 adobetarget.data.adobedc.net United States
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
239.255.255.250
 unknown Reserved
unknown unknown false
172.66.0.163
 unknown United States
13335 CLOUDFLARENETUS false
44.196.228.180
 unknown United States
14618 AMAZON-AESUS false
99.86.229.114
 prod.adobeccstatic.com United States
16509 AMAZON-02US false
52.71.63.232
 api.echosign.com United States
14618 AMAZON-AESUS false
18.207.85.246
 unknown United States
14618 AMAZON-AESUS false
178.237.33.50
 geoplugin.net Netherlands
8455 ATOM86-ASATOM86NL false
184.31.61.57
 unknown United States
16625 AKAMAI-ASUS false
50.16.103.66
 unknown United States
14618 AMAZON-AESUS false
3.233.142.19
 unknown United States
14618 AMAZON-AESUS false
172.217.215.84
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
dd20fzx9mj46f.cloudfront.net 3.161.193.61 true
privacycollector-production-457481513.us-east-1.elb.amazonaws.com 3.217.28.88 true
textbin.net 148.72.177.212 true
widget.uservoice.com 104.17.27.92 true
api.echosign.com 52.71.63.232 true
faststaynow.duckdns.org 46.183.222.118 true
geoplugin.net 178.237.33.50 true
cdn-sharing.adobecc.map.fastly.net 151.101.1.138 true
adobetarget.data.adobedc.net 63.140.39.9 true
adobe.com.ssl.d1.sc.omtrdc.net 63.140.39.130 true
www.google.com 142.250.105.105 true
by2.uservoice.com 104.17.27.92 true
prod.adobeccstatic.com 99.86.229.114 true
use.typekit.net unknown unknown
c.evidon.com unknown unknown
ims-na1.adobelogin.com unknown unknown
assets.adobedtm.com unknown unknown
l.betrad.com unknown unknown
dc-api-v2.adobecontent.io unknown unknown
p.typekit.net unknown unknown
dc-api.adobecontent.io unknown unknown
adobe.tt.omtrdc.net unknown unknown
cdn-sharing.adobecc.com unknown unknown
static.adobelogin.com unknown unknown
files-download2.acrocomcontent.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://geoplugin.net/json.gp true
  • URL Reputation: phishing
 unknown
about:blank false
    		low