IOC Report
file.ps1

loading gif

Files

File Path
Type
Category
Malicious
file.ps1
ASCII text
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbzdxgou.amf.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qmvq5uzg.d44.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A13YHUCNLHRPHQDSXMZJ.temp
data
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://pesterbdd.com/images/Pester.png
unknown
 malicious
http://nuget.org/NuGet.exe
unknown
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
https://go.micro
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://contoso.com/License
unknown
https://contoso.com/Icon
unknown
https://oneget.orgX
unknown
https://aka.ms/pscore68
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://github.com/Pester/Pester
unknown
https://oneget.org
unknown
There are 4 hidden URLs, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
206D4995000
heap
page read and write
7DF97E000
stack
page read and write
206DDAD4000
trusted library allocation
page read and write
7DF9FB000
stack
page read and write
7E044F000
stack
page read and write
206D6260000
heap
page readonly
7DEF3E000
stack
page read and write
206DCE25000
trusted library allocation
page read and write
206DDAF2000
trusted library allocation
page read and write
206D6784000
heap
page read and write
206D6621000
trusted library allocation
page read and write
206D6A28000
trusted library allocation
page read and write
206DE0E6000
trusted library allocation
page read and write
206DB86A000
trusted library allocation
page read and write
7DF6F8000
stack
page read and write
206D499B000
heap
page read and write
206D6801000
trusted library allocation
page read and write
206D6888000
trusted library allocation
page read and write
206D48C0000
heap
page read and write
206D49DD000
heap
page read and write
206DB1F0000
trusted library allocation
page read and write
206DBC3D000
trusted library allocation
page read and write
206D67C3000
heap
page read and write
206DD5B5000
trusted library allocation
page read and write
206D493D000
heap
page read and write
206DAA6F000
trusted library allocation
page read and write
206D881C000
trusted library allocation
page read and write
206D6786000
heap
page read and write
7DF57D000
stack
page read and write
206DD010000
trusted library allocation
page read and write
7DF5F9000
stack
page read and write
206DDDB0000
trusted library allocation
page read and write
206D49A2000
heap
page read and write
206DDD03000
trusted library allocation
page read and write
206D9E4E000
trusted library allocation
page read and write
206DD93B000
trusted library allocation
page read and write
206D4BB5000
heap
page read and write
206D6739000
heap
page read and write
206DD16A000
trusted library allocation
page read and write
7E0408000
stack
page read and write
7DF676000
stack
page read and write
7DEFFE000
stack
page read and write
206DD205000
trusted library allocation
page read and write
206D7BF4000
trusted library allocation
page read and write
206DD158000
trusted library allocation
page read and write
206DD307000
trusted library allocation
page read and write
206D493B000
heap
page read and write
7DEEB5000
stack
page read and write
206D6651000
trusted library allocation
page read and write
7DEFBD000
stack
page read and write
206D665C000
trusted library allocation
page read and write
206D972B000
trusted library allocation
page read and write
206D6240000
heap
page read and write
206D49B5000
heap
page read and write
206D71F4000
trusted library allocation
page read and write
206DC63D000
trusted library allocation
page read and write
206D6623000
trusted library allocation
page read and write
206D6746000
heap
page read and write
206D67F0000
heap
page read and write
206D497D000
heap
page read and write
206DB824000
trusted library allocation
page read and write
206DB08B000
trusted library allocation
page read and write
206D6250000
trusted library allocation
page read and write
206D4860000
heap
page read and write
206DB8E7000
trusted library allocation
page read and write
206D66E0000
heap
page execute and read and write
206DB889000
trusted library allocation
page read and write
206D66F0000
heap
page read and write
7DF7FE000
stack
page read and write
206D62D0000
heap
page read and write
206DBB77000
trusted library allocation
page read and write
7DF27D000
stack
page read and write
206D8D27000
trusted library allocation
page read and write
206DAB1D000
trusted library allocation
page read and write
206D85F4000
trusted library allocation
page read and write
206D4BB0000
heap
page read and write
206D4940000
heap
page read and write
206DCB49000
trusted library allocation
page read and write
206D497A000
heap
page read and write
206DD37D000
trusted library allocation
page read and write
206D49E4000
heap
page read and write
206DE6BE000
trusted library allocation
page read and write
206D48F0000
heap
page read and write
7DF3FE000
stack
page read and write
7DF2FE000
stack
page read and write
206D6210000
trusted library allocation
page read and write
206DE5CC000
trusted library allocation
page read and write
206DA9CC000
trusted library allocation
page read and write
206D8D2B000
trusted library allocation
page read and write
206D8C7B000
trusted library allocation
page read and write
206DB091000
trusted library allocation
page read and write
7DF87E000
stack
page read and write
206D67EB000
heap
page read and write
7DF4FE000
stack
page read and write
206D4780000
heap
page read and write
206D4903000
heap
page read and write
206DBC39000
trusted library allocation
page read and write
206DD3F7000
trusted library allocation
page read and write
206DE476000
trusted library allocation
page read and write
206DA84E000
trusted library allocation
page read and write
206DBB73000
trusted library allocation
page read and write
206D4880000
heap
page read and write
7DF47F000
stack
page read and write
206D6704000
heap
page read and write
206DCB1D000
trusted library allocation
page read and write
7DF777000
stack
page read and write
206DCBA3000
trusted library allocation
page read and write
206DA92E000
trusted library allocation
page read and write
206D62D5000
heap
page read and write
206D6270000
trusted library allocation
page read and write
7DF37B000
stack
page read and write
206DD043000
trusted library allocation
page read and write
206D4997000
heap
page read and write
There are 103 hidden memdumps, click here to show them.