Edit tour

Windows Analysis Report
PI1qW7yV9K.exe

Overview

General Information

Sample name:	PI1qW7yV9K.exe renamed because original name is a hash value
Original sample name:	af8da7f9142ae9bdee1fa3be93f0c8c1.exe
Analysis ID:	1665177
MD5:	af8da7f9142ae9bdee1fa3be93f0c8c1
SHA1:	de5d591e4013f4fa6115a30e3c71d83b74c10bf9
SHA256:	4a6389fb42a4918ca6b7aec6c86a4e945f85dfb6490f873f9be24fa5c7f9df06
Tags:	exeuser-abuse_ch
Infos:

Detection

PureLog Stealer, Quasar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected PureLog Stealer

Yara detected Quasar RAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Bypasses PowerShell execution policy

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects code into the Windows Explorer (explorer.exe)

Joe Sandbox ML detected suspicious sample

Queries sensitive service information (via WMI, MSSMBios_RawSMBiosTables, often done to detect sandboxes)

Queries temperature or sensor information (via WMI often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Alternate PowerShell Hosts - PowerShell Module

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

PI1qW7yV9K.exe (PID: 7384 cmdline: "C:\Users\user\Desktop\PI1qW7yV9K.exe" MD5: AF8DA7F9142AE9BDEE1FA3BE93F0C8C1)

conhost.exe (PID: 7440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7816 cmdline: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 6192 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 6200 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD89C.tmp" "c:\Users\user\AppData\Local\Temp\akylvhfm\CSC15D32CA6BA724B45B0CB2F57F81BE153.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

svchost.exe (PID: 2524 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WMIADAP.exe (PID: 6200 cmdline: wmiadap.exe /F /T /R MD5: 1BFFABBD200C850E6346820E92B915DC)

svchost.exe (PID: 3388 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s NcdAutoSetup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

explorer.exe (PID: 3084 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
PI1qW7yV9K.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2681806308.00000000104F0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x188d10:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000008.00000002.2689977678.00000000290A0000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000008.00000002.2689977678.00000000290A0000.00000004.10000000.00040000.00000000.sdmp	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x17156c:$x4: Uninstalling... good bye :-(
00000008.00000002.2689977678.00000000290A0000.00000004.10000000.00040000.00000000.sdmp	MAL_BackNet_Nov18_1	Detects BackNet samples	Florian Roth	0x16e9a9:$s1: ProcessedByFody 0x17577b:$s2: SELECT * FROM AntivirusProduct
00000008.00000002.2686215912.0000000020B03000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000008.00000000.1431061226.00000000104F0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x188d10:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000008.00000002.2648853929.00000000092B0000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.1712421715.000002321D350000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000002.1548348801.0000023217860000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x456d00:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x5e2e08:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000002.00000002.1548348801.0000023216460000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000000.1332889262.00000000003D2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7816	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x15f4f14:$b2: ::FromBase64String( 0x1a2aab4:$b2: ::FromBase64String( 0x10e4b:$s1: -join 0x10e86:$s1: -join 0x10f55:$s1: -join 0x10f83:$s1: -join 0x1112f:$s1: -join 0x11152:$s1: -join 0x11413:$s1: -join 0x11434:$s1: -join 0x11466:$s1: -join 0x114ae:$s1: -join 0x114db:$s1: -join 0x11502:$s1: -join 0x1152d:$s1: -join 0x11549:$s1: -join 0x115b2:$s1: -join 0x11a50:$s1: -join 0x11a72:$s1: -join 0x11aca:$s1: -join 0x11af4:$s1: -join
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.explorer.exe.92b0000.0.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.explorer.exe.92b0000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.explorer.exe.290a0000.17.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.explorer.exe.290a0000.17.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x16f76c:$x4: Uninstalling... good bye :-(
8.2.explorer.exe.290a0000.17.unpack	MAL_BackNet_Nov18_1	Detects BackNet samples	Florian Roth	0x16cba9:$s1: ProcessedByFody 0x17397b:$s2: SELECT * FROM AntivirusProduct
8.2.explorer.exe.290a0000.17.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
8.2.explorer.exe.290a0000.17.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x17156c:$x4: Uninstalling... good bye :-(
8.2.explorer.exe.290a0000.17.raw.unpack	MAL_BackNet_Nov18_1	Detects BackNet samples	Florian Roth	0x16e9a9:$s1: ProcessedByFody 0x17577b:$s2: SELECT * FROM AntivirusProduct
2.2.powershell.exe.2321d350000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.powershell.exe.2321d350000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.PI1qW7yV9K.exe.3d0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.powershell.exe.23216460cf8.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.powershell.exe.23216460cf8.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", CommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PI1qW7yV9K.exe", ParentImage: C:\Users\user\Desktop\PI1qW7yV9K.exe, ParentProcessId: 7384, ParentProcessName: PI1qW7yV9K.exe, ProcessCommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", ProcessId: 7816, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", CommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PI1qW7yV9K.exe", ParentImage: C:\Users\user\Desktop\PI1qW7yV9K.exe, ParentProcessId: 7384, ParentProcessName: PI1qW7yV9K.exe, ProcessCommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", ProcessId: 7816, ProcessName: powershell.exe

Sigma detected: Alternate PowerShell Hosts - PowerShell Module

Source: Event Logs

Author: Roberto Rodriguez @Cyb3rWard0g: Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 20bf2611-63c3-43b9-8542-4438e7ab1df8 Host Application = C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1 Engine Version = 5.1.19041.1682 Runspace ID = 905a113d-0c9b-44bb-b7e5-806f6cf673a6 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1 Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="TypeDefinition"; value="using System;using System.Diagnostics;using System.Runtime.InteropServices;using System.Text;public class AmsiPatcher{ public const uint PROCESS_VM_OPERATION = 0x0008; public const uint PROCESS_VM_READ = 0x0010; public const uint PROCESS_VM_WRITE = 0x0020; public const uint TH32CS_SNAPPROCESS = 0x00000002; public static byte[] patch = new byte[] { 0xEB }; [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct PROCESSENTRY32 { public uint dwSize; public uint cntUsage; public uint th32ProcessID; public IntPtr th32DefaultHeapID; public uint th32ModuleID; public uint cntThreads; public uint th32ParentProcessID; public int pcPriClassBase; public uint dwFlags; [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)] public string szExeFile; } [DllImport("kernel32.dll")] public static extern IntPtr CreateToolhelp32Snapshot(uint dwFlags, uint th32ProcessID); [DllImport("kernel32.dll")] public static extern bool Process32First(IntPtr hSnapshot, ref PROCESSENTRY32 lppe); [DllImport("kernel32.dll")] public static extern bool Process32Next(IntPtr hSnapshot, ref PROCESSENTRY32 lppe); [DllImport("kernel32.dll")] public static extern bool CloseHandle(IntPtr hObject); [DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, uint dwProcessId); [DllImport("kernel32.dll")] public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int dwSize, IntPtr lpNumberOfBytesRead); [DllImport("kernel32.dll")] public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int dwSize, IntPtr lpNumberOfBytesWritten); [DllImport("kernel32.dll")] public static extern IntPtr LoadLibraryA(string lpFileName); [DllImport("kernel32.dll")] public static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName); public static int SearchPattern(byte

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", CommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PI1qW7yV9K.exe", ParentImage: C:\Users\user\Desktop\PI1qW7yV9K.exe, ParentProcessId: 7384, ParentProcessName: PI1qW7yV9K.exe, ProcessCommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", ProcessId: 7816, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7816, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline", ProcessId: 6192, ProcessName: csc.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7816, ParentProcessName: powershell.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt, ProcessId: 2524, ProcessName: svchost.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7816, TargetFilename: C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", CommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PI1qW7yV9K.exe", ParentImage: C:\Users\user\Desktop\PI1qW7yV9K.exe, ParentProcessId: 7384, ParentProcessName: PI1qW7yV9K.exe, ProcessCommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", ProcessId: 7816, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7816, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline", ProcessId: 6192, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PI1qW7yV9K.exe	Virustotal: Detection: 52%			Perma Link
Source: PI1qW7yV9K.exe	ReversingLabs: Detection: 55%

Yara detected Quasar RAT

Source: Yara match	File source: 8.2.explorer.exe.92b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.explorer.exe.92b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.explorer.exe.290a0000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.explorer.exe.290a0000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2689977678.00000000290A0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2686215912.0000000020B03000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2648853929.00000000092B0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.9%

Source: PI1qW7yV9K.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 15.204.213.5:443 -> 192.168.2.5:49695 version: TLS 1.2

Source: PI1qW7yV9K.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.pdbhP source: powershell.exe, 00000002.00000002.1473986709.0000023206903000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.pdb source: powershell.exe, 00000002.00000002.1473986709.0000023206903000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 4x nop then jmp 0136476Fh		0_2_013646F4
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 4x nop then jmp 0136476Fh		0_2_01364773

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 15.204.213.5 443			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 85.192.49.163 4782			Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.5:49692 -> 85.192.49.163:4782

Source: Joe Sandbox View	IP Address: 15.204.213.5 15.204.213.5
Source: Joe Sandbox View	IP Address: 15.204.213.5 15.204.213.5

Source: Joe Sandbox View

ASN Name: DINET-ASRU DINET-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.49.163
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: ipwho.is

Source: powershell.exe, 00000002.00000002.1548348801.0000023215E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.1473986709.0000023205612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1473986709.00000232049E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1473986709.0000023205612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1473986709.00000232049E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.1548348801.0000023215E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1548348801.0000023215E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1548348801.0000023215E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.1473986709.0000023205612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1473986709.0000023206012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.1548348801.0000023215E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695

Source: unknown

HTTPS traffic detected: 15.204.213.5:443 -> 192.168.2.5:49695 version: TLS 1.2

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 8.2.explorer.exe.92b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.explorer.exe.92b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.explorer.exe.290a0000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.explorer.exe.290a0000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2689977678.00000000290A0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2686215912.0000000020B03000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2648853929.00000000092B0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.explorer.exe.290a0000.17.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 8.2.explorer.exe.290a0000.17.unpack, type: UNPACKEDPE	Matched rule: Detects BackNet samples Author: Florian Roth
Source: 8.2.explorer.exe.290a0000.17.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 8.2.explorer.exe.290a0000.17.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BackNet samples Author: Florian Roth
Source: 00000008.00000002.2681806308.00000000104F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000008.00000002.2689977678.00000000290A0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 00000008.00000002.2689977678.00000000290A0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects BackNet samples Author: Florian Roth
Source: 00000008.00000000.1431061226.00000000104F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000002.00000002.1548348801.0000023217860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7816, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.h			Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini			Jump to behavior

Source: C:\Windows\System32\wbem\WMIADAP.exe

File deleted: C:\Windows\System32\wbem\Performance\WmiApRpl.h

Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_013640BA	0_2_013640BA
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_01363D70	0_2_01363D70
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_01360CE0	0_2_01360CE0
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_0136262F	0_2_0136262F
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_0136410F	0_2_0136410F
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_01364971	0_2_01364971
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_01364980	0_2_01364980
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_01360A28	0_2_01360A28
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_0136AA78	0_2_0136AA78
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_01363D60	0_2_01363D60
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_05090040	0_2_05090040
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF7C7C0652C	2_2_00007FF7C7C0652C
Source: C:\Windows\explorer.exe	Code function: 8_2_10679FBC	8_2_10679FBC
Source: C:\Windows\explorer.exe	Code function: 8_2_1067A38C	8_2_1067A38C
Source: C:\Windows\explorer.exe	Code function: 8_2_1067B264	8_2_1067B264
Source: C:\Windows\explorer.exe	Code function: 8_2_1067A7C4	8_2_1067A7C4
Source: C:\Windows\explorer.exe	Code function: 8_2_106790C8	8_2_106790C8

Source: PI1qW7yV9K.exe, 00000000.00000000.1333764956.00000000008B9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFrustrateHook Loader.exeL* vs PI1qW7yV9K.exe
Source: PI1qW7yV9K.exe, 00000000.00000002.1746911837.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PI1qW7yV9K.exe

Source: 8.2.explorer.exe.290a0000.17.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 8.2.explorer.exe.290a0000.17.unpack, type: UNPACKEDPE	Matched rule: MAL_BackNet_Nov18_1 date = 2018-11-02, hash1 = 4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc, author = Florian Roth, description = Detects BackNet samples, reference = https://github.com/valsov/BackNet
Source: 8.2.explorer.exe.290a0000.17.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 8.2.explorer.exe.290a0000.17.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_BackNet_Nov18_1 date = 2018-11-02, hash1 = 4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc, author = Florian Roth, description = Detects BackNet samples, reference = https://github.com/valsov/BackNet
Source: 00000008.00000002.2681806308.00000000104F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000008.00000002.2689977678.00000000290A0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 00000008.00000002.2689977678.00000000290A0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_BackNet_Nov18_1 date = 2018-11-02, hash1 = 4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc, author = Florian Roth, description = Detects BackNet samples, reference = https://github.com/valsov/BackNet
Source: 00000008.00000000.1431061226.00000000104F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000002.00000002.1548348801.0000023217860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: Process Memory Space: powershell.exe PID: 7816, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: PI1qW7yV9K.exe, KSjdraoiodUru8Ds45.cs	Cryptographic APIs: 'CreateDecryptor'
Source: PI1qW7yV9K.exe, KSjdraoiodUru8Ds45.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.powershell.exe.2321d350000.3.raw.unpack, eYqf26Tq5XNYyFIqYl.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.powershell.exe.2321d350000.3.raw.unpack, eYqf26Tq5XNYyFIqYl.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.powershell.exe.2321d350000.3.raw.unpack, eYqf26Tq5XNYyFIqYl.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 8.2.explorer.exe.92b0000.0.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadInteger
Source: 8.2.explorer.exe.92b0000.0.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadBytes
Source: 8.2.explorer.exe.92b0000.0.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadMessage
Source: 8.2.explorer.exe.92b0000.0.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.Dispose
Source: 8.2.explorer.exe.92b0000.0.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteInteger
Source: 8.2.explorer.exe.92b0000.0.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteBytes
Source: 8.2.explorer.exe.92b0000.0.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteMessage
Source: 8.2.explorer.exe.92b0000.0.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.Dispose

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Flag
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\ADAP_WMI_ENTRY
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7440:120:WilError_03
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Lib

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select __RELPATH, ExecutablePath, ProcessID from Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select __RELPATH, ExecutablePath, ProcessID from Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select __RELPATH, ExecutablePath, ProcessID from Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select __RELPATH, ExecutablePath, ProcessID from Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select __RELPATH, ExecutablePath, ProcessID from Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select __RELPATH, ExecutablePath, ProcessID from Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select __RELPATH, ExecutablePath, ProcessID from Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::ExecQuery - CIMWin32 : select __RELPATH, ExecutablePath, ProcessID from Win32_Process
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: unknown	Process created: C:\Users\user\Desktop\PI1qW7yV9K.exe "C:\Users\user\Desktop\PI1qW7yV9K.exe"
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD89C.tmp" "c:\Users\user\AppData\Local\Temp\akylvhfm\CSC15D32CA6BA724B45B0CB2F57F81BE153.TMP"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\user\AppData\Local\Temp\ace9e5a3-2f4b-4e08-b92c-ed7f0e4c1ad2.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\akylvhfm\akylvhfm.cmdline"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD89C.tmp" "c:\Users\user\AppData\Local\Temp\akylvhfm\CSC15D32CA6BA724B45B0CB2F57F81BE153.TMP"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R	Jump to behavior

Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: loadperf.dll	Jump to behavior

Source: PI1qW7yV9K.exe, KSjdraoiodUru8Ds45.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 2.2.powershell.exe.2321d350000.3.raw.unpack, eYqf26Tq5XNYyFIqYl.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: 8.2.explorer.exe.20bc34c0.13.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 8.2.explorer.exe.20bc34c0.13.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 8.2.explorer.exe.20bc34c0.13.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 8.2.explorer.exe.20bc34c0.13.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 8.2.explorer.exe.20bc34c0.13.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_01367443 pushfd ; iretd	0_2_01367445
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Code function: 0_2_01368CAE pushfd ; ret	0_2_01368CB3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF7C7C09DC7 push esi; iretd	2_2_00007FF7C7C09DCD

Source: PI1qW7yV9K.exe, KSjdraoiodUru8Ds45.cs	High entropy of concatenated method names: 'g79kQN2Jip', 'nW4lBacjpc', 'ae5kFRqYTY', 'PdwkzM40uu', 'Ppc8ph7aI4', 'wqZ8kgYCcR', 'OMo6lriETy', 'dmkfGRYpi', 'jRjPqKvKX', 'SH0cbLnd7'
Source: PI1qW7yV9K.exe, BbDY5S8XPq3qWLFR1iB.cs	High entropy of concatenated method names: 'iLo8OSI5qW', 'MR587vhxF2', 'dHl8Luu0p3', 'CaN8WhbwV4', 'TSC8lw12Xj', 'rMv83ViQca', 'i598BOxh8O', 'OpK8DMWlhn', 'jyX8mQvv7Q', 'Tb28eVGI9F'
Source: 2.2.powershell.exe.2321d350000.3.raw.unpack, X6ryA4MF9UUYiaF1V9.cs	High entropy of concatenated method names: 'NHNd4QbNPI', 'nridHbsJAPTHJ8uC648', 'mUsIxtsjZHkEwU7krva', 'yh8b0Asf89AegXRCOrK', 'zeYARpsHjYtXDIW39aZ', 'aQsyIpsVmVLVVfpxad1', 'NSIuwCsqad7BQ1SoJwE', 'z59smistuNGYDJOyPrs', 'paEbPNs6aaDLqQA3lx1', 'c7jCpBsiyyAnViPeoiP'
Source: 2.2.powershell.exe.2321d350000.3.raw.unpack, eYqf26Tq5XNYyFIqYl.cs	High entropy of concatenated method names: 'SfTZEmsxBCXLIBtpuGm', 'GlLdyOsnPL4fEv8dVvl', 'BG3VHhQ9uU', 'O0v3WNsdnPoFM3TEmZn', 'oREVnZsKvSWT0cmVLs1', 'MI3l1rsNpctGU3CygTl', 'HogWlesoJImsIbnLMct', 'FNZPTYsBuIRIr6M4LR9', 'pYVPYJsIrkCUGGkl6OW', 'cs3fhFsgIwTQf1XQ9RN'

Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: MSSmBios_RawSMBiosTables
Source: C:\Windows\System32\svchost.exe	WMI Queries: MSSmBios_RawSMBiosTables
Source: C:\Windows\System32\svchost.exe	WMI Queries: WDMClassesOfDriver.ClassName="MSSmBios_RawSMBiosTables",Driver="C:\\Windows\\system32\\kernelbase.dll[MofResourceName]",HighDateTime=30982926,LowDateTime=1699781275
Source: C:\Windows\System32\svchost.exe	WMI Queries: WDMClassesOfDriver.ClassName="MSSmBios_RawSMBiosTables",Driver="C:\\Windows\\system32\\kernelbase.dll[MofResourceName]",HighDateTime=30982926,LowDateTime=1699781275
Source: C:\Windows\System32\svchost.exe	WMI Queries: WDMClassesOfDriver.ClassName="MSSmBios_RawSMBiosTables",Driver="C:\\Windows\\system32\\kernelbase.dll[MofResourceName]",HighDateTime=30982968,LowDateTime=1311154843
Source: C:\Windows\System32\svchost.exe	WMI Queries: MSSmBios_RawSMBiosTables
Source: C:\Windows\System32\svchost.exe	WMI Queries: MSSmBios_RawSMBiosTables
Source: C:\Windows\System32\svchost.exe	WMI Queries: WDMClassesOfDriver.ClassName="MSSmBios_RawSMBiosTables",Driver="C:\\Windows\\system32\\en-US\\kernelbase.dll.mui[MofResourceName]",HighDateTime=30982926,LowDateTime=2562148143

Source: C:\Windows\System32\svchost.exe	WMI Queries: MSAcpi_ThermalZoneTemperature
Source: C:\Windows\System32\svchost.exe	WMI Queries: MSAcpi_ThermalZoneTemperature
Source: C:\Windows\System32\svchost.exe	WMI Queries: WDMClassesOfDriver.ClassName="MSAcpi_ThermalZoneTemperature",Driver="C:\\Windows\\system32\\kernelbase.dll[MofResourceName]",HighDateTime=30982926,LowDateTime=1699781275
Source: C:\Windows\System32\svchost.exe	WMI Queries: WDMClassesOfDriver.ClassName="MSAcpi_ThermalZoneTemperature",Driver="C:\\Windows\\system32\\kernelbase.dll[MofResourceName]",HighDateTime=30982926,LowDateTime=1699781275
Source: C:\Windows\System32\svchost.exe	WMI Queries: WDMClassesOfDriver.ClassName="MSAcpi_ThermalZoneTemperature",Driver="C:\\Windows\\system32\\kernelbase.dll[MofResourceName]",HighDateTime=30982968,LowDateTime=1311154843
Source: C:\Windows\System32\svchost.exe	WMI Queries: MSAcpi_ThermalZoneTemperature
Source: C:\Windows\System32\svchost.exe	WMI Queries: MSAcpi_ThermalZoneTemperature

Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Memory allocated: 1320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Memory allocated: 2B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Memory allocated: 51F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Memory allocated: 61F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Memory allocated: 6320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Memory allocated: 7320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Memory allocated: 7CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Memory allocated: 8CA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\explorer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5069	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4759	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2417	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 6952	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 884	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 844	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 2696	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 1181	Jump to behavior

Source: C:\Users\user\Desktop\PI1qW7yV9K.exe TID: 7720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3536	Thread sleep count: 5069 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6148	Thread sleep count: 4759 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3656	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7508	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 1936	Thread sleep count: 2696 > 30	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 1936	Thread sleep count: 1181 > 30	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PI1qW7yV9K.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
PI1qW7yV9K.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: svchost.exe, 00000006.00000000.1390670833.0000023359D71000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityMicrosoft Hyper-V Virtualization Infrastructure Driver{4d36e97d-e325-11ce-bfc1-08002be10318}Win32_PnPEntityMicrosoft Hyper-V Virtualization Infrastructure DriverROOT\VID\0000System.String[]MicrosoftMicrosoft Hyper-V Virtualization Infrastructure DriverSystemROOT\VID\0000VidOKWin32_ComputerSystemuser-PCBCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74
Source: svchost.exe, 00000006.00000000.1389598483.00000233593A7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1572016071.00000233593AA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_CacheMemoryCache Memory 2nd unrestricted access to all features of Hyper-V.OK
Source: svchost.exe, 00000006.00000003.1572954734.0000023359376000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000006.00000000.1390078269.0000023359743000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 6LU2AGRR VMCI Bus Device
Source: svchost.exe, 00000006.00000003.1572954734.0000023359376000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductZXGBMD2ED92742-89DC-DD72-92E8-869FA5A66493VMware, Inc.None
Source: svchost.exe, 00000006.00000000.1389598483.00000233593A7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1572016071.00000233593AA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1576483229.00000233593AF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: user-PC\Hyper-V Administrators
Source: svchost.exe, 00000006.00000000.1390138450.000002335978B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: svchost.exe, 00000006.00000000.1390078269.0000023359743000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 229FKOX3 VMCI Bus Device
Source: svchost.exe, 00000006.00000000.1390138450.000002335978B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntityMicrosoft Hyper-V Generation Counter{4d36e97d-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntityMicrosoft Hyper-V Generation CounterACPI\VMW0001\7System.String[]MicrosoftMicrosoft Hyper-V Generation CounterSystemACPI\VMW0001\7gencounterOKWin32_ComputerSystemuser-PCBCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74
Source: svchost.exe, 00000006.00000000.1390670833.0000023359D71000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: svchost.exe, 00000006.00000000.1390078269.0000023359743000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AC9SPRRK VMCI Bus Device
Source: svchost.exe, 00000006.00000000.1390078269.0000023359743000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_PnPEntity6LU2AGRR VMCI Bus Device{4d36e97d-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntity229FKOX3 VMCI Bus DevicePCI\LS1LLG1N&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FSystem.String[]VMware, Inc.AC9SPRRK VMCI Bus DeviceSystemPCI\THLU3ZGM&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FvmciOKWin32_ComputerSystemuser-PCBCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74
Source: svchost.exe, 00000006.00000000.1389598483.00000233593A7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1572016071.00000233593AA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1576483229.00000233593AF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Members of this group have complete and unrestricted access to all features of Hyper-V.
Source: svchost.exe, 00000006.00000000.1389598483.00000233593A7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1572016071.00000233593AA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nd unrestricted access to all features of Hyper-V.
Source: svchost.exe, 00000006.00000000.1389598483.00000233593A7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1572016071.00000233593AA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1576483229.00000233593AF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Win32_GroupS-1-5-32-578user-PCuser-PC\Hyper-V AdministratorsHyper-V AdministratorsMembers of this group have complete and unrestricted access to all features of Hyper-V.OK
Source: svchost.exe, 00000006.00000000.1389598483.00000233593A7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1572016071.00000233593AA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1576483229.00000233593AF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators

Source: 2.2.powershell.exe.2320691d278.1.raw.unpack, AmsiPatcher.cs	Reference to suspicious API methods: OpenProcess(56u, bInheritHandle: false, pid)
Source: 2.2.powershell.exe.2320691d278.1.raw.unpack, AmsiPatcher.cs	Reference to suspicious API methods: LoadLibraryA("amsi.dll")
Source: 2.2.powershell.exe.2320691d278.1.raw.unpack, AmsiPatcher.cs	Reference to suspicious API methods: GetProcAddress(intPtr2, "AmsiOpenSession")
Source: 2.2.powershell.exe.2320691d278.1.raw.unpack, AmsiPatcher.cs	Reference to suspicious API methods: ReadProcessMemory(intPtr, procAddress, array, array.Length, IntPtr.Zero)
Source: 2.2.powershell.exe.2320691d278.1.raw.unpack, AmsiPatcher.cs	Reference to suspicious API methods: WriteProcessMemory(intPtr, new IntPtr(value), patch, patch.Length, IntPtr.Zero)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF839063843	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF839063843	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 104F0000	Jump to behavior

Source: C:\Users\user\Desktop\PI1qW7yV9K.exe	Queries volume information: C:\Users\user\Desktop\PI1qW7yV9K.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: Yara match	File source: PI1qW7yV9K.exe, type: SAMPLE
Source: Yara match	File source: 2.2.powershell.exe.2321d350000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.2321d350000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.PI1qW7yV9K.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.23216460cf8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.23216460cf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1712421715.000002321D350000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1548348801.0000023216460000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1332889262.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	411 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	33 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	221 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	51 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	51 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	411 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption